Blackpoint Cyber is a managed detection and response provider sold exclusively through the MSP channel, built around its own SOC platform, CompassOne, covering Microsoft 365, network and endpoint signals with an in-house analyst team that can respond to and isolate threats automatically. Pricing is quoted to MSP partners rather than published.
Listing updated . Checked by MSP Software .
Blackpoint Cyber is a managed detection and response provider sold exclusively through the MSP channel, built around its own SOC platform, now called CompassOne, which covers MDR for Microsoft 365 and network activity alongside endpoint response from Blackpoint's own EDR agent, staffed by an in-house analyst team that can respond to and isolate a compromised device or account without waiting for the MSP to act first. It suits MSPs who want an all-in-one response service covering cloud identity and network signals as well as the endpoint, rather than an EDR agent that only raises alerts for a technician to triage manually. Its network visibility is built on a patented Live Network Map that tracks how devices, accounts and sessions interact in real time, rather than only scanning endpoints in isolation. Because response actions can happen automatically, MSPs should understand what Blackpoint's analysts are authorised to do on their own before an incident occurs, rather than during one.
Pricing is per endpoint or per protected user per month, quoted to MSP partners at wholesale rates rather than published, with the MSP setting its own client-facing price (checked September 2026); Blackpoint also offers a free trial with full platform access and no credit card required. Blackpoint Cyber integrates with ConnectWise PSA and Autotask for automatic ticket creation, plus tools including LastPass, Zscaler Internet Access, Cloudflare and Sophos Firewall for log collection, and its own portal is built for multi-tenant use, so a technician can see response actions taken automatically across every client alongside detections that still need manual review, rather than logging into each client's environment separately. The endpoint agent covers Windows and macOS; there is no Linux agent, so MSPs with Linux servers need a separate tool for those endpoints. Blackpoint Cyber is based in the United States and was founded in 2014. Before buying, confirm exactly which PSA integrations are supported for automated ticketing, and ask what level of automatic response, such as isolating a device or disabling a compromised account, is enabled by default versus requiring MSP approval first, since that changes how much oversight a technician retains during an active incident. It is also worth asking how findings that still need manual review are surfaced to a technician, by email, PSA ticket, or only inside Blackpoint's own portal, since that affects how quickly a lower-confidence detection actually gets looked at.
Field Effect MDR MDR from Field Effect for endpoints, cloud and network, priced $5 to $25 per user a month via quote. No reviews yet · from US$5.00 vs Field Effect MDR
UnderDefense MAXI Vendor-agnostic MDR platform from UnderDefense, starting at $11 per endpoint per month. No reviews yet · from US$11.00 vs UnderDefense MAXI| Feature | Supported | Note |
|---|---|---|
| 24-hour human-staffed SOC | yes | |
| Managed threat response and isolation | yes | SOC can isolate a device or account automatically, without MSP approval first. |
| Own endpoint telemetry agent | yes | Own EDR agent, covering Windows and macOS. |
| Identity threat detection | yes | ITDR module covers Microsoft 365, Google Workspace and Cisco Duo accounts. |
| Network monitoring | yes | Uses Blackpoint's patented Live Network Map. |
| Microsoft 365 monitoring | yes | |
| Monthly threat reporting | unknown | Not confirmed on the vendor site. |
| PSA integration for ticketing | yes | Ticket sync confirmed for ConnectWise PSA and Autotask. |
| Multi-tenant console | yes | |
| Works with third-party EDR | unknown | Current platform pages emphasise Blackpoint's own agent; bring-your-own-EDR support not confirmed. |
| Dedicated incident response | yes |
| Feature | Supported | Note |
|---|---|---|
| Behavioural detection | unknown | |
| Automated remediation | yes | |
| Rollback to pre-attack state | unknown | |
| USB and device control | unknown | |
| Application allow-listing | yes | Separate Application Control module blocks risky applications by policy. |
| Offline protection | unknown | |
| Threat hunting console | unknown | |
| Managed MDR add-on | yes | MDR is Blackpoint's core service built on its own EDR agent, not a separate add-on. |
| SIEM and SOAR integration | unknown | |
| RMM integration | unknown | |
| macOS support | yes | |
| Linux support | no | No Linux agent. |
Blackpoint Cyber's CompassOne platform covers Microsoft 365 and network activity alongside endpoint response, not just the endpoint agent that some competing MDR products are built around. This is one of its main differentiators, giving an in-house analyst team visibility into cloud identity and network signals as well as device-level threats when deciding how to respond to an incident.
Blackpoint's in-house analyst team can respond to and isolate a compromised device or account automatically as part of its managed response, rather than only alerting the MSP and waiting for approval. MSPs evaluating Blackpoint should ask exactly what actions are authorised automatically versus what requires MSP sign-off first, since this affects how much control a technician retains during an active incident.
Blackpoint Cyber integrates with ConnectWise PSA and Autotask for automatic ticket creation, syncing tickets and comments in both directions so detections and response actions appear in an existing service desk queue. Coverage is limited to these two PSAs rather than every platform on the market, so confirm the exact PSA in use is supported before assuming tickets will be created without manual entry.
Blackpoint Cyber is priced per endpoint or per protected user per month, quoted to MSP partners at wholesale rates rather than published as a fixed list price, with the MSP setting its own client-facing price. Blackpoint also offers a free trial with full platform access, so an MSP can test the service before agreeing a rate. Because pricing can be structured either way depending on the modules used, confirm which basis applies before comparing it against another MDR provider's quote.
Yes. Blackpoint Cyber renamed its underlying SOC platform to CompassOne in April 2025, unifying MDR, identity threat detection, vulnerability management, asset inventory and a security posture rating into one console. The company and MSP-facing brand are still Blackpoint Cyber; CompassOne is the name of the platform an MSP logs into, not a separate vendor or product.
Reviews are moderated. How reviews work.
Share what it is like to use this product day to day. Your experience helps other MSPs choose with confidence.
Write the first review
