Work out your ratio of endpoints to technicians before comparing quotes. A shop with three technicians and 1,500 endpoints pays far less on per-technician plans such as Atera or Syncro, while a team with many technicians and fewer devices does better with per-endpoint pricing from NinjaOne, SuperOps or Level. MSPs that want one vendor for RMM, PSA, backup and security can negotiate bundles with ConnectWise or Kaseya, N-able suits those focused on RMM, backup and security operations, and HaloPSA is the PSA to pair with whichever RMM you keep. Whatever you buy, treat the RMM as the most sensitive system you run: require phishing-resistant multi-factor authentication for every technician, limit who can run scripts across all clients, patch self-hosted servers within days of a security bulletin, and review installed extensions and integrations regularly.
What is the difference between RMM and PSA?
RMM software works on the client’s computers: an agent installed on each device reports health and alerts, installs patches, runs scripts and gives technicians remote access. PSA software runs the MSP’s own business: tickets and service-level targets, contracts, time tracking, quotes, projects and recurring invoices, usually synced with QuickBooks or Xero. Some vendors sell both in one product (Atera, Syncro, SuperOps), some sell separate products that integrate (ConnectWise, Kaseya), and some do only one of the two, such as Level for RMM and HaloPSA for PSA.
How do attackers abuse RMM tools, and what does CISA recommend?
The January 2023 advisory from CISA, the NSA and MS-ISAC described help-desk-themed phishing emails that led federal employees to download portable copies of ScreenConnect and AnyDesk, which run without installation or admin rights, followed by refund scams, and it warned that MSPs and IT help desks are frequent targets. It recommends auditing which remote access tools are in use, checking logs for portable RMM programs, blocking unapproved RMM software with application controls, allowing approved RMM only through approved remote access, and blocking common RMM ports at the network edge. In June 2025 CISA reported that ransomware actors had exploited unpatched SimpleHelp RMM, through CVE-2024-57727, to reach the customers of a utility billing software provider, and urged organizations to find every SimpleHelp instance and update or isolate it.
Should our RMM run in the cloud or on our own servers?
Several of the most damaging RMM incidents hit self-hosted servers: Kaseya said the direct customers hit in the 2021 VSA attack were all running on-premises VSA, the 2025 SimpleHelp attacks targeted unpatched self-hosted servers, and ConnectWise’s November 2026 guidance singled out on-premises ScreenConnect environments that still had the flagged extensions enabled. A cloud-hosted RMM moves server patching to the vendor, which removes one common failure, but no hosting model protects stolen technician credentials. Choose on-premises only if you need it for data residency or control and have a process to apply vendor patches within days.