How risky is third-party monitoring software with full server access?

If the monitoring provider owns the systems, isolating them in a separate network segment or DMZ with tightly restricted firewall rules is a sensible design. If the machines are your production servers and run your applications, network isolation alone is not enough—you should also restrict the agent permissions, document the approved actions, and review the configuration regularly.

First determine whether the provider is listed as a MasterServer, ControlServer, or ordinary Server. MasterServer access is effectively powerful administrative control, so it needs a strong business justification and careful auditing. Also verify authentication settings, credentials, update permissions, logging, and whether the monitoring connection is limited to the required direction and ports. Treat the vendor as a privileged third party and apply least privilege rather than accepting the default installation.

Check the NetXMS agent configuration file, usually nxagentd.conf. The server address can be assigned different access levels: Servers is read-only monitoring, ControlServers can run predefined actions, and MasterServers has extensive control, including changing the agent configuration and installing components. A provider that only needs monitoring should normally be configured under Servers. Also review which subagents are enabled, since those determine what information and functionality the agent exposes.