What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Huntress reported that remote monitoring and management (RMM) abuse was involved in 45% of the endpoint-related incidents it investigated in Q1 2026. That is a finding from Huntress-covered environments—not an estimate that 45% of endpoint incidents across the entire industry involve RMM abuse. The company’s new Tragic Quadrant places RMM abuse among the threats it says deserve the most attention.
What Huntress’s 45% figure means
The 45% figure is the share of endpoint-related incidents investigated by Huntress in Q1 2026 that involved RMM abuse, according to a 2026 report by IT Security Guru. Huntress said its telemetry covered more than 5 million endpoints, 15 million identities, and nearly 300,000 organizations. Those figures describe the environments Huntress monitors; they do not establish a random or representative sample of all businesses.
The full report is gated, so the public account does not make the precise incident denominator or selection methodology available for independent assessment. Treat 45% as a Huntress finding reported by IT Security Guru, not as a universal prevalence rate.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the Tragic Quadrant measures
Huntress’s Tragic Quadrant ranks 11 attack tactics on two axes: prevalence in its observed data and what it calls the “Pucker Factor”—its estimate of how close a tactic gets to causing serious harm before defenders catch it. Huntress describes the result as its “data-backed (and highly opinionated) view of the threats that actually deserve your attention” on its Tragic Quadrant resource page.
In Huntress’s view, RMM abuse, mailbox manipulation, and account takeover sit in the highest-priority corner. The chart is a vendor-specific prioritization tool, not an industry-wide or vendor-neutral ranking: both its placements and detections reflect Huntress’s own environments and methodology.
Why attackers abuse legitimate remote-management tools
RMM software is designed to give administrators remote access and control. That same legitimacy can help an attacker’s activity blend into routine IT work. Jamie Levy, Huntress’s Senior Director of Adversary Tactics, put the appeal this way: “Why would you spend the cycles to develop or build from scratch when you can use a legitimate tool that you can just pull off the shelf?”
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Huntress’s incident analysis describes intruders using unauthorized or poorly secured remote access and then installing additional remote tools. In one Akira incident, an attacker used RDP without MFA before installing Chrome Remote Desktop, RustDesk, and AnyDesk, as described in Huntress’s incident analysis. The example illustrates why a familiar application name alone does not establish that its use is authorized.
How the 2025 figures relate—and differ
Huntress’s 2026 Cyber Threat Report gives two separate measures of RMM abuse in its 2025 analysis. Neither should be substituted for the Q1 2026 endpoint-incident share.
Rank #3
- Mastering Microsoft Endpoint Manager: Deploy and manage Windows 10, Windows 11, and Windows 365 on both physical and cloud PCs
- ABIS BOOK
- Packt Publishing
| Figure | What it measures | Source |
|---|---|---|
| 277% year-over-year growth | Growth in RMM abuse during 2025, as reported by Huntress in its 2026 Cyber Threat Report. | Huntress report coverage; Huntress 2026 Cyber Threat Report |
| 24% of all observed incidents | Share attributed to RMM abuse in Huntress’s 2025 analysis. | Huntress 2026 Cyber Threat Report |
| 45% of endpoint-related incidents | Share involving RMM abuse among incidents Huntress investigated in Q1 2026. | IT Security Guru’s 2026 report |
The figures differ by period and denominator: one is year-over-year growth, one is a share of all observed incidents in 2025, and one is a share of endpoint-related incidents in Q1 2026.
What businesses should check first
The practical lesson is not to remove every remote-management tool. It is to know which tools are authorized, why they are installed, and whether their activity matches normal use. Finding an RMM application is a prompt to investigate its context, not proof of an intrusion.
- Inventory endpoints and approved applications. Keep an accurate record of devices, authorized software, and the people or teams responsible for each remote-management tool.
- Review unnecessary exposure. Remove or disable remote-access paths and services that are not needed for business operations, where doing so is practical.
- Strengthen remote-access authentication. Require MFA for VPN, RDP, and other remote-access accounts where supported, and review accounts that can reach those services.
- Investigate unfamiliar tools and activity. Check whether the tool has a documented owner and business purpose, who used it, when it ran, and whether that behavior fits the system’s normal use.
Huntress says roughly 70% of active intrusions caught by its SOC start with VPN authentication, often using valid credentials without a second factor, according to its 2026 Cyber Threat Report coverage. This is a Huntress SOC observation, not a universal rate, but it supports treating VPN authentication and MFA as concrete parts of a remote-access review.
What the finding does—and does not—establish
The public figures make a clear case that RMM abuse is a priority within Huntress’s own incident data. They do not establish how common the tactic is across all organizations, prove that RMM software is inherently unsafe, or show that a business with no known RMM tools is protected from other attack paths. The Tragic Quadrant is most useful as a Huntress-specific way to prioritize attention alongside an organization’s own asset inventory, access controls, and incident evidence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
