RMM abuse behind 45% of endpoint incidents as Huntress publishes inaugural Tragic Quadrant

Remote Monitoring and Management (RMM) tools are being systematically weaponized by attackers, accounting for 45% of endpoint incidents detected across over 5 million endpoints. Because RMM tools are designed to have deep, privileged access to systems, adversaries who abuse them can move laterally, execute commands, and maintain persistence with minimal detection. Attackers exploit these tools either by compromising legitimate RMM agents already installed or by deploying unauthorized RMM software as a backdoor — effectively hiding malicious activity behind trusted, allowlisted processes. This matters because defenders often overlook RMM traffic as routine administrative noise, giving attackers extended dwell time. Organizations must treat RMM tools with the same rigor as any high-privilege access vector.