Full Report
Here’s why purchasing your cybersecurity products and services through your RMM provider isn’t always the best value. Learn how to avoid common pitfalls and choose more effective EDR and MDR solutions.
Analysis Summary
# Best Practices: Decoupling Security from RMM Providers
## Overview
These practices address the risks associated with purchasing cybersecurity products (EDR/MDR) bundled through Remote Monitoring and Management (RMM) providers. The goal is to eliminate "middleman" friction, ensure clear lines of responsibility during a breach, and guarantee expert-level incident response that RMM-centric models often lack.
## Key Recommendations
### Immediate Actions
1. **Audit Security Ownership:** Review current contracts to identify which security tools are managed or licensed through an RMM provider versus directly through a security vendor.
2. **Review Incident Response (IR) SLAs:** Verify who is contractually obligated to respond to a "True Positive" alert. If the RMM provider acts as the first line of defense, test their response time.
3. **Verify Alert Integrity:** Check if security alerts are being auto-closed or marked as "resolved" by RMM automation without human investigation.
### Short-term Improvements (1-3 months)
1. **Establish Direct Vendor Relationships:** Transition from RMM-bundled security to direct relationships with Managed Detection and Response (MDR) or Endpoint Detection and Response (EDR) providers to eliminate communication "hot potato."
2. **Formalize a Communication Matrix:** Create a RACI (Responsible, Accountable, Consulted, Informed) chart specifically for cyber incidents to ensure no ambiguity between IT operations and security teams.
3. **Conduct a Tabletop Exercise:** Simulate a ransomware attack (e.g., Lorenz ransomware) to identify if your current RMM-managed security setup results in "radio silence" or delayed action.
### Long-term Strategy (3+ months)
1. **Implement "Verification-Based" Security:** Shift from a posture of "overtrust" in IT tools to a behavior-based verification model to prevent RMM abuse (which is rising as a vector for stealthy access).
2. **Vendor Specialization Strategy:** Adopt a "best-of-breed" approach where RMM is used exclusively for IT maintenance and a dedicated SOC/MDR provider handles all threat hunting and remediation.
## Implementation Guidance
### For Small Organizations
- **Avoid the "Bundle Trap":** While bundling security with RMM seems cost-effective, prioritize a standalone MDR that offers 24/7 human analysis to compensate for a lack of internal security staff.
### For Medium Organizations
- **Redundancy Planning:** Ensure that if your RMM tool is compromised or fails, your security monitoring remains functional and independent.
- **Service Desk Alignment:** Integrate security alerts directly into your ticketing system, bypassing RMM middleware where possible.
### For Large Enterprises
- **Dedicated IR Retainers:** Supplement security tools with an independent Incident Response firm to avoid the "pizza with no ingredients" scenario where you are forced to manage a breach yourself.
- **Deep Telemetry Integration:** Ensure EDR data flows directly to your SIEM/SOAR rather than being filtered through an RMM's simplified dashboard.
## Configuration Examples
*While specific CLI commands are not provided in the text, the following architectural configuration is recommended:*
- **Direct Agent Deployment:** Deploy EDR agents directly via MSI or Script, ensuring the agent communicates directly with the security vendor's cloud, not through an RMM proxy or gateway.
- **Behavioral Monitoring:** Configure RMM tools to trigger alerts if they execute unauthorized PowerShell scripts or unusual remote access patterns, treating the RMM itself as a potential threat vector.
## Compliance Alignment
- **NIST CSF (Respond & Recover):** Decoupling ensures faster response times and clearer recovery paths.
- **CIS Controls (Control 8 & 17):** Focuses on Audit Log Management and Incident Response maturity by removing third-party bottlenecks.
- **ISO/IEC 27001:** Addresses the requirement for clear organizational roles and responsibilities in information security.
## Common Pitfalls to Avoid
- **The "False Economy":** Choosing the cheaper RMM bundle which leads to massive costs during extended downtime.
- **Assuming RMM = Security:** Mistaking IT system health monitoring for active threat hunting.
- **Shadow Alerts:** Allowing an RMM provider to filter or suppress alerts before they reach your internal team.
## Resources
- **Huntress Blog:** [huntress[.]com/blog]
- **Threat Reports:** [huntress[.]com/resources/cyber-threat-report]
- **Frameworks:** NIST Cybersecurity Framework (nist[.]gov/cyberframework)