MSP Programme
Managed AI VMS as a Monthly Recurring Service
MSPs closing security projects and walking away from the revenue are leaving the highest-margin opportunity in the engagement on the table. Okiff Reflex is designed for remote management at scale — OTA fleet updates that reach every client node from one action, REST API and Webhooks that plug into your existing PSA and RMM toolchain, and RBAC that gives every client a scoped, isolated view of their own infrastructure. The platform you need to turn a one-time security installation into a monthly managed service contract.
One
Management action to push updates fleet-wide across all client nodes
REST API
Full platform integration with your existing PSA and RMM stack
Zero
On-site engineer visits required for OTA patch deployment
Why MSPs undermonetize physical security — and what the managed model changes.
Physical security is the last IT workload that most MSPs treat as a break-fix service. Cameras are installed, NVRs are configured, the client is handed a username and password, and the MSP's involvement ends — until something fails. The support ticket that follows is low-margin reactive work, not a scalable managed service revenue stream.
Two structural barriers have historically prevented MSPs from offering managed VMS as a recurring service:
Legacy NVR platforms are not built for remote management at scale. Managing 30 client NVR installations means 30 different login sessions, 30 manual update procedures, and 30 independent alert streams that do not aggregate into a unified operations view. The operational overhead of managing a legacy NVR estate across clients makes recurring managed VMS economically unviable.
Cloud VMS platforms exclude MSPs from high-value verticals. Healthcare, legal, finance, and government clients — the highest-value accounts in most MSP portfolios — are increasingly declining cloud VMS on data residency and sovereignty grounds. An MSP that can only offer cloud VMS cannot serve these clients with a premium managed surveillance product.
Okiff Reflex for MSPs: the remote management platform that makes managed VMS scalable.
Okiff Reflex is engineered for multi-tenant, remotely-managed deployment from the ground up. Every operational function an MSP performs across a client fleet — patching, monitoring, alert triage, footage access, configuration change — is available via the management dashboard and REST API without an on-site visit.
Three capabilities that define the MSP operating model on Okiff Reflex:
Déploiement OTA automatisé et sécurisé sur l’ensemble des nœuds
Fleet-Wide OTA Management. Software updates, AI model refreshes, and security patches deploy to every client node simultaneously from a single management action in the Okiff Reflex console. The MSP initiates the deployment; each node authenticates the cryptographically-signed package and installs autonomously. Per-node deployment status is visible in the management dashboard in real time. No engineer dispatch. No per-client update window coordination.
Gestion multi-client sécurisée avec contrôle d’accès par rôle
Multi-Tenant RBAC Isolation. Each client's Okiff Reflex instance is fully isolated — separate data, separate alert streams, separate footage access — under the MSP's unified management console. Client administrators see only their own infrastructure. MSP operations staff see fleet-wide telemetry across all managed clients. RBAC is enforced at the infrastructure level, not by policy configuration that can be misconfigured.
Intégration native PSA/RMM via API REST et Webhooks
PSA and RMM Integration via REST API and Webhooks. All Okiff Reflex platform events — AI detection alerts, node health telemetry, storage utilization, camera stream status — are available as structured JSON payloads via REST API and Webhooks. Your existing PSA (ServiceNow, ConnectWise, Autotask) receives Okiff events on the same webhook infrastructure as your other managed service workloads. Alert escalation, ticket auto-creation, and SLA tracking work with the same toolchain you already operate.
MSP Service Tier Design
Surveillance Base
Remote fleet monitoring, OTA patching, camera health alerts, footage access via MSP console
Target Client : SME clients, single-site deployments
Surveillance + AI Detection
All Base capabilities + AI event alert management, Rules & Events configuration, monthly AI event report
Target Client : Multi-site clients requiring proactive AI monitoring
Sovereign Surveillance Pro
All AI Detection capabilities + Evidence Manager export management, compliance documentation support, dedicated client RBAC portal
Target Client : Regulated verticals: healthcare, finance, government
Okiff Reflex in MSP-managed deployments.
SMB-Focused MSP, 45 Managed Clients
An MSP managing IT infrastructure for 45 SMB clients adds Okiff Reflex to its managed security stack. Thirty-one clients have existing IP camera infrastructure — the Router Agent connects all existing cameras without hardware replacement. The MSP's RMM platform receives Okiff Reflex node health events via Webhook. A security patch affecting 38 deployed nodes is pushed fleet-wide in one console action — completing within 90 minutes without a single client call or site visit. Monthly recurring revenue from the Okiff Reflex managed surveillance tier adds predictable margin to a previously project-only security revenue line.
Regulated-Vertical MSP, Healthcare and Legal Clients
An MSP serving healthcare and legal clients has been unable to propose cloud VMS due to client data residency policies. Okiff Reflex on-premise deployment allows the MSP to offer a premium "Sovereign Surveillance Pro" managed tier — footage stays within each client's own server infrastructure, with MSP-managed remote administration. The managed tier includes monthly compliance documentation export (GDPR and HIPAA alignment) generated via Evidence Manager. Client contracts are signed at a higher monthly rate than any cloud VMS offering the MSP previously proposed.
MSP Offering AI Event Monitoring as a Managed SOC Service
An MSP builds a physical security monitoring service using Okiff Reflex as the underlying VMS platform. Client AI detection events (perimeter breach, fall detection, fire and smoke) are routed via Webhook to the MSP's 24/7 SOC. The SOC dashboard aggregates events across all client deployments in a unified Rules & Events view. SLA response times are tracked per event type per client. The MSP bills for verified AI event responses — not for passive camera recording — positioning the service as outcome-based managed physical security.
FAQ
an an MSP manage multiple client Okiff Reflex deployments from a single console?
Yes. The Okiff Reflex MSP management console provides a unified fleet view across all managed client nodes — with per-client RBAC isolation enforced at the infrastructure level. Fleet-wide telemetry, per-client drill-down, and per-node OTA update management are all accessible from one authenticated session.
ow does Okiff Reflex integrate with existing PSA platforms like ConnectWise or ServiceNow?
The REST API and Webhook infrastructure delivers all Okiff Reflex platform events as structured JSON payloads to any configured HTTP endpoint. Standard webhook authentication (HMAC signing) is supported. ConnectWise, Autotask, and ServiceNow integrations are supported via standard HTTP event collection — no proprietary middleware required.
What is the MSP billing model for Okiff Reflex?
MSPs pay a monthly per-node platform licensing fee at MSP partner pricing. Client billing — rate, interval, and service tier definition — is entirely at the MSP's discretion. Okiff does not have visibility into or involvement in the MSP's client pricing.
an MSP clients access their own Okiff Reflex portal independently?
Yes. RBAC supports a client-facing portal access tier — scoped to the client's own cameras, alerts, and footage — without access to the MSP's fleet management console or any other client's data. Client portal access credentials are provisioned and managed by the MSP.
How does OTA update deployment work when a client node is offline?
OTA update packages are queued for offline nodes and delivered automatically when the node re-establishes connectivity. The MSP management console shows per-node update status — including "pending reconnection" status — so the MSP can identify and address persistently offline nodes without manual fleet checking.
Physical security managed services that scale with your client portfolio
Join us and make your company a better place.