--- title: Session recording adoption takes off description: Selective session recording is one of the oldest and cheapest controls in privileged-access security, and every regulatory framework that touches remote administration expects it. The control became generally available on the Acronis platform on April 22, 2026. This report measures the two months of adoption that followed, through June 23, 2026. canonical_url: https://www.acronis.com/en/tru/posts/session-recording-adoption-takes-off/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 13 July 2026 # Session recording adoption takes off Selective session recording is one of the oldest and cheapest controls in privileged-access security, and every regulatory framework that touches remote administration expects it. The control became generally available on the Acronis platform on April 22, 2026. This report measures the two months of adoption that followed, through June 23, 2026. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** **Author: Alexander Ivanyuk**, Senior Director, Technology ## Executive summary Selective session recording is one of the oldest and cheapest controls in privileged-access security, and every regulatory framework that touches remote administration expects it ([NIST SP 800-53 control AU-14 calls it Session Audit](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)). The control became generally available on the [Acronis platform](https://www.acronis.com/en/#sp) on April 22, 2026. This report measures the two months of adoption that followed, through June 23, 2026. The main result is that adoption is climbing steadily and broadly. In the first two months after launch, thousands of tenants began recording sessions, and weekly recording volume grew about 178% from the first full week to its peak while the number of tenants recording each week roughly doubled. This is not the signature of a handful of power users — recording is spread widely across the adopting base, with the single busiest tenant accounting for only about 1.2% of all recordings and the top 10 together accounting for less than 10%. The control is following a healthy, broad-based adoption curve rather than concentrating in a small cohort. Usage is substantive, not token. Across the window the platform captured several thousand recording hours of privileged remote sessions, averaging about 13 minutes per recorded session. These are real working sessions being preserved as audit evidence. The regional picture is encouraging and uneven in informative ways. Among geolocated active tenants, recording adoption already reaches double digits in several markets: Canada (about 19%), Switzerland (17.2%), Japan (13.1%), South Africa (13%) and Brazil (11.7%), with Brazil and the United States contributing the largest absolute numbers of recording tenants. Large European markets such as the United Kingdom, Italy and Spain still sit in the low single digits, a gap given their regulatory exposure and a clear opportunity to grow. The takeaway for any customer or MSP not yet recording is simple: The control is live, it is being adopted quickly by peers, the cost to enable it is near zero, and the compliance and incident-response value begins the moment a privileged session is preserved. Turning it on this quarter provides a team with the leading, fastest-growing edge of the market on this control. **Key takeaways:** * Adoption is growing steadily: Weekly recording volume rose about 178% from the first full week after launch to its peak, and the tenants recording each week roughly doubled over the same period. * Recording is broad-based, not concentrated: The busiest single tenant accounts for about 1.2% of recordings, the top five for about 6% and the top fifty for about 27%. * Usage is substantive: Recorded sessions average about 13 minutes, amounting to several thousand hours of preserved privileged-session evidence over two months. * Regional adoption already reaches roughly 19% of geolocated active tenants in the leading market and double digits across several others, while major European markets remain in the low single digits — the clearest near-term growth opportunity. ## Why session audits matter Privileged remote work is the highest-impact activity an administrator performs on an endpoint. A remote-desktop session typically carries the ability to execute arbitrary commands, read arbitrary files, install or remove software and modify configuration. Recording those sessions is the control that turns privileged remote access from an unobservable action into an auditable one. NIST SP 800-53 Revision 5 control AU-14 (Session Audit) authorizes selective recording of user sessions to support accountability, investigation of suspicious activity and oversight of users with significant privileges. ISO/IEC 27001:2022 Annex A 8.15 (Logging) and 8.16 (Monitoring activities) require that activities and exceptions be produced, stored, protected, analyzed and monitored for anomalous behavior. [NIST SP 800-92 is the operational manual](https://csrc.nist.gov/pubs/sp/800/92/final) that pairs with these controls: Retention schedules, access controls on the logs themselves and a defined review cadence. GDPR Article 32 (Security of processing) requires controllers and processors to implement appropriate technical and organizational measures appropriate to the risk; a session audit of privileged remote work is a recognized such measure for EU-resident data. ENISA procurement guidance lists session-audit capability as a control that regulated buyers should require of remote-administration tools, and [CIS Critical Security Controls v8 Control 8](https://www.cisecurity.org/controls) (Audit Log Management) makes the practice accessible to SMBs even at the lowest implementation group. The practical implication: Session recording is not a niche feature for security-paranoid operators — it is the mechanism that satisfies the audit obligations every standards body and most regulators expect. ## Adoption since launch The feature became generally available in [Acronis RMM](https://www.acronis.com/en/products/cloud/cyber-protect/rmm-solution/?utm_source=google&utm_medium=cpc&utm_campaign=MF-X-X-Cloud-Americas-NAM-EN-MQL-CloudSEMb-MSPcloud-G-PS&gad_source=1&gad_campaignid=897344085&gbraid=0AAAAAD7eew-NF7K4W4V-7VP9V8-FX7Q2J&gclid=CjwKCAjwvNfSBhBiEiwAyaGMCcR04EkqGhR0NtKiwEGd5wBKjJAAs8eydx191dw24m0-vwYtogNmjhoCUmAQAvD_BwE) on April 22, 2026. The chart below tracks the two months that followed: The green bars show the share of all recordings made each week (the rising weekly cadence), and the navy line shows the cumulative share of recording tenants that had made their first recording each week. ![Image 1: Session recording adoption takes off](https://staticfiles.acronis.com/images/content/8016c8fd4decb72c55d958c938491ec5.png) Two things stand out. First, weekly volume rises almost without interruption across the window — the feature is not seeing a launch spike followed by decline, but sustained, compounding uptake. Second, the cumulative-onboarding line is close to linear: A steady stream of tenants makes its first recording every week rather than the curve flattening, which is the signature of a control still early in its adoption and broadening rather than saturating. ## How recording is being used Recording is broad based. The single busiest tenant accounts for only about 1.2% of all recordings; the top five together account for about 6%, the top ten for less than 10% and the top fifty for about 27%. In other words, the long tail does most of the work — this is a control being adopted across a wide population of operators, not a feature exercised by a handful of specialists. That breadth is exactly what a healthy adoption pattern looks like. The usage is also substantive. Recorded sessions average about 13 minutes each (with a median of roughly 4.1 minutes), and together they amount to several thousand hours of preserved privileged-session activity over the two-month window. These are real working remote-administration sessions being captured as durable audit evidence: The raw material that makes an incident investigation or a compliance review tractable after the fact. The profile of a recording tenant is recognizable: Operators — in-house IT teams, MSPs and partner-side technicians — who either work under contractual audit obligations to their downstream customers, or who have decided that privileged remote access should be observable by default. As adoption broadens, that posture is becoming a mainstream operating practice rather than a specialist one. ## Regional adoption Adoption rates differ markedly by market. The chart and table below show, for the leading markets, the share of geolocated active tenants that recorded at least one session in the window. (Because the denominator is the geolocated active-tenant base, these rates are higher than any platform-wide figure and are best compared with one another.) ![Image 2: Session recording adoption takes off](https://staticfiles.acronis.com/images/content/a1220d265ad9faf68697c4e6d8d762ea.png) Canada, Switzerland and Japan lead on adoption rate, with several Latin American and African markets (Colombia, South Africa, Brazil, Mexico, Botswana) also in double digits — Brazil and the United States contribute the largest absolute numbers of recording tenants. The notable gap is the larger European markets: The United Kingdom, Italy and Spain still sit in the low single digits despite the strongest regulatory exposure under GDPR. That gap is the clearest near-term opportunity to grow adoption where the compliance case is already made. ## Conclusions Two months after general availability, session recording is on a healthy, broad-based adoption curve. Weekly recording volume has grown steadily without a post-launch slump, and a steady stream of tenants begins recording each week, which is the signature of a control that is broadening rather than saturating. The breadth is the most encouraging signal: Recording is spread across a wide population of operators rather than concentrated in a small set of specialists, so the practice is becoming mainstream rather than remaining niche. The usage behind the adoption is substantive. Recorded sessions are full working sessions, not incidental clips, and together they represent thousands of hours of preserved privileged-session evidence — exactly the audit material that the major standards expect organizations to be able to produce. The control is doing real compliance work for the teams that have turned it on. Regional adoption is uneven in an informative way. Several markets in the Americas, Africa and the German-speaking and Japanese markets have already reached double-digit adoption among active tenants, while the larger Western European markets remain in the low single digits despite carrying the strongest regulatory exposure. The geography of adoption therefore points directly at where the next wave of growth is both easiest to motivate and most overdue. For any team not yet recording, the case is straightforward. The control is live, it is being adopted quickly by peers, the cost to enable it is effectively zero, and its compliance and incident-response value begins the moment the first privileged session is preserved. Enabling it now places a team with the fastest-growing edge of the market on a control that every relevant standard already expects. ## Recommendations ## For SMBs running Acronis RMM directly Turn on session recording for the technicians — in-house or MSP-side — who can take remote control of your endpoints, starting with the privileged accounts that touch your most sensitive machines such as domain controllers and finance systems. Selective recording on privileged users is exactly what NIST SP 800-53 AU-14 recommends. Define a retention period (six to 12 months covers most SMB cases) and a named reviewer before you enable it; NIST SP 800-92 covers retention and access-control discipline for security logs. If you handle personal data of EU residents, treat session audits for privileged remote work as a default measure under GDPR Article 32 and document the decision either way. ## For managed service providers Make session recording a default offering for customers in regulated verticals (health care, finance, public sector) and a documented option for everyone else — the markets adopting fastest in the data are doing exactly this, building recording into the service description. Publish a short, customer-facing session-audit policy: What is recorded, how long it is retained, who can request a recording, and what triggers a review; ISO/IEC 27001:2022 Annex A 8.15 and 8.16 expect this kind of documented discipline, and CIS Controls v8 Control 8 makes it concrete. Pair recording with the analyst-delegation pattern from the admin-roles work — recordings without anyone reviewing them, and analysts without an audit trail, are each only half of the control. ## For customers working with an MSP Ask your MSP in writing whether session recording is enabled on your tenant and for which categories of action. A satisfactory answer specifies which sessions are recorded, how long recordings are retained, and how you would request one. Treat the right to request a recording as part of your supplier oversight, not a special favor: CISA AA22-131A frames MSP oversight as a customer responsibility, and GDPR Article 32 makes the session-audit arrangement one of the technical and organizational measures worth documenting in the MSP contract for EU-resident data. Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)