Nexus
RMM · PSA
Product updates

What actually shipped.

A dated record of changes that are merged and running — written in the same vocabulary as the rest of the site, including the part where we tell you what something is not yet. Nothing here is an announcement of future work; that lives on the roadmap.

Endpoints & RMMAI & automationOperations consoleSecurity & governanceBilling & reportingDocs & community
July 22, 2026·Operations console
Live in our practice

One RMM workspace instead of a scavenger hunt

The RMM surfaces — fleet, devices, jobs, scripts, patching — moved behind a single workspace shell with a genuine operational overview on the front, rather than a dozen sibling routes a technician had to know by name.

  • A workspace overview that reports real fleet health and real job state, with no invented counters
  • Existing deep links keep working — every previous route still resolves rather than 404ing into a redesign
  • Authorization boundaries were preserved verbatim through the restructure; the shell changed, the permission checks did not
  • Overview health and job navigation land on the filtered view they claim to, so a number you click is the list you get

What this is not yet: This is the bounded first phase. Several child screens inside the workspace are still on their pre-existing layouts and are tracked as follow-on refinements.

Endpoint management & RMM →
July 22, 2026·Billing & reporting
Live in our practice

Read-only billing reconciliation against the payment provider

A reconciliation lane that compares what the platform believes about a subscription against what Stripe actually reports — and is structurally incapable of "fixing" a mismatch by writing to either side.

  • Strict validation of the provider response before any of it is trusted — a malformed or unexpected payload fails closed rather than being coerced into a clean-looking answer
  • Duplicate customer identities fail closed: if a tenant maps to more than one provider identity, reconciliation refuses to guess which one is real
  • Payment state is classified truthfully, including the states nobody likes to show — past due, incomplete, and cancelled do not get rounded up to "active"
  • Cross-tenant reconciliation reporting is restricted to root operators, not tenant admins
  • Proven no-mutation: the regression suite asserts the lane writes nothing, to the platform or the provider
Security →
July 22, 2026·AI & automation
Live in our practice

Attribution that admits what it could not attribute, and a real inbound reply path

Five sales surfaces existed with no way to ask which campaign produced revenue, and the SDR conversation loop existed in the API with nothing feeding it. Both are now wired end to end — including the parts that make the numbers less flattering.

  • Campaign attribution now survives the lead-to-deal boundary, and deals created before attribution existed are walked back through their lead rather than left silently unattributed
  • Every report states what it could not attribute, with a permanent "unattributed" row that stays visible even at zero — dropping unattributable leads would flatter whichever campaigns remain
  • Long sales cycles count by close date rather than creation date, so a deal does not vanish from every window it spans
  • A signed, off-by-default inbound endpoint feeds prospect replies into the conversation loop; ingesting a reply writes history and can never send anything
  • Reply matching is strongest-first and gives up when the sender is ambiguous rather than guessing — a misattributed reply would put a follow-up in front of the wrong person
  • An unmatched reply is stored and queued for manual attachment, never discarded, and a short reply that says "unsubscribe" is honoured as an opt-out because people really do answer that way
  • All report arithmetic lives in a pure module with no store, clock, or network access, holding the house rule that numbers are never model output
AI sales & marketing →SDR →
July 22, 2026·AI & automation
Available on configure

The three named gaps in the sales module, closed

The AI sales module shipped with three capabilities explicitly marked not-wired rather than shown as working. All three are now real — which is the whole reason for naming them out loud instead of letting a simulated response imply a live one.

  • Public funnel capture posts into the existing anonymous lead intake, so funnel analytics reflect real public traffic rather than only what an authenticated recorder logged
  • A funnel and step submitted by a visitor are treated as claims to verify, not data to store — the funnel must exist and be published, the step must belong to it, and the response is identical either way so ids cannot be enumerated
  • Live AI landing-page generation is reachable, with publishing still a manual admin action
  • The live enrichment waterfall is wired: a request timeout, a cache keyed on lookup inputs rather than lead id, an error taxonomy that distinguishes a bad key from a blip, and provider health with a degraded flag
  • Enrichment stays advisory and fill-empty-only — a human's typed value always wins, and it will link a lead to an existing company but never invent one from a third-party guess

What this is not yet: Wired does not mean on. Each live provider path still reports "needs config" until an admin deliberately adds a key, and falls through to the offline simulation until then — merging this changed nothing for anyone who has not configured a provider.

AI sales & marketing →
July 21, 2026·Operations console
Live in our practice

The dashboard became an operations cockpit

A responsive, customizable cockpit replaced the fixed dashboard — with each widget still owning its own query, so a customized layout cannot invent a number that no query produced.

  • Widget and query ownership preserved through the rebuild: every tile still fetches its own truth
  • Customization controls built to be operable by keyboard and screen reader, not mouse-only drag targets
  • Responsive down to the screen a technician actually has open next to a remote session
July 21, 2026·Operations console
Live in our practice

Device detail rebuilt as a technician command center

The single device page a technician spends the most time on, rebuilt around what you actually need in front of you when something is broken — and honest about the states where the answer is "we do not know yet".

  • Reusable presentation components rather than another bespoke page, so the next surface inherits the work
  • Health states are honest: unknown renders as unknown instead of a reassuring green that nothing verified
  • Device actions were preserved through the rebuild — no capability quietly disappeared in a redesign
  • Query state is owned by the page and stays tenant-safe across navigation
  • Full system inventory is back in a compact form — printers, graphics, memory modules, lifecycle, connectivity, processes, startup items, and browser extensions
Asset & device management →
July 21, 2026·Endpoints & RMM
Live in our practice

A 500-script PowerShell library, imported as drafts on purpose

The canonical PowerShell catalog was consolidated into the RMM Scripts workspace — arriving tenant-scoped, unsigned, and in draft, because a library that runs on import is a supply-chain problem wearing a convenience costume.

  • Around 500 catalogued scripts plus a curated library, wired into the Scripts workspace rather than living in a folder somewhere
  • Every imported script lands as a tenant-scoped unsigned draft — nothing becomes runnable on an endpoint by virtue of being imported
  • Immutable provenance on each entry: where a script came from survives the import
  • Parameter assessment reports what a script actually expects, instead of leaving a technician to read the source and hope
  • Readiness is reported truthfully — a script that has not been through signing is displayed as exactly that
Endpoint management & RMM →
July 21, 2026·AI & automation
Available on configure

AI sales & marketing: copilot, sequences, funnels, and a governed autonomous SDR

A five-surface sales and marketing layer over the existing CRM — the first place in the platform where an AI agent is allowed to send something without a human clicking approve first, and the guardrails that made that acceptable.

  • AI Sales Copilot: lead and deal scoring where the numbers are computed deterministically and never come from the model, plus next-best-action and drafts-only email composition with merge-field preview
  • Multi-step email sequences with an operator-run advance tick, enrollment tracking, and a suppression list enforced at both enroll time and send time
  • Funnels and landing pages with per-step drop-off analytics — publishing a page stays a manual admin action
  • Autonomous SDR that researches, drafts, and sends on its own once an operator turns it on — bounded at the server by an owner kill switch, contact opt-out, the suppression list, and a per-tenant daily rate limit
  • Every autonomous send is written to an immutable audit trail, so "the AI sent it" is a record, not an explanation

What this is not yet: This shipped with live third-party enrichment and live AI landing-page generation deliberately not wired — tracked as named follow-ups rather than quietly shown as working. Both were closed the next day, along with public funnel capture; see the entry above.

AI sales & marketing →CRM & sales →
July 20, 2026·Docs & community
Live in our practice

Public wiki, API reference, and a community roadmap board

Two customer-facing documentation sites and a public feature-request board — with real threaded comments and moderation, not a thumbs-up widget standing in for a conversation.

  • 66 wiki pages across 12 sections, each written from the actual route and library source rather than from a feature list
  • 97 documented API endpoints across 13 resources, restructured so one file per resource can grow independently
  • Threaded comments with one level of nesting and admin moderation, sharing the same off-by-default origin allow-list, rate limit, and honeypot gate as public lead intake
  • A community roadmap board where a feature request and a vote are public but rate-limited and origin-gated

What this is not yet: Honest about scale: 66 pages and 97 endpoints is a substantial reference, not 1:1 coverage of every route in the platform. The thinnest sections are thin because the underlying surface is, not because the docs were rushed.

July 20, 2026·Endpoints & RMM
Available on configure

Apple MDM admin console

A tenant-scoped Apple MDM console — enrollment profiles, device inventory and detail, device information queries, and revocation behind a typed confirmation.

  • Rotating profile-generation authorization invalidates only outstanding unused enrollment profiles, so already-enrolled devices stay connected instead of being knocked offline by a key rotation
  • Enrollment revocation requires typing the thing you are revoking, not clicking through a dialog
  • Credentials are replace-only and are never returned to or retained by the browser
  • The one-time token lives only in component memory for a bounded retry, then is cleared on download, cancellation, or navigation
Jamf & Apple device management →
July 20, 2026·Billing & reporting
Live in our practice

Scheduled report delivery, proven per tenant

Branded scheduled reporting shipped with single-tenant coverage and no multi-tenant proof. That gap was closed by testing the real production tick path rather than a convenient stand-in — and it surfaced a genuine product gap that was reported instead of buried.

  • A schedule created in one tenant is invisible to another, and generated report counts never cross a tenant boundary
  • Branded report email renders each tenant's own organization name only
  • Generated PDFs are real, mutually distinct per tenant, with delta maps that do not leak a device added in one tenant into another's numbers
  • Cadence and idempotency proven through the actual production tick: one tenant's due-ness never starves another's, and a same-day re-tick never double-fires
  • A brand-new empty tenant produces a valid zero-count report instead of an error

What this is not yet: The pass surfaced a real gap and published it rather than fixing it quietly: a scheduled run currently writes no audit record, so auditable success/failure evidence for this feature does not yet exist.

July 19, 2026·Security & governance
Live in our practice

Nine more endpoint capabilities — each one individually signed off

The default-deny capability registry grew a working operational set: service inspection and control, process query and termination, power transitions, user-session lookup, diagnostic export, and agent self-update. Every single one required its own recorded approval before it could be issued.

  • Read capabilities: service state, running processes, and logged-in user sessions — reported in a privacy-safe form that identifies a session, not a person's activity
  • Endpoint-affecting capabilities: start, stop, restart, and set the startup type of a service; terminate a process; reboot or shut down with a bounded delay and a message
  • Power transitions refuse to run against an interactive session rather than pulling the floor out from under somebody who is working
  • Agent self-update carries the highest risk tier and its own approval record
  • Capabilities registered but not yet approved — disk usage, event tail, pending reboot, Android device info — stay explicitly disabled in the registry rather than being quietly available
Signed jobs and cryptographic endpoint authorization →Security →
July 19, 2026·Endpoints & RMM
Building now

NexusRMM Agent V3: a native Windows service, built cold

A ground-up native Windows agent, assembled over the week in deliberately inert stages — identity and key custody, durable local state, transport and health, inventory, script supervision, diagnostics — with each stage landing disarmed and only then being switched on.

  • Runs as a real Windows service under the Service Control Manager as LocalSystem, with service recovery and crash-safe execution state, rather than as a scheduled task pretending to be a service
  • Managed identity custody and signed-job authorization on the device itself — the agent verifies what it is asked to do before it does it
  • Durable local state that survives a forced child crash, a custom restart, and a full SCM restart with identity and state preserved
  • A transactional native updater with rollback, so an update that fails leaves a working agent behind rather than a brick
  • Native C# hardware and Windows inventory, including normalized monitor serials and baseboard identity
  • Bounded diagnostics, component health, and a durable terminal-job evidence store

What this is not yet: Agent V3 is a lab-validated candidate, not a fleet rollout. Its first server-acknowledged MSI cutover ran on a single lab endpoint; exact-commit rebuild, code signing, reboot/update/rollback acceptance, and broader validation are still ahead of it. The existing agent remains what runs in production.

Endpoint management & RMM →Why our monitoring agent is outbound-only →
July 17, 2026·Operations console
Live in our practice

Inline editing on the tickets board

Ticket fields became editable in place on the board, with column and stale-data handling that keeps a grid from confidently showing you something that is no longer true.

  • Edit a ticket field without leaving the board or opening a detail view
  • Stale-data handling so an edited row reflects what the server accepted, not what the browser hoped
Helpdesk & tickets →
July 16, 2026·Security & governance
Live in our practice

Turning a capability off now fails the build too

Enabling an endpoint capability already required a recorded, signed approval. After a change disabled script execution with no such record, the rule was made symmetric and enforced by continuous integration in both directions.

  • Enabling a capability beyond the original proof-of-concept set requires a signed governance record naming that exact capability
  • Disabling an already-approved capability requires its own record — "it is a security fix" is not an exemption, it is a proposal
  • The check fails the build rather than emitting a warning somebody can merge past
  • A security concern about an approved capability is itself a governance item, never a unilateral code change
Why we publish incident postmortems →The case for public architecture decisions →
July 16, 2026·Endpoints & RMM
Live in our practice

Deployment rings, fleet health filters, and monitor-to-ticket remediation

Targeting became a persisted, bounded concept rather than a selection you rebuild every time — and a monitor that fires now has somewhere to go.

  • Persisted deployment rings so a rollout targets a defined group, in a defined order, on purpose
  • Fleet health filters, so "show me only what is actually wrong" is one control instead of a mental exercise
  • Monitor-triggered remediation linked to a ticket, giving an alert an owner and a paper trail instead of a notification
Deployment ring →Patch ring design in depth →
July 16, 2026·Endpoints & RMM
Live in our practice

Tenant-safe embedded remote sessions

The MeshCentral remote-control workflow was wired to be tenant-safe end to end, and an embedded session was subsequently launched and used against a real lab endpoint from inside the RMM device interface.

  • A remote session is launched from the device it belongs to, inside the console, rather than from a second product with its own login
  • Tenant scoping applies to the session workflow itself, not just to the device list it was launched from
Endpoint management & RMM →

Looking for what comes next instead of what already landed? See the roadmap.

Want these as they ship?

We'll reach out as Nexus moves into private beta — no spam, no lists sold.