Nexus
RMM · PSA
From the team

Notes on building an agentic PSA + RMM platform.

AI architecture, security design decisions, and honest looks at what compliance tooling should actually do — written as we build, not as marketing copy after the fact.

Small MSP
July 21, 2026 · 6 min read

What a "change advisory board" should look like when there are two people to advise

CAB sounds like a committee a two-person shop can't afford to run. Stripped to its essential function, it is something a two-person shop can't afford to skip.

Operations
July 21, 2026 · 6 min

Root cause analysis versus symptom-fixing: how to tell which a ticket actually needed

Reboot-and-close is the right call more often than root cause purists admit — and the wrong call more often than a stretched tech has time to notice. Here is the actual decision line.

Education
July 21, 2026 · 7 min

The mobile device lifecycle in a 1:1 program: five stages most trackers only handle two

Most device trackers are built for deployment and repair. A 1:1 program actually runs on five stages, and the two nobody builds for are where compliance risk lives.

Operations
July 21, 2026 · 6 min

Why a real check-out and check-in workflow beats a static asset spreadsheet

A spreadsheet can tell you what you own. It can't tell you who has it, whether it came back in the condition it left, or that it's three weeks overdue.

Small MSP
July 21, 2026 · 6 min

Sequencing your second and third technician hire: what actually changes operationally

Hire two and hire three solve different problems, not the same problem twice. Getting the sequencing wrong shows up in coverage gaps and burnout before it shows up in the P&L.

Operations
July 21, 2026 · 6 min

What "board-ready" should actually mean for an MSP owner's own reporting

Client-facing reports get a lot of design attention. The reporting an MSP owner uses to run their own business usually gets none — and it shows.

Company
July 21, 2026 · 6 min

What a deliberately limited launch buys a small vendor that a big splashy one doesn't

Limiting availability on purpose looks like caution from the outside. From the inside it is a specific set of operational advantages a wide launch forecloses.

Company
July 21, 2026 · 6 min

Why a "coming soon" page can hurt your credibility more than having nothing live

A coming-soon page and an email capture form signal something specific to a technical buyer, and it is rarely the thing the vendor intended.

Company
July 21, 2026 · 6 min

The economics of a design-partner cohort, for the vendor and for the partner

A design-partner model trades something real on both sides. Here is what each party is actually giving up and gaining, without the soft-launch marketing gloss.

Small MSP
July 21, 2026 · 6 min

Build versus buy for your own internal tooling: when "just build it" is actually right

The build instinct is usually a trap. Occasionally it is the correct call. Here is how to tell the difference before you sink a quarter into an internal tool.

Operations
July 21, 2026 · 7 min

A real method for calculating the seam cost of your stitched-together stack

Seam cost is usually cited as a vibe, not a number. Here is an actual worked method for pricing it, built to be filled in with your own numbers rather than ours.

Buyer's guide
July 21, 2026 · 7 min

How do you actually price a consolidated platform against six point tools?

Sticker-price comparisons between a platform and a stitched stack are almost always wrong, in both directions. Here is where the comparison gets misleading and what to line up instead.

Education
July 21, 2026 · 6 min

Student Data Minimization in Practice: Collecting Less Is a Technical Decision, Not Just a Policy Statement

'We only collect what we need' is a sentence every privacy policy contains and almost no system architecture enforces. Minimization gets decided field by field, not in a board meeting.

Education
July 21, 2026 · 6 min

Planning a Summer Deployment Window for a School Client: What Has to Be Locked In by Spring

Ten weeks looks generous until it's decomposed into shipping, imaging, training, and testing. Summer isn't a convenient window — it's the only one, and it closes on a fixed date.

Education
July 21, 2026 · 7 min

The Real Economics of Damage and Loss in a 1:1 Device Program, and What a Support Model Has to Plan For

Damage and loss in a 1:1 fleet aren't random — they cluster by season, by age cohort, by drop height. A support model that ignores the shape gets surprised by predictable spikes.

Education
July 21, 2026 · 6 min

E-Rate Documentation Requirements, Explained for the MSP Who's Never Filed a 470 or 471

E-Rate doesn't audit whether the district got good service. It audits whether the paper trail proves it — and that paper trail has to exist before the bidding even starts.

Compliance
July 21, 2026 · 7 min

The GLBA Safeguards Rule Reaches Further Than 'Financial Institution' Sounds — Including Schools

A district's business office doesn't think of itself as a financial institution. GLBA's Safeguards Rule doesn't care what the business office thinks of itself as.

Compliance
July 21, 2026 · 6 min

Building a Control Library From Scratch: Where to Actually Start When You Have Nothing Written Down

Don't open a framework document first. Inventory what's actually running, document the handful of things already happening honestly, and mark the rest 'planned' without flinching.

Compliance
July 21, 2026 · 6 min

Evidence-Based Audits Versus Checklist Audits: Why 'Yes' Isn't an Answer an Auditor Should Accept

A checklist rewards documentation of intent. An evidence-based review asks for proof the control actually ran — and that gap is where most failures live.

Compliance
July 21, 2026 · 6 min

Vendor Risk Management Applies to the MSP's Own Vendors Too, Not Just the Client Relationship

An MSP that rigorously assesses every tool a client considers and never once assesses its own RMM provider has a blind spot exactly the size of its own supply chain.

Compliance
July 21, 2026 · 6 min

Cyber Insurance Questionnaires Decoded: What the Underwriter Is Actually Trying to Find Out

Forty questions on a cyber insurance application usually collapse into four real risk signals asked from different angles — and the honest partial answer beats the optimistic yes.

Compliance
July 21, 2026 · 6 min

The State Breach Notification Law Patchwork: Why 'We'll Notify Affected Users' Isn't a Single Answer

Fifty states, fifty different definitions of what counts as personal information, fifty different clocks. One incident response plan has to account for all of them at once.

Compliance
July 21, 2026 · 6 min

CMMC for the Small MSP With One Client That Touches Defense Contracting

The question isn't whether your client sells to the Department of Defense. It's whether any system they use ever touches Controlled Unclassified Information — and that answer can surprise everyone involved.

Compliance
July 21, 2026 · 6 min

GDPR Isn't Just a European Law: When a US-Based MSP's Client Actually Falls Under It

Article 3(2) doesn't care where your client is headquartered — it cares whether they're offering goods or monitoring behavior of people in the EU. Most US MSPs have only checked half of that question.

Operations
July 21, 2026 · 6 min

Runbook-driven support versus tribal knowledge: what actually breaks when the one person who knows leaves

Tribal knowledge feels efficient right up until the person carrying it takes a vacation, or a job offer, at the worst possible time.

Small MSP
July 21, 2026 · 6 min

Change management doesn't require a change advisory board — what a two-person MSP actually needs

Formal change management scales down further than people assume. It just needs different mechanics at two people than at two hundred.

Operations
July 21, 2026 · 6 min

Designing an escalation path that works at 2am with one tech on call, not just on a whiteboard

A five-tier escalation matrix looks great in a slide deck. At 2am with one person awake, it collapses to one real question: who do I actually call?

Operations
July 21, 2026 · 6 min

Ticket triage design patterns: what actually determines priority versus what should

Most triage systems rank by what's loudest, not what's worst. Those are different lists, and the gap between them is where clients get burned.

Compliance
July 21, 2026 · 6 min

Why an AI agent's actions need the same audit discipline as a human technician's — no exceptions

'The AI did it' is not an audit trail. It's the exact ambiguity an audit trail exists to eliminate.

AI
July 21, 2026 · 7 min

Hallucination risk in IT automation, and the specific design choices that contain it

You can't make a model stop hallucinating. You can make sure a hallucination never gets to execute anything by itself.

Buyer's guide
July 21, 2026 · 6 min

A short list of questions that separate a real AI capability from an \"AI-powered\" label

Most of the marketing copy would still be true if you deleted the AI. Here's how to find out before you buy.

AI
July 21, 2026 · 7 min

What supervised autonomy costs you in review time, and what it saves — an honest accounting

Every approval step you keep is a cost you're choosing to pay. The question isn't whether to pay it — it's which ones are worth it.

AI
July 21, 2026 · 6 min

Why an AI agent placing an outbound call still needs a human decision behind it, not just a good script

A well-written script tells the AI what to say. It doesn't tell it who should have decided the call gets made in the first place.

AI
July 21, 2026 · 6 min

The real economics of AI-assisted ticket resolution: where the time actually gets saved

The savings aren't in the fix. They're in the unglamorous minutes before the fix — the part nobody puts on a slide.

Security
July 21, 2026 · 7 min

What AI-prioritized vulnerability triage actually means, mechanically, versus a raw severity score

A CVSS score describes the vulnerability in a vacuum. Triage has to describe it on your network, on that asset, this week — which is a different computation entirely.

AI
July 21, 2026 · 6 min

How AI drafting actually reduces mean-time-to-resolution — and where it doesn't help at all

MTTR isn't one number you can point an AI at and watch drop. It's five or six distinct phases, and drafting only touches two of them.

Company
July 21, 2026 · 7 min

The case for writing architecture decisions down in public, not just internally

An architecture decision documented only on an internal wiki explains a choice to the team that made it. The same decision, dated and public, lets anyone else check whether it actually holds up.

Company
July 21, 2026 · 6 min

Why a same-day postmortem, published honestly, is worth more than 'we take security seriously'

'We take security seriously' is unfalsifiable. A same-day postmortem with a named root cause and a concrete fix is the opposite kind of claim — and it's the one worth actually trusting.

Security
July 21, 2026 · 7 min

Supply-chain risk in the MSP's own tooling: the vendor you trust is also an attack surface

An RMM or PSA platform has broad access across every client an MSP serves, all at once — which makes it a bigger supply-chain target than almost anything in a client's own stack, and worth the same scrutiny.

Engineering
July 21, 2026 · 7 min

SSRF and why an admin-typed webhook or integration URL is a bigger risk than it looks

Any form field that accepts an admin-typed URL the server will later fetch is a structural SSRF risk, cloud metadata endpoints included. Validating the string once at input time doesn't stop a DNS rebind or a redirect.

Engineering
July 21, 2026 · 6 min

Why 'fail closed' beats 'fail open' for a secrets system, even when it's less convenient

A secrets system that fails open when its encryption key isn't available will quietly start anyway, sometimes in plaintext. A system that fails closed just won't start — and that's the correct tradeoff.

Security
July 21, 2026 · 6 min

'Encrypted at rest' and 'encrypted in transit' are not the same claim

'We encrypt your data' collapses two independent claims that protect against different threats and can each be true in a way that's technically accurate and practically meaningless.

Security
July 21, 2026 · 7 min

RBAC design for a platform managing dozens of clients: what 'least privilege' should mean in practice

For a platform managing dozens of separate clients, least privilege has a second dimension generic RBAC guidance skips entirely: not just what a role can do, but which tenant it can do it to.

Security
July 21, 2026 · 7 min

What actually belongs in an incident response runbook, written before you need it

The document most MSPs call an incident response plan is a table of contents for one. A real runbook replaces 'assess the situation' with a decision tree someone can execute at 2am without waking anyone up.

Security
July 21, 2026 · 7 min

Vulnerability prioritization beyond the raw CVSS score: what 'exploitability' should actually mean

A 9.8 CVSS score with no exploit in the wild and no exposure path is not automatically a higher priority than a 6.5 being actively exploited on an internet-facing service. The base score was never built to know the difference.

Security
July 21, 2026 · 6 min

Phishing simulation programs that actually change behavior, not just generate a click-rate number

A quarterly click-rate report measures a moment, not a habit. The programs that actually change behavior track something different: whether people report suspicious email, not just whether they avoided clicking one.

Security
July 21, 2026 · 6 min

What breach monitoring can and can't catch before a client account is compromised

Breach monitoring tells you when a credential already showed up in a dump somewhere. It says nothing about the credential stolen yesterday that hasn't surfaced yet.

Security
July 21, 2026 · 6 min

What 'SIEM' actually means, and why the term gets stretched thin

SIEM has a real, narrow definition — log correlation across sources, normalized and retained for months. A lot of what gets called a SIEM in MSP marketing is just an alert list wearing a bigger word.

Operations
July 20, 2026 · 6 min

Client onboarding checklists that survive contact with reality: what actually goes wrong in week one

Every onboarding checklist looks clean on paper. Week one is where the previous provider goes quiet, a credential doesn't work, and the network diagram was wrong. Here is what to actually plan for.

Operations
July 20, 2026 · 6 min

CRM for an MSP is not a Salesforce clone: what a service-business pipeline actually needs to track

A generic sales CRM is built for a company that closes a deal once. An MSP closes a deal and then serves that client for years. Here is what that difference should actually change about the pipeline.

Small MSP
July 20, 2026 · 6 min

The first hire an MSP owner should make before they scale past solo — and what your tooling should already be doing that job

Most solo MSP owners assume their first hire is a second technician. Usually it isn't — it's whoever absorbs the coordination overhead, and a chunk of that job should already belong to your platform.

Security
July 20, 2026 · 7 min

What "outbound-only agent" actually means at the TCP level, for the technically skeptical reader

"Zero inbound exposure" is a claim you shouldn't take on marketing language alone. Here is what the agent actually does at the socket layer, in terms you can verify yourself with a packet capture.

Company
July 20, 2026 · 5 min

Building in the open: why we publish our own roadmap and test-to-code ratio instead of a glossy one-pager

A one-pager can say anything. A public roadmap and a real test-to-production number can be checked against what actually ships. Here is why we bet on the version that can be caught being wrong.

Operations
July 20, 2026 · 6 min

Why network monitoring across FortiGate, Meraki, UniFi, and Omada in one console matters more than any single vendor's own dashboard

A vendor's own dashboard is the best tool for that vendor's hardware. Most MSPs don't run one vendor's hardware. Here is what you lose by monitoring network gear vendor-by-vendor instead of in one place.

Operations
July 20, 2026 · 6 min

Consolidating five vendor logins into one platform: what changes operationally, not just financially

The pitch for consolidation is usually the invoice total. The bigger change is quieter: what a Monday morning actually looks like once "check five dashboards" becomes "check one." Here is a walkthrough.

Small MSP
July 20, 2026 · 6 min

The MSP pricing conversation nobody wants to have: per-device, per-user, or flat-fee

Every pricing model protects a different thing — predictability for the client, margin for you, or neither, depending on how your client mix actually behaves. Here is the tradeoff underneath each one.

AI
July 20, 2026 · 5 min

Why we don't let AI agents auto-close tickets, even when the fix obviously worked

The model can tell a ping succeeded. It cannot tell you the ticket is actually resolved to the client's satisfaction. Here is the specific reason "obviously worked" is not the bar for autonomous closure.

Security
July 20, 2026 · 6 min

What a signed-job model actually buys you over a plaintext RMM script queue

Most RMM tools push a script to an agent and trust the connection it arrived on. Here is what changes, in concrete supply-chain terms, when every job is cryptographically signed instead.

Operations
July 20, 2026 · 7 min

The hidden cost of migrating PSA platforms mid-contract-year, and what a parallel-run migration actually buys you

Most MSPs who are unhappy with their PSA still wait until the renewal date to switch, even when the pain is costing them now. Here is what that wait actually costs, and why a parallel-run migration is a safer answer than either "wait" or "cut over on a Friday."

AI
July 20, 2026 · 5 min

Why we log every AI-agent draft and every human approval as separate audit events, not one combined action

It would be simpler to log "agent resolved ticket #4021" as one entry. We deliberately don't. Here is why collapsing a draft and an approval into a single audit event erases the exact accountability question you'd want answered after something goes wrong.

Buyer's guide
July 20, 2026 · 6 min

Multi-tenant isolation, explained for a non-engineer buyer: what "tenant-scoped" should actually mean

A vendor tells you your data is "tenant-scoped" or "logically isolated." Those phrases can describe a real guarantee or a hopeful one, and you cannot tell which from the phrase alone. Here is the plain-English version of the question worth asking instead.

Backup
July 20, 2026 · 6 min

Backup 3-2-1 is table stakes - why restore drills are the metric that actually matters

Three copies, two media types, one offsite. Every MSP can recite the 3-2-1 rule. Fewer can tell you the last time they actually restored something from it under time pressure. Here is why that second number is the one worth tracking.

Operations
July 20, 2026 · 6 min

The vCIO conversation most MSPs are avoiding: turning a QBR from a status update into a budget decision

A quarterly review that ends with "here is what we did" is safe and forgettable. A quarterly review that ends with "here is what it will cost to close these three gaps" is the one that actually grows the account — and the one most MSPs quietly avoid having.

Security
July 20, 2026 · 6 min

Patch Tuesday from an MSP's chair: why patch timing policy matters as much as patch coverage

Coverage answers "did every device get patched." Timing answers a harder question: patched when, relative to disclosure, relative to a zero-day, relative to the client's Monday morning. Most patch policies only answer the first question.

Security
July 20, 2026 · 5 min

Why every integration credential in Nexus is replace-only, never read back

You can rotate an API key in Nexus. You cannot ever view one again after you save it — not as an admin, not through support, not through the database directly. Here is the actual security reasoning behind that restriction.

Education
July 19, 2026 · 7 min

What K-8 schools actually need from an MSP that a generic SMB client does not

A school is not just a smaller office. E-rate funding cycles, 1:1 device programs, FERPA, and a hard summer deadline change what "good IT support" means. Here is what actually differs when the client is a K-8 district.

Small MSP
July 18, 2026 · 6 min

The real cost of alert fatigue when you are the only tech on call

A five-hundred-tech MSP can hire a NOC to triage noise. A one- or two-person shop cannot. Here is what alert fatigue actually costs a solo MSP, and a practical way to triage signal from noise without a team to spread it across.

Operations
July 17, 2026 · 6 min

"Single pane of glass" is mostly marketing copy - here is what actually removing tool-sprawl looks like

Every RMM and PSA vendor promises a "single pane of glass." Almost none of them mean the same thing by it. Here is the difference between a shared login skin and tools that actually stopped being separate.

Security
July 16, 2026 · 6 min

The shared admin password is the small-MSP breach nobody budgets for

One domain-admin password in a shared document, used by everyone, rotated never. It is the most common credential pattern in small IT shops — and the single cheapest thing to fix before it becomes an incident report.

Operations
July 16, 2026 · 6 min

The first 30 days of a new client: onboarding as a runbook, not a scramble

The first month with a new client sets the tone for the whole relationship — and it is usually the least systematized thing an MSP does. Here is what changes when onboarding is a checklist the platform walks with you.

Backup
July 15, 2026 · 6 min

A backup you've never restored is a hypothesis

Backup jobs that report green for months can still fail the only test that matters: an actual restore, under time pressure, of the thing the client actually needs. Here is the case for restore drills as a scheduled, first-class operation.

Security
July 15, 2026 · 7 min

Patch management without the 2am surprise: rings, windows, and rollback

The scary part of patching is not applying updates — it is applying them everywhere at once. Here is the boring, reliable structure that turns patching from a monthly gamble into a routine: rings, maintenance windows, and a tested way back.

Operations
July 14, 2026 · 6 min

Alert fatigue is a design failure, not a discipline failure

When a tech ignores the 400th alert of the day, the problem is not the tech. Here is why monitoring noise is an architecture decision — and what a monitoring pipeline owes the human at the end of it.

Small MSP
July 13, 2026 · 6 min

Per-seat software pricing was designed for a 50-person MSP. Most MSPs aren't one.

Minimum seat counts, tiered add-ons, and per-technician pricing all assume a growing headcount to amortize against. Here is the "small MSP tax" that pricing model creates — and the honest state of pricing at Nexus today.

Small MSP
July 12, 2026 · 6 min

When to hire your first tech: what has to change operationally before you do

The signal that you need a second person usually isn't revenue — it's whether your operations are documented well enough that a second person could actually be useful on day one instead of just busy.

Small MSP
July 12, 2026 · 6 min

Running an MSP of one (or three): what six different logins actually cost you

A five-person MSP and a fifty-person MSP often run the same number of vendor tools. The bill is similar. The team available to manage that bill is not. Here is the cost that never shows up on a feature-comparison table.

Operations
July 11, 2026 · 6 min

Executive dashboards and vCIO reporting that build themselves from data that already exists

A vCIO review is only as good as the data behind it — and building that data by hand from four different tools the night before a client meeting is where most vCIO programs quietly break down.

Operations
July 10, 2026 · 5 min

IT documentation that lives where the work happens, not in a wiki nobody opens

Documentation tools fail for a boring reason: they are a second place, disconnected from the ticket and the device it describes. Here is what changes when the docs are attached to the record instead of filed next to it.

Company
July 9, 2026 · 5 min

Why we call modules "design-partner ready" instead of "coming soon"

A blanket "in development" label across every module was honest about uncertainty but wrong about where things actually stand. Here is the more precise status language we moved to, and why it took a public review to catch it.

AI
July 8, 2026 · 6 min

Policy-governed autonomy: a more precise description than "human in the loop"

"Human in the loop" has become a marketing phrase that could mean anything from "a person approves literally everything" to "a person could theoretically look at a dashboard someday." Here is the actual model Nexus runs on.

Engineering
July 6, 2026 · 5 min

Why we publish our own test-to-production ratio in public

Most vendors tell you their product is "thoroughly tested" and expect you to take their word for it. We put the actual number on our own README instead. Here is why, and what it does and doesn't prove.

Company
July 2, 2026 · 5 min

Building in the open: how we're sequencing Nexus from Foundation to GA

Why we'd rather ship a smaller set of real, tested modules than a long feature list that only half works — and how that shapes the order we're building in.

Operations
June 29, 2026 · 6 min

One HQ console, hard tenant walls: running every client from one place without flattening the boundaries between them

Running dozens of clients from one place sounds like it should mean weaker isolation between them. Here is how a unified operations console and hard per-tenant data boundaries coexist in the same platform.

Buyer's guide
June 24, 2026 · 7 min

What to actually evaluate when choosing an RMM + PSA platform

A vendor-neutral checklist for the questions that matter more than the feature-comparison table: architecture, data ownership, and what happens on your worst day.

Operations
June 18, 2026 · 5 min

From "deal won" to a provisioned tenant: what happens when the CRM and the platform are the same system

Most MSPs run a CRM that has no idea what happens after a deal closes. Here is what changes when closing a deal and onboarding a client are the same event instead of a handoff between two tools.

Compliance
June 15, 2026 · 8 min

A practical guide to SOC 2 and NIST CSF for MSPs (and what "compliance tracking" should mean)

Compliance software that just shows a checklist isn't compliance tracking — it's a to-do list with a nicer font. Here is what a posture dashboard actually needs to do to be useful.

Backup
June 8, 2026 · 6 min

"Your bucket, your keys": what that actually means for Microsoft 365 backup

A lot of M365 backup vendors ask you to trust their storage, their retention policy, and their exit terms. Here is the alternative architecture we built instead, and why the distinction matters more than it sounds.

Operations
June 1, 2026 · 7 min

PSA and RMM in one platform: what actually breaks when they're separate tools

Ticketing in one tool, monitoring in another, a Zapier-and-hope integration between them. Here is where that pattern quietly costs MSPs time, context, and SLA compliance.

Security
May 25, 2026 · 6 min

Every remote command Nexus runs on a device is cryptographically signed — here is why

Remote scripting and patch deployment are two of the most powerful things an RMM can do to a device, and two of the most dangerous if the authorization model is weak. Here is the signed-job architecture behind ours.

Security
May 18, 2026 · 5 min

Why we designed the Nexus monitoring agent to be outbound-only

No inbound firewall rules, no exposed listening port, no VPN tunnel to maintain. Here is the actual architecture behind "zero inbound exposure" and why it was a hard requirement, not a nice-to-have.

Security
May 11, 2026 · 6 min

Tenant isolation should be a database guarantee, not an application promise

Most multi-tenant SaaS relies on every query remembering to filter by tenant_id. One missed WHERE clause and you have a data leak. Here is why Nexus enforces isolation at the Postgres layer instead.

AI
May 4, 2026 · 6 min

What "agentic AI" actually means for MSPs (and where the human stays in the loop)

"Agentic" gets used to mean almost anything right now. Here is the specific, narrow definition we build to at Nexus — and why every agent drafts, and only a human sends.