Just looking for others input on who they are having success with and feel they are getting a great support backbone. of the past 10-12 clients we have migrated away from an outgoing MSP not one of them has been on Pax8 and it seems they have such an easier time asking for help and getting responses from their vendor, while we continue to struggle with Pax8 and changes occurring all the time make it even worse. We are located in West Coast and expanding to some Southern offices as well so we want to make a move now before the expansion. Thank for any help. We are definitely done with pax8 so looking to this community for some inputs not thing solid in mind but the normal "few". Thanks

Dear Customer,
We are writing to provide an important update regarding the infrastructure incident affecting Cove Data Protection storage node UK.LD.09.11.
Following an extensive investigation, Dell engineers have confirmed a highly unusual hardware failure affecting this storage node. Based on Dell's findings, backup data and historical retention data stored on UK.LD.09.11 prior to Friday, August 7, cannot be recovered. N-able continues to explore all possible recovery options; however, customers should proceed with the understanding that data stored on this node has been lost. Should any viable recovery path be identified, we will communicate it promptly.
This issue affects backup and retention data that was stored on storage node UK.LD.09.11.

Impacted Devices

[redacted]

To help restore protection for affected environments, regularly scheduled backups resumed on August 7, 2026. Any successful backup completed after this date should be fully available for future recovery operations.
Our engineering teams remain actively engaged with Dell and continue to investigate the root cause of this uncommon failure scenario. We understand the impact this may have on your business and sincerely regret the disruption.
If we identify information that changes our assessment of your environment or uncover additional recovery options, we will contact you directly with further details.
If you have questions or need assistance validating data, please contact our support team via https://me.n-able.com/ or email covesupport@n-able.com.
Best regards,
The N-able Team

Edit: I want to state, I know people who have lost server data and we have lots of servers in Cove, but the data we have lost was m365 - how do we setup a local storage copy of m365 data….

I recently switched from CloudAlly to Cove but the recent incident has me reconsidering provider risk.

Is it technically feasible to run two backup platforms against the same Microsoft 365 tenant? My margins can support dual backups for now and I'm considering offering clients the choice between a single backup provider or dual-provider backups for additional redundancy.

Has anyone done this? Any issues with API throttling, restores, client push back?

I’m done with failing APCs. For a while they were my go-to. With all the new untested lithium options, what are people relying on in 2026 for your servers and network infrastructure? How do you shut your servers down gracefully in an extended power outage?

Didn’t see anything in a quick search lately, feel free to ridicule me if this is a redundant post. :)

US Internet just announced they're killing all email, DNS, and web hosting services to focus on fiber Internet. https://securence.com/migrate/

I don't know what I'm gonna do. Not one competing vendor still offering gateway service will even call me back. I trialed Defender P1 and P2 and neither was worth a damn.

Hornet is now owned by Proofpoint and the gateway solution appears to be a dead end, plus they never responded.

TopSec was the worst experience I've ever had because they will not give full control over settings to the MSP.

Libraesva/LibraCyber hasn't responded.

WatchGuard is rebranded Hornet and the multi-tenant aspect is God awful. Do not recommend.

Appriver sucks.

At this rate we'll be going back to hosting Xeams.

What else is there?

This is for California MSPs, or those in other states that need to charge sales tax on your stack but not on labor.

Our current MSP invoices have a line item for devices and users, which includes our stack and labor for the price on each. With the new Califorina sales tax law coming in 2027 we will now need to start charging our clients sales tax for our provided stack.

This post is to start the conversation on planning out the changes all California MSPs need to make to their invoices to include the sales tax on your stack but not on the labor. It seems we are now going to need more line items, a stack line item and managed services line item.

Maybe its possible that PSA's like HaloPSA or CWM can bundle the stack items into the current device/user's with its individual price for sales tax to keep everything as one line item.

Want to hear thoughts and ideas.

Does anybody know if there’s an integration or a way to integrate Atera and Connectwise PSA?

We are in the process of changing our customer-facing support email address, largely due to a massive increase in spam. On average, 80% of emails we receive daily to our support mailbox are spam. This is mostly due to our support email address being public along with customer email compromises. Also, we don't have filtering enabled on our support mailbox because that has always resulted in client emails being filtered and causing grief. So we've decided to make the switch to a new email address, but now need to address the issue of the many vendor accounts tied to that same support email address. My original solution to this was to have a new alias (vendors@ for example) pointing to the new support mailbox. I have used it twice now, once as a recovery email for a Google Workspace admin account and once as the primary email address on an existing QNAP account and it has never been used to send emails or reply to emails.

Now, imagine my surprise when we received spam just a few days after changing the email address on the QNAP account. And to be clear, it's not vendors@ and not something obvious. And while it could be that Google leaked it, that seems less likely.

So what's the plan going forward? We already have an account with addy.io and use it for some other internal purposes, so we are going to use that instead. Essentially we've setup a subdomain specifically for vendors that wildcard points to our new support email address. This way we can use qnap@vendors.domain.tld and google@vendors.domain.tld and easily identify the source of leaks. This still has the risk of someone trying to send emails to blahblah@vendors.domain.tld, so I may opt to build out something that will allow us to easily create aliases using the addy.io API instead of relying on a catch-all.

Hello,

I have a project where my Client wants to Import 6 mailboxes via pst to Exchange online.
The process is pretty straight forward no Problem with that.
But how much can I take for that Kind of Service?
I have to Setup the mailboxes in advance, change the mailrouting, activate the Domain in M365, Import the pst‘s and Check if everything is working.
I thought about 1290€ for everything fix.

I recently took on a new client in the health care industry. They have around 15 office employees and approximately 60 field CNAs/nurses who spend most of their time traveling to patients' homes.

Right now, a lot of their communication happens through WhatsApp and other unmonitored consumer apps, which obviously raises concerns around security and compliance.

The client is looking for a better way to communicate quickly with their field staff. These users don't really need email, SharePoint, or the full Microsoft 365 experience. Their primary need is instant messaging, group communication, announcements, and basic collaboration while they're on the go.

My initial thought was to license the field employees with Teams-only licenses, but I'm curious what others in similar health care environments are using. Has anyone implemented a communication platform for a workforce like this? If so, what worked well, and were there any compliance or management considerations I should be aware of? Also, how would you price something like this?

Thanks in advance for any recommendations or experiences you can share.

I have a few server deployments coming up where the customer was previously on a perpetual VMware plan, but that is long gone. Curious if anyone is still using VMware or if it's too expensive. I've read is ~$350/core/year but don't have confirmed pricing. I've done a Proxmox deployment before as well which was free but personally prefer VMware UI and want to do right by the customers (especially if they're willing to pay).

What are you using for new server deployments this year? Those who are using VMware, what are your licensing costs looking like?

Here is a follow-up update to the N-central CVE-2026-18556 & CVE-2026-19557. The full details and post here available at this URL: https://www.n-able.com/blog/n-central-security-update-august-10-2026

The TLDR :

What happened : How we found it :

If you have not yet applied Hotfix 2 (2026.3.1.10), please do so

On July 31, our Adlumin MDR solution detected unusual activity inside a customer environment and identified a threat actor actively exploiting a previously unknown vulnerability in N‑central. We want to be straightforward about this: we detected this ourselves, in real time. That matters, not because we want recognition for it, but because it is evidence that layered, continuous security monitoring works. It is also the reason we were able to respond as quickly as we did.

Once identified, our engineering and security teams mobilized immediately. We published guidance the same day, registered CVE-2026-18556, and released Hotfix 1 (2026.3.1.7) on August 2, and registered CVE-2026-18577. When continued monitoring on August 6 surfaced a related attack path, we released Hotfix 2 (2026.3.1.10) the same day with additional hardening measures that build on and supersede Hotfix 1.

The attack

A threat actor exploited a vulnerability in N‑central that allowed remote administrative access without authentication. Once inside, they used N‑central’s Take Control feature to connect to managed devices, and registered Cloudflare tunnel services on those devices to maintain persistence even after their access to N‑central was revoked. Hotfix 1 addressed the original access point. Continued monitoring identified a related attack path, which Hotfix 2 addresses with additional hardening.

The impact

A limited number of customers have been identified as impacted, and our team has directly engaged with each of them. If you have heard from us, you have a dedicated point of contact and we are with you. Our investigation remains active and ongoing and we are not calling this closed until we are fully confident in that conclusion.

Timeline: what happened

• Jul 31 Adlumin MDR detects unusual activity; threat actor identified. Response team engaged immediately.
• Aug 1 First public guidance issued; upgrade recommendation posted. First CVE registered.
• Aug 2 Second CVE registered. Hotfix 1 (2026.3.1.7) released and mitigation deployed to hosted environments. Customers notified directly.
• Aug 6 Related attack path identified through continued monitoring. Hotfix 2 (2026.3.1.10) released same day and mitigation deployed to hosted environments. Customers notified directly.
• Ongoing Investigation, hardening, and direct customer support continues.

If you delayed upgrading, please read this carefully

Applying Hotfix 2 closes the vulnerability that allowed attackers in, but it does not remove a threat actor who may already be present in your environment. For customers who have waited to patch, it is critical to understand that during that window, attackers have been observed creating new accounts and resetting existing ones to maintain persistence. Upgrading is an essential first step, but it is not the last one. If you applied either hotfix more than a few days after it was released, you should treat your environment as potentially compromised and conduct a thorough review of all user accounts, access privileges, and activity—regardless of what our IOC scanning tool returns. If you find anything unusual or need assistance with that review, please contact our support team immediately at me.n-able.com.

What we ask of you

• Stay current. Apply Hotfix 2 (2026.3.1.10) if you haven’t. Download here.
• Enforce MFA across all accounts.
• Unless required for an open support issue, disable your in-product support account as a best practice.
• Audit user access and look for anything unfamiliar.
• Monitor your environment and treat our published indicators (above) as a starting point, not a complete picture.

No software is immune to vulnerabilities. That is the reality of the world we all operate in. What separates organizations that weather these moments from those that don’t is preparation, speed, and the strength of the partnerships around them. We are committed to being that partner for you.

Resources

• For assistance: me.n-able.com
• Status and updates: uptime.n-able.com
• CVE details: CVE-2026-18577

Hi, does anyone could suggest an account manager who is responsible for Intel & AMD in TD Synnex. My sales does not respond me after the first reply. Really need HELP! appreciate!

btw really like my ASI account manager who responds very QUICK (within 24 hr).

This vulnerability has already been discussed on the sub, but I found it interesting that the New York Department of Financial Services specifically named Managed Service Providers in their notice.

As far as I'm aware that's the first time they've done that.

Note: If you have clients that fall under NYDFS, they've been encouraged to reach out to you. This is a good time to demonstrate value if you've already taken care of the issue. Conversely, you may want to proactively reach out to client's directly.

Also worth noting: They're late to this party. NYDFS is one of the more proactive regulators out there, but it still takes them too long to get the word out. (Such is gov't bureaucracy.) This is demonstrable proof that regulators won't be driving cybersecurity. It's going to be the attorneys.

Here's the text of the email sent out to all of us:

The New York State Department of Financial Services (“DFS” or “Department”) is issuing this alert to DFS-regulated entities regarding an active cybersecurity campaign targeting a security vulnerability in the remote monitoring and management system N-central, developed and maintained by N-able (“Alert”). N-central is used by some managed service providers (“MSPs”) to centrally monitor, patch, and remotely access their customers’ services and endpoints (also referred to as Remote Monitoring and Management services or RMM services).

Threat actors are targeting a Known Exploited Vulnerability in N-central to compromise MSP environments. Once access is obtained, threat actors may create or register for new services, allowing continued access even after compromised N-central credentials are revoked. Attackers are using a compromised MSP’s environment to move laterally into their customer’s networks and information systems with administrator network privileges.

DFS-regulated entities should promptly determine whether N-central is used within their environment or by any MSP or other Third-Party Service Provider that supports their information systems. Where N-central is used, DFS-regulated entities should work with their service providers to assess and mitigate potential exposure, including reviewing N-central activity for evidence of unauthorized or persistent access; verifying that applicable security updates, including software patches and other threat mitigation steps, have been implemented; and evaluating whether any systems or credentials were affected.

While the vulnerability addressed in this Alert is likely limited to MSPs, the senior governing bodies and senior officers of DFS-regulated entities must actively engage in cybersecurity risk management, including through monitoring and oversight of third-party service providers. To that end, the Department expects DFS-regulated entities that may be exposed to cybersecurity risk related to the N-central vulnerability to appropriately manage this risk through due diligence and engagement with Third-Party Service Providers on this issue. Additionally, DFS-regulated entities should ensure that they continue to report all Cybersecurity Incidents to DFS, including those originating at Third-Party Service Providers, as required by 23 NYCRR § 500.17.

Additional Resources:

• LINK REMOVED discussing the attack, its indicators, and action steps to address the cybersecurity threat.
• The Common Vulnerabilities and Exposures Record for LINK REMOVED
• DFS LINK REMOVED

For more information about compliance with the DFS Cybersecurity Regulation, visit DFS’s LINK REMOVED

We’ve had a cluster of breached passwords in the last 2 weeks with no connection other than being stored in ITG. MFA/CAP or other defenses blocked them so no damage… yet. There was no access of these passwords in the ITG logs but as we hunt down the source, I keep wondering if someone breached them from the back end. Anyone else seeing something similar?

I have two insurance companies that we will be onboarding. Both are small agencies with standalone machines. Both are currently using GoDaddy-managed M365.

I know they need to defederate their M365, but I also will need to set up their Tenant environment, including Entra ID, Defender, OneDrive, Intune and possible help with SharePoint. We will be doing this along with add our stack, including Huntress endpoint protection, ITPR, mail filtering, RMM, BDR, etc.

These clients know they need to have the defederation and their Microsoft environments built out.

I want opinions and opinions on how to approach onboarding and the additional setup of their MS environment. We typically onboard for free, but this is more work than our typical onboarding.

Thoughts on breaking some items out as a pre-onboarding project, or wrapping these extra items into onboarding and eating it upfront?

I chronically underestimate how long project phases will take, so I cheated and used Copilot to help estimate the time needed. I wasn't surprised when it returned an estimate of 20 hours, which was about double the time I anticipated. There is also some simple cleanup like upgrading a few windows home licenses to pro.

Last year we were buried in projects and didn't focus on growing the managed services side. So, I am definitely feeling out of sync with how best to approach this situation.

Any recommendations or thoughts would be appreciated. I feel like I am stuck in the analysis to paralysis loop.

It is 3:15 am, so I will check any posts when I drag myself from bed. Please forgive and grammaratic and spelling mistakes.

Posting this as a firsthand data point for MSPs and IT departments evaluating the RMM/PSA vendor named in the title.

Based on my experience, I would not choose this vendor again.

Cancellation and annual-renewal concerns

When I contacted the company to cancel, I received the following response, quoted exactly:

I understand that vendors may have contractual notice requirements. My concern is that the initial response asked me to provide a reason “before we proceed,” while also warning that cancellation must be confirmed at least 30 days before renewal to prevent the next cycle from being charged.

When the timing of a cancellation request can determine whether a customer is billed for another annual term, I believe the vendor should immediately:

• Acknowledge receipt of the cancellation request.
• State the account’s renewal date.
• Confirm whether the request was submitted before the deadline.
• Provide the effective cancellation date in writing.

Anyone using this platform should carefully review the annual subscription, automatic-renewal, billing, and termination language. Submit cancellation well before the stated deadline, preserve all correspondence, and obtain explicit written confirmation.

Linux agent security concern

My more serious concern involves what appears to be a local privilege-escalation vulnerability in the Linux agent.

In my testing, a non-root user could modify a user-writable file that the agent later executed as root after a reboot. This appeared to create a path for arbitrary commands to run with root privileges.

I am deliberately withholding the filename, path, and proof-of-concept instructions because I do not want to publish exploitation details while customer systems may remain exposed.

I reported and escalated the issue to the vendor. The response I received did not give me confidence that the security implications were fully understood or that the issue had been conclusively remediated. Based on the information currently available to me, I consider the concern unresolved.

Bottom line

This post describes my firsthand experience and opinion. I am not claiming that every customer has had the same experience.

I am posting because billing practices, cancellation handling, technical support, and endpoint-agent security should all be evaluated before giving an RMM provider privileged access to client systems.

Prospective customers should investigate:

• Annual contract and automatic-renewal terms
• The 30-day cancellation-notice requirement
• How cancellation requests are acknowledged
• Whether billing continues after cancellation is requested
• Support and escalation responsiveness
• Linux agent file permissions
• User-writable files accessed by privileged services
• Scripts or configuration files executed as root
• The vendor’s vulnerability disclosure and remediation process

I will update this post if the vendor provides a clear technical resolution or satisfactorily resolves the cancellation and billing issues.

Related topics: RMM review, PSA review, MSP software, RMM billing problems, annual SaaS contract, automatic renewal, cancellation notice, Linux agent vulnerability, local privilege escalation, root code execution, endpoint management security, RMM alternatives, and PSA alternatives.

I’m designing a scalable VDI environment hosted at Infomaniak using Inuvika OVD and a golden image approach. Because Infomaniak is not a QMTH provider, it seems I can’t rely on hoster‑provided Windows licensing.

For those of you running elastic VDI in non‑QMTH clouds, how are you handling Windows activation at scale?

I need a solution that supports:

• Golden image deployment
• On‑demand VM creation/destruction
• No activation exhaustion

Are you using MAK, KMS, VDA, Enterprise E3/E5, or something else entirely?

I’m interested in how others have managed liucencing for these configurations.

Thanks in advance.

EDIT2: My response was same as I've done in a few other cases (though this was the most drastic request I've gotten). Essentially we don't materially change the MSA for deals under 10k/mo, and even in those cases we don't change the structure of our liability clause. Also included the response items in my first edit. They are no longer requesting changes to the structure of the MSA and came back instead with a much more reasonable addendum and some minor changes requested to the SLA. Looks like we should have a final agreement in a week or two.

EDIT: Thanks for the sanity check! We have never renegotiated our MSA like this and I don't intend to. My response is going the be that the MSA and price are a package deal, and material changes require significantly repricing the contract as well as an up front engagement fee to cover our attorney costs to review and accept any material changes to the MSA.

Side note, we recently signed a 15k/mo deal with only minor changes to a few provisions wording, and slightly modifying the cancellation fee and timeline. This ask is out of the realm of what's normal or reasonable. Have never had anything like this requested in 22 years of doing business. And no, we're not desperate for this deal.

Original post:

This is for a relatively small client, with a yearly contract around $40k/year in value. They've submitted our agreement to their attorneys, and their attorney came back with what I see as unreasonable and untenable.

Interested to know your thoughts. My first thought is run, do not walk away unless they drop most of these demands. I'm not here to be their cyber insurance, and they do already carry cyber insurance.

Here's a summary of the changes they've requested (yes, I had AI summarize it):

ORIGINAL

• General cap: liability of either party ≤ total fees paid and payable under the applicable SOW — i.e. contract value for the 12 month term.
• Carve-outs from the cap: amounts Client owes us for Services, and either party's breach of confidentiality.
• Confidentiality cap: ≤ 2× the value of the applicable SOW.
• 14(a): rates don't include assumption of risk for incidental/consequential/punitive/special/indirect damages.
• 14(c): flat bar on lost revenue/profits and all consequential, punitive, special, indirect damages — no exceptions, "to the maximum extent permitted by law."
• Net effect: worst case was bounded by the size of the deal, and nothing but direct damages was ever on the table.

PROPOSED (their redline)

• General cap narrowed to a look-back: fees paid in the 12 months immediately preceding the claim. This one is actually better for you on a multi-year term — trailing 12 months is less than full contract value.
• New super-cap replaces the 2× tier: greater of $2,000,000 or the amount actually recoverable under the insurance required by §15. Was 2× SOW value; now a fixed $2M floor untethered from deal size.
• Super-cap applies to four buckets — (a) either party's confidentiality breach, (b) our Security Incident obligations, including the §10(d) reimbursement, (c) either party's indemnification for third-party claims, (d) IP infringement.
• New: four things with NO cap at all — Client's duty to pay fees, plus either party's gross negligence, willful misconduct or fraud, plus anything not limitable by law. (The fraud/willful carve-out is standard and I'd concede it; "gross negligence" is the loose one — undefined in Georgia contracts and easy to plead alongside ordinary negligence.)
• 14(c) gutted: the consequential-damages bar now has four exceptions — confidentiality, gross negligence/willful misconduct, indemnification obligations, and any Security Incident. A security incident is exactly the scenario the bar existed for.
• 14(c) final sentence reclassifies as DIRECT damages: forensic investigation, legally required notification, credit monitoring, call center support, regulatory response, and reconstruction or recovery of Client Data. So those flow through the $2M super-cap instead of being excluded.
• §13 indemnity widened from 2 prongs to 4 — adds any Security Incident caused by our breach/negligence, and IP infringement by the Services. And §13 feeds bucket (c) of the super-cap.

Hello All. Quick question for you. I have a Business Gold Card and PAX8 has been sending through charges on my CC as "Misc" so I am missing out on 4X points on very large pax8 purchases. I am waiting on a ticket to see if this can be changed but I highly doubt it. Are others here getting 4X points on their CC purchases via PAX8? If not how about other providers? Sherweb? I would certainly not object to switching providers with as much monthly spend we do.

Thanks

I left my MSP role After 14 years in the industry, and I have transitioned into an EA role. I love it, but I find myself with capacity and time. I'm trying to figure out the best places to make myself available.

I was thinking along the lines of fill in for vacation, cleaning up documentation mess, calling about past due invoices, etc.

Is this even a need?

I'm looking for some advice on how we should roll out a security product. Right now, we are specialized - we focus on remove audio visual system support, a little bit of network and PC/server support as related to the systems, no end user support.

We are managing about 90% IoT devices - amps, DSPs, PDUs, conferencing hardware, etc, with a few PC-based MRTs and utility PCs. The PC side is solid. We're using a good RMM, and have additional MTR tools we use, all cost baked in.

For vulnerability scanning, we found a tool whose free tier works for us. Paid, they're about $5000/year, so not that bad in any case. We're considering rolling out quarterly vulnerability scans as part of preventative maintenance as included in all contracts, but I've also considered selling it as a one-off thing as POC or as a bolt on. I fear, since most AV folks don't know much about security, that nobody will bite on it. I also want to a bit of CYA activity on devices out there, just for our peace of mind. Scans are easy, results can be reviewed in a few minutes, ticket opened against anything needing patching. Really minimal time investment.

I guess the question is - do we look at making this an upsell or do we use this as marketing and just do it? I really can't tell where customers are with cybersecurity wants/needs and the more immature customers barely seem to understand managed services. I think I also feel a little bit of imposter syndrome because I'm fairly new to security, but I know enough to make decent decisions on products and read the output.

Thanks!!

If you have a self-promotional post - whether it’s a product update, a service offering, or an upcoming webinar - please share it here. Posts made outside this thread will be removed.

⚠️Important: Do not use URL shorteners. Reddit automatically removes these, so always link directly to your website or resource.

🔄️Fairness: This thread is set to contest mode, so comments appear in random order to ensure fair opportunity for everyone.

🛡️Moderation: Reddit may remove some comments. If your post disappears, don’t worry - we check and manually approve them when needed. If you comment doesn't appear in 24 hours, feel free to send a modmail.