NerdsToGo Alexandria
How NerdsToGo Alexandria Turns Browser Evidence Into Client Policy
Atakama is a browser security platform that gives IT teams visibility and control at the browser layer, consolidating AI governance, data loss prevention, credential risk analysis, DNS and web content filtering, extension management, and browser hardening into a single console. NerdsToGo Alexandria, a managed service provider serving regulated small and midsize businesses, builds it into the security package its managed clients receive and uses what Atakama surfaces to write and enforce acceptable use policy.
NerdsToGo Alexandria first engaged with Atakama after seeing it demonstrated at the Build IT conference, and it has been part of the stack ever since.
Atakama is included in the secure service package every managed client receives, alongside a 24/7 US-based SOC.
Password strength and exposure are reported as letter grades for individual users and individual credentials, which NerdsToGo Alexandria takes directly to client decision makers.
“[Atakama is] something that we put into place to make sure that we're giving our clients high value, and they're able to have data insights across the browser to look for things like shadow AI, credential analysis, and data loss prevention.”
About
NerdsToGo Alexandria is a managed service provider supporting small and midsize businesses across government contracting, financial services, healthcare, nonprofits, and education. Its offerings range from fully managed IT with compliance, backed by a 24/7 US-based SOC and frameworks spanning CMMC, NIST, HIPAA, PCI, and SOC 2, to co-managed engagements built on a shared responsibility matrix and compliance-only support for regulated firms competing for contracts.
Thomas Morton, IT Operations Manager, joined the firm in August 2023, bringing a background in computer science and secure software engineering plus more than a decade of executive-level management experience. He owns the vendor stack and the client relationships that depend on it, running monthly meetings and quarterly business reviews aimed at improving each client’s technology footprint and security posture.
Challenge
Two very different client pressures, pointing at the same blind spot
Some of Morton’s clients bill by the hour, which makes time on task a revenue question rather than a management preference. Others sit in regulated industries where data loss prevention must be demonstrated, not assumed. Both pointed at the same place: the browser, where employees spend the day and where distraction, unsanctioned tools, and risky logins all live.
“We’re looking to make sure that we’re doing everything to look at data loss prevention, especially in the age of AI, where so many people are using AI tools, either sanctioned or unsanctioned. And we need to have some type of visibility on what that looks like.”
Credential hygiene was a second gap. NerdsToGo Alexandria already ran a password manager that produced overall scores, but nothing gave the team a view of individual users and individual logins it could put in front of a client. Controls anchored to the firewall also stopped mattering the moment a user worked from home or from their own network.
Solution
Controls that follow the user instead of the network
Morton’s team first engaged with Atakama, a browser security platform, after seeing it demonstrated live at the Build IT conference. What stood out was enforcement that stayed with the endpoint rather than the perimeter, paired with the insight layer his clients had been asking for.
“Being able to have controls around the browser that you can enforce, not being dependent on the firewall. So even if somebody’s working remote or on their own network, those permissions are still put in place across the endpoint on the browser.”
Site watermarking addressed a related risk. Users regularly hand out credentials to lookalike domains, and confirming that a login page is the real one before anything is typed is, in Morton’s view, where a good deal of the value sits for his clients.
Deployment through the tools already in place
Rollout was straightforward. NerdsToGo Alexandria pushed Atakama out through a script tied into its RMM, then relied on the Entra ID setup already standard across its managed endpoints to enforce sign-in inside the browser. Most clients run Edge or Chrome as part of their Microsoft 365 environment, which kept coverage consistent, and the platform made it simple to suspend a user or carve out an exception when a client needed one
“Once you get a script and you get your script tied into your RMM system, it was fairly easy to push out to the clients.”
AI governance as a standing policy conversation
NerdsToGo Alexandria establishes baseline policies at onboarding and revisits them quarterly or twice a year, treating acceptable use and acceptable AI use as two separate documents. Atakama supplies what those reviews need: which AI tools are in use, how much time is going into them, and which of them were never approved in the first place. From there the team puts guardrails around the tools a client wants to keep.
“If we know that we’re working with an AI friendly client, we want to make sure that if they’re using ChatGPT, it’s not on personal accounts, but on a team or enterprise account where the employer has ultimate use over the IP that’s being created and the data that’s being uploaded. And if that employee becomes unemployed by that client, all of that information doesn’t just walk away in somebody’s personal account.”
Results
Evidence clients can act on, and policy that keeps up with them
- Policy written from evidence. Browser insights feed the acceptable use and acceptable AI use policies NerdsToGo Alexandria maintains for each client, amended with sign-off from the client’s own points of contact and decision makers.
- Credential risk made specific. Letter grades on individual users and individual logins turn a vague warning into a list. When a report shows weak credentials sitting on mission-critical applications, clients move to get those passwords changed.
- Shadow AI surfaced with context. Unapproved AI tools show up along with how much time is going into them, which is what makes a guardrail conversation possible instead of a guess.
- Protection that travels. Browser permissions hold at the endpoint whether a user is in the office, at home, or on their own network.
- A second line on credentials. The per-user grading works alongside the password manager already in the stack, adding a view of the individual end user that the existing tool’s overall scores did not provide.
Morton also points to the working relationship behind the platform. He has met regularly with the Atakama team since onboarding, and in a market where every tool arrives with heavy marketing, a vendor that keeps showing up looks very different from one that goes quiet until renewal.
Stay ahead of browser threats
Get monthly security insights, product updates, and expert guides delivered to your inbox.
No spam. Unsubscribe anytime.