Obsidian RidgeManaged ESPM · early access
Managed Endpoint Security Posture Management is two controls on your Windows computers. App Control allows the software you approve and blocks the rest. RMM Guard finds the remote monitoring and management tools on a computer and can block the ones you have not approved. It is in early access, it has no published price, and it is not part of any tier.
What it is
Application allowlisting, deployed as the Base Policy. It starts in learning mode, which audits what runs on each computer and blocks nothing. Once enforcement is on, it blocks unsigned executables, software signed with certificates you have not approved, and applications you have not approved. Every approval becomes an allow rule.
Remote monitoring and management tools are how IT providers support computers from a distance, and attackers use the same tools for remote access. RMM Guard detects RMM tools on a computer and, once enforcement is on, denies the ones you have not approved.
How it rolls out
App Control is for eligible Windows endpoints only. Windows Home is not supported, so a Home-edition computer stays on managed detection and response alone.
In learning mode, App Control audits what each computer runs and blocks nothing. That record is what the allowlist is built from. The learning window is at least a week.
A computer moves from learning to blocking only when the policy is active, it has rebooted since activation, the seven-day learning window has passed, there are no recent would-block events from tools nobody has reviewed, and its list of exceptions has stopped growing. Blocking starts only after at least a week of learning and these checks.
Once enforcement is on, newly installed software is blocked until it is approved, and each approval becomes an allow rule. Approvals happen within one business day, so plan installs a day ahead.
The carrier question
Cyber insurance applications ask about remote access. Travelers' MFA supplement (CYB-14306), for example, asks whether MFA is required for all remote access to your network, including access by third-party service providers, and a true Yes starts with an inventory of every remote-access path. The question, explained.
RMM Guard shows which remote monitoring and management tools are actually on your computers, and can block the ones you have not approved. That is one part of the inventory behind your answer. It does not answer the question for you, and we do not claim it meets any carrier's requirement.
Obsidian Ridge is not an insurance producer, broker, or agent. We do not sell, place, or advise on insurance products.
Where this fits
Managed ESPM is in early access and is not part of any tier; it has no published price. Managed detection and response, in every tier, is what watches the endpoints today.
Pairs with Managed Detection & Response, Managed SIEM, and Managed ITDR.
A practice's workstations run a known set of software. App Control learns that set, then, once enforcement is on, blocks what is not on it; RMM Guard shows which remote-support tools are installed. The practice software itself stays with your IT vendor. Managed ESPM is in early access.
How this works for dentalRMM Guard shows every remote monitoring and management tool on the firm's Windows machines, including any a former vendor left behind, and can block the ones you have not approved. App Control handles the rest of the software list. Managed ESPM is in early access.
How this works for law firmsSeasonal preparers install things. With App Control enforcing, new software waits for approval, which happens within one business day, and RMM Guard shows the remote-access tools on each machine. Managed ESPM is in early access.
How this works for accountingThe insurance wedge
Applications ask whether every remote-access path requires MFA, including the tools your IT provider and software vendors use.
RMM Guard shows the remote monitoring and management tools on your machines, one part of that inventory; it does not answer the question for you.
The Readiness Sprint maps your remote-access paths to the exact question your carrier is asking.
From $1,500, delivered in 7 business days — final quote depends on scope, up to $3,500. Signed evidence pack mapped to your carrier's questionnaire — delivered, or we keep working at no additional cost until it is. We don't control underwriter decisions. We control whether you walk in with the evidence they ask for.
Obsidian Ridge is not an insurance producer, broker, or agent. We do not sell, place, or advise on insurance products.
FAQ
Two controls on your Windows computers. App Control allows the software you approve and, once enforcement is on, blocks unsigned executables, unapproved certificates and unapproved applications.
RMM Guard detects remote monitoring and management tools and can block the ones you have not approved. It is in early access.
No. Managed detection and response watches what runs and responds when behaviour looks malicious. App Control decides what is allowed to run at all, and RMM Guard decides which remote-access tools may run. They answer different questions and work alongside each other.
During learning, nothing is blocked. Blocking starts only after at least a week of learning and a set of readiness checks. From then on, newly installed software is blocked until it is approved; approvals happen within one business day and each one becomes an allow rule. Plan installs a day ahead.
App Control is for eligible Windows endpoints only. Windows Home is not supported.
There is no published price. Managed ESPM is in early access and is not part of any tier. Ask on a briefing whether your machines are eligible.
Related
Sources
What this page describes is what the early-access console shows, checked September 2026. Eligibility: Huntress Managed ESPM early-access requirements | Huntress ESPM support docs
Next step
A briefing covers eligibility, the readiness checks before blocking starts, and how approvals would work for your team.