See Command run your operation
Run Command on your own endpoints in a free 30-day pilot, or book a guided walkthrough of service delivery, endpoint management, and security operations.
Simple where you want it. Powerful where technicians need it.
Command unites your service desk (PSA), projects, RMM, cybersecurity, and IT documentation in one operating platform for MSPs.
Works with Microsoft 365, Microsoft Defender, Google Workspace, QuickBooks Online, Pax8, Sherweb, and the AI provider you choose.
Our products
- MSP operations and security
Command
The MSP operations and security platform, for every client you manage.Includes:Service desk (PSA)RMMEDR and DNS filteringIT documentationMicrosoft 365Response Ops - Billing and finance
Accord
Billing and finance for MSP owners: Pax8, Sherweb, and QuickBooks reconciled per client, with changes you approve.Includes:Owner dashboardReconciliationClient bookInvoicesApproval inboxProcurement review - Security scanning
Vulnerability Scanner
In developmentVulnerability scanning for the infrastructure you manage, built as its own tool that connects to the Command service desk.Planned:External domain scansEndpoint scanningPer-site scopingFindings sent to the service desk
Founding partners run Command free for 30 days.
A free pilot on up to 50 endpoints, with guided onboarding and a product walkthrough. Founding partners then get 40% off for 12 months, with the rate locked.
One alert, worked end to end
A Sentry EDR alert on a client laptop, from detection to an isolated endpoint, without leaving Command. Choose any step to look closer.
Aegis / Sentry EDR / Alerts
HighSentry EDRToday 09:41:07
Suspicious process reparenting on FIN-07
- Client
- Arbor Logistics
- Endpoint
- FIN-07, Windows 11
- User
- m.lopez
Process chain
WINWORD.EXEopenedInvoice_0412.docmpowershell.exe -nop -w hidden -enc JABzAD0ATgBlAHcA…- Moved under
explorer.exeto hide its parent
Service Desk / SOC / TKT-0031941
TKT-0031941OpenHighCreated 09:41
[New alert] EDR HIGH: Suspicious process reparenting on FIN-07
- Client
- Arbor Logistics
- Queue
- SOC
- Source
- Sentry EDR
- Endpoint
- FIN-07
- User
- m.lopez
- Assigned to
- PNPriya N.
TKT-0031941 / Command AI
Evidence Observed
- Windows monitoring14 events on FIN-07 in the last hour
- Aegis, Microsoft 365m.lopez signed in from a new country at 08:52
- Ticket history1 earlier ticket from m.lopez this month
Assessment AI
Likely a malicious document. Contain FIN-07 before m.lopez signs in again.
Suggested action Needs a technician
Isolate FIN-07 via Overwatch
Command AI runs only for clients that switched it on, on the AI provider you connect.
TKT-0031941 / Isolation request
PNPriya N. requested isolation of FIN-07 at 09:44. A second technician has to approve it.
Approve isolation of FIN-07?
FIN-07 will be cut off from the network.
Type FIN-07 to confirm
FIN-07
TBTom B. approving
Overwatch / Endpoints / Arbor Logistics
| Endpoint | OS | Status |
|---|---|---|
| FIN-07 | Windows 11 | OnlineIsolated |
| FIN-03 | Windows 11 | Online |
| FIN-11 | macOS 15 | Online |
TKT-0031941 timeline
- Sentry EDR alert opened the ticket
- Command AI suggested isolating FIN-07
- Priya N. requested isolation
- Tom B. approved with the typed hostname
- FIN-07 isolated
What makes Vigil Glass different
In development since 2025, and in daily use for over a year at our founders’ MSSP: real clients, real endpoints, real alerts. The MSSP is a separate company. About Vigil Glass
One console for the whole operation
Service desk, RMM, endpoint security, Microsoft 365, and IT documentation in one place, for every client you manage.
Service desk and SOC tickets share one board. Switch between them on the right, or see both.
| Ticket | Client | Source | Subject | Created |
|---|---|---|---|---|
| TKT-0031945 | Aster Dental | Phone | Front desk printer is offline | 2m |
| TKT-0031942 | Verity Insurance | Cloud Alerts | [New alert] M365: Impossible travel sign-in — j.chen | 4m |
| TKT-0031944 | Cobalt Systems | Laptop setup for a new hire on Monday | 9m | |
| TKT-0031941 | Arbor Logistics | Sentry EDR | [New alert] EDR HIGH — Suspicious process reparenting on FIN-07 | 11m |
| TKT-0031943 | Arbor Logistics | Portal | Access to the dispatch shared mailbox | 18m |
| TKT-0031940 | Verity Insurance | Cloud Alerts | [New alert] M365: BEC inbox rule — a.patel | 26m |
| TKT-0031938 | Atlas Clinic | Chat | VPN keeps disconnecting at the clinic | 41m |
| TKT-0031939 | Cobalt Systems | M365 Security | [New alert] M365: MFA disabled on account — it.admin | 48m |
| TKT-0031937 | Aster Dental | Technician | Replace the failing drive in RECEPTION-PC | 1h |
| TKT-0031936 | Atlas Clinic | Sentry EDR | [Web Protection] Blocked phishing domain — WS-103 | 3h |
AI you control
Command AI runs on the AI provider you connect, and Response Ops calls it to help triage and investigate. Pick an incident on the left to see what it found.
- Your provider: Anthropic (Claude), OpenAI, Google, or a self-hosted model
- Off for each client until an administrator switches it on
- Never takes a privileged action: a technician runs each one
Command AI on FRONTDESK-02
Evidence Observed
- Windows monitoring14 new events on FRONTDESK-02 in the last hour
- Cloud alertsThe front desk account signed in from a new device at 08:52
- Ticket historyNo earlier tickets for this host
Assessment AI
Likely malicious. Contain FRONTDESK-02 before the account signs in again.
Suggested action A technician decides
Isolate FRONTDESK-02 via Overwatch
Command AI on WS-102
Evidence Observed
- Windows monitoringRequests to one domain every 60 seconds since 07:30
- Ticket historyA file sync app was installed on WS-102 on Tuesday
- Cloud alertsNo related alerts for this client
Assessment AI
Probably the new sync app checking in. Confirm it with the client before closing.
Suggested action A technician decides
Confirm the app with the client, then close
Command AI on j.chen
Evidence Observed
- Cloud alertsj.chen signed in from a new country at 06:14
- Ticket historyj.chen reported travel last week
- Windows monitoringNothing unusual on j.chen’s laptop
Assessment AI
The travel matches the earlier ticket. Watch for now; act on a second sign-in.
Suggested action A technician decides
Reset j.chen’s password if it happens again
One console instead of five or six tools.
The jobs MSPs usually split across separate products, logins, and contracts, in one Command console for every client you manage.
Client credentials get their own vault
A vault, not a document field
Client passwords sit in a dedicated vault, separate from documentation, with their own permission to reveal.
AES-256, a key per client
Stored credentials are encrypted with a separate key for each client.
Every reveal audited
The log shows who revealed a password and for which client.