Many vulnerability products were designed for one company with one security team. MSPs use them anyway, and pay for it in rebuilt settings, noisy alerts and agents that quietly stop reporting. If you are choosing tooling for a managed service, judge it on four things first: true multi-tenancy, agents that keep reporting, rollout through your RMM and a way to organise many clients without starting again each time.

I'm Richard Daly, Partner Lead for the UK and Ireland at Nanitor. This is the fifth post in a series on what stalls MSP vulnerability management. The first post covers all five problems. This one is about the tools.

What does multi-tenant need to mean for an MSP?

It means one platform, many clients, each kept apart. You should see every customer's security posture in one place and still be able to look at a single client without the others in the way.

Test it with three questions:

• Can I see all clients together and each one on its own?
• Can I group assets by customer without a spreadsheet?
• Does adding a client take minutes, or a project?

Nanitor is a SaaS-based, multi-tenant platform with a global view of every customer's security. For MSPs, the asset list supports viewing assets by customer.

Why does a silent agent hurt more than a noisy one?

A noisy tool wastes your time. A silent one gives you false comfort. When an agent stops reporting, the device looks clean because nothing is being said about it.

So the tool has to tell you when a device goes quiet. Nanitor's asset inventory flags devices that are unmonitored, have stopped reporting, or still report after being decommissioned. It also finds devices on the network that have no Nanitor sensor at all, which is where blind spots usually start.

How should agent rollout work in an MSP?

Through the RMM you already run. Rolling agents out by hand, client by client, does not scale.

Nanitor integrates with NinjaOne to deploy agents at scale, and vulnerability and exposure insights can appear inside NinjaOne next to device data. The Datto RMM integration uses Datto's deployment and scripting features to install agents in a few clicks, with coverage meant to follow devices as they are added to or removed from the RMM.

Each agent sends back configuration, vulnerability and exposure data. Nanitor then shows agent status and security posture for all customers in one view.

How do you organise many clients without rebuilding settings?

With labels. Assets can be tagged automatically by rules, such as hostname patterns, subnets, platforms or directory units, or tagged by hand. Labels can carry a criticality rating, so a client's domain controller outranks its guest Wi-Fi without anyone re-ranking it each month.

Set the rules once per client. After that, new devices pick up the right label as they appear.

What should you ask before you buy any tool?

Take this list into every vendor conversation, ours included:

• Is multi-tenancy built in, or bolted on?
• How will I know when an agent stops reporting?
• Can I deploy through my RMM?
• Does it find devices that have no agent?
• How does it rank findings for each client?
• Can I give a client a report without giving them a login?
• What does it cost to run, not only to buy?

Advania replaced a vulnerability tool that was complex, costly and never became usable after two years of effort. Its case study says Advania now has real-time visibility across client environments that it did not have before.

The right tool is the one your engineers actually keep running.