Why Antivirus and RMM Don’t Work As Vulnerability Assessment Tools

Both fill important functions, but they can’t flag and remediate vulnerabilities before they become breaches.

If you visit our Cybersecurity FAQ page, you’ll see a common question that we receive goes like this: I have an RMM and antivirus software, why do I need the ConnectSecure Vulnerability Manager?

We give the short answer right here: Every day, more than 50 new vulnerabilities are discovered. These cannot be addressed by RMMs and antivirus software. Vulnerability assessment tools such as ConnectSecure are a must to stay protected.

Now, this post will dive into more details. Interestingly, as we also point out here, if you know how to use an RMM tool to create value (we suspect you do), then you’re ready to profitably ramp up your cybersecurity practice. With the help of invaluable input from our community of managed service providers (MSPs) like yourself, we designed a solution that enables you to win more SMB deals by assessing, managing, and remediating gaps in your clients’ cybersecurity posture. 
So, although remote monitoring and management (RMM) and antivirus software play important roles in a comprehensive cybersecurity strategy, they can’t replace the need for vulnerability assessment tools that you can leverage in your interactions with small to medium-sized business clients. Here’s why.

What’s the likelihood of exploitation for you and your clients?

First of all, let’s take a quick look at what IT teams are up against. As we pointed out earlier, the number of vulnerabilities published every day is high and growing. The figures come from a Cisco report released last year which concludes IT teams are struggling to keep up with addressing all vulnerabilities across their infrastructures.

Three key findings include:

• 95% of IT assets have at least one highly exploitable vulnerability. (Note: Exploitability was based on the Exploit Prediction Scoring System, an open, data-driven, cross-industry effort for estimating the probability that a software will be exploited in the wild).
• 87% of organizations have open vulnerabilities in at least a quarter of their active assets, with 41% showing vulnerabilities in three of every four assets.
• 62% of vulnerabilities have a low probability of exploitation, with less than 1% chance of being exploited.

These stats are important because they show you must 1) be able to identify existing vulnerabilities (you can’t fix what you don’t know) and 2) determine which are high-risk and need to be addressed immediately to reduce the measured exploitability of your client’s organization (or your own).

Can antivirus software and RMMs get the job done? They are, after all, tools that have become second-nature to MSPs so it’s hardly surprising some may hope their capabilities stretch into the realm of vulnerability management.

The function of RMM (Remote Monitoring and Management)

As an MSP, RMM tools hardly need an introduction. They are an essential component of any MSP toolkit, allowing you to proactively manage client networks, endpoints, and computers by providing real-time monitoring, patch management, and remote access to systems. The concept of launching a software “scan” to analyze the customer’s environment and return important insight is something you’re likely very comfortable with. Whether there’s a hardware failure or system error, you can count on an automated alert that enables you to quickly respond and resolve issues.

But:

RMM tools are primarily focused on the health of the system, including hardware and software, and providing alerts when issues arise. They are not designed to identify vulnerabilities in the same way that a vulnerability assessment does. While an RMM can provide some security-related information, such as system logs and event data, it lacks the functionality of dedicated vulnerability assessment tool.

The function of antivirus software

No business would consider operating without antivirus software. First introduced in the 1970s and 1980s to detect and remove computer viruses spreading through floppy disks and other forms of removable media, antivirus software is now ubiquitous. As you’re well aware, it works by scanning files and applications for patterns that match known malware signatures. If a match is found, the antivirus software will take action to remove the threat and prevent further damage.

But:

Unlike vulnerability assessment tools, it cannot identify unknown vulnerabilities or new types of attack. Rather, antivirus software focuses on detecting and removing known malware threats that have already been identified and analyzed by security researchers. This means that it’s reactive rather than proactive — it can only respond to threats that have already been identified and analyzed, rather than identifying vulnerabilities before they are exploited by cybercriminals.

What sets vulnerability assessment tools apart

Vulnerability assessment tools are designed specifically to identify potential vulnerabilities in systems and networks. They use a systematic approach to find gaps — outdated software, misconfigured systems, weak passwords, and social engineering schemes — that could be exploited by attackers.

Once a vulnerability scan detects these vulnerabilities, it helps you prioritize remediation efforts and implement mitigations to reduce the risk of a cybersecurity breach. In essence, it empowers you to take a proactive approach by flagging and remediating vulnerabilities before they become breaches. That goes for you and your SMB clients.

In sum

RMM software and antivirus software are both crucial tools for any MSP. But they don’t enable the type of proactivity that you need to identify, assess, prioritize, and mitigate vulnerabilities before it’s too late. The ever-evolving threat landscape, in which cybercriminals are constantly ramping up new techniques to exploit security gaps, demands a comprehensive strategy that actively tries to stay one step ahead of the next attack.

Try the ConnectSecure Vulnerability Manager for yourself. Sign up for a free 14-day trial today.