AI Governance & Security Vendor Wiki

6 min read

Blackpoint Cyber

Primary category: ai-soc-analysts. Also listed in siem-soc.

One-liner — A managed detection and response (MDR) provider sold through managed service providers (MSPs). Its 24/7 SOC watches endpoints, Microsoft 365 / Google identities and cloud, and acts on threats itself. CompassOne, its platform, adds asset inventory, vulnerability and posture management, and a compliance-oriented SIEM.

What it does — Blackpoint sells a managed service, not software your team runs. The core is a 24/7 SOC that takes action on threats (isolating endpoints, locking compromised accounts) instead of only sending alerts. Its homepage claims it locks a Microsoft 365 account “every 30 minutes” on average (unsourced). Service lines: Endpoint MDR, Cloud MDR, Managed EDR, and Blackpoint ITDR for Microsoft 365, Google Workspace and Cisco Duo. CompassOne (launched 2025) is the platform around the service. Its modules are Security Posture Rating, Asset Inventory, Vulnerability Management, Cloud Posture, Application Control, a Tenant Administrator for MSPs that manage many clients, and SIEM (Logging & Compliance). The SIEM is described as real-time event collection with automated mapping for compliance logging. That is why it is cross-listed in siem-soc. It appears to be a logging module of the MDR platform, not a standalone SIEM competing with splunk or microsoft-sentinel.

What AI it claims (vendor marketing). The site says the SOC is “human-led, AI-accelerated”, the MDR has “AI-enhanced alerts for rapid threat detection and response”, and it promotes “Blackpoint AI” with the tagline “AI that acts in seconds. Human expertise that built it.” No technical detail was found on what the AI does: which models, which steps of triage or response are automated, or how much analyst review there is. Treat it as an MDR with some automation, not as an AI-SOC product in the sense of dropzone-ai or prophet-security. It sits in ai-soc-analysts under the 2026-10 decision to put MDR providers there.

Naming / provenance — Founded 2014 by Jon Murchison, a former NSA computer operations expert. The company says it was founded by “former NSA cybersecurity experts”. Earlier coverage calls its technology SNAP-Defense; current branding is Blackpoint MDR and CompassOne. HQ is unverified. Directories disagree between Ellicott City, Maryland and Denver, Colorado. The 2025 CEO release is datelined Denver, and a 2024 release called Denver its “second office”.

Ownership & viability — independent, private and growth-equity backed. A $190M growth investment led by Bain Capital Tech Opportunities, with Accel, was reported 2023-06-09. Existing backers Adelphi Capital Partners, Telecom Ventures, Pelican Ventures and WP Global Partners also took part. Directory totals of $201M to $214M disagree, so funding_total is left null. Leadership has changed: Gagan Singh (ex-McAfee, Norton, Avast) became CEO on 2025-06-23, Murchison became Executive Chairman, and a new CFO was named in April 2026. The CEO release lists “M&A” in the remit. Three years after a Bain growth round, a sale to a larger security or MSP-tooling vendor is plausible. Precedents are zscaler buying Red Canary and N-able buying Adlumin (see adlumin). For an end customer the risk is that the MSP’s service terms change.

Positioning & differentiators —

  • Channel-only, MSP-first. Unlike reliaquest or esentire, which sell to enterprises directly, Blackpoint is “partner-first”. Most buyers get it through their outsourced IT provider. Its closest peers are Huntress, Arctic Wolf and N-able’s adlumin (no wiki pages for the first two).
  • Responds, not just alerts. The pitch is that the SOC acts on its own: “outcomes, not just alerts”. Every MDR says this, so check the response actions and authority in your contract.
  • A bundled posture stack. CompassOne puts asset inventory, vulnerability management, cloud posture and a compliance SIEM in the same console. Small firms get one vendor. Larger firms will already own better tools for each piece.

Who should choose them / anti-fit — Fits a small fund or family office whose IT is outsourced to an MSP that already resells Blackpoint, and that wants 24/7 response coverage without hiring security staff. Anti-fit: a firm with its own security team and an enterprise SIEM. It will want direct vendor contracts, log retention it controls, and detection content it can tune, and Blackpoint’s channel model and bundled SIEM are not built for that. It is also a poor fit if you need to buy direct rather than through an MSP (whether direct contracts exist is unverified).

Known weaknesses / gotchas — Survey write-in (2026-10): written into Q46 SIEM/Logging by 2 respondents, both in production. That likely reflects its CompassOne SIEM / logging module or the MDR as a whole. AI claims are marketing with no detail. HQ, certifications and customer counts are not stated on primary pages. When you buy through an MSP, your contract and SLAs are with the MSP, not with Blackpoint.

Deployment & data handling — SaaS plus an endpoint agent (Managed EDR / application control), with API connections to M365, Google Workspace and Duo. Endpoint, identity and log telemetry is processed in Blackpoint’s cloud and SOC (data_leaves_tenancy: true). Residency, retention, and whether telemetry is used for AI training are unverified. Out-of-band, so there is no inline latency.

Integrations & partnerships — M365, Google Workspace, Cisco Duo (ITDR). An Integrations module exists, but no full list was checked. MCP support unverified. Channel is MSPs.

Compliance & FS traction — A Trust Center is linked, but no certifications were named on the pages fetched. No named FS customers. The two production respondents (hedge-fund / PE-heavy sample) are the only FS evidence.

Commercial — Not public. Sold through MSP partners, who set end-customer pricing.

Open questions

  • What “Blackpoint AI” actually automates (triage? response? reporting?), and whether customer telemetry trains its models.
  • SOC 2 / ISO 27001 status (Trust Center not reviewed).
  • HQ (Maryland vs Denver) and current funding total.
  • CompassOne SIEM retention periods, and whether it is sold standalone.
  • Whether firms can contract directly, or only through an MSP.

Sources

History

  • [2026-10-24] Page created and researched. Added because of Oct-2026 CTO survey write-ins under Q46 SIEM/Logging (2 respondents, both in production). Primary set to ai-soc-analysts per the 2026-10 decision placing MDR providers there; siem-soc cross-list for the CompassOne SIEM module.

Graph View

Backlinks