Stop onboarding surprises. Start proactive MSP intelligence.

Onboarding Assessment

The day-one report that fuses the estate's analysers into the hidden issues a new client never mentioned - compounding device risk, fleet-wide analyser failures, exposed-and-unhealthy machines - with a rolling weekly diff and compliance posture. Deterministic scoring, no LLM on the hot path.

Unrecognised-binary detection

Executables from every install location and user profile on Windows, and the standard binary paths on Linux and macOS, hashed and checked against the NIST National Software Reference Library. The custom, in-house and novel binaries that match nothing known lead each weekly scan - the ones in user-writable paths first. A throttled agent scan; read-only intelligence, never a verdict.

Discuss-and-Override

Findings you can argue with. When a finding is benign - your own admin tool, a dev box's open ports - accept it in two clicks, one scanner detection at a time or the whole analysis, or just tell the AI in chat. The score is recomputed from what remains, every override is audited, a whole-analysis accept is one click to undo, and new findings still alert.

Root-cause investigation

A finding tells you what is wrong; an investigation works out why. A tool-using AI agent walks event timelines, baselines and live osquery, then reports probable cause, evidence and the next action - one click, or automatically on fresh critical findings up to a daily cap per client.

Describe the problem. Get the answer.

Some problems arrive as a phone call, not a finding: the practice software has crashed ten times since the vendor reinstalled it. Open a case from the device chat in your own words, add when it started and attach the logs or a screenshot of the error, and it is investigated in the background on our strongest model while you get on with the day. It reads the machine's crash reports, reliability timeline, event logs, services and SQL Server's own error log, correlates them, and posts the cause and the next action back into the chat. Read-only, always: it can look at everything and change nothing. You see the ceiling before it starts and pay for what it actually used, and if you run Zammad it can open the ticket for your client and keep its findings as internal notes for you.

On one page, for the people you work with: the PDF

Patch posture, every OS

Windows, Linux and macOS - pending and security updates, end-of-life operating systems, and whether the update machinery itself works. A box that can't patch is the finding, not a footnote. Read-only intel; your RMM still does the patching.

Remote control, Windows and Linux

Full desktop control from the browser - no VPN, no inbound firewall rules at the client, no second product. Linux desktops are captured through the compositor itself, so there is no consent dialog to click on a machine nobody is sitting at. Change-driven capture stays light on the endpoint, switching between monitors is one click, a locked Windows machine shows its sign-in screen and takes your Ctrl+Alt+Del, and every session lands in the audit log under an always-on-top banner the user cannot close.

Live terminal, every OS

A real PowerShell or bash session in the browser, running as SYSTEM or root on any online device running the agent - operators only. Credentials are scoped to a single session and expire on their own after 30 minutes, and every session open is audited. Investigate a finding and fix it in the same minute.

Ask a machine how it feels

Answers with charts, not essays. Ask how the CPU has behaved and the stored samples are drawn rather than described. Ask what is happening right now and the agent watches the box for ten seconds, charts CPU, memory, network or disk - throughput, IOPS and queue depth - and names the processes responsible. Ask what the link is actually doing and it measures download, upload and latency from the endpoint itself. Every one of them reads. None of them write.

Live AI chat & monitoring

Ask about any device, group or organisation and get streaming AI answers over that level's full analysis history. In a device chat it can also propose accepting findings as expected risk: you tick which, and the health score is recomputed from what remains. Open the live monitor and CPU, memory, disk and network stream from the agent about every two seconds; the rest of the time a lighter baseline rides the heartbeat.

Event forecast

Predict which Windows events fire in the next 24 hours and 7 days - pure statistical analysis of 30-day archives, zero AI cost, with confidence from scheduled to sporadic.

Honey accounts

The one finding that is not an inference. Create an account whose only purpose is never to be used - disabled, or holding a long random password - and tell Wegweiser its name. Nothing legitimate ever authenticates as it, so a logon event naming it is not a probability score, it is somebody working through credentials they should not have. The agent matches on the endpoint against the Windows security log it already reads, so nothing about your directory leaves the machine and Wegweiser has no write path into it - it never creates the account. Windows event logs are collected once every 24 hours, so a trip surfaces within a day rather than within minutes; we would rather say that than imply a speed we do not have.

Community feeds, in the deeper sweep first

Your catalogue is not only ours. YARA-Forge, which aggregates 45+ vetted public rule repositories, is pulled weekly and indexed alongside our own detections. Community rules feed the deeper sweep before the daily one, on purpose: a detection nobody has watched yet can fire on every machine you manage, and an untested rule costs you more than it finds. They earn the daily pass rather than arriving with it.

Retrohunt

Detection that reaches backwards. When a sample is newly published as malicious, its hash is matched against the binary inventory already collected across your fleet - so a file that was unknown the day it landed is still found the day it becomes known. Hits land in the threat-hunting view like any other detection.

A headline that names software searches your estates

When a headline or a new flaw names software, the security briefing turns it into a probe: it searches every client's machines for the names that software installs under, reads the versions against the fixed releases, and asks the machines themselves every six hours over live osquery. The Threat response card names what runs where, which versions sit below the fixed releases, and what the live check heard. It says installed, never vulnerable, and it never alerts.

The facts only a human has

An analysis reading perfectly true telemetry still called a development desktop a production photo server, because the missing input was never more telemetry. Leave one note on a device, group, organisation or tenant - what it is for, who owns it, what is deliberate - and every check that looks at that thing reads the same fact. Attributed, dated, and inherited downward the way exclusions already are.

It checks its own readings

A finding that fires wrongly gets noticed. A check that has stopped measuring and still writes a plausible score does not, and it is the more dangerous of the two. Wegweiser audits its own numbers: a score computed from a sample of nothing, a payload stored in a shape the rest of the fleet does not use, a score that has not moved for several runs while the data underneath it has. The first pass over our own estate found eight machines carrying hardening scores between 58 and 66 whose own reports said zero tests had been performed. These never count against a device's health - a broken instrument is not a sick patient, and conflating the two is the mistake that makes the whole number worthless.

Explain it, then dismiss it once

Ask the AI why a rule fired and get the matched file, the rule's provenance and a plain-English read. If it's a false positive, mute it once and it applies to every device that matched in the window you're viewing - and once enough endpoints reject the rule, it's dropped from the packs entirely.

Client uptime monitoring

Watch the services a client actually notices - web, mail, VPN endpoints - with per-organisation monitors and keyword checks. Outages are re-probed independently before anyone is paged, then alert down the same Slack, Teams and webhook channels as everything else, with a recovery notice when it clears.

A staff list, not one invitation at a time

Onboarding a client with a hundred staff meant opening the invite dialog a hundred times. Upload the list, see exactly what will happen before it does, confirm: invitations go out with a role for each person. Two roles and no more, deliberately - the platform-wide role is granted in the database and never from a spreadsheet.

Passkey sign-in

Phishing-resistant login with WebAuthn passkeys - Touch ID, Windows Hello or a hardware key - alongside TOTP two-factor and single-use backup codes.

Report Centre

Generate a device, organisation or tenant PDF on demand, and have the organisation or tenant report e-mail itself weekly or monthly. Plus a plain-English client QBR, a device-inventory CSV per organisation, and a searchable archive of every PDF you produce.

The whole practice on one page

Your estate in the same chapters as a client page: health and ninety days of trends at every level, every client worst first, and a weekly reading of what repeats across them, built up from each machine's own. Ask the assistant across the whole tenant from the same bar.

Slack / Teams / webhook alerts

Critical findings land in your workflow - Teams, Slack, e-mail, or a ticket-shaped webhook your PSA ingests. Sign generic-webhook deliveries with an HMAC secret, and test any channel in one click.

Your helpdesk and your RMM

Zammad reads its own organisation list into Wegweiser so nobody retypes a hundred and fifty client names, then files findings back as tickets - a used honey account, a drive reporting its own failure, a malware detection the analyser agreed was real, a device falling through a health threshold. One open ticket per device per condition rather than one per event, updates appended to it only when there is something new to say, and once your people close a ticket Wegweiser never touches it again. Off for every organisation until you switch it on, with a dry run that shows what a real run would file. A case can open its own ticket too: your client sees a plain statement that the investigation is under way, and the findings arrive as internal notes for your team. Kaseya VSA 10 gets the health score, status and a link back written onto each matched device.

Agents that keep themselves up to date

Four agent versions across an estate is how a fix reaches some machines and not others. Every release reaches our own fleet first, and yours a day later once it has run there cleanly, spread over hours so a bad build can be stopped before it reaches everyone. Each install is signed, verified and proven with a real round trip before it counts, and an endpoint that cannot prove itself puts its previous version back on its own. You can pin a version or pause it, and any single machine can refuse.

Share-with-client links

Hand a client a tokenised read-only health view - no login, no chat, no internal IDs - revocable any time.

Seven frameworks, and you pick which

Findings carry the controls they materially evidence: CIS v8.1, ISO/IEC 27001:2022 Annex A, NCSC Cyber Essentials, NIST SP 800-53 Rev. 5, and - for German clients - the BSI IT-Grundschutz-Kompendium, NIS2 as § 30 Abs. 2 BSIG, and DIN SPEC 27076, the BSI CyberRisikoCheck. A German house is not shown British Cyber Essentials just because it exists; each tenant chooses its own set, seeded by the language its analyses are written in. A hand-maintained, deliberately conservative mapping, not AI guesswork - and a test fails the build if any check is neither mapped nor explicitly recorded as evidencing nothing. Orientation for an audit, not a certificate.