Managed Endpoint Monitoring for Verkada: Closing the Breach Gap Your Cameras Don't Cover

For a multi-site healthcare provider, six clinical sites running 50 Verkada cameras, 35 access readers, and roughly 350 active badges now sit alongside 570 laptops, servers, and workstations that an HTS RMM (Remote Monitoring and Management) agent reports on every 60 seconds. The cameras catch what happens in the parking lot; the endpoints catch what happens to patient records. Both views live in the same HTS Managed console.

The endpoint is now the breach entry point

When security leaders talk about Verkada, they usually talk about cameras. The 2026 Verizon Data Breach Investigations Report (DBIR) — covering more than 22,000 confirmed incidents — found that vulnerability exploitation overtook stolen credentials for the first time in 19 years, accounting for 31% of confirmed breaches [2]. In other words, the device that gets exploited is rarely the camera in the ceiling. It is the laptop on the cart, the workstation at intake, or the EHR (Electronic Health Record) server in the back office.

The patch gap is widening in parallel. Organizations patched only 26% of CISA Known Exploited Vulnerabilities (KEV) in 2025, with a median time-to-patch of 43 days [2]. By year-end 2024 the CISA KEV catalog held 1,275 entries, with 320 new vulnerabilities added in a single year [10]. Independent research finds that 38–45% of known critical CVEs (Common Vulnerabilities and Exposures — the standardized identifiers for publicly known security flaws) remain unpatched at any given moment across enterprise environments [11].

Healthcare sits in the worst position on the cost curve. The average healthcare breach cost $7.42 million in 2025 — 67% above the global average — and took 279 days to identify and contain [4]. Encryption at rest is required, not addressable, under current HIPAA Security Rule guidance, which made BitLocker (Microsoft's built-in full-disk encryption for Windows) a baseline expectation for covered endpoints [12].

For a Verkada customer with regulated data flowing through laptops, kiosks, and servers, the conclusion is straightforward: cameras and access control are necessary, but they are not the breach surface that determines the cyber-insurance renewal conversation.

What HTS RMM actually does

HTS RMM is a managed service built on ConnectWise RMM, the same platform HTS already operates across its customer base. A single agent per endpoint reports every 60 seconds on CPU, memory, disk health, event log, service health, network reachability, and security posture (BitLocker, firewall, antimalware, OS patch level).

Routine patches deploy through staged rings during the weekend following Patch Tuesday; emergency patches deploy the same day. HTS's default third-party coverage targets the major applications, including Chrome, Edge, Office, and 7-Zip. The customer supplies the list of any additional third-party applications it needs covered. Customer-defined maintenance windows govern routine deployment, with rollback and ticketing on failure.

Remote access is delivered through ConnectWise ScreenConnect, the same engine HTS's own help desk uses, presented to the customer as a branded HTS feature. Unattended access is governed by the customer's tier and the HTS Network Operations Center's (NOC's) role-based access control.

Pre-built remediation playbooks fire on common conditions: CLEANUP_TEMP when disk free space drops below 10%, RESET_WUA (Windows Update Agent) on a Windows Update error, ENFORCE_BITLOCKER when encryption is off, REINSTALL_EDR (Endpoint Detection and Response — software that continuously monitors devices for threats) when the EDR agent goes missing, and FORCE_PATCH when an OS patch is more than 30 days stale. The dashboard shows baseline compliance as a percentage per site, with the same data exportable as a quarterly auditor report.

Three tiers, one billable line

HTS RMM is sold in three tiers, priced per endpoint per month with no minimum endpoint count and no per-technician surcharge.

Volume discounts apply across the HTS Managed platform: 10% off RMM at $2,500–$10,000 platform MRR (Monthly Recurring Revenue), 20% at $10,000–$50,000, and 25–35% at $50,000+. The setup fee is $2,500, credited toward the customer's first three months and waived on a 5-product full-attach deal.

For a 100-endpoint healthcare customer, a Manage-on-workstations, Secure-on-servers mix lands at roughly $2,360 per month, or $28,320 per year — a wash on truck-roll elimination alone and a meaningful lift on patch compliance, MTTD (Mean Time To Detect — how quickly an incident is identified), and Helpdesk utilization.

The proof point

The provider is a multi-site specialty medical group running 50 Verkada cameras, 35 access readers, and roughly 350 active badges across its clinics. The owner signed an HTS Managed agreement at $6,646 MRR covering Verkada Command, badging, and network operations, with about 120 NOC alerts per month. The cameras and badges are the visible part of the security program; the 570 laptops, servers, and workstations underneath are the part the audit asks about.

Three drivers brought RMM into the recommended attach:

1. HIPAA Security Rule, January 2025 update. BitLocker on every endpoint is now required, not addressable. The customer's IT team can configure BitLocker on a new device; it cannot continuously verify BitLocker on 570 devices, with recovery keys escrowed and encryption state exported for audit. The HTS RMM Secure tier does that as a continuous process.
2. EHR application servers. A failed patch on the EHR server at the King of Prussia site is a patient-safety issue, not an IT ticket. KEV-prioritized patching with a 30-day KEV SLA is the right level of operational rigor.
3. Audit evidence. The provider is SOC 2-bound (SOC 2 is an independent audit of a service organization's security controls) and HIPAA-bound. HTS Comply consumes the HTS RMM patch status API and packages it as part of the auditor evidence pack — patch coverage, exceptions, and remediations documented on a single date.

The recommended tier mix — 500 workstations on Manage, 30 servers on Secure, 40 mobile devices on Verkada plus a future HTS MDM (Mobile Device Management) add-on — lands at roughly $11,810 per month, or $141,720 per year, on top of the existing $6,646 MRR. RMM is the product that turns a Verkada-and-badging agreement into a full 5-product attach.

One pane of glass, joined with the rest of the HTS suite

The RMM dashboard is a Next.js application (a modern web framework used for the customer-facing console) in the HTS Managed web app — the same shell as Sentinel (camera health), NetOps (managed network), and Comply (compliance evidence automation). Three integrations matter for a Verkada customer:

• RMM + Sentinel. A camera that goes offline because the switch it was plugged into failed is now visible as a switch issue, a camera issue, and an endpoint issue — correlated in one timeline.
• RMM + Comply. Patch status becomes the most-asked-for line in any SOC 2, HIPAA, PCI DSS, or CMMC audit. Without RMM, Comply has nothing to attest; with RMM, the evidence is generated on the auditor's schedule.
• RMM + Helpdesk. Every RMM alert has a defined ticket mapping. A failed patch on KOP-FIN-04 becomes Helpdesk ticket HD-2026-09-17-0042 with the patch name, exit code, and deep link to the endpoint's posture page already attached. The system files the ticket before the user calls.

What good looks like at day 30

A 30-day onboarding takes a customer from signed SOW (Statement of Work) to baseline compliance reporting. The pilot ring (5–10 endpoints) verifies health by day 7; the remaining rings roll out by day 14; the first quarterly patch compliance report lands by day 30. The customer receives a weekly email showing patch compliance %, posture compliance %, open alerts (median under 5), and truck rolls avoided.

The auditor can request a patch status report and receive it the same day. The cyber underwriter can request a posture attestation and receive a quarterly report that maps encryption coverage, patch SLA attainment, EDR coverage, and MFA (Multi-Factor Authentication) status — the dataset that, per industry research, supports meaningful cyber-insurance premium reductions [22].

The endpoint estate is the part of the security program the auditor and the underwriter actually ask about. HTS RMM exists to make that answer measurable, automated, and defensible — for a 50-camera, 6-site specialty medical group, and for the next 200 customers like it.

Talk to us. HTS Managed delivers endpoint monitoring, patching, and remote support as a managed service for Verkada customers and the broader mid-market. Reach the team at htsmanaged.com or support@hts.pro.

Sources

[1] Verizon, 2025 Data Breach Investigations Report, April 2025. [2] SecurityWeek, Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft, April 2026; Verizon, 2026 Data Breach Investigations Report. [3] IBM, Cost of a Data Breach Report 2024, July 2024. [4] IBM, Cost of a Data Breach Report 2025, July 2025. [7] ConnectWise, Third-Party Patching at Scale announcement, August 20, 2025. [10] Edgescan, 2025 Vulnerability Statistics Report. [11] Cloud Security Alliance, The Bugpocalypse Threshold whitepaper, 2025. [12] HHS, HIPAA Security Rule NPRM factsheet, 2024–2025. [13] HHS Office for Civil Rights, Breach Portal (cited). [16] Dataintelo, Remote Monitoring and Management (RMM) Market Report, 2025. [22] Twin City Security, Insurance Carriers Are Raising the Bar on Property Security Standards, 2024.

Harris Technology Services (HTS) · https://www.hts.pro · Support: support@hts.pro