The Platform Went Dark, the Price Moved
A quick disclosure before we start. I own shares in N-able, which is part of this story.
The software MSPs run on, and the price of the AI they resell, are both getting harder to count on.
Start with N-able. The company declared what it called a major outage of its hosted N-central platform and took it offline. It also strongly urged MSPs running N-central on their own servers to take those offline too, until N-able tells them otherwise. The trigger was a public disclosure. Sean Bales, an independent application security consultant, published more than 30 alleged N-central vulnerabilities on GitHub, including flaws he says allow credential theft, the creation of administrator accounts, and remote code execution. He says he tested them on N-able’s latest pre-release version. N-able says it hasn’t seen active exploitation, and that a hotfix is coming soon.
That fix won’t be the first. It will be N-central’s fifth emergency hotfix since the start of August. The first was for a flaw attackers were already exploiting. In early September, N-able shipped two in two days, the second for a remote code execution flaw rated 10 out of 10 for severity.
The price side is moving too. Microsoft has delayed, for the second time, its plan to turn on usage-based billing by default for new Microsoft 365 Copilot Business licenses sold through partners. The start date was November 2. Then it was December 1. Now, citing partner feedback, it’s sometime between January and March 2027. When it arrives, the default spending cap is 4,000 Copilot credits per user per month, about 40 dollars, unless someone changes it. And the meter is already running for a growing share of customers. Satya Nadella says the number of Copilot customers consuming credits on usage-based billing grew more than 75 percent in a single quarter.
Hear what that adds up to. A platform MSPs manage their clients through went dark on the vendor’s call. And the price of the AI layer MSPs resell has a start date that keeps moving, attached to a meter that’s already running.
In plain terms, the tools under the MSP are less stable, and so is what they cost.
So why are both happening at once?
The answer turns out to be the same for both.
AI Finds the Flaws and Runs the Meter
Underneath both is one dynamic. AI has made two kinds of work fast and cheap that used to be slow and scarce: searching software for weaknesses, and doing tasks with it. Both now run on demand, by machine, and that changes how sturdy software is and how it’s priced.
Start with the searching. OpenAI released GPT-6 Cyber, a model it says is much better at finding and exploiting vulnerabilities than what came before. OpenAI says its researchers used it to find 81 previously unknown high-severity flaws in Firefox, and to help build working exploits for 948 Linux kernel vulnerabilities, 588 of them previously unknown. On an OpenAI evaluation called ExploitGym, the new model scored 48.5 percent, against 32.1 percent for the version before it. Those are OpenAI’s numbers, and access is limited to vetted security customers for now.
The fixing hasn’t sped up to match. OpenAI’s own cyber executive in residence, Michael Aiello, says open-source maintainers are receiving “hundreds and hundreds” of AI-submitted vulnerability reports. Most, he says, are likely real bugs. Some maintainers have simply stopped taking them.
Now, a fair objection: nobody has said AI found the N-central flaws. True, and it doesn’t have to have. When looking gets this cheap, every large, long-lived codebase gets examined faster than its maker can respond, no matter who is doing the looking.
The same dynamic sets the price. An AI agent costs its vendor something every time it runs, so vendors are starting to price by use. ConnectWise is moving to token-based pricing, probably next year, with the exact form still undecided: per-seat pricing for conventional software, consumption pricing for agents, with an example like a contract for 300 dollars’ worth of tokens. Chief executive Manny Rivelo frames the new question as how much work you want done, and what that work costs in an agent-based world. The AI labs are already there. Anthropic’s amended S-1 filing shows just over 26 billion dollars of its revenue through the third quarter, 79 percent of the total, came from consumption.
In plain terms, AI made finding flaws cheap and made doing work metered. One makes software less stable. The other makes its price less predictable.
And both roll downhill, toward whoever promised the client a fixed number.
For most MSPs, that promise is the business model.
Somebody Else’s Default
And when the vendor moves, a default decides what happens next.
Start with Copilot Chat. Microsoft is applying usage limits to more Copilot Chat features for business users without a full Microsoft 365 Copilot license. It doesn’t publish the limits, saying they’re subject to change, and admins can’t adjust them. When a user hits one, in most organizations the notice offers an upgrade: request a license from the admin or, where self-service purchasing is allowed, buy one directly. Microsoft says hitting a limit “might indicate interest in additional Copilot capabilities.” Admins can turn direct purchases off. But there’s no single switch. Microsoft says it’s done product by product, one customer tenant at a time. Someone has to do it, for every client. Left alone, your client’s first conversation about what AI costs is with Microsoft’s notice.
The security side has its own default, and it’s worse. When a platform goes dark, the instinct is to keep a second way in. Acronis looked at more than 1.8 million endpoints running its RMM and found 63.1 percent already had at least one other remote-access or management tool installed. That’s more than three of every five machines. That’s Acronis’s own customer data, and it says many of those installs are legitimate. But it warns that tools and accounts left behind after a provider change give attackers an opening, and that patching may not remove access an attacker already has. The backup door is still a door.
Put those together. Without a plan, somebody else’s default handles the moment: the vendor’s upgrade notice, or an extra remote tool nobody is tracking. Neither works in the MSP’s favor.
So here’s the choice. Rehearse the vendor event before it happens. For every platform your service depends on, your RMM, your backup, the AI licensing you resell, decide now what you do the day it goes dark or changes its price: one approved break-glass path you can account for, spending caps and purchase settings you set instead of the defaults, and a client notice already drafted. Then run it on a schedule, because this isn’t a one-time event.
Or treat a vendor’s bad week and a billing date that keeps moving as one-off trouble, wait for things to settle, and learn what your default was when the client calls.
And that choice shows up first in how you quote.
Because most MSPs walked away from all-you-can-eat pricing a while ago for defined monthly recurring revenue, a set scope at a set price, and metered AI puts even that definition at risk. A defined bundle with a meter inside it isn’t defined anymore. So when you quote, split it: fixed services at a fixed price, and every metered component on its own line, with the cap already set, direct purchases off, and that cap written on the page as the most the client can be billed. That keeps the cost conversation on your quote, not in Microsoft’s upgrade notice. The MSP that does this meets the next price change with the answer already on the page.
What to Consider
- Find the meters hiding in your bundles. List every component of your agreements that now bills by use: Copilot credits, agent tokens, anything sold per task. Any of those sitting inside a flat per-user price means your margin absorbs every swing, so give each one its own line before the vendor’s meter starts running.
- Set the caps before the defaults do. When Microsoft’s default usage billing arrives, new Copilot Business licenses come with a spending cap of 4,000 credits per user per month, about 40 dollars, which for a 25-person client is up to 1,000 dollars a month on top of the licenses, and direct purchases stay on unless an admin turns them off. Decide each client’s number in advance, set it to zero where the client hasn’t agreed to usage billing, and write that number into the agreement.
- Put a pricing review on the calendar, not just a rate on the page. The vendors haven’t finished deciding their meters: ConnectWise’s form is still undecided, and Microsoft’s start date has moved twice. A scheduled review of metered lines and caps against actual usage turns the next vendor price change into a meeting you planned instead of an invoice you explain.
If this trend continues: By the end of 2027, most of the platforms MSPs run on or resell will carry a usage meter, and the MSPs still selling one flat bundle will carry those meters’ swings in their own margin. Since I own N-able shares, here’s one way to score me: if N-central goes through 2027 without another emergency hotfix, the fragility half of this call was wrong.