Around 150 customers, 4,000 endpoints, and a rollout that was done in half a day. What sounds like a complex IT project was technically implemented quickly at your admins. And what became clear afterwards, too, is this: to anchor vulnerability management sustainably in everyday MSP operations and to drive improvements across all customers, you don't need additional technicians – you mainly need one thing: a clear plan and efficient processes that integrate seamlessly into day-to-day business.
In the webinar, Michel Kulozik, Technical Director at your admins, explains how his team mastered these challenges, why lywand is now part of the standard package, and which experiences he would pass on to other MSPs.
About your admins
your admins has been on the market for around 30 years under the motto "We keep IT simple" and today serves roughly 150 customers. The focus is on the tax advisory sector: the company is a DATEV Solution Partner and Hosting Partner and manages IT environments with 5 to 300 workstations. Around 20 of its roughly 40 employees work in the technical area. your admins uses NinjaOne as its RMM system.
Managed services are not a new business for your admins. The packages were tailored to the needs of tax firms at an early stage. The question therefore was not whether vulnerability management should be introduced, but how it could be sensibly integrated into the existing business model.
The Starting Point: Why an Additional Layer of Control Made Sense
The trigger for adopting lywand was not a sales target but the company's own quality standards. Around 20 technicians at your admins look after several thousand endpoints. At that scale, automated processes can fail to run through completely without anyone noticing right away. Targeted verification is therefore all the more important.
Patch management is a clear example: an update is distributed, but the device is still waiting for a reboot. The signal does not always come through, the patch only becomes active later, and at first glance everything in the dashboard looks done. Such cases usually only come to light when someone checks specifically.
The team's first reaction was entirely understandable: write their own scripts to verify that the agreed services were actually being delivered. That worked in isolated cases but could not be scaled to around 150 customers. This gave rise to a central question that became the starting point for the entire project:
"We need a tool that lets us check: are we actually delivering the work we sell to our customers?" Michel Kulozik, your admins
On top of that come topics that go beyond pure patching: configurations and best practices around cryptography and active directory. At customers who have been supported for years, such settings change over time. This creates misconfigurations that no one leaves in place on purpose. Regular, objective verification creates visibility here.
The Path to lywand: From the MSP Conference to an Independent Assessment
Michel first became aware of lywand at the MSP Conference – organized by Fokus MSP. Previously, your admins had worked with Tenable on a case-by-case basis, but only at customers who already brought the license with them. The team had also looked at the vulnerability scanner integrated in the RMM, but deliberately opted for a vendor-independent solution.
The thinking behind this is not a judgment about individual systems but a question of perspective: those who check their own work may overlook mistakes. Michel uses an everyday analogy: a garage carries out repairs, and the TÜV independently checks whether the vehicle meets the required standards. It is similar in IT operations: the RMM takes care of management and automation, while lywand acts as an independent control instance verifying whether the desired security standards are actually being met.
The Rollout: 4,000 Agents in Half a Day
The technical rollout was straightforward. The team pulled the customer-specific agent keys from lywand, stored them as variables in the RMM, and then distributed the agents to all endpoints by script. Two safeguards were added: a scheduled task so that new machines are automatically equipped with the agent, and a monitoring check that detects missing agents and reinstalls them.
The result: 4,000 agents across around 150 customers. The actual effort amounted to half a day. Anyone who maintains their RMM properly will hardly find this a challenge. However, the technical rollout is not the same as the project: it still takes time before the platform runs smoothly in everyday operations. You try things out, develop scripts, and work through the misconfigurations step by step.
The First Shock and How to Handle a Large Number of Vulnerabilities
After the rollout, the scale of existing vulnerabilities became visible for the first time. Michel describes this moment openly:
"Seeing misconfigurations is never a nice thing. But ultimately you introduce a tool like this precisely to make them transparent and tackle them in a targeted way." — Michel Kulozik, your admins
His advice: take a deep breath and analyze carefully what is actually behind it. The absolute number is rarely the decisive factor. A failed Windows patch quickly affects 600 servers — one lever instead of 600 individual cases.
What matters here is a shift in perspective: the vulnerabilities were already there beforehand. lywand did not change the situation — it made it visible and thereby created the basis for initiating improvements.
The Grading System as a Compass
Instead of frustration, the grading system provides a clear compass: where do we stand across all customers, and which improvements take us to the next level? Michel values this approach because it gives the team a clear direction and makes progress measurable. The goal is not to bring individual customers up to the top grade A while others are still at F. Instead, your admins focuses on improving the worst grades first — from F to E, then to D, and step by step onwards. This raises the security level across the entire customer base.
Recommendations for Other MSPs
Several points can be derived from your admins' experience that make it easier for other IT service providers to get started.
Appoint a responsible person or a small team. This is the tip Michel would put first today. At your admins, this was not a defined process at the beginning. The effort required to get an overview was greater than expected. Depending on company size, a single person or a small group makes sense.
Start with a blueprint at a single customer. Rather than tackling all customers at once, your admins selected one customer with a large number of misconfigurations, worked through AD configurations, patch cycles, and best practices there, and developed a template from it. This blueprint was then rolled out to all affected customers via the RMM.
Think in patterns, not individual cases. A patch missing on 600 servers is one task, not 600. Anyone who addresses first the issues that occur at multiple customers works significantly more efficiently.
Put results into context. Not every measure to remediate a vulnerability is covered by the agreed scope of services. Using lywand's managed services filter, your admins can switch between different views in a targeted way and thus distinguish which measures are covered by existing customer contracts and which go beyond them. This makes it possible to prioritize contractually agreed services and to identify additional improvement potential that opens up further, billable services.
Use the platform as a neutral control instance. While many RMM systems detect vulnerabilities by comparing installed software versions, lywand also checks the Windows registry and the file system. This makes security risks visible that persist despite successful updates — for example due to leftover, outdated DLL files. lywand thus provides an independent control instance that highlights where action is needed.
Sales and Pricing: Why lywand Belongs in the Package
This is where one of the most valuable practical tips from this success story lies. Selling security services individually is, in experience, demanding – especially when there is no acute reason on the customer side. your admins had already made this experience when introducing an EDR solution (Endpoint Detection and Response). With lywand, the IT service provider therefore chose a different approach:
"When we talk about security, we ask ourselves: is this part of our basic equipment? If yes, we include it in our package." – Michel Kulozik, your admins
Lywand was the first security tool introduced at your admins as part of the standard package for every managed computer and server – as part of the service delivered, not as a separate add-on product.
your admins initially bore the cost of lywand itself for a few months. Existing contracts were then moderately repriced, which was well received by customers. The focus is not on marketing lywand as a standalone product: vulnerability management is a fixed component of the managed service package, whose profitability is assessed holistically rather than on the margin of a single tool.
At present, your admins uses lywand primarily for internal quality control and improvement. Regular security checks are part of the standard package. Further use cases are already planned for the future: the reports generated by lywand are to be used specifically, for example, in basic security assessments for new customers or to document security status in the context of cyber insurance. This allows your admins to offer customers additional value while at the same time creating new, separately billable services.
Conclusion: Security Begins with Transparency
The experience of your admins shows that vulnerability management does not have to be an elaborate IT project. While the technical rollout of 4,000 agents took only half a day, the long-term value lies in the continuous quality control and improvement of the managed IT environments.
With lywand, your admins creates the transparency needed to identify vulnerabilities systematically, prioritize measures across all customers, and raise the security level step by step. Integrating it into the standard package ensures that vulnerability management does not remain an optional add-on product but becomes a fixed part of daily service quality.
FAQ
