A Tool the Police Trusted — Until the Provenance Didn't Add Up
The Metropolitan Police has suspended its use of a mobile phone forensics tool after US prosecutors traced the supposedly American-built product back to Moscow. No breach. No malware outbreak. The software, by all accounts, did the job it was bought to do. What failed was provenance: the answer to "who actually built this, where does our data really go, and who stands behind it?" The moment that answer changed, a tool embedded in live investigations was switched off mid-operation.
If you work in IT operations, resist the urge to file this under "government problem." Every RMM agent, remote access client, monitoring collector, and patch agent in your fleet belongs to exactly the same category of software: privileged, third-party code running as SYSTEM or root on every endpoint you're responsible for. If you're an MSP, multiply that by every client you serve. So ask yourself the uncomfortable question this story raises: if a client, an auditor, or your cyber insurer asked you to account for every piece of privileged management software in your estate — vendor, version, install date, who approved it, where the vendor is actually incorporated — how long would it take you to answer honestly?
For most IT teams, the honest answer is "days." That's the problem worth fixing.
The Problem: Your Management Stack Is a Provenance Blind Spot
Count the privileged agents on a typical Windows workstation in a mid-size company:
- A monitoring agent or collector (PRTG, Zabbix, or similar)
- An RMM agent (ConnectWise, N-able, NinjaOne, or similar)
- A remote access tool (TeamViewer, AnyDesk, Splashtop)
- An AV/EDR client
- A backup agent
- Whatever patch mechanism sits on top (a WSUS client plus a vendor module)
That's six or seven SYSTEM-level binaries per endpoint, from six or seven different vendors — six or seven vendor relationships someone should be vetting: where the company is incorporated, where telemetry and session data are stored and processed, who at the vendor can reach into your fleet, how updates are built and signed. Almost nobody has the time. The stack was assembled over a decade by three different IT managers, each solving the problem in front of them at the time. Nobody owns the big picture.
Then a provenance question lands — a news story like the Met's, a client security review, an auditor questionnaire, a cyber insurance renewal — and the fragmented stack turns a ten-minute lookup into a multi-day project:
- The inventory lives nowhere. The RMM has an applications list. The monitoring tool only really knows servers. The CMDB was last touched 18 months ago by an intern who has since left. Reconciling them means CSV exports from three or four consoles and a spreadsheet merge that eats a technician's day — and still misses the laptop that missed its last agent check-in.
- The audit trails don't line up. Monitoring has event timestamps, the RMM has session logs, the helpdesk has tickets, and nothing links them. "Who connected to that server last Tuesday, and why?" gets answered from human memory, which is not an audit trail.
- MSPs get the multiplier. Forty clients means forty variations of the same question, and one unvetted tool at one site becomes an escalation that pulls your senior tech off billable work.
This isn't a hypothetical risk. In 2020, trojanized SolarWinds Orion updates were downloaded by roughly 18,000 customers, including government agencies and security vendors. In July 2021, attackers exploited zero-days in Kaseya VSA — an RMM — to push REvil ransomware to as many as 1,500 downstream businesses through their MSPs. Management platforms are the most valuable supply-chain targets in existence precisely because they already hold trusted code execution on everything you own. The number of privileged agents in your fleet is, quite literally, the size of your provenance problem.
And even when nothing goes wrong, tool sprawl taxes you daily: technicians with six consoles open to support one endpoint, alert data that never reaches the helpdesk, remote fixes that leave no trace on any ticket, and an IT manager who can't produce a defensible SLA report because the monitoring, RMM, and helpdesk data live in three systems that have never met.
How AlertMonitor Closes the Gap
AlertMonitor is built on a simple bet: infrastructure monitoring, RMM, helpdesk, patch management, and network visibility belong in one platform, driven by one agent, writing to one timeline. For provenance and audit accountability, that architecture changes everything.
One agent, one vendor relationship to vet. A single AlertMonitor agent covers monitoring, remote management, script execution, and patch state. Every duplicate tool you retire removes one vendor questionnaire, one update pipeline to trust, and one SYSTEM-level binary per endpoint. When the next provenance scare hits the industry, you have one vendor to interrogate, not seven.
Continuous fleet-wide software inventory. Installed applications, versions, publishers, and install dates are collected from every Windows endpoint automatically — not during an annual audit scramble. "Which machines run vendor X, and at what version?" is a search box, not a project.
Script jobs across device groups. Write a PowerShell or Bash audit script once, push it to hundreds of endpoints grouped by site, client, or OS, and the results stream back into the platform. The output of every run is stored against the device's timeline, so evidence of what was checked and what was found is preserved by default.
Every action on one record. Remote sessions, script runs, software pushes, and patch deployments are logged with technician identity and timestamp — and through the integrated helpdesk, tied to the ticket they belong to. "Who touched this endpoint, and why?" has a single searchable answer.
The before/after in real numbers. A provenance request that used to mean exports from the RMM, the monitoring tool, and the helpdesk merged in Excel over two days becomes a ten-minute query plus one scheduled report. An 800-endpoint internal IT team that once burned 15–25 technician hours producing a credible software inventory now has one that is always current. An MSP with 2,000 endpoints across 40 clients turns a week-long audit into an hour of review — and can hand every client a monthly software and patch compliance report as a deliverable instead of an apology.
Practical Steps: Audit Your Fleet's Privileged Software This Week
Step 1: Pull a ground-truth inventory from the registry. This reads both the 64-bit and 32-bit uninstall views, so nothing hides:
$paths = @(
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$apps = Get-ItemProperty $paths -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName } |
Select-Object DisplayName, DisplayVersion, Publisher, InstallDate
$out = "C:\Temp\InstalledSoftware_$env:COMPUTERNAME.csv"
$apps | Sort-Object Publisher, DisplayName |
Export-Csv -Path $out -NoTypeInformation -Encoding UTF8
Write-Output "$env:COMPUTERNAME : $($apps.Count) applications exported to $out"
Step 2: Run it as an AlertMonitor script job across a device group. Create a group such as "All Windows Workstations" (or one per client), deploy a variant that flags software from publishers you haven't vetted, and let every result land on the device's timeline:
# Asset audit: surface installed software whose publisher is not on the approved list.
# Deploy via an AlertMonitor script job; output is stored on each device's timeline.
$Approved = 'Microsoft|AlertMonitor|Adobe|VMware' # extend with your vetted publishers
$paths = @(
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$review = Get-ItemProperty $paths -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -and $_.Publisher -and ($_.Publisher -notmatch $Approved) } |
Select-Object DisplayName, DisplayVersion, Publisher, InstallDate
if ($review) {
Write-Output "$env:COMPUTERNAME : $($review.Count) applications need publisher review:"
$review | Format-Table -AutoSize | Out-String | Write-Output
} else {
Write-Output "$env:COMPUTERNAME : all installed software is from approved publishers"
}
On Linux servers, the same audit is one command per package family:
# Debian/Ubuntu
dpkg-query -W -f='${Package}\t${Version}\t${Maintainer}\n' | sort
# RHEL/Rocky/Alma — the VENDOR field is exactly the provenance data you want
rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\t%{VENDOR}\n' | sort
Step 3: Ask the five provenance questions for every privileged tool you find:
- Who actually builds this, and where is the company incorporated?
- Where is my fleet's data — telemetry, session recordings, scripts — stored and processed?
- Who at the vendor can access my environment, and under what controls?
- How are updates built, signed, and delivered to my endpoints?
- What happens to my data and my fleet if the vendor is acquired, or the relationship ends?
Step 4: Retire the duplicates. Wherever AlertMonitor already covers the function — monitoring, remote sessions, script execution, patch state — decommission the overlapping agent. Every removal shrinks your privileged footprint and shortens next year's vendor review cycle.
Step 5: Schedule it. Set the audit script job to run monthly so inventory and publisher review stay continuously current. When the next trust event hits the industry — and there will be a next one — your answer is a ten-minute report instead of a two-week scramble. And because results, remediation sessions, and tickets all live on one timeline in AlertMonitor, the audit writes its own evidence.
The Met could hit pause on their tool within a day because they knew exactly where it was deployed and what it touched. That's the standard your fleet should meet by default. One agent, one console, one timeline.
Related Resources
AlertMonitor RMM & Remote Management AlertMonitor Platform Overview Book a Demo RMM & Remote Management Resources
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.