Ironscales Now Works in Harmony With HaloPSA

The integration between IRONSCALES and HaloPSA allows security events from the security platform to flow directly into the PSA system as tickets, and usage data flows from the security platform into the PSA as license information. This process aims to ensure that security work is reflected within the business operations tracked by the PSA. Native email filtering in Microsoft 365 and Google Workspace has inherent limitations regarding phishing protection, allowing certain attacks to bypass built-in filters through various means. When these limited native protections fail, the resulting remediation work typically occurs outside the official tracking systems of the MSP, leading to lost visibility regarding time spent on security tasks, client history, and billing.
The integration standardizes this process by turning qualifying security events into actionable tickets within HaloPSA, providing technicians with a unified queue, ownership, timestamps, and historical context that resides within the PSA. Furthermore, daily synchronization links the usage metrics from the security platform to the software licenses tracked in the PSA, ensuring license counts align with actual usage.
The integration process involves OAuth2 authentication and a one-time daily sync of usage data; there is no hourly polling or sync back from HaloPSA to IRONSCALES. This setup aims to bridge the gap between reactive security events and proactive business management by ensuring that security activities are visible, measurable, and billable within the existing PSA framework.

* IRONSCALES works with HaloPSA starting November 1.
* The integration aims to integrate email security events and usage data into the PSA system.
* Microsoft 365 and Google Workspace have built-in email filtering limits against phishing emails.
* Native filters miss approximately 293 phishing emails per 100 mailboxes in M365 and 350 in GWS.
* Attacks can bypass native filters by exploiting legitimate sender reputations or actions lacking links/attachments.
* Security work not recorded in the PSA does not count against SLAs or appear in client history.
* Integration creates a ticket in HaloPSA within a minute when a qualifying IRONSCALES event occurs.
* The integration syncs IRONSCALES usage to HaloPSA software licenses once a day, with a retry for failed records.
* The integration authenticates via OAuth2 client credentials and includes permissions for reading clients, tickets, contracts, items, and licenses.
* Setup involves creating an API Application in HaloPSA, entering credentials in IRONSCALES, and running a setup wizard.

The narrative establishes a structural disconnect between where security work occurs and where business operations are managed, positioning the integration as a necessary reconciliation mechanism. The core tension lies in how essential security actions—which consume technician time and impact client risk—are currently externalized from formal business tracking systems like the PSA. The assertion that security work "belongs where the business runs" suggests a systemic failure in current operational paradigms where security overhead is treated as an ancillary, separate task rather than an intrinsic component of service delivery.
The framing around native email filtering subtly introduces a contrast: while large platforms offer baseline protection, their inherent limitations necessitate external tracking, which then creates administrative friction for the MSP. The shift proposed by the integration moves from manually transferring event data to automated synchronization, aiming to transform passive security outputs into active business metrics (tickets and license usage). This suggests a pattern where value is generated only when disparate systems can communicate seamlessly.
The potential implication is that resistance to such integrations stems not from technical inability but from inertia—the difficulty of redefining how service delivery is measured. If the integration successfully forces security events into the established framework of SLAs and client history, it redefines what constitutes "work" for an MSP, moving it from an item of investigation to a documented business outcome. The question remains whether this alignment truly shifts agency or simply reframes existing friction points within a larger system.
Bridge Questions: If security work is fully integrated into the PSA, how should the value proposition for clients change? What operational resistance exists in MSP workflows that prevents immediate adoption of such unified tracking, and what could address that inertia?