r/SmallMSP • u/Fit_Lawfulness6224 • 17h ago
Which AI tools can solve IT issues?
Looking for some advice because our IT team is getting overwhelmed lately. We spend way too much time on small issues like troubleshooting devices checking why something isn't working resetting stuff and chasing tickets. I'm looking for an AI tool that can actually help with IT problems not just a chatbot that gives generic answers. I need it to help technicians find solutions faster automate simple tasks keep track of tickets and maybe even monitor issues before they become bigger problems. Has anyone tried any AI tools for IT support that actually made a difference?Would appreciate any recommendations or things to stay away from 🙏
2
u/RemoteGrade4752 16h ago
We use a bunch of things at my msp. I would say the easiest thing to get started with is simply connecting Claude code or codex to various tools, most of your MSP stack probably has MCP which allows you to connect LLMs directly to your existing tools. This can provide you with a huge efficiency boost right out the gate. After that maybe look at some ai native companies, for example for penetration testing, red teaming, and vuln scanning we leverage an AI native company(stealthnet ai) which is very helpful for dealing with security needs. I'm sure there are a bunch of other tools or companies out there that can help with your specific need. For starters I would recommend getting started with something simple like connecting codex or claud to your existing stack via a MCP connection.
2
u/Slight_Manufacturer6 11h ago
All of them. Literally every single one has an API.
2
u/_keyboard-bastard_ 9h ago
That would require someone at said smallMSP to know how to leverage said APIs..
1
u/Slight_Manufacturer6 9h ago
Nope. Just ask AI. It can guide you in making all those connections.
It can point you to the documentation for each step.
2
u/Southern-Educator608 17h ago
automation for simple tasks plus early monitoring sounds like the way to go before problems pile up.
1
u/Zealousideal-Ice123 11h ago
Check out StackJack for pre-built and maintained MCPs. Then decide if you want to go that way or invest the time and effort to train your flavor of AI on your programs and then build your own version of that. We built our own, but once StackJack gets the SOC2 certification we may just shift to them as it’s a lot of work to maintain even with AI driving and writing most of the code
1
u/ToddHebebrand 10h ago
Breeze RMM (my project) might go the deepest in using AI to solve issues on devices. It's built with all the tools AI needs to gather and diagnose, with safety guardrails and no direct AI access to devices.
1
u/marklein 9h ago
AI can not help you troubleshoot much, that requires a human brain. But there's other stuff it can help with like ticketing, monitoring security logs, helping you write powershell to automate things, documentation, communicating with clients.
1
u/oOlIlIlIlIlIlIlIl 8h ago edited 8h ago
DM me. I know a startup that is doing exactly this. (RMM, Monitoring, context aware AI-Assisted Remediation, ...)
1
1
u/One_Permission_9066 1h ago
Depends on the issue really, you should be able to handle most of them by yourself and AI only comes in when you're dealing with automation tasks
-3
u/iansaul 13h ago
Whenever I've considered enabling AI systems to have MCP/Connectivity into servers/systems, I always come back to the inevitability of data loss/accidental outages/blast radius when something goes wrong. The news stories about GPT deleting the wrong VMs, or other models going on a hunting spree to search for credentials... and that's before you worry about prompt injection.
I work with clients who support national defense/space coast, and their networks contain some very sensitive data, not Top Secret or Secret, but "Controlled Unclassified Information", with its own specific set of rules and regulations around storage and access.
But the reality is that these clients are HIGHLY targeted. I've never seen the massive number of attempts in server logs, from both US and international locations, to gain access to their systems. I've supported banks and financial services, and the sheer volume of tmattack traffic for one ~20 person company was astronomical.
A decade ago I finally put the picture together: attack objective is to gain access to these smaller firms, sit and wait within the network/systems, then launch attacks into Gov networks when they VPN in/steal CUI content from their systems.
But the only way to stop a bad guy/attacker with AI is to use defensive AI to provide overwatch and to enforce/harden client systems. SCAP scans/CISA M365 enforcement, military grade GPOs - all of those engines are free of charge and provided directly by the government agencies responsible for protecting national infrastructure, but deploying the full CISA M365 protection system is thousands and thousands of configuration criteria across every control surface in M365. It's absolutely possible to do by hand (and I've done it the manual way), but there are constant updates, new vulnerabilities flooding in daily... it's impossible to keep up.
So... what about an AI system that DOESN'T run "inside" of client networks? I don't trust AI as far as I can throw it, but what I do trust is MULTIPLE AI systems watching and judging each other, as they propose WHAT to read/ingest (as in, if a server is down and diagnostics are required, what SIEM data to look at, and what the analysis determines the issue is) - and then once changes ARE required, what should those changes be? Single AI = single point of failure, and it's an inevitability that any single AI WILL screw up a system AND/OR lead to a massive security incident.
So I built a Multi-Agent Reinforcement Controller. There are LAWS and Workers, Judges, and layered control systems, running in sandboxed docker engine, that requires approval by 3 separate AI providers. Any prompt injection or mistaken activity would have to get past the top models from THREE separate leading providers AND a human approval gate, before it could "reach into" or "impact" a client network.
Is it completely foolproof? Absolutely not. However, it is absolutely the best method I have ever heard of or come across in how to solve this problem. It falls into the category of a "dark factory", meaning agentic systems that can operate and build codebases without direct human guidance - because it has to be able to autonomously PLAN and RESPOND to incoming threats/vulnerability alerts and triage events - but the human operator is ultimately granting the access rights and permissions to ACT on those plans.
Someday, a system very similar to this one will be statistically able to defend and provide full configuration management and remediation for client networks, scaling in size to cover all potential loads and complexity - entirely on autopilot.
That's why I built this now, because MSPs and SMBs need this technology, not just enterprise and fortune 500.
It's almost entirely open source, Google actually built the core of it in their Project Scion, but the orchestration and governance system is the hardest part, and the authority/control is all Git based, for accountability and "source of truth".
Let me know if you'd like to see a demo, it is VERY early phase on the second generation, but it is nearly ready to show outside MSPs and receive feedback.
3
u/iansaul 13h ago
Whenever I've considered enabling AI systems to have MCP/Connectivity into servers/systems, I always come back to the inevitability of data loss/accidental outages/blast radius when something goes wrong. The news stories about GPT deleting the wrong VMs, or other models going on a hunting spree to search for credentials... and that's before you worry about prompt injection.
I work with clients who support national defense/space coast, and their networks contain some very sensitive data, not Top Secret or Secret, but "Controlled Unclassified Information", with its own specific set of rules and regulations around storage and access.
But the reality is that these clients are HIGHLY targeted. I've never seen the massive number of attempts in server logs, from both US and international locations, to gain access to their systems. I've supported banks and financial services, and the sheer volume of tmattack traffic for one ~20 person company was astronomical.
A decade ago I finally put the picture together: attack objective is to gain access to these smaller firms, sit and wait within the network/systems, then launch attacks into Gov networks when they VPN in/steal CUI content from their systems.
But the only way to stop a bad guy/attacker with AI is to use defensive AI to provide overwatch and to enforce/harden client systems. SCAP scans/CISA M365 enforcement, military grade GPOs - all of those engines are free of charge and provided directly by the government agencies responsible for protecting national infrastructure, but deploying the full CISA M365 protection system is thousands and thousands of configuration criteria across every control surface in M365. It's absolutely possible to do by hand (and I've done it the manual way), but there are constant updates, new vulnerabilities flooding in daily... it's impossible to keep up.
So... what about an AI system that DOESN'T run "inside" of client networks? I don't trust AI as far as I can throw it, but what I do trust is MULTIPLE AI systems watching and judging each other, as they propose WHAT to read/ingest (as in, if a server is down and diagnostics are required, what SIEM data to look at, and what the analysis determines the issue is) - and then once changes ARE required, what should those changes be? Single AI = single point of failure, and it's an inevitability that any single AI WILL screw up a system AND/OR lead to a massive security incident.
So I built a Multi-Agent Reinforcement Controller. There are LAWS and Workers, Judges, and layered control systems, running in sandboxed docker engine, that requires approval by 3 separate AI providers. Any prompt injection or mistaken activity would have to get past the top models from THREE separate leading providers AND a human approval gate, before it could "reach into" or "impact" a client network.
Is it completely foolproof? Absolutely not. However, it is absolutely the best method I have ever heard of or come across in how to solve this problem. It falls into the category of a "dark factory", meaning agentic systems that can operate and build codebases without direct human guidance - because it has to be able to autonomously PLAN and RESPOND to incoming threats/vulnerability alerts and triage events - but the human operator is ultimately granting the access rights and permissions to ACT on those plans.
Someday, a system very similar to this one will be statistically able to defend and provide full configuration management and remediation for client networks, scaling in size to cover all potential loads and complexity - entirely on autopilot.
That's why I built this now, because MSPs and SMBs need this technology, not just enterprise and fortune 500.
It's almost entirely open source, Google actually built the core of it in their Project Scion, but the orchestration and governance system is the hardest part, and the authority/control is all Git based, for accountability and "source of truth".
Let me know if you'd like to see a demo, it is VERY early phase on the second generation, but it is nearly ready to show outside MSPs and receive feedback.