Agents that update themselves are convenient. They are also a soft spot if the update process does not check that what it downloaded is genuine before running it.

enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT. This piece explains the weakness class behind that soft spot and gives you a list of what to demand from any RMM vendor.

What CWE-494 is, in plain English

CWE-494, Download of Code Without Integrity Check, describes a weakness where a system pulls in code or data from somewhere else and runs it without properly verifying it is what it claims to be. In an RMM or agent context, that usually means an update, plugin or script is loaded and executed based on trust in the delivery channel rather than verification of the content itself.

Why integrity checks fail in self-update and plugin paths

Self-update paths exist so an agent can patch itself without a person doing it manually. That convenience only holds if every step in the chain, the update server, the transport and the signature check, is verified before the update runs. If any 1 step is skipped or misconfigured, the agent will run whatever it is handed. Plugin paths have the same shape. A plugin is code, and if it is loaded without verifying its signature and origin, it is functionally the same risk as an unverified update.

What to ask your RMM vendor to evidence

• Code signing on every update and plugin, and how signature verification is enforced, not just offered.

• Update channel hardening. How the delivery path itself is protected against tampering or substitution.

• Rollback. What happens if a bad update ships, and how fast it can be reversed across every managed endpoint.

• Audit logs. Whether every agent update and plugin load is logged in a way you can review later.

Controls you can add now

• Allow-listing for which update sources and plugins are permitted to run at all.

• Network segmentation, so a compromised agent update path cannot reach everything in the environment.

• Monitoring specifically on agent update and plugin activity, not just on the endpoints those agents manage.

Buyer checklist for agent-based tools

• Does the vendor verify code signatures before running an update or plugin, and can they show you how.

• Is the update channel itself hardened against tampering.

• How fast can a bad update be rolled back across every managed endpoint.

• Is every update and plugin load logged and reviewable later.

enhanced.io monitors agent and tooling behavior across every surface we cover, and your named Fractional Security Director flags an integrity gap in a partner's own stack before it gets exploited, the same way we flag one in a client's environment. This is not about 1 platform. It is about watching the behavior regardless of which tool produced it.