Should we worry about vulnerabilities in our RMM tool?

The question

It's a fair question, and it's come up more than once this year for a reason: the tool that gives your IT provider eyes and hands on your systems is, by design, one of the highest-value targets an attacker can find.

What we told them

RMM (remote monitoring and management) software is what most MSPs use to patch machines, push updates, and troubleshoot without physically showing up. That's exactly why it's dangerous when something goes wrong with it: a flaw in the RMM platform itself doesn't just expose one computer, it can expose every machine that platform manages.

This week's case is a widely used RMM product that shipped its third zero-day patch in six weeks, the latest scoring a maximum 10.0 severity rating — an unauthenticated attacker could take over the management server itself, no valid login required. That's not a hypothetical: a flaw at that severity in that kind of tool is a genuine "drop everything and patch" event for anyone running it.

Here's the part that actually matters to you as a client, though: you almost certainly don't know, and don't need to know, which specific RMM product your provider runs. What you should know is whether your provider has a real patch-management discipline for their own tooling — not just your servers and laptops, but the software that manages them. That's a fair, specific question to ask, and any provider worth keeping should have a fast, confident answer.

• Ask your provider directly: "How quickly do you patch your own management tools when a critical flaw comes out?"
• A provider that treats their RMM platform with the same urgency as a client server is doing it right; one that shrugs is a red flag.
• This is one of the reasons a single vendor being compromised can ripple across hundreds of unrelated small businesses at once — it's worth understanding even if you never touch the tool yourself.