What a Security-First MSP Needs Before Rolling Out AI Support

Peter Vasilion runs the IT side of a 30-person company. His IT team is five people. The rest of the company works across other disciplines, including a digital side that builds products for clients. On the IT side there's no fixed vertical. Clients include a large nonprofit and a property management company, and the team often comes in to take over from a client's previous IT provider.

At the interview in late 2025, the team was in Flamingo's first beta cohort. They hadn't deployed OpenFrame to any client. The next step was to spin it up on virtual machines and test it on lab hardware that's off the network.

This page is about the bar a careful MSP sets before AI support goes near a client. Peter knows the jobs he wants it for: faster answers for clients, notes and time that get logged, and less back-and-forth on vague tickets. He sees Mingo, OpenFrame's technician copilot, as "an orchestrator of tasks and services". In his rollout plan, Fae, the agent on client machines, becomes the first place a user goes for help.

Peter frames his biggest question around service, not tools: "My biggest question is how do I provide better service to my customers to get parity with kind of how they interact with the world in general." His clients get instant answers everywhere else and expect the same from IT. "They are like, hey, I want an answer now."

Two daily time sinks stand in the way. The first is admin: "Realistically, our biggest challenge any day of the week is just getting our techs to put notes and time in." The second is first-pass triage. A ticket arrives saying "my computer's running slow" or "I have an email question", and someone has to go back and ask what that means. "We spend a lot of time asking people for more information, like doing triage, initial triage."

User changes add more work. When someone joins or leaves a client, the change has to cascade into other directories. Offboarding is a checklist job, and in his words, "humans don't remember to check all the boxes."

Every new tool also has to clear his security bar. He won't deploy a beta product into production for existing contracts. It goes into a test environment first, on lab hardware that's off the network, so the team can check everything for its clients. His hurdles are practical: how easy it is to deploy, how easy it is to remove, what logging and telemetry it gives, and how it handles security.

Peter's team joined the OpenFrame beta in the first cohort and runs it as an evaluation, not a rollout. The test he cares about most is a simple one: "I want to give it to an L1 and have the L1 be able to just deploy it in a test environment." Install and uninstall need to work as well as everything else. At the interview, the next step was VM testing on lab hardware that's off the network.

He's specific about where AI fits. On notes, he expects AI chat to help "a little bit", because chats get logged to the tickets they belong to. On triage, he expects Fae to pull telemetry off the machine, such as CPU load and memory, so a "running slow" ticket comes with the reason attached. The other half is asking the user to clarify. He asked for screenshots taken with the user's permission, with sensitive data blurred and the image kept for only a day or two. These are his requests, not features his team had used.

He has already planned how he'd introduce Fae to clients. A chat assistant shows up on their machine. It answers questions about their computer and works with them to gather what the team needs to service the ticket quickly. In his words, Fae "might even be able to just take care of the issue for you."

For Mingo, he sees a bigger role: "an orchestrator of tasks and services." His team already uses N8N. He wants Mingo to fire a webhook into a workflow there, for example to offboard a user, then hear back when it's done and update the ticket status. Of even a basic webhook integration, he said: "It'll allow us to extend pretty deeply." He also asked about scheduled offboarding, and identity verification before sensitive changes, such as a new forwarding rule on the president's mailbox.

At the interview in late 2025, Peter's team had no client results to report, and he didn't claim any. They were in the first beta cohort. OpenFrame wasn't on any client machine yet, and the next step was lab testing on virtual machines, off the network.

What the evaluation produced was a clear checklist. His hurdles come down to four questions: how easy OpenFrame is to deploy, how easy it is to remove, what logging and telemetry it gives, and how it handles security. He has also named the jobs he wants AI on: notes and time, first-pass triage, and user offboarding.

What he still wants, framed as polish: more documentation on security and on how the platform is deployed in the cloud, deploy and remove simple enough for an L1, Fae screenshots with permission, blurring and short retention, a text-message path when a user's internet is down, Mingo webhook calls into workflows like N8N, scheduled offboarding, identity verification for sensitive requests, and a mobile app.

What he expects next: once clients meet Fae, he expects it to become their first contact, gathering the details his team needs and sometimes fixing the issue before a tech picks it up. On notes, he expects AI chat logging to help "a little bit".