Who does what
Provider
- Monitor and investigate supported threats
- Isolate endpoints within agreed authority
- Disable accounts within agreed authority
Your team
- Deploy agents and maintain integrations
- Set tenant policies and response authority
- Handle remediation, recovery and client communication
Coverage
- Endpoints
- Identity & Access
- SaaS Applications
Details
Service scope
Best for MSPs wanting active endpoint and identity containment for SMB clients
Response authority
The SOC can isolate endpoints and disable accounts within the purchased scope and agreed permissions. The buyer or MSP retains recovery and business decisions.
Package coverage
Essentials MDR and Essentials ITDR are distinct. Core combines endpoint and identity services with additional controls, while Standard adds SIEM and 365-day log storage.
Channel terms
The May 2025 Essentials sheet describes monthly terms. The reseller agreement defaults to 12 months unless the order states otherwise, so confirm the current order and renewal conditions.
Full service analysis
Blackpoint's CompassOne MDR analysts investigate and isolate affected endpoints, with account disabling available when identity response is included. The buyer or MSP maintains agents and connectors, sets response authority and owns recovery and client communication.
- Your team owns
- Deploying and maintaining agents, cloud connectors and supported integrations
- Setting response authority, notification preferences and tenant-specific policies
- Handling remediation, recovery, user communication and business-owner decisions after containment
- Managing MSP-client packaging, billing and service-level expectations
- Validating whether LogIC and reports satisfy the buyer's audit or insurance requirements
Response scope
The containment lane follows documented analyst actions. It does not assign every daily SOC responsibility to Blackpoint or make out-of-scope recovery part of MDR.
Package boundary
The current CompassOne table distinguishes Essentials MDR from ITDR. Core and Standard combine more capabilities. Do not apply the broad suite description to an endpoint-only order.
Terms boundary
Historical monthly Essentials packaging and the current reseller agreement describe different defaults. Confirm the signed order instead of assuming one universal commitment.
Compliance boundary
SOC 2 is an assurance report. HIPAA support includes an available BAA and GDPR support includes processor terms. These do not certify the customer environment.
Pricing & contract
- Billing
- Custom, Tiered
Request a package-specific channel quote covering endpoint and identity quantities, integrations and SIEM. The May 2025 Essentials sheet offers monthly terms, but the reseller agreement defaults to 12 months unless the order specifies otherwise. Confirm current term and renewal conditions.
Tradeoffs & buying questions
Strengths
-
Documented endpoint isolation and account disabling
-
Multi-tenant operation for MSP clients
-
Endpoint and identity packages can be combined
Considerations
-
Endpoint and identity coverage must be scoped separately
-
SIEM and some integrations require higher packages or fees
-
Buyers retain recovery, policies and client communication
Ask before buying
- Which containment actions can Blackpoint run automatically for our tenants or environment?
- Which endpoint, identity, cloud and PSA integrations are included in the quoted package?
- How do MDR Essentials, Core, Standard and add-on modules change coverage, retention and commitment terms?
Customer feedback
Customers value
-
December 2025 G2 MSP reviewers describe prompt containment and useful SOC support.
-
Reviewers value combined endpoint and Microsoft 365 investigations within their selected services.
Reported concerns
-
2025–2026 G2 reviewers describe support-portal changes and configuration training needs. Some reviews were incentivized.
-
A December 2025 Essentials trial account on Reddit reported limited incident notes. Verify the evidence and reporting available in your package.
Integrations
Platform / SIEM
- CompassOne SIEM (Standard package)
Endpoint
- Blackpoint EDR Agent
- Microsoft Defender
Cloud
- Microsoft 365
- Google Workspace
Other integrations
- Cisco Duo
- Microsoft Entra ID
Common questions
Does Blackpoint Cyber only alert customers?
No. This profile classifies Blackpoint as Contain threats because official MDR and SOC pages support human-led active response, including containment actions such as endpoint isolation and account disabling when those actions are in scope.
Is Blackpoint Cyber pricing public?
Request a current quote from the provider or MSP. Confirm the package, protected quantities, integration fees and order term. Historical monthly Essentials material is not a substitute for the signed order.
Does Blackpoint Cyber replace a full SOC?
Not by itself. Blackpoint provides 24/7 MDR monitoring, investigation and containment through its SOC, but the buyer or MSP still owns deployment, connected telemetry, response authority, remediation, recovery and client or business communication.
Company details
- Founded
- 2014