NinjaOne: Four MSP platform features announced

Key insights

• Vulnerability Management is described as server-side and connects CVE alerts with NinjaOne patching.
• Browser Management identifies installed extensions, shows risk scores and can block extensions.
• Dynamic Policies configure devices according to who uses them and what they need.
• Katana AI can prioritize work, run reports and read or update documentation.
• NinjaOne's broader roadmap was presented as a plan, so the timing and final scope may change.

NinjaOne announced four platform features for managed service providers: Vulnerability Management, Browser Management, Dynamic Policies and Katana AI. They target MSP teams that manage customer devices and need to address vulnerabilities, browser extensions, configuration policies and technician workflows. Jonathan Edwards reports on the announcements and conversations with MSPs in a YouTube video from NinjaOne’s MSP NXT event.

What's new

The four announcements focus on different parts of day-to-day service delivery. Vulnerability Management is intended to identify affected devices when a new CVE applies and connect that finding to NinjaOne’s patching engine. Edwards says the process is server-side, with no endpoint impact, and describes a workflow to find, prioritize and fix issues in one place.

Browser Management gives MSPs visibility into browser extensions installed by their customers, including risk scores, and a way to block extensions deemed problematic. It also shows which AI tools users are logging into. That visibility may help MSPs discuss AI use and browser risks with customers, although the material does not specify which browsers, risk criteria or reporting controls are included.

Dynamic Policies change how device configuration is organized. Rather than managing as many separate policies, MSPs can configure devices based on who uses them and what they need. Edwards also says administrators can see why a device was configured a particular way, which may make it easier to understand a configuration when supporting a customer.

Katana AI is presented as NinjaOne’s AI technician for engineers. The examples include asking what needs fixing or prioritizing, generating a report, retrieving information from documentation, adding information to documentation and turning a remote session into a knowledge base article. The transcript also says Katana AI connects to other tools, but it does not name those integrations or explain how they are configured.

Who it is for and what you need

The announcements are aimed at managed service providers using NinjaOne to support customer environments. Vulnerability and browser management are relevant to technicians and service teams responsible for customer devices; Dynamic Policies concern those who configure and maintain those devices. Katana AI is aimed at engineers and technicians who investigate work, produce reports and maintain operational documentation.

The material does not state what NinjaOne plan, subscription, role permissions or technical prerequisites are needed for any of the four features. It also does not provide a rollout schedule, preview status, regional availability or a date when customers can use them. MSPs should confirm those details with NinjaOne before planning a deployment or changing a service offering.

The conference also included a broader roadmap message: “do more with less,” through fewer clicks and more automation, while keeping people involved in managing AI for customers. Edwards describes that roadmap as a plan that might shift. It should not be treated as confirmation that every roadmap item is available now.

How it works

The announcements describe intended capabilities, not a complete setup guide. Edwards does not show a console walkthrough, menu path, configuration sequence or settings page for any feature. The following outline reflects the workflow described, not verified click-by-click instructions.

1. For vulnerability work: identify devices affected by a new CVE, prioritize the issue and use the connection to NinjaOne patching to address it. The announced process runs server-side, according to Edwards.
2. For browser oversight: review customer browser extensions and their risk scores, block extensions considered problematic, and see which AI tools users are logging into. The specific controls and supported browsers are not stated.
3. For device configuration: use the identity of the device’s user and their needs as the basis for Dynamic Policies. The stated goal is fewer policies and clearer visibility into why the device received its configuration.
4. For technician assistance: ask Katana AI operational questions, request a report or documentation information, and use it to help write documentation from a remote session. The material does not detail approval controls or the steps to connect other tools.

These descriptions may help MSPs decide which operational problems to evaluate first, but they are not enough to reproduce a configuration. A practical evaluation should establish feature access, supported platforms, policy behavior, and how technicians review or correct AI-generated outputs.

Limitations and open questions

The announcement provides a high-level feature summary rather than implementation detail. It does not name the CVE data source, explain how vulnerability severity is calculated, or specify which patches can be deployed through the described integration. It also does not state whether the server-side operation requires an agent or what telemetry the feature uses.

For Browser Management, the transcript does not identify supported browsers, extension-risk methodology, policy scope or whether administrators can manage AI-tool access beyond seeing sign-ins. For Dynamic Policies, it does not explain which user attributes drive configuration or how conflicting requirements are handled. Those details matter when an MSP has distinct customer security baselines or shared devices.

Katana AI’s examples do not establish which actions it can perform directly, how outputs are validated, what approval steps apply or which external tools it can connect to. The research notes mention additional Katana AI and NinjaOne 16.0 capabilities, including specific approval behavior, but those details are not demonstrated or confirmed in the transcript used for this report and are therefore not treated here as established facts.

In particular, the feature names and descriptions do not establish general availability or licensing. MSPs should verify current availability and terms with NinjaOne. The separate roadmap discussion is explicitly tentative, and the conference presentation alone does not establish delivery dates.

Sources

• Jonathan Edwards’s MSP NXT report and feature descriptions

Frequently asked questions

What features did NinjaOne announce at MSP NXT?

The four announcements described are Vulnerability Management, Browser Management, Dynamic Policies and Katana AI.

What does NinjaOne Browser Management do?

It is described as showing installed browser extensions and their risk scores, allowing problematic extensions to be blocked, and showing which AI tools users log into. Supported browsers and detailed controls are not stated.

Can I use Katana AI now, and what licence do I need?

The source material does not state availability, rollout timing, licensing or prerequisites. Confirm those details with NinjaOne.

How do NinjaOne Dynamic Policies work?

They configure devices based on who uses them and what they need, with the aim of reducing the number of policies and clarifying why a device received its configuration. The specific setup steps are not provided.