Safeguards shouldn't be an upsell

Out there

In August, Toolradar took a snapshot of 5,191 software products that publish at least two plans and checked which features sit only on the most expensive one. Among products that offer single sign-on, 61 percent sell it only on the top tier. Audit logs: 68 percent. Advanced permissions and roles: 42 percent. For comparison, analytics and reporting are top-tier-only 17 percent of the time.

A smaller hand check in June, by Topickz, looked at 28 business tools one by one. Sixteen reserved single sign-on for their single most expensive plan, and ten of those sixteen don't publish a price for it. You have to call sales to find out what safety costs.

Now the other side of the ledger. Verizon's 2026 Data Breach Investigations Report, covering incidents from November 2024 to October 2025, found ransomware in 48 percent of breaches, and for the first time software vulnerabilities, at 31 percent, beat stolen passwords as the way in. The Cyber Readiness Institute's read of the same report puts small organizations at 96 percent of ransomware victims.

Put the two together. The market prices audit trails, access controls and sign-in protection as enterprise features, and the breaches land on the businesses that will never buy the enterprise plan.

In here

The Nexus feature guide has one line on this: safeguards shouldn't be an upsell. Here is what that means on the Free plan, the one that costs nothing.

Who sees what, everywhere. Every page, search, widget and export shows a person only what they're allowed to see. There's no view that forgets to check.

Sign-in protection. You can require two-step sign-in for the whole workspace, limit where people sign in from, and set how long they stay signed in. Signing in with a Microsoft account is on every plan.

A record you can trust. The governance audit is a tamper-evident trail of who did what, with filters, a who-holds-what view, and export to CSV. Legal hold lets you open a matter, freeze the records that belong to it, and export what's held, with two people required to approve access.

Emergencies, on the record. Break-glass access is time-limited, requires a stated reason, is recorded, and is watched by the Owner and whoever holds Compliance. Admins and role holders who go quiet for six months are stepped down automatically, because the forgotten admin account is how a lot of bad weeks start.

"Why can't I?" The Permission Debugger answers that question for any person, page or record, so access problems get fixed in a minute instead of by giving someone more access than they need.

All of that is on Free. Scoped access, where you grant a role over one part of the workspace, starts on Basic. Custom roles start on Pro. Two things sit on Enterprise: seeing which of your company's own sign-in policies apply to Nexus, and keeping your company directory's groups mapped to roles on a schedule. Those two exist only for a business that already runs its own Microsoft directory, and each one takes real work per company to run. A lock on the door doesn't, so it isn't priced like one.

Two honest limits. None of this replaces your firewall, your backups or two-step sign-in on your email; it protects what lives in Nexus. And I'm not going to describe how Nexus is built or hosted in a public post, for the same reason you don't post a photo of your alarm panel.

What to do Monday

Two things, whether or not you ever use Nexus.

First, require two-step sign-in on your email and your accounting software today, if it isn't already. Stolen passwords are still the second most common way in.

Second, find out who manages your firewall and ask them one question: can the admin page be reached from the internet? On October 6 the FBI and Secret Service put out a joint advisory about a campaign against one common brand of firewall that steals sign-in details, adds its own admin accounts and sometimes deletes yours. Their fix is less about patching and more about turning off internet-facing admin pages, resetting passwords and checking for accounts you don't recognize. Even if you don't own that brand, the question is worth asking.

If you want the safeguards above around your own work, the Nexus beta opens Monday, October 19, and costs nothing to join: nerthos.com/beta.

Sources

1. Toolradar, SaaS feature paywall report, snapshot of 5,191 tools taken August 4, 2026.
2. Topickz, The SSO Tax Report 2026, 28 tools hand-checked June 7, 2026, published June 20, 2026.
3. Verizon, 2026 Data Breach Investigations Report, summary page.
4. Cyber Readiness Institute, 2026 Verizon Cyber Report: Small Businesses Face Escalating Cyber Threats, June 1, 2026.
5. FBI and U.S. Secret Service, Joint Cybersecurity Advisory JCSA-20261006-01, October 6, 2026.