The Open Source MSP Stack: TacticalRMM, Wazuh, and ITFlow vs a $50K Commercial Stack

A 500-endpoint MSP running a mainstream RMM, PSA, and log management stack pays north of $50,000 a year for the privilege. Swapping that trio for TacticalRMM, Wazuh, and ITFlow drops the licensing line to roughly $6,800. That gap is real, and it's also incomplete, because an open source MSP stack moves cost off the vendor invoice and onto your payroll. This post prices both sides, including the sponsorship tiers and engineering hours that free-tools roundups leave out.

TL;DR

• The swap works. TacticalRMM, Wazuh, and ITFlow can replace a $51,000-a-year RMM, SIEM, and PSA stack for about $6,800 in licensing and infrastructure at 500 endpoints.
• The catch is labor. Budget 120 to 160 hours to build it and roughly 10 hours a month to keep it running.
• Year one nets about $24,700. Year two and beyond lands closer to $35,000.
• Skip it if nobody on your team is comfortable with Linux, Docker, and reverse proxies.

What a $50,000 Commercial Stack Buys You Today

Start with the baseline, because the savings number means nothing without it. Take an MSP supporting 500 endpoints across 40 clients with six technicians.

On the RMM line, Datto RMM publishes a base rate of $2.99 per endpoint per month. ConnectWise RMM lands between $1.50 and $3.50 per agent depending on tier and negotiation. Kaseya VSA sits around $4 to $5 per endpoint, though Kaseya doesn't publish pricing and every number comes from a custom quote. Call it $3.50.

Add a PSA at roughly $2 per endpoint equivalent once you convert per-technician pricing down, since per-tech PSA licensing runs $129 to $209 monthly when billed annually. Add log management or a managed SIEM feed at $3. That's $8.50 per endpoint per month, or $51,000 a year at 500 endpoints.

The number climbs from there. ConnectWise Automate deployments routinely carry $2,000 to $20,000 in implementation and training fees before the first ticket closes. And stack audits regularly surface $3 to $5 per endpoint of duplicate spend, usually where EDR, RMM-bundled patching, and SaaS backup overlap with BCDR.

Against that, the Service Leadership Index puts top-performing IT solution providers above 19% adjusted EBITDA while a large share of the field sits between 8% and 12%. When tooling eats $8.50 per endpoint and you're billing $150 per user, the stack line is one of the few costs you can move quickly. That pressure is why ConnectWise alternatives stay one of the most searched topics in this industry.

TacticalRMM and the Source-Available Asterisk

TacticalRMM is the endpoint layer nearly every open source thread recommends, and it earns the recommendation on cost. Near-zero per-endpoint pricing, genuine cross-platform agents, real scripting, and full data ownership because everything runs on infrastructure you control.

Two things get glossed over.

First, the license. TacticalRMM is not open source in the OSI sense. Its maintainers call it source-available, and that distinction matters when you're betting client infrastructure on it. You can read the code and self-host it. You don't get the redistribution and forking guarantees that a GPL or Apache license would give you if the project's terms changed. ITFlow, by comparison, ships under GPL and carries no such asterisk.

Second, the paywall. The core platform is free, but free stops the moment you need code-signed Windows agents, SSO, or the reporting module. Those sit behind a sponsorship tier running $55 to $80 a month. Code signing isn't a luxury item either. Unsigned agents mean SmartScreen prompts and antivirus friction on every deployment, which is exactly the kind of thing that turns a rollout into a support queue.

Infrastructure is cheap and predictable. TacticalRMM needs a VPS with at least 2 vCPUs and 4GB of RAM on a supported Linux distribution. For up to 200 endpoints, a $20 to $30 VPS from Hetzner, Contabo, or OVH handles it comfortably. At 500 endpoints, budget $60 a month and give yourself headroom.

The pattern across r/msp threads is consistent: teams with Linux skills report running TacticalRMM happily for years, while teams without those skills tend to bounce off it within a quarter. The tool is capable. The operational tax decides the outcome.

Wazuh Is the Strongest Piece and the Hardest to Run

Wazuh is where the open source stack goes from credible to genuinely competitive. It unifies XDR and SIEM across endpoints and cloud workloads, it's free under a real open source license, and it took two 2026 Cybersecurity Stars Awards, for Best Cloud Security Platform and Best SIEM Platform. Commercial SIEM vendors charge by ingest volume. Wazuh charges nothing, which changes what you can offer a 30-seat client without destroying the margin.

Then comes multi-tenancy, and this is the part that separates a weekend project from a production platform. Wazuh supports tenant isolation and a single dashboard serving multiple organizations, but wiring that up across 40 clients is engineering work, not configuration. You're building index patterns per tenant, role mappings, retention policies, and alerting rules that don't leak one client's data into another client's view. Getting that wrong is a breach notification, not a bug ticket.

Cost scales with log volume rather than endpoint count, which catches people off guard. Documented MSP deployments handle anywhere from 500GB to 2TB of logs daily, and infrastructure runs from about $125 a month for a small single-node setup to $3,938 a month for large enterprise clusters. At 500 endpoints with sensible log filtering, a mid-size cluster around $400 a month is a reasonable plan. Turn on verbose Windows event forwarding without tuning first and that number moves fast.

Retention is the second cost trap. Cyber insurance carriers and most compliance frameworks want 12 months of log retention, and storage for a year of 500 endpoints at moderate verbosity is a meaningfully larger cluster than what handles 30 days. Decide the retention window before you size the hardware, because retrofitting it means a migration rather than a config change.

Wazuh is the layer worth staffing properly. It's also the layer where a botched deployment does the most damage, because a SIEM that nobody tunes produces alert noise that trains your team to ignore it.

ITFlow Finally Made the PSA Layer Credible

For years the honest answer to "is there an open source PSA?" was no, and that single gap sank the whole open source stack argument. RMM and SIEM had strong options. Billing and ticketing didn't, so shops ran TacticalRMM alongside a commercial PSA and captured maybe half the savings.

ITFlow closed that gap. It reached stable release in 2025 and now carries over 778 GitHub stars with an active community. It's GPL-licensed and covers the workflow that matters: ticketing with a client portal, invoicing with quotes and recurring billing plus Stripe, asset and license tracking, client documentation, an encrypted password vault, and domain and SSL expiry monitoring. There's a REST API for wiring it to an RMM or CRM.

What it doesn't have is a vendor. Support means the community forum and public GitHub issues. No 24/7 help line, no SLA, no account manager to escalate to when invoicing breaks on the 1st of the month. For a shop billing 40 clients, that's the risk to weigh, and it's a different kind of risk than the one you carry with a commercial PSA. Anyone comparing the field should look at how ITFlow stacks up against the commercial PSA options before committing a billing system to community support.

Deployment is the simplest of the three. A $30 VPS running Ubuntu or Debian handles a mid-size shop, and ITFlow's team offers a managed option if self-hosting the billing layer feels like one risk too many.

The Integration Glue Nobody Prices

Every roundup of free MSP tools stops at the tool list, and that's where the estimates go wrong. A commercial stack from a single vendor ships the connections between RMM, PSA, and security already built. Alerts become tickets. Tickets carry time entries. Time entries land on invoices. Nobody thinks about that plumbing because somebody else maintains it.

Assemble three independent projects and you own that plumbing permanently. A TacticalRMM alert has to reach ITFlow as a ticket, which means writing against ITFlow's REST API and handling the cases where it returns an error at 3am. Wazuh alerts need routing rules so a failed login attempt on one client's server opens a ticket on the right account with the right priority. Asset inventory has to reconcile between TacticalRMM's agent list and ITFlow's asset records, or your billing drifts from reality within two quarters.

None of that is hard engineering. All of it is ongoing engineering. Each upstream release can change an API response, and you find out when a ticket doesn't appear rather than when a changelog warns you. That's the bulk of the 10 hours a month in the table below, and it's the line item that surprises teams who budgeted for setup but not for maintenance.

There's an upside worth stating plainly. Because you built the connections, you can change any single layer without renegotiating a suite contract. Swap the RMM and the PSA stays. That's the practical meaning of no lock-in, and it's the thing a bundled contract can't offer at any price.

The Real Cost Comparison, Labor Included

Here's the full picture at 500 endpoints, with engineering time priced at $75 an hour loaded internal cost.

Year one saves roughly $24,700. Year two and beyond saves closer to $35,000, and that spread widens every time a vendor raises prices, which is the whole reason renewal negotiation became a skill MSP owners had to learn.

Two honest caveats on that table. The 140-hour build estimate assumes someone who has deployed Docker and a reverse proxy before. Someone learning as they go should double it. And the 10 hours a month of ongoing administration is a floor, not an average. Patch Tuesday breaking an agent, a Wazuh index filling a disk, or an ITFlow upgrade that needs a schema migration all draw from that budget.

The savings are real. They're just wages, not magic.

Who Should Not Build This Stack

Some shops should read this comparison and keep their commercial contract.

If nobody on your team is comfortable at a Linux command line, this stack becomes a liability the first time something breaks at 2am. The failure mode isn't a slow ticket queue. It's a monitoring platform that's down while you learn systemd from a forum post.

If you're under 100 endpoints, the math thins out. At 100 endpoints, the commercial stack costs about $10,200 a year while the open source version still needs the same 140 hours of build time and most of the same administration hours. The labor doesn't scale down with your client count, so the crossover point sits somewhere around 200 to 250 endpoints for a team billing at typical rates.

If you're preparing for an acquisition or a SOC 2 audit in the next 12 months, the documentation burden of a self-built stack works against you. Auditors want vendor attestations and support contracts. Community forums don't produce those.

And if your growth plan depends on adding clients faster than you add engineers, every hour spent maintaining infrastructure is an hour not spent on billable work or sales. That trade is fine at 500 endpoints with a technical owner. It stops being fine when the person maintaining Wazuh is also the person closing deals.

There's a quieter risk in the single-owner pattern. Self-built stacks tend to live in one technician's head, and that person becomes unable to take a real vacation. Write the runbooks as you build, keep the infrastructure in version control, and make sure a second person has deployed the thing from scratch at least once. If you can't staff two people against it, you're buying a savings number and a key-person risk in the same transaction.

A Build Order That Survives Contact With Clients

Sequence matters more than tool selection, because the failure pattern is trying to cut over all three layers at once during a renewal window.

Start with ITFlow, and start it in parallel with your existing PSA rather than replacing it. Documentation and asset tracking carry the lowest blast radius. If ITFlow goes down for a day, nobody's endpoints go unmonitored and no invoices vanish. Run it for 60 days on real client data before you move billing.

Move TacticalRMM second, one client at a time, starting with your most technical and most forgiving account. Get code signing sorted through the sponsorship tier before the first deployment, not after the first SmartScreen complaint. Keep the commercial RMM running in parallel until you've been through two full patch cycles clean.

Save Wazuh for last, and give it dedicated time rather than fitting it around ticket work. Build the multi-tenancy model on paper before you build it in the console. Decide retention per client, decide which log sources you're ingesting, and tune the ruleset against one pilot tenant until the alert volume is something a human would read.

That order takes about six months. Compressing it into a quarter is where the horror stories come from.

Where This Leaves You

An open source MSP stack is a real option in 2026 in a way it wasn't in 2022, and ITFlow reaching stable release is most of the reason. The savings hold up under scrutiny. So do the requirements.

There's a middle path worth naming. Some shops want off per-endpoint pricing and vendor lock-in without inheriting three self-hosted platforms to maintain. That's the gap OpenFrame is built for: an AI-native all-in-one MSP and IT platform with native PSA included rather than bolted on, priced without lock-in, and maintained by someone other than your senior technician at 2am.

The question was never whether open source can run an MSP. It can. The question is whether the 260 hours in year one are cheaper than the check you're writing now. Run your own endpoint count through that table before you renew anything.