Device Trust and RMM Tool Abuse: A Practical Third-Party Access Security Checklist

ReliaQuest's recent vishing incident is instructive precisely because MFA — the control most organizations lean on hardest — was successfully defeated by attackers, and it was a second, independent layer (device trust) that actually contained the breach. Separately, a broader pattern this year involves phishing operations abusing legitimate remote monitoring and management (RMM) tools to gain direct control over victim systems, exploiting IT teams' routine trust of tools they already use for support. Both incidents point to the same structural fix: layered controls that don't depend entirely on a human making the right decision under social pressure.

Why MFA Alone Isn't Enough Against a Skilled Social Engineer

MFA is designed to defeat credential theft — an attacker with a stolen password still can't log in without the second factor. It was never designed to defeat a live, convincing social engineering attempt where the victim voluntarily approves the MFA push because they genuinely believe they're talking to their own security team. Vishing campaigns targeting MFA approval specifically have become common enough that any security program still treating MFA as a sufficient standalone control against phishing is working from an outdated threat model.

The Checklist: Device Trust and Conditional Access

• Implement device-trust policies that restrict access to sensitive applications and dashboards to explicitly enrolled, company-managed devices — this is the control that contained ReliaQuest's incident to a single view-only session rather than a full account takeover
• Layer conditional access policies on top of MFA rather than treating MFA as the final gate — location, device posture, and behavioral signals should all factor into whether an authenticated session is actually granted full access
• Require re-authentication and device verification for any session attempting to reach particularly sensitive systems, even within an already-authenticated broader session, so a single compromised credential-plus-MFA combination doesn't grant unlimited scope

The Checklist: RMM and Third-Party Tool Governance

• Maintain an explicit, current inventory of every RMM and remote-access tool authorized for use in your environment — attackers abusing RMM tools frequently rely on the target's own IT team not immediately recognizing an unauthorized tool as suspicious, since RMM usage is routine
• Restrict which employees can install or approve new RMM software, and require a defined approval process for any new remote-access tool rather than allowing ad hoc installation by any employee with local admin rights
• Monitor for RMM tool usage from unexpected accounts, at unexpected times, or targeting systems outside a given tool's normal scope — behavioral anomaly detection on already-authorized tools is a genuinely different (and often under-monitored) problem than detecting unauthorized software

The Checklist: Employee Training That Actually Reflects the Real Threat

Generic phishing-awareness training that focuses primarily on suspicious email links is increasingly mismatched to the actual threat — vishing campaigns that combine a spoofed login page with a live, convincing phone call from someone impersonating internal security staff are a categorically different, and currently more effective, attack pattern. Training should explicitly cover the specific pattern used against ReliaQuest: a phone call claiming to be internal security or IT, directing the employee to approve an MFA push or visit a login page, should trigger independent verification (calling the person back through a known, separately-verified number, not one provided during the call) as standard practice, not an exceptional response reserved for obviously suspicious requests.