PowerShell signing beside NinjaOne

NinjaOne is a common MSP RMM. Trustholm Govern is not a NinjaOne alternative for patching, remote support, or endpoint management. It is the policy and evidence layer for privileged PowerShell when NinjaOne’s scripting history is not enough for an assessor. Read this alongside the NinjaOne compare page.

What stays in NinjaOne

Device management, patching, alerting you already tuned, and technician remote tools stay in NinjaOne. Trustholm does not offer RDP/remote shell as a hero feature and does not take OS patch management.

What moves to Trustholm

Scripts that change security boundaries: identity, privileged local accounts, sensitive registry, complex vendor installs that are “the script is the installer.” Those get signing, approval, and tenant-scoped audit export.

Dual agent

Endpoints can run both agents. Bind Trustholm’s agent.runtime.json to the correct tenant code. Do not copy runtime files across tenants. Install guidance lives on the operator Install tab (GPO/Intune for Trustholm agent is customer-operated).

Evidence story for NinjaOne shops

When a renewal questionnaire asks for script provenance, export Trustholm audit for the privileged set and keep NinjaOne activity for everything else. Do not double-count the same control in two tools. Map patching to NinjaOne and signing to Trustholm.

Agentic tools

If you add Rewst, Neo, or similar, route privileged execution through Trustholm’s execution-intent gate so the chatbot or workflow cannot mint unsigned mutate authority. Trustholm is the gate, not an L1 ticket bot competing with NinjaOne’s ITSM add-ons.

Claims to avoid

No NinjaOne replacement claim. No invented marketplace badge. No SOC 2 Type II claim. No Essential Eight product certification.

Ninety-day pilot

Month 1: catalog ten scripts, RequireSigned on, one customer. Month 2: Assessor ZIP plus questionnaire pre-fill. Month 3: decide whether the privileged set expands. Leave NinjaOne as the estate RMM throughout.

Scale

Use lookup and catalog APIs in the portal. Do not load the full NinjaOne-sized fleet into a Trustholm dropdown. That is a product rule, not a preference.

Field notes (NinjaOne coexistence)

Keep NinjaOne for patch, remote support, and estate RMM. Move only the privileged script set into Trustholm. Bind agent.runtime.json to the correct tenant. Do not claim NinjaOne replacement or an invented marketplace listing. Route agentic tools through execution-intent so they cannot bypass signing.

Date the diligence folder YYYY-MM-DD and record the portal product version. Re-export after upgrades. Do not reuse last week's grant token. Public starter PDFs copy without email. Gated files need a live grant. If the Platform API is down, HubSpot may still capture the lead with no download buttons. Say that out loud so GRC does not think the trial is broken.

Walk one denied unsigned dispatch when RequireSigned is on. Capture a 403 from a mismatched tenant header. Export audit for one window and confirm no foreign tenant codes. Open the Assessor ZIP trust-artifacts.json and read the limitations appendix. Leave Gap rows as Gap. Do not paste LabVerified for Entra, Okta, Stripe, or SMTP until the capability verification registry says LabVerified.

Keep the incumbent RMM. Trustholm does not replace OS patching, remote takeover, or a NOC hero pitch. Probe and observe features are operator tools, not the reason a council or insurer should buy. Named design-partner logos stay off marketing pages until attestation exists.

Store ZIP files with access control. They hold tenant metadata even when secrets are stripped. Email security@trustholm.com only for Manual DPA or pentest summary. Do not invent those PDFs on www.

If someone asks to select all agents in a dropdown, stop and show catalog pagination. If someone asks for a second region or a single global edge FQDN, say Phase 1 Australia edge is current and global discovery is deferred.

Copy the trust hub sentence into the packet: we do not hold SOC 2 Type I or Type II and do not claim an observation period. Trustholm supplies technical artifacts for the customer's program. It does not automate customer SOC 2 Trust Services Criteria like a GRC product.

Assign an owner to refresh this packet quarterly or after a Shipped/Gap change. Workshops go stale. Prefer live reproduction over architecture slides. Prefer export files over screenshots alone, then keep both.

Keep NinjaOne for patch, remote support, and estate RMM. Move only the privileged script set into Trustholm. Bind agent.runtime.json to the correct tenant. Do not claim NinjaOne replacement or an invented marketplace listing. Route agentic tools through execution-intent so they cannot bypass signing.