A named instance of the master-key problem
On 1 August 2026, N-able disclosed active exploitation of a vulnerability in N-central affecting all versions prior to 2026.2, and urged an immediate upgrade (per the N-able advisory). If you run N-central, you already know the drill: read the notes, schedule the window, patch fast, then check whether anything moved before you did.
That is the job. What is worth pausing on is the shape of the risk. A monitoring console sits above thousands of downstream endpoints. When it gets popped, the blast radius is not one box, it is lateral access across every client that console touches. This is the RMM-console-as-master-key pattern, and it keeps recurring because that is what a management plane is: a single point that reaches everything.
Patch your RMM. Just don’t hang your client book off it.
Here is the part owner-operators can actually design around. The question is not only “how fast do I patch”, it is “what else is exposed when the management plane is”. If your tickets, contracts, time entries and invoices live inside the same all-in-one suite as your monitoring, then a monitoring zero-day is also a path into your book of business.
Opentra takes the opposite bet on purpose. We don’t do RMM. That’s the point. Opentra does one job completely: the PSA your work runs on, from first email to paid invoice. Your monitoring stays yours. You keep N-central, Level.io, ScreenConnect, whatever you already trust, and you patch it on your own cadence. Their alerts ingest into Opentra as billable tickets. Your client book does not share a fate with a monitoring console.
Self-hosted and single-tenant, so separation is real
Separation only counts if it is architectural, not marketing. Opentra is self-hosted and single-tenant. Your PSA data sits on infrastructure you control, not pooled in a cloud landlord’s multi-tenant estate. A vulnerability in someone else’s platform is not a vulnerability in yours, because your platform is yours. If a vendor disappears tomorrow, nothing stops: you own and can export your data.
That is the difference between two platforms with two separate patch windows and two separate threat models, versus one suite where a single advisory can ruin a fortnight. Two systems is not a downside here. It is the containment.
You can read how we think about this on our security page, and see the exact monitoring tools that ingest as tickets on integrations.
The takeaway
Keep your RMM. Patch it hard and fast. Just don’t let a monitoring console be the door into your PSA client book. That is a design choice you make once.
Work out flat-vs-per-seat on the pricing calculator: Community is free to self-host, Pro is $149/mo, Opentra Cloud is $249/mo. All flat, unlimited techs and client orgs.