The Growing Problem with Self-Hosted RMM Tools
If you manage IT infrastructure for multiple clients, you've likely heard the horror stories—or worse, lived them. Self-hosted Remote Monitoring and Management (RMM) tools have become a favorite target for attackers, and the incidents keep piling up.
The appeal of self-hosting is understandable. You get more control, potentially lower long-term costs, and independence from vendor infrastructure. But that independence comes with a critical responsibility: keeping your RMM platform secure falls entirely on your shoulders.
When tools like ScreenConnect, N-Central, or other self-hosted solutions get compromised, attackers don't just get access to one system—they get the keys to every client environment you manage. It's the ultimate supply chain attack, and it's happening far too often.
Why Self-Hosted RMM Platforms Are Prime Targets
Attackers are strategic. They look for maximum impact with minimum effort, and self-hosted RMM tools check every box:
Centralized Access: A single compromised RMM server can provide access to dozens or hundreds of client networks. For ransomware operators, this is the jackpot.
Inconsistent Patching: Let's be honest—when you're busy putting out fires for clients, patching your own infrastructure often slides down the priority list. Attackers know this and actively scan for unpatched RMM installations.
Exposed Attack Surface: Self-hosted solutions need to be internet-accessible to function. Without proper hardening, they become sitting ducks for automated scanning and exploitation.
Trusted Connections: RMM tools have elevated privileges by design. Once compromised, attackers inherit those same trusted connections to push malware, exfiltrate data, or deploy ransomware across your entire client base.
Real Security Gaps That Lead to Compromise
Most RMM compromises aren't sophisticated zero-day attacks. They exploit basic security failures that are entirely preventable:
Outdated Software
Vendors release security patches for a reason. The ScreenConnect vulnerability from early 2024 (CVE-2024-1709) had a CVSS score of 10.0—maximum severity. Organizations that delayed patching paid the price.
Weak Authentication
Default credentials, lack of multi-factor authentication, and password reuse continue to plague self-hosted installations. If your RMM admin portal is protected by just a password, you're one phishing email away from disaster.
Missing Network Segmentation
Your RMM server shouldn't have unrestricted access to everything. Proper network segmentation limits blast radius when (not if) something goes wrong.
No Monitoring or Alerting
Many MSPs discover compromises only after the damage is done. Without proper logging and alerting, attackers can operate undetected for weeks.
Hardening Your Self-Hosted RMM Infrastructure
If you're committed to self-hosting, treat your RMM platform like the crown jewels it is:
Patch Religiously: Subscribe to vendor security bulletins. When critical patches drop, apply them immediately—not next week, not after the current project wraps up.
Enforce MFA Everywhere: No exceptions. Every admin account, every technician account, every API connection that supports it.
Implement IP Restrictions: If your techs only work from known locations, restrict access accordingly. Use VPN requirements for remote access.
Regular Vulnerability Scanning: You can't fix what you don't know about. Automated scanning identifies misconfigurations, missing patches, and exposed services before attackers find them.
Audit Access Logs: Review who's accessing your RMM platform and when. Unusual login times or locations should trigger immediate investigation.
Have an Incident Response Plan: Know exactly what you'll do if your RMM is compromised. Which clients do you contact first? How do you isolate affected systems? Who handles communication?
The Bigger Picture: Your Security Posture Reflects on Your Clients
Here's the uncomfortable truth: if you're selling security services to clients but running vulnerable infrastructure yourself, you're putting everyone at risk. Your clients trust you with privileged access to their systems. That trust demands you hold yourself to the highest security standards.
Regular vulnerability assessments of your own infrastructure aren't optional—they're essential. The same scanning and hardening practices you recommend to clients should be standard operating procedure for your own environment.
Take Action Today
Don't wait for attackers to find your vulnerabilities first. Regular scanning is one of the most cost-effective ways to protect your business and your clients.
Oscar Six Security's Radar solution provides automated vulnerability scanning for just $99—giving you the visibility you need to identify and fix security gaps before they become incidents. Whether you're securing your own RMM infrastructure or helping clients meet compliance requirements, proactive scanning is the foundation of solid security.
Focus Forward. We've Got Your Six.
This article was originally published on Oscar Six Security Blog.