PowerShell signing beside ConnectWise Automate

ConnectWise Automate remains a strong incumbent for remote monitoring, scripting at RMM scale, and technician muscle memory. Trustholm Govern sits beside Automate when buyers ask who signed a privileged script, who approved it, and whether you can export that history for an assessor. This article complements the compare page; it is not a rip-and-replace pitch.

Division of labor

Keep Automate for:

• Patch and maintenance windows you already trust
• Broad scripting that is not the regulated privileged set
• Ticketing adjacency you already wired

Add Trustholm for:

• Customer-held code-signing verification on the agent
• Tenant approval policy before enqueue
• Security audit export scoped to one tenant
• Agentic/partner gates so Rewst or other tools cannot bypass signing

Do not move OS patching into Trustholm. That is an explicit non-goal.

Pilot shape

Pick ten high-risk scripts (AD hardening, credential-adjacent, complex installs). Duplicate platform examples or import after review. Require signatures. Leave commodity Automate scripts where they are. Measure time-to-export for one assessor request.

Technician workflow

Technicians still live in Automate for most tickets. For the privileged set they open Trustholm, pick a catalog script (paginated, not a 100k dropdown), confirm parameters, and dispatch. Execution evidence lands in Trustholm’s queue and audit plane. Optionally link a PSA ticket. Automate’s script log can remain for the rest of the estate.

Claims to avoid

Do not tell a customer Trustholm “replaces Automate.” Do not claim ConnectWise certification. Do not claim Essential Eight or SOC 2 product certification. Coexistence is the product.

Reproduction in trial

1. Install the Trustholm agent beside an existing Automate agent (supported coexistence).
2. Dispatch a signed script to that endpoint.
3. Export audit. Show the assessor the row.
4. Keep Automate screenshots for patch evidence in the same binder.

File orchestration

When an install is a zip plus PowerShell rather than an MSI, Trustholm can stage files from the tenant library, run the signed script, and pull artifacts back. Automate remains available for other software deployment patterns you already operate.

Commercial honesty

Govern is the policy and evidence engine. Probe/NOC features exist but are not the hero GTM. Do not sell monitoring parity versus Automate’s NOC as the reason to buy Trustholm.

Field notes (Automate coexistence)

Pilot ten high-risk scripts only. Leave commodity Automate scripts in Automate. Dual-agent is expected. Do not claim a ConnectWise marketplace badge from this page. Map patching evidence to Automate and signing evidence to Trustholm so the assessor does not double-count.

Date the diligence folder YYYY-MM-DD and record the portal product version. Re-export after upgrades. Do not reuse last week's grant token. Public starter PDFs copy without email. Gated files need a live grant. If the Platform API is down, HubSpot may still capture the lead with no download buttons. Say that out loud so GRC does not think the trial is broken.

Walk one denied unsigned dispatch when RequireSigned is on. Capture a 403 from a mismatched tenant header. Export audit for one window and confirm no foreign tenant codes. Open the Assessor ZIP trust-artifacts.json and read the limitations appendix. Leave Gap rows as Gap. Do not paste LabVerified for Entra, Okta, Stripe, or SMTP until the capability verification registry says LabVerified.

Keep the incumbent RMM. Trustholm does not replace OS patching, remote takeover, or a NOC hero pitch. Probe and observe features are operator tools, not the reason a council or insurer should buy. Named design-partner logos stay off marketing pages until attestation exists.

Store ZIP files with access control. They hold tenant metadata even when secrets are stripped. Email security@trustholm.com only for Manual DPA or pentest summary. Do not invent those PDFs on www.

If someone asks to select all agents in a dropdown, stop and show catalog pagination. If someone asks for a second region or a single global edge FQDN, say Phase 1 Australia edge is current and global discovery is deferred.

Copy the trust hub sentence into the packet: we do not hold SOC 2 Type I or Type II and do not claim an observation period. Trustholm supplies technical artifacts for the customer's program. It does not automate customer SOC 2 Trust Services Criteria like a GRC product.

Assign an owner to refresh this packet quarterly or after a Shipped/Gap change. Workshops go stale. Prefer live reproduction over architecture slides. Prefer export files over screenshots alone, then keep both.

Pilot ten high-risk scripts only. Leave commodity Automate scripts in Automate. Dual-agent is expected. Do not claim a ConnectWise marketplace badge from this page. Map patching evidence to Automate and signing evidence to Trustholm so the assessor does not double-count.