ScreenConnect: separate containment from support recovery

Define what the notice establishes

The ConnectWise notice, dated November 11, reports precautionary disabling of Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. The company is investigating unauthorized access and advises avoiding interactive sessions with suspected compromised devices.

Their presence does not establish compromise. Cause and scope remain under investigation.

Map the path that will be authorized

Choose a customer and a legitimate support task. Map who requests it, who approves it, which account executes it, the technician device it starts from and the receiving endpoint. Identify someone able to stop the work at each end. This proposed map helps prevent a recovery test from proceeding without an accountable destination owner.

The CISA overview explains that malicious actors can also use remote access tools. For the assessment, propose an inventory connecting every authorized installation to its provider and purpose. A familiar signature or product name does not replace that correspondence.

The analysis of communication during isolation complements the plan: agree how customer and provider will exchange decisions and evidence while their usual support channel is being assessed.

Define acceptance by task, device and customer

Before any rehearsal, the response team defines what is authorized and which evidence must be preserved. The proposed test starts in a controlled environment, using accounts and devices designated for validation. Do not use a test connection to investigate a suspicious endpoint or reproduce a reported technique whose mechanism remains unconfirmed.

Record the technician device identifier, approved destination, expected task and corresponding authorization. After execution, ask the customer’s accountable owner to confirm the observed result. If a record shows another account, another destination or activity inconsistent with the task, stop acceptance and refer the discrepancy to the response team.

Keep a record for each examined path. It should distinguish a completed operation, an interrupted attempt and a sample that was never executed. Ask someone who did not perform the rehearsal to review it: that person should be able to identify what was authorized and which evidence supports the conclusion.

Before the rehearsal, agree what should happen if the customer’s accountable owner cannot participate. Record a new window and a point of contact. Missing acceptance should remain visible in the deliverable, rather than being concealed by the task’s technical success.

Connect recovery to remaining open questions

NIST SP 800-61r3 integrates incident response with risk management. In this proposed workflow, recovery is an accountable decision: the customer accepts the work that can resume, and the provider records the applicable conditions and limitations.

Propose a short operational acceptance record containing the released scope, test results, temporary restrictions and owner of the next review. It does not replace investigation. Its purpose is to prevent a limited approval from being interpreted as permission to reconnect every account and device.

The review of cross-account trust and sessions helps frame questions about other delegated access. Establish separately who can grant authority, where it can be exercised and who retains the evidence. Keep records in the organization’s authorized channels, without exposing secrets or customer data in shared reports.

Frequently asked questions

Related reading

• Vanderbilt: isolation and response channels
• Qubole: trust and session revocation

Sources and references

• ConnectWise: November 11 ScreenConnect advisory, 22:45 UTC
• CISA: overview of securing remote access software
• NIST: incident response integrated with risk management

Original Pentesty analysis, published November 11, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.