The frontier AI for IT work
The frontier AI for IT work
Theo AI Technician resolves IT issues
end-to-end with controlled autonomy
Your technicians are your advantage. They know the clients, make the judgment calls, and solve the problems that earn trust.
Theo takes the repeatable work — password resets, account unlocks, licence assignments, mailbox permissions — so your team can move up to complex issues, projects, and proactive client service.
More capacity per technician means stronger service, room for new clients, and more profit without adding headcount just to keep pace.
Keep experienced people on client conversations, escalations, and projects instead of resetting passwords between them.
When routine tickets are handled, technicians can deliver the thoughtful fixes and proactive guidance that deepen client relationships.
Theo works inside the stack you already run. Your team supervises it and expands autonomy without becoming workflow builders.
Take on more work with the people who already know your clients, then hire because the opportunity demands it — not because L1 volume does.
Theo brings deep IT knowledge, then adapts it to your operation. It understands each customer’s environment, follows your playbooks, and learns from your technicians.
It operates your PSA, RMM, security stack, and customer applications—and can use a secure virtual computer when the work requires a browser. The result is not generic automation. It is an AI technician that operates the way your best technicians do, across every customer.
Theo pulls the ticket, resolves the requester to a real identity, reads your IT Glue or Hudu documentation, and checks how your team resolved this category before. Context first, action second.
Over 500 real actions across identity, email, licensing, groups and devices. Theo resets the password, releases the lockout, provisions the user, reclaims the licence.
What was wrong, what it did, what it deliberately didn't do, and what a human should watch for. The note is the handover, not a log dump.
Theo starts at zero. You decide what it works on, what needs approval, and which clients are in scope.
Build autonomy one ticket type at a time. Give Theo your playbook, run it under supervision, and refine its behavior using feedback from your technicians. Once it performs reliably, graduate that ticket type to end-to-end execution.
Start with high-volume work that has clear steps, limited customer interaction, and actions that are low-risk or reversible. After Theo has been tuned and evaluated on your queue, expand it to higher-impact ticket types.
| Order | Category | Automation Order |
|---|---|---|
| 1 | Monitoring & Alerts | First |
| 2 | Identity & Access | First |
| 3 | General Service Requests | First |
| 4 | Security & Threat Investigations | First |
| 5 | Email & Messaging | Next |
| 6 | Collaboration & Content | Next |
| 7 | User Lifecycle | Next |
| 7 | Applications & Software | Next |
| 9 | Endpoint & Device | Next |
| 10 | Vendor, Procurement & Licensing | Next |
| 11 | Network & Connectivity | Last |
| 12 | Cloud & Infrastructure | Last |
| 13 | Backup & Recovery | Last |
| 14 | Projects & Strategic | Last |
| 15 | Compliance, Audit & Governance | Last |
Theo proposes; your technician approves every write action. You watch it work your real queue, not a demo tenant.
Turn Theo loose on password resets. Then account unlocks. Then licensing. You choose the order, per client and per ticket type.
Every action is logged and attributable. When a client asks what happened at 2:14am, you have the answer in one click.
General-purpose models have never seen your PSA schema, your ticket taxonomy, or what a correct Exchange remediation looks like. Theo is trained and evaluated on the actual work: 17 domains, 142 work types, and thousands of resolution paths from real service desks.
Example layout using domains from Theo’s IT-work taxonomy. Figures are evaluation results.
work domains
work types
on real tickets
Theo expands what you can take on. By handling the repetitive work and assisting with execution, it gives you the time and leverage to solve more challenging problems—whether that means implementing Conditional Access, managing privileged identities, or recovering critical customer data.
The buyer. Revenue per technician is the only number that moves your margin. Theo is the hire that doesn't churn, doesn't need onboarding, and costs less than the junior you were about to recruit.
The margin caseThe evaluator. You set what Theo touches and what it doesn't. Nothing goes autonomous until you have watched it work. Every action is logged, so when a client asks what happened, you have the answer.
Control and auditabilityThe one who lives with it. Theo takes the repetitive categories off your plate and shows you exactly what it did. You approve, correct or override. You keep the judgement calls.
How supervision worksOver 500 discrete actions across the desk — identity, email, devices, PSA, documentation, licensing, collaboration, and more. These are executions, not suggestions.
Search, create, update and restore users. Manager attributes, contact details, org units, and admin roles in Microsoft 365 and Google Workspace.
Password resets, account unlocks, MFA methods, session revocation, risky-user inspection, and blocks — with the irreversible ones gated.
Security groups, Microsoft 365 groups, distribution lists, dynamic groups, owners and members, Google admin roles, and OU moves.
Assign and reclaim Microsoft 365 licences, check SKU availability, and manage Sherweb catalog, orders, amendments and cancellations.
Forwarding, aliases, send-as, inbox rules, signatures, auto-replies, quotas, quarantine, message trace, and why mail never arrived.
Create and convert shared, room and equipment mailboxes. Full Access, Send As, folder permissions, GAL visibility, and booking policy.
Room metadata, calendar access, Teams membership and channels, policies, meetings, Google Chat and Meet, Slack users, and technician notify.
SharePoint sites and lists, OneDrive and Google Drive sharing, permissions, version restore, and Google Shared Drives.
Full provisioning, group and licence assignment, mailbox conversion, litigation hold, data transfer, session and token revoke, and restore from recycle bin.
Archive mailboxes, retention tags and policies, litigation hold, Google Vault holds and exports, and inactive-mailbox inspection.
Compromised-account checks, Google alert centre, named locations, Conditional Access policies, app secrets, and enterprise-app enablement.
Intune inventory, ownership and primary user, Datto and NinjaOne health, patches, alerts, remote scripts, and device diagnostics.
Create, update, reply and resolve tickets in Halo, ConnectWise, Autotask and SuperOps. Contacts, assets, notes, and time entries.
IT Glue and Hudu articles, assets, organisations, password folders, and search across your own resolved ticket history.
Sherweb customers, catalog, subscriptions, quantity changes, cancellations, and payable or receivable charges.
Content searches, DLP policy inspection, audit and sign-in logs, email activity, and Google admin and Drive activity reports.
App registrations, expiring client secrets, redirect URIs, and enable, disable or delete enterprise applications.
URL and latency checks, MX and CNAME propagation, one-time secret links, custom client workflows, and CSV export of results.
What Theo can run depends on the integrations you connect. Sensitive writes stay gated until you grant them.
We map your stack and your ticket mix, and identify which categories Theo takes first — and which ones it shouldn't touch.
PSA, Microsoft 365 or Google Workspace, and your documentation platform. Same week, no services engagement.
Theo starts working your real queue with a technician approving every action. You see everything before it happens.
Week 1 · first resolved ticketCategory by category, client by client, on your schedule. Dial anything back whenever you want.
Month 1 · ROIFigures below are from named pilot deployments. Items marked [ ] are waiting on customer sign-off before GA.
"We put Theo on password resets and unlocks for two clients and left it supervised for three weeks. It was right often enough that arguing about it became the bigger waste of time. We've since given it licensing too."
"I was two weeks from posting a junior role. We didn't post it. That's a $52,000 line item that didn't happen this year, and the queue is in better shape than it was."
"My worry was a mess in the queue at 8am that I'd have to unpick. It hasn't happened, because the things I was worried about are exactly the things it stops and asks about."
You control what Theo does autonomously and where it requires approval. Every action is logged with a full audit trail. Start fully supervised and expand autonomy as you build confidence.
Two things matter more than the error rate. First, the categories where Theo acts alone are ones you have already watched it work. Second, the actions that are hard to undo — offboarding, MFA changes, shared mailbox permissions — stay gated even in an otherwise autonomous category.
Most of them were workflow builders. They needed someone on your team to design every automation before anything got resolved, and that person never had the time.
Theo doesn't require you to build anything. In your supervised pilot you'll see real tickets from your own queue resolved in the first week, before you've committed to anything.
One week from discovery call to first resolved ticket. We connect your PSA, your Microsoft 365 or Google Workspace tenant, and your documentation platform. There's nothing to build and no automation engineer to hire.
Theo is SOC 2 Type II certified. See the Trust Center.
Your client data is not used to train models, and it is not retained beyond the execution of the ticket. What Theo needs to resolve the work is used for that run — then it is gone.
Theo is built on bounded access. On every ticket run it receives only the fine-grained permissions required for that work — this client, this identity, these actions — not a standing key to the tenant.
That is the opposite of agents such as OpenClaw, which hand the model unbounded, full-environment access and hope the prompt holds. Theo cannot reach what the ticket does not need, even if the model tries.
You can — at $45,000–$55,000 plus benefits, four to eight weeks to hire, and a few months to competence.
Theo costs less, starts in a week, works the overnight queue, and doesn't leave in eighteen months. Most of our MSPs use it to defer the next hire rather than to reduce the team they have.
Theo connects to ConnectWise, Autotask, Halo PSA and SuperOps, plus Microsoft 365, Google Workspace, IT Glue and Hudu. On the RMM side, Datto RMM and NinjaOne are connected for device metadata, alert intake and remote scripts.
See a full list of applications Theo works with.
Yes. Autonomy is configured per client as well as per ticket category, so you can run Theo fully autonomous for one client and fully supervised for another, with different category sets for each.
Book 30 minutes. We'll map your stack, look at your actual ticket mix, and tell you which categories Theo takes in week one — and which ones it shouldn't touch.