Huntress Opens Managed ESPM Early Access and Makes RMM Guard Free
Summary
Huntress says Managed ESPM is in early access and RMM Guard is free for customers with deployed agents. RMM Guard inventories remote management tools and is designed to block unauthorized RMMs; blocking mode is expected soon.
Key points
- The article describes attackers using phishing to install legitimate RMM tools, creating persistent access while blending in with normal IT activity.
- Huntress reports RMM-based attacks rose 277% from 2024 to 2025 and says 32% of its incidents this year could have been prevented by blocking rogue RMM tools.
- Managed ESPM is Huntress's managed endpoint-hardening offering, including application control, vulnerability visibility, and configuration management.
- RMM Guard inventories RMM tools across an environment and is intended to block unauthorized tools, including attacker-controlled instances of approved tools such as ScreenConnect.
- Managed ESPM is in early access; RMM Guard is free for Huntress customers and partners with an agent deployed until ESPM is ready for sale.
- The SIEM requirement has been removed; RMM Guard is currently available in Learning Mode, with blocking mode expected in the immediate future.
Article Details
- Event Type
- Huntress announced Managed ESPM in Early Access and made RMM Guard available for free to customers and partners with a deployed agent.
- Impact
- RMM Guard inventories remote monitoring and management tools across an environment and is designed to detect and block unauthorized RMMs, including attacker-controlled instances of approved tools such as ScreenConnect. At publication, the SIEM dependency had been removed; blocking mode was expected in the immediate future. The article also reports that Huntress observed a 277% increase in RMM-based attacks from 2024 to 2025.
People
Vendors
Products
AnyDeskAttackers love your RMM tools as much as you do. Watch Huntress and AnyDesk break down how RMM abuse actually works, how attackers turn trusted tools into a path to ransomware, and how you can close that gap.LogMeIn ResolveBehind the scenes, that single action quietly installs a Remote Monitoring and Management (RMM) tool: LogMeIn Resolve. This is the kind of thing that keeps defenders up at night, because the attacker now has persistentManaged EDRZero trust security assumes no user or device is trusted by default. See how Huntress enforces the model with Managed EDR and ITDR for lean IT teams.Managed ESPMHomeBlogApp Control for the 99%: Why We’re Building Managed ESPMManaged SIEMPreviously, RMM Guard was limited to Learning Mode and required Managed SIEM. The SIEM dependency has been removed, and we expect blocking mode to be available in the immediate future. If you're an existing HuntressRMM GuardEnforce Where It Makes Sense: Starting With RMM GuardScreenConnectany that aren't explicitly authorized, including attacker-controlled instances of approved tools like ScreenConnect.