31% of breaches start at an unpatched flaw; RMM to close it costs US$1–3.75 a device

01The case for RMM is now a breach statistic

Verizon’s 2026 Data Breach Investigations Report, covering incidents from 1 November 2024 to 31 October 2025, found that 31% of breaches began with the exploitation of a vulnerability, while credential abuse fell to 13% as the way in.^{1 2} It also measured how slowly holes close: only 26% of the critical flaws on CISA’s known-exploited list were fully remediated in 2025, down from 38% a year earlier, and the median time to fix stretched to 43 days.²

That is the whole argument. An RMM is an agent on every device, a console that sees them all, and a scheduler that installs operating-system and third-party patches in rings without a technician visiting a desk. Monitoring and remote control ride on the same agent, but the patch loop is what moves the 43-day figure.

02What it costs: 7 of 20 products print a price

TechBag’s RMM and patch guide carries 20 product records across 12 vendors, verified against vendor documentation on 22 August 2026. Twelve are quote-only, including every product from N-able, ConnectWise and Datto; LogMeIn Resolve prices per endpoint without printing the figure; seven publish one.³ Per-device rates run from Splashtop AEM’s stated ceiling of US$1 a month to NinjaOne’s US$3.75 at 50 or fewer endpoints, falling to US$1.50 at 10,000. SuperOps prints US$1.50 at its 100-endpoint minimum. Atera prices per technician instead (US$149 a month, unlimited devices).^{3 4}

Two of the five products the original recommended were never RMMs: Hexnode manages phones and laptops, and Auvik monitors network gear. The honest shortlist for a 200-device company is Action1 at no charge, Atera if the team is two people and the fleet is growing, or NinjaOne and SuperOps if the third-party patch catalogue matters more than the invoice.

03In India the agent is also the evidence

CERT-In’s Directions of 28 April 2022 require every body corporate to synchronise clocks to the NIC or NPL time source, report a listed incident within 6 hours, and keep logs of all ICT systems for a rolling 180 days within Indian jurisdiction.⁵ An RMM does not store those logs, but it is the only live inventory most small IT teams have, which is the first thing CERT-In asks for after an incident. The DPDP Rules, notified on 13 November 2025, add a duty of reasonable security safeguards from 13 May 2027.⁶