Blackpoint Cyber

A SOC that takes action

Blackpoint's managed detection and response service pairs its own detection technology with a security operations center that runs around the clock. When it sees suspicious activity, its analysts investigate and act to neutralize the threat on behalf of the MSP partner, instead of leaving the response to the partner.¹ Its CompassOne platform adds identity threat detection for Microsoft 365, Google Workspace and Cisco Duo accounts, cloud posture monitoring, vulnerability management, application control, SIEM logging and an asset inventory.⁵

In one case Jon Murchison described in 2025, attackers took over a Microsoft Intune global administrator account and used it to push RedLine Stealer malware to several endpoints. Blackpoint's SOC spotted unusual PowerShell activity coming from Intune within minutes, isolated the affected machines and found further compromised accounts.⁶

No public prices

Blackpoint sells mainly through managed service providers and says that to protect its partners' pricing it does not list rates on its website. Prices come from a form on its pricing page.³ An end customer pays whatever its MSP charges for a bundle that includes Blackpoint, so the cost of the service itself is hard to compare with providers that publish a per-endpoint price.

Bain backing and a new CEO

Jon Murchison, a former National Security Agency computer operations specialist, founded Blackpoint in 2014.¹ In June 2023 it took a $190 million growth investment led by Bain Capital Tech Opportunities, with Accel, after raising $26 million before that.¹² In August 2024 it opened an office in Denver, Colorado, saying it had more than 200 employees.⁴ In June 2025 Gagan Singh, a former chief operating officer of McAfee, became CEO, and Murchison moved to the new role of executive chairman.²⁷

How it compares with Huntress and Expel

Huntress also sells to small businesses through MSPs, but it publishes a suggested retail price per endpoint. Expel sells directly to larger companies and works on top of the security tools they already own. Blackpoint sits closer to Huntress in its buyers and closer to Expel in how much the SOC does on its own, including live response inside Microsoft 365.

Who should look elsewhere

Companies without an MSP, or that want to contract for detection and response directly, will need another provider. Reviewers have asked for better Linux support and a clearer interface, so teams with many Linux servers should test coverage before signing.