How to secure RMM software: 8 controls MSPs should test

A new guide outlines eight security controls that managed service providers should verify before trusting any RMM platform, built from Acronis's experience securing endpoint management at scale across its Cyber Platform. The checklist stresses testing real outcomes—device discovery, risk-based patching, privileged access separation, alert noise reduction, safe automation, incident response integration, recovery validation, and tenant isolation—rather than relying on vendor feature lists. The piece points to recent incidents as proof that RMM tooling itself is part of the attack surface: N-able's N-central platform needed an emergency hotfix for the maximum-severity pre-auth RCE flaw CVE-2026-86218 (its fourth fix in five weeks, with about 1,500 servers exposed), while Microsoft SharePoint's "ToolShell" zero-days, CVE-2025-53770 and CVE-2025-53771, were exploited before patches existed and compromised at least 85 on-premises servers. CISA has similarly flagged ransomware groups abusing legitimate RMM tools to pivot into customer networks, underscoring why MSPs need hands-on validation of these controls rather than assuming they are covered by default.