One service workflow across different customer stacks
Bring customer controls, exposure, fixes, evidence, and open work together even when customers use different EDR, identity, firewall, backup, cloud, and ticketing platforms.
Managed service providers
Turn repeatable security operations into a higher-value managed service.
VitalSec gives MSPs one way to work across customer environments: see what is happening, prioritize important work, carry out fixes each customer has approved, check the result, keep the proof, and measure the change. The customer keeps its stack and control over what can be changed. You get a more repeatable service and a stronger offer.
A repeatable managed service
Scale the service without making every customer a custom project.
VitalSec lets an MSP deliver the same security workflow across customers that use different tools, without forcing them onto one security stack.
Approved actionFresh checkCustomer proof
Customer ATheir tools.
Their permissions.
Their permissions.
Their evidence and results.
Customer BTheir tools.
Their permissions.
Their permissions.
Their evidence and results.
Customer CTheir tools.
Their permissions.
Their permissions.
Their evidence and results.
Repeat the service. Keep permissions and evidence with each customer.
Managed remediation customers can verify
Prioritize material work, carry out only actions the customer approved through Rusty and connected systems, check the environment again, and keep evidence that the fix worked.
Proof of value for account teams
Bring current evidence, completed fixes, unresolved work, and risk movement into QBRs and renewals without reconstructing the service history from tickets and slide decks.
Higher-value services without rip-and-replace
Package continuous assurance, vulnerability closure, control testing, insurance readiness, and evidence-backed reporting around tools customers already own.
Managed-service workflow
Use one delivery method across customers while keeping every customer separate.
VitalSec gives an MSP a repeatable way to bring in customer evidence, prioritize work, carry out approved fixes, verify the result, and keep proof. Each customer keeps its own tools, permissions, data, and evidence.
How the service works
Systems already in place
Customer environments
Keep the stack already in place.
EDR / XDR
Identity / MDM
Firewall / SASE
Backup / recovery
Cloud
PSA / ticketing
How work gets done
How the service runs
Observe → Decide → Act → Validate → Prove → Measure. Use the same process across customers without forcing them onto the same stack.
01
Observe
Bring together current controls, exposure, endpoints, identities, and evidence from the customer's existing systems.
02
Decide
Put important customer work ahead of low-value ticket volume and determine which actions the customer has permitted.
03
Act
Use Rusty and connected systems only for actions the customer has approved.
04
Validate
Check the environment again, retest the relevant condition, and determine whether the correction actually held.
05
Prove
Keep the original evidence, approved action, retest, observed result, and unresolved work attached to the customer record.
06
Measure
Update risk direction and the customer view so the service can show whether risk actually moved.
What the customer gets
What the MSP can sell
Show customers what was fixed, what was verified, and what still needs work.
Continuous control assurance
Vulnerability closure
Verified endpoint remediation
Insurance and renewal readiness
QBRs backed by current proof
Measurable risk improvement
Customer separation
The workflow can be shared across customers. Customer identities, permissions, telemetry, evidence, remediation scope, and results stay separate for every customer.
MSP versus MSSP
Same customer boundaries. Different service.
MSP
This pageA more repeatable managed service
Use one consistent process to find, fix, verify, report, and renew security work across customers that may use very different technology stacks.
Consistent service across customers
Delegated remediation
QBR and renewal proof
Broader managed-service packaging
MSSP / SOC
Carry the work past detection
Carry detections and investigations through approved response, remediation, retest, evidence, and measurable change in customer security state.
Detection with customer context
Response and remediation
Adversarial validation
Measured security improvement
Service catalog
What you can actually package and deliver.
Turn security operations into managed services backed by current evidence and results customers can see.
Continuous control assurance
Keep critical control state current and surface drift before the next quarterly review.
Vulnerability closure
Use VUMA to prioritize material exposure, track remediation, retest, and preserve closure evidence.
Control testing
Use CAAT to test whether expected controls are actually present and functioning, not merely documented.
Endpoint fixes
Use Rusty and connected platforms for approved fixes, then check the endpoint again to verify the change worked.
Insurance readiness
Keep current evidence available for renewal, underwriting questions, carrier review, and claims support.
Customer assurance reporting
Give customers Evidence Continuity evidence and Risk Compression Index movement instead of a manually reconstructed slide deck.
How VitalSec closes the work
Observe → Decide → Act → Validate → Prove → Measure.
Observe brings in current evidence. Decide prioritizes the work. Act carries out an approved fix. Validate checks the environment again before VitalSec keeps the proof and measures the result.
Observe
Read the customer's endpoint, identity, network, backup, cloud, security, and workflow evidence and establish what is true now.
Decide
Compare the current evidence with what should be true, put material work first, and stay within the permissions the customer has granted.
Act
Carry out the approved correction through Rusty or a connected system without giving the MSP unrestricted access to customer systems.
Validate
Read the environment again, retest the relevant condition, and determine whether the correction actually worked.
Prove
Keep the original evidence, approved action, retest, follow-up evidence, and unresolved work attached to the customer record.
Measure
Update risk direction and the customer view so the MSP can show whether the service changed what mattered.
Works with the customer stack
You do not have to force every client onto the same tools to deliver the same service.
VitalSec reads data and uses approved action paths from systems already in place, then keeps the follow-up evidence tied to the customer.
EDR / XDRIdentity / MDMFirewall / SASEBackupCloudSIEM / SOARPSA / ticketingExposure management
See integrations Customer separation and permissions
Each customer stays separate inside the MSP workspace.
Each customer's data, permissions, approved actions, remediation history, and proof stay tied to that customer.
Separate customer state
Approved action only
Customer-specific evidence
Traceable remediation and verification
Business case
A more repeatable service with outcomes customers can see.
Make the service easier to value at renewal and expansion time with results customers can see, instead of asking them to infer value from activity and ticket volume.
Less swivel-chair work
A common process means less time jumping between tools just to understand what is happening.
Less reporting labor
Current proof and remediation history reduce manual QBR, audit, and renewal preparation.
More repeatable delivery
The same service workflow can scale across customers without forcing a common underlying security stack.
More visible differentiation
Verified results make the value of the service easier to see at renewal and expansion time.
Proof customers can use
At the QBR, show what changed and how you know.
Show current evidence, completed remediation, unresolved exceptions, control-test results, and Risk Compression Index movement instead of leading with ticket counts and alert totals.
Evidence Continuity evidence tied to the customer record
VUMA and CAAT closure evidence
Risk Compression Index movement over time
Renewal and claims-ready evidence when needed
Research & white papers
Related research
Selected PatientLock papers on the issues covered here.
White paper
Delegated Authority Under Continuous Control
A practical architecture for delegated cyber operations in which MSPs can work at scale without collapsing customer authority, evidence, or auditability.
Central argument
Managed services work best when the provider can act at scale while each customer keeps clear authority boundaries and independent evidence of what happened.
Written for: MSP leaders, service operators, customer IT leaders, and managed-service governance teams.
White paper
Proving Managed Security Outcomes Across Customer Tenants
A service-delivery model that measures verified customer outcomes instead of relying on ticket volume, activity reports, or provider-controlled assertions as final proof of work.
Central argument
Managed providers should be able to show each customer what was observed, what action was authorized, what changed, and whether the result held without mixing customer authority or evidence across tenants.
Written for: MSP executives, service-delivery leaders, account teams, and managed-service customers.
White paper
MSP Remediation Proof and Customer Accountability
How MSPs can move beyond ticket closure using delegated-action records, resulting-state verification, governed exceptions, and remediation receipts.
Central argument
Managed remediation is more accountable when the provider can prove the state before action, the authority under which the action ran, and the resulting customer state after the change.
Written for: MSP operations leaders, service managers, customer success teams, and IT leaders.
White paper
Scaling Cyber Operations Without Collapsing Tenant Boundaries
A multi-tenant operating model for MSP automation using customer-specific least privilege, local policy gates, shared remediation recipes, and evidence isolation.
Central argument
The economic promise of an MSP platform is shared operations at scale. The security requirement is that shared operations never erase the data, authority, or evidence boundary of the individual customer.
Written for: MSP CTOs, platform leaders, security architects, operations executives, and enterprise customers.