Attackers using AI agents go through remote-management tools to reach thousands of companies at once

The two ideas face different competition. The fourth-party exposure rating is the weaker of the two. CyberCube, Bitsight, FICO, Verisk and Guidewire already sell supply-chain concentration and single-point-of-failure analytics to cyber insurers, and CyberCube already checks dependencies for each applicant at underwriting. A newcomer could only win with something those firms don't seem to have: a detailed inventory of which RMM, PSA, backup and remote-access tools sit at each SMB, plus the cloud app identities those tools hold in the client's tenants. That data is hard to see from outside, which is why the incumbents probably lack it. Getting it means pulling data from the MSP side or reading tenant consent grants, not just scanning the internet. Even then, the likely outcome is a data feed sold to or acquired by one of these incumbents, not a standalone rating business. The RMM blast-radius monitor has more open space. My searches found plenty of RMM hardening advice and some Sigma-style detection rules. They found no product that collects command and script activity across all of an MSP's client tenants, detects fan-out at agent speed, and stops it. One search summary said directly that no detection content exists for a script running across many endpoints in a short time. The obvious threats are Huntress, Blackpoint and similar MSP security vendors, plus the RMM vendors themselves (ConnectWise, Kaseya/Datto, NinjaOne, Acronis). Any of them could add this as a feature, and Acronis has put it on its roadmap. The idea also needs reframing. According to Microsoft's write-up, the ConnectWise breach did not use RMM scripts. The attackers stole the credential ConnectWise's Cloud Backup app uses to reach customer Microsoft 365 tenants, then logged in as that app, with no MFA, across about 2,250 tenants. A monitor that only watches RMM script runs would have missed this attack. The gap that is actually open is cross-tenant detection that can halt fan-out across RMM commands and also across the cloud app identities and API tokens that MSP vendors hold. Selling through insurers looks like a real opening. Cork shows that verification run through the RMM can be sold as risk transfer, and insurers still mostly rely on questionnaires they don't check. A product that produced continuous blast-radius evidence that insurers could use for premium credits would be different from what the MSP security vendors offer. Timing helps too: the Microsoft report came out on October 21, 2026, so demand is fresh, but incumbents will respond quickly.

• CyberCube SPoF Intelligence / Portfolio Manager / Account Manager

  This is the closest match to the fourth-party rating idea. CyberCube says it models more than 1,000 technology single points of failure and maps which insureds depend on each one. Insurers can stress-test a portfolio or check one applicant's dependencies at underwriting. Chubb and Corvus are named customers. I found no evidence that it scores RMM or PSA tools specifically.

• Bitsight (Discover / fourth-party aggregation)

  Bitsight sells fourth-party discovery and a risk-aggregation module aimed at cyber insurers, built on the argument that one service-provider breach can cause hundreds of claims. Its focus is cloud and hosting concentration, not MSP management tooling.

• FICO Enterprise Security Score (4th party)

  FICO extended its security score to rate fourth-party risk and show breach insurers where a portfolio's policies share IT suppliers. This overlaps directly with the rating idea, but it is an older product.

• Verisk Cyber Underwriting Report

  The report gives underwriters a cyber score and a separate score for business-interruption resilience if a single cloud service goes down. It is a shared-dependency signal, but not one specific to RMM or MSPs.

• Guidewire Cyence

  An outside-in cyber underwriting analytics product with exposure signals, incident probabilities and expected loss. It is an established channel that a fourth-party rating would have to sell into or compete with.

• Cork cyber warranty

  Cork sells a warranty for MSPs and checks their security stack through the MSP's own RMM. That shows the 'sold through the risk transfer channel' route for MSPs already exists. I found no sign that it monitors commands for fan-out.

• Huntress

  The leading MSP-focused EDR, identity detection (ITDR) and SOC vendor. Huntress writes about MSPs whose RMM instance was compromised and was the firm that confirmed 300 tenants were accessed in the ConnectWise breach. Its endpoint and Microsoft 365 telemetry puts it in the best position to add cross-tenant fan-out detection, but I found no shipped feature that halts RMM fan-out.

• Acronis RMM / agentic AI guardrails

  Acronis publishes RMM hardening checklists that include script approval and audit controls. It has also put anomaly detection for suspicious usage patterns on its roadmap. This is evidence that RMM vendors may build the feature into their own products.

• Microsoft Intune Multi Admin Approval / Saner CVEM multi-level script approval

  Endpoint management platforms already ship native approval steps for scripts and protected changes. This is a partial substitute for the 'halt' part of the monitor, though it is not based on detecting speed or fan-out.

Checked 2026-10-24