Blackpoint Cyber

1.1 Identity and operating model

Blackpoint Cyber is described across its public materials as a cybersecurity provider built for managed service providers and small and medium-sized businesses. Its offer combines managed detection and response, identity threat detection and response, a 24/7/365 human-staffed security operations center, and the CompassOne platform. The company’s own description emphasizes investigation, containment, and remediation rather than alert forwarding. Independent comparison material also characterizes Blackpoint as channel-exclusive, with no direct-to-business purchase path, while noting that its pricing is custom quoted. The available evidence does not establish a founding date, headquarters, legal domicile, or current corporate stage with sufficient precision.[CO001, CO002, CO003, CO004]

1.2 Leadership, workforce, and governance signals

Public evidence identifies Gagan Singh as CEO and names Wil Santiago as SVP of Security Operations and Mike Estep as Chief Client Officer in company materials. A current IT Operations Lead posting describes a player-coach role supporting approximately 230 team members across a distributed workforce, which is an operational workforce signal rather than a verified company-wide headcount. The same posting describes identity, endpoint, compliance, and vendor responsibilities, suggesting that security operations and corporate controls require specialized internal ownership. No assigned source provides a complete executive roster, board composition, founder names, or a verified record of leadership changes, so key-person dependence and governance depth remain open diligence items.[CO005, CO006, CO007, CO008]

1.3 Financing, scale, and evidence limits

One employer-distributed job listing says Blackpoint is in hyper-growth mode and refers to a recent $190 million Series C round, but the assigned evidence does not independently identify the round date, lead investors, post-money valuation, debt, or proceeds available to the business. Company pages make scale claims such as more than 1,800 MSP partners and telemetry from nearly a million accounts or endpoints; these are company-reported marketing metrics and are not equivalent to audited customer count, ARR, revenue, or retention. The public materials also do not disclose current valuation, revenue run-rate, gross margin, net retention, or total raised on a basis that can be verified here.[CO009, CO010, CO011, CO012]

1.4 Milestones and current direction

The evidence trail shows a company moving from a human-led MDR identity toward an AI-accelerated operating model. Company materials describe more than a decade of SOC intelligence and current CompassOne integration, while a July 8, 2026 release announces a generally available AI SOC Agent for identity threats in Microsoft 365 and Google Workspace. The release claims average containment in under two minutes and as little as 21 seconds, but those are company-reported performance claims rather than an independent benchmark. A separate comparison identifies a Linux-agent gap as of 2026, making platform coverage a concrete diligence question for MSPs with mixed operating systems. The timeline therefore combines dated evidence and explicitly labels undated historical gaps.[CO013, CO014, CO015, CO016]

1.5 Exhibits

2.1 Market boundary and substitutes

The investable boundary is channel-delivered managed detection and response for managed service providers and their small and midsize business clients, with endpoint MDR as the entry product and identity, cloud, logging, posture, and application-control capabilities as adjacencies. This boundary excludes direct enterprise MDR demand that bypasses an MSP, self-managed antivirus or EDR sold without a managed response layer, and broad cybersecurity spending unrelated to continuous detection and containment. The principal status-quo substitute is an MSP building its own round-the-clock SOC, which requires analysts, shift coverage, and tooling. Point solutions and alert-only services are additional substitutes, but they leave investigation and response labor with the MSP.[CM001, CM002, CM003, CM004]

2.2 Evidence-constrained sizing

The assigned evidence supports a layered opportunity, not a dollar market estimate. The broadest relevant pool is MSP-served organizations that need outsourced security operations; Blackpoint's reachable core narrows to MSPs willing to standardize on a channel-only, contain-first MDR vendor. Monetization then depends on protected endpoints and identities, while expansion depends on attach rates for cloud, logging, posture, and related modules. Public third-party sources describe indicative per-endpoint pricing, but Blackpoint does not publish a list price or minimum, and the evidence set contains no independent count of eligible MSPs, managed endpoints, identity seats, or module adoption. A numeric TAM, SAM, or SOM would therefore create false precision.[CM005, CM006, CM014, CM015, CM016]

2.3 Buyer, user, payer, and adoption path

The economic buyer is normally the MSP owner, security practice leader, or service-delivery executive; SOC and technical teams evaluate integrations, response authority, and operating visibility; and the MSP pays the vendor before packaging the service for end customers. Small and midsize businesses are the protected users and ultimate economic beneficiaries but generally access Blackpoint through the partner. Adoption is triggered when an MSP cannot economically staff continuous response, wants to reduce alert-handling work, or wants to consolidate endpoint, identity, cloud, and logging coverage. The channel-only model can lower Blackpoint's direct selling burden, but it also makes partner enablement, packaging, and incumbent stack replacement central to conversion.[CM001, CM002, CM003, CM009, CM013]

2.4 Growth drivers, constraints, and valuation relevance

Demand is supported by identity attacks, out-of-hours response requirements, limited MSP staffing, and pressure to consolidate overlapping security tools. Blackpoint's July 2026 launch extends autonomous response to Microsoft 365 and Google Workspace, which can broaden identity attach opportunities, but its speed and telemetry claims are company-issued rather than independent benchmarks. Adoption can be slowed by quote-only pricing, separate add-ons, absent public response SLAs, limited buyer control over autonomous actions, operating-system coverage gaps reported by third parties, and the switching work required to displace an incumbent stack. Valuation should therefore be tied to verified partner growth, protected endpoints and identities, gross retention, module attach, and realized pricing—not a generic cybersecurity TAM.[CM007, CM008, CM009, CM010, CM011, CM012, CM016]

2.5 Exhibits

3.1 Competitive landscape and buyer choice

The relevant competitive set is broader than named MDR vendors. Blackpoint's direct peer set includes Huntress and other MSP-channel MDR providers; incumbents include endpoint and security platforms that add managed services; adjacent alternatives include Guardz's unified MSP security stack and provider-led offerings such as Sophos MDR, while substitutes include an MSP's own SOC, alert-only tools, traditional antivirus, and internal security operations. The independent Netalith comparison describes Blackpoint and Huntress as two different response-model bets: Blackpoint acts on high-confidence threats first, whereas Huntress reviews alerts before they reach the customer. Guardz's competitor-authored alternatives guide broadens the shortlist to thirteen providers and explicitly frames response authority, coverage, SLA visibility, and price visibility as selection dimensions. These are buying criteria, not independent proof that any provider is superior.[CP001, CP002, CP003, CP004]

3.2 Competitor profiles and capability trade-offs

Blackpoint's strongest defensible positioning in the assigned evidence is a channel-first operating model with a 24/7 SOC and active containment. Its own materials claim endpoint, cloud, and on-premises coverage and describe a SOC that acts rather than only alerts; the company also announced an AI SOC Agent for Microsoft 365 and Google Workspace identity threats in July 2026. Huntress is the closest directly documented peer: the Netalith comparison describes a channel model, human-reviewed alerts, published direct pricing, and Linux coverage, while Blackpoint pricing is quote-only in that comparison. Guardz presents an adjacent alternative with endpoint, email, identity, and MDR in one MSP console and configurable approval controls. The evidence does not establish independently comparable detection rates, retention, customer scale, or contract economics.[CP005, CP006, CP007, CP008, CP009]

3.3 Switching costs, distribution, and moat durability

Distribution is a central competitive variable because Blackpoint sells through MSPs and MSSPs rather than through a direct-to-business path, according to the Netalith comparison. That channel focus can improve partner workflow fit and resale packaging, but it also narrows the addressable buying motion and makes partner relationships a dependency. Technical switching costs are likely to arise from agent deployment, integrations, identity and endpoint policy, response runbooks, and the trust placed in autonomous containment; the available sources document integrations and response actions, but do not quantify migration time, churn, multi-homing, or partner concentration. Huntress's broader OS coverage and approval-oriented response model can appeal to buyers prioritizing control or Linux, while Blackpoint's contain-first model can appeal to buyers prioritizing speed. These trade-offs suggest a moat based on workflow and trust, not an independently proven technology monopoly.[CP010, CP011, CP012, CP013]

3.4 Displacement risk and diligence judgment

The market is moving toward platform consolidation and AI-assisted response, which raises both opportunity and commoditization risk. Blackpoint's July 2026 release claims identity containment in less than two minutes on average and as little as 21 seconds, supported by a human-oversight model; those figures are company claims, not an independent benchmark. Guardz's alternatives guide reports vendor-stated response and coverage comparisons across a larger field, but it is published by a competitor and includes Guardz, so it should be treated as a directional buying guide rather than independent validation. The assigned evidence contains no public Blackpoint price sheet, audited detection benchmark, customer retention series, or quantified partner concentration. A buyer should therefore test response authority, Linux and cloud coverage, integrations, realized pricing, contract terms, and outcome evidence in a pilot before concluding that Blackpoint's speed translates into durable pricing power.[CP014, CP015, CP016]

3.5 Exhibits

4.1 Revenue model and monetization

Blackpoint sells through MSPs and MSSPs rather than a direct-to-business checkout, so the economic unit is a partner deployment and its enabled endpoints, identities, logs, and services. Public descriptions identify 24/7 MDR and ITDR as core offerings, with CompassOne tiering Essentials, Core, and Standard. The official platform page says Standard adds SIEM with 365 days of log storage, while some integrations have additional terms and fees. This supports a recurring subscription and expansion model, but it does not establish realized revenue, ARR, renewal rates, discounting, or revenue recognition. The company describes more than 1,800 MSPs protected and tens of millions of security events ingested daily; those are company-claimed operating indicators rather than audited customer or revenue figures.[CI001, CI002, CI003, CI004, CI005]

4.2 Cost structure and unit economics

The delivery model is service-intensive: Blackpoint combines software, telemetry, autonomous response, and a human SOC. The official platform describes a shared security platform and tiered packaging, while a current IT operations posting describes support for approximately 230 team members and a distributed workforce. These inputs suggest operating leverage may depend on telemetry scale, analyst productivity, infrastructure, and support costs, but no public source supplies gross margin, SOC cost per protected account, CAC, payback, churn, or partner take rate. Pricing evidence is especially limited: a competitor comparison states that Blackpoint pricing is custom and not publicly listed, and labels third-party ranges as directional. Underwriting therefore needs contract-level realized price, endpoint and identity volumes, implementation cost, and service-level obligations.[CI006, CI007, CI008, CI009, CI010]

4.3 Capital adequacy and underwriting verdict

Blackpoint announced a $190 million growth investment in June 2023, led by Bain Capital Tech Opportunities with participation from Accel and existing investors. The company said the proceeds would fund further security-technology development and enable MSP partners to address a changing threat landscape. FundedIQ independently records one Series C of $190 million and a 101–250 employee band, while a current job posting describes approximately 230 team members; the differing granularity is a reminder that headcount is not a cash-flow proxy. No assigned source reports cash on hand, current burn, runway, debt, project-finance obligations, or a next-round trigger. The financial verdict is therefore positive on disclosed capital access and product breadth, but low-confidence on valuation, margin path, and capital adequacy until management provides a current model and financing terms.[CI011, CI012, CI013, CI014, CI015, CI016]

4.4 Exhibits

5.1 Customer workflow and delivered service

Blackpoint's product is not only an alert feed. Its public product material describes a managed workflow in which endpoint, identity, and email signals are monitored by a 24/7 SOC, investigated, and converted into response actions. The customer-facing outcome is containment and an incident record rather than a queue of alerts for an MSP to triage. The Brivy description gives concrete examples: endpoint signals from SentinelOne, identity signals through Microsoft Entra and Petra, and email-compromise indicators are watched; response can isolate endpoints, disable accounts, revoke sessions, and open a timeline. It also says investigations are documented in ConnectWise, which is useful for insurer or auditor evidence but is not itself proof of incident outcomes. Cyber Buyer describes SNAP-Defense as the proprietary security-operations and incident-response platform, while a current third-party directory lists cloud response, logging with context, ransomware response, and multi-tenant operation. These sources establish the operating model, not a quantified detection rate or contractual response SLA.[CE001, CE002, CE003, CE004]

5.2 Modules, integrations, and architecture

The public product map has several layers: a core MDR/SOC service; endpoint and network telemetry; identity and cloud response; logging and compliance context; and the MSP control plane. Cyber Buyer identifies SNAP-Defense and a separate LogIC logging-with-integrated-compliance service, including a self-service web application for event and log collection. A third-party directory lists integrations with NinjaOne, ConnectWise, Datto, Kaseya, Pax8, Microsoft 365, and Google Workspace, but the listing is not an implementation specification and should not be treated as evidence that every integration has identical response depth. A Blackpoint job posting provides additional operational evidence for the company's own environment: Entra ID, Intune, Jamf, Auth0, SCIM, Datto RMM, and deployment of the Blackpoint agent through Datto RMM. That posting is a company job repost and therefore company-issued evidence, not independent product validation. The architecture is best understood as a managed, multi-tenant service with integration-dependent telemetry and actions rather than a fully documented public API stack.[CE005, CE006, CE007, CE008]

5.3 Maturity, deployment, and roadmap

Blackpoint's 2022 SOC slick sheet says the managed detection and response service can be installed and protecting a business within a matter of days, and describes a centralized SOC that monitors endpoints, networks, assets, and locations. Those are vendor claims about onboarding and operating scope, so diligence should test time-to-value across representative MSP estates, not assume the claim is a service-level commitment. The July 2026 launch adds a generally available AI SOC Agent for identity threat detection and response. Blackpoint says the agent covers Microsoft 365 and Google Workspace, acts on high-confidence threats, and retains human SOC oversight and escalation. It reports an average containment time of less than two minutes and as little as 21 seconds, but these figures are company-reported and the reviewed source does not provide a denominator, test protocol, or independent benchmark. The roadmap therefore shows meaningful expansion from endpoint MDR toward identity and cloud context, while public evidence does not establish production reliability, rollback behavior, service availability, or change-control performance.[CE009, CE010, CE011, CE012]

5.4 Trust, safety, and technical diligence

The product's main technical advantage is operational authority: its SOC can act on selected high-confidence threats instead of waiting for an MSP to approve every containment step. That design may reduce dwell time, but it makes false-positive controls, auditability, reversibility, escalation, and customer-specific policy boundaries central diligence questions. Blackpoint's launch material says the AI agent was trained using analyst decisions, breach forensics, and telemetry from nearly a million accounts, and that it was validated before deployment; those are company claims rather than an independently reproducible safety evaluation. The reviewed evidence also does not disclose public uptime targets, incident-history statistics, penetration testing, certification scope, data-retention rules, tenant-isolation architecture, or a complete API and export specification. A buyer should require those artifacts, test identity and endpoint containment in a controlled pilot, confirm supported operating systems and cloud tenants, and obtain written responsibility boundaries for remediation and recovery. The assigned pool's critical product evidence consists of an independent comparison and a competitor-authored alternatives page, neither of which is an independent technical benchmark. The principal product risk is therefore an evidence gap, not a finding that the controls are absent.[CE013, CE014, CE015, CE016]

5.5 Exhibits

6.1 Buyer, user, and payer segments

The consistent commercial pattern is channel-led rather than direct-to-business. Blackpoint's MDR page says the service is purpose-built for MSPs, while the FutureSafe partnership describes MSPs using Blackpoint to deliver enterprise-level protection to SMB clients without an in-house security team. This creates at least two customer layers: the MSP or MSSP that buys, packages, and operates the relationship, and the SMB or mid-market end customer whose endpoints, cloud environments, and identities are protected. ToolsInfo similarly describes Blackpoint as an outsourced SOC for MSP clients and lists multi-tenant operation, integrations, and support features. That structure can support efficient partner distribution, but public sources do not quantify partner concentration, end-customer concentration, average contract value, or attach rates.[CU001, CU002, CU003, CU004]

6.2 Adoption trajectory and proof quality

Public adoption evidence is strongest at the channel and service-design level. The company states that more than 1,800 MSPs worldwide have transformed their security operations with its unified approach, and that it processes tens of millions of security events daily; both are company-reported metrics without a disclosed denominator, time series, or independent audit. FutureSafe provides a partner-side account of working with Blackpoint since January 2024 and describes integration, 24/7 monitoring, and white-glove support. Blackpoint's 2026 ITDR announcement adds a named customer quotation from STF Consulting, while the company site quotes Liberty Technology's vCISO on real-time response. These references demonstrate named partner or customer advocacy, but they do not establish production scope, paid-seat count, renewal, or outcome attribution.[CU005, CU006, CU007, CU008, CU009]

6.3 Durability, expansion, and concentration risks

The product and channel design offers a plausible expansion loop: an MSP can start with managed detection and response, add endpoint and cloud coverage, and extend into identity threat detection and response. The MDR page describes incident insights feeding future security improvements across a client base, while the 2026 announcement says the AI SOC Agent is included with all ITDR service tiers. However, this is a product packaging and workflow hypothesis, not measured land-and-expand performance. No assigned source reports NRR, GRR, churn, renewal rates, cohort behavior, contract length, satisfaction scores, or the share of revenue from the largest partners. A comparison article also says Blackpoint does not publish pricing and sells through MSPs/MSSPs, so procurement friction and partner dependence remain material diligence items.[CU010, CU011, CU012, CU013, CU016]

6.4 Exhibits

7.1 Risk ranking and investment relevance

Blackpoint's principal risk is not simply whether its detection technology works; it is whether a channel-dependent security operation can sustain fast, safe response while scaling across heterogeneous MSP environments. The reviewed evidence describes a 24/7 SOC, autonomous containment, identity coverage, and a unified platform, but most performance evidence is company- or vendor-reported rather than independently audited. That makes response authority and false-positive control central underwriting questions. The company also appears to depend on MSP distribution, partner economics, and integrations with customer identity and endpoint estates. These dependencies can accelerate reach, but they can also amplify churn, implementation, and reputational effects when a deployment fails. Investment monitoring should therefore emphasize independently verified incident metrics, contractual service terms, partner concentration, and the financial capacity to remediate a serious event.[CR001, CR002, CR003, CR004]

7.2 Regulatory, legal, and trust exposure

The public record reviewed here does not establish a specific enforcement action, lawsuit, or breach involving Blackpoint during the current run. That absence is not evidence that no such event exists. The more immediate legal and regulatory exposure follows from the product's authority to isolate endpoints, terminate processes, contain networks, disable accounts, and act on cloud identities. A false positive, incomplete remediation, or delayed escalation could create customer loss, contractual claims, privacy questions, and compliance consequences. Public product listings identify SOC 2 and SOC 2 Type II, while a current company job posting describes CMMC Level 2 and SOC 2 Type 2 control work inside the company; these are signals of control coverage, not independent certification evidence for every customer deployment. The diligence path is to obtain current attestations, exclusions, incident-notification terms, indemnities, cyber insurance, and a sample of post-incident reports.[CR005, CR006, CR007, CR008]

7.3 Operational, technical, and partner dependencies

Blackpoint's operating model concentrates risk in the SOC, the response automation boundary, and the MSP channel. The company's current AI SOC Agent release says it can contain identity threats in less than two minutes on average and as little as 21 seconds, based on company training and telemetry; those figures are promising but should not be treated as an SLA or independent benchmark. A third-party comparison likewise reports company response averages and notes that Blackpoint has no Linux agent as of 2026, which could constrain mixed-OS or server-heavy deployments if confirmed in a technical evaluation. The channel-only model adds a second layer of dependency: MSPs control packaging, customer communication, and often the commercial relationship. A material outage, integration failure, or partner dispute could therefore propagate across many end customers. A pre-investment pilot should test rollback, human escalation, unsupported operating systems, identity-provider failure, logging continuity, and the division of remediation responsibility.[CR009, CR010, CR011, CR012]

7.4 Financial resilience, monitoring, and thesis-break triggers

Public evidence does not disclose current revenue, growth, gross margin, net retention, burn, runway, or customer concentration, so financial-model risk cannot be scored precisely. A current job repost describes a recent $190 million Series C and approximately 230 team members, but these are company-representative hiring materials rather than audited financial statements. Private-company opacity matters because security operations require skilled staffing, resilient infrastructure, insurance, and ongoing product integration; a margin squeeze or slower partner expansion could reduce the ability to invest in all of them at once. The thesis should be monitored with measurable indicators: independently verified containment and false-positive rates; incident severity and notification timeliness; partner retention and concentration; gross margin and cash runway; service availability; and the share of deployments requiring unsupported or bespoke integrations. A thesis-break event would be a material security incident with inadequate disclosure or remediation, repeated SLA failures, a partner concentration shock, or evidence that autonomous actions create customer harm exceeding the value of speed.[CR013, CR014, CR015, CR016]

7.5 Exhibits

8.1 Investment case and anti-thesis

Blackpoint's investment case is a channel-specific operating model rather than a disclosed financial-growth story. Independent directories describe a 24/7 human-led MDR service for MSPs and their SMB and mid-market customers, while the company describes an AI-plus-human identity response capability. The evidence suggests differentiated response authority and bundled platform scope, but most performance claims remain company- or directory-reported. The anti-thesis is that channel concentration, opaque pricing, absent retention and margin data, and unverified customer economics can make strategic differentiation difficult to translate into an underwritten return. A track recommendation therefore reflects quality of the product thesis without assuming that the financing price is attractive.[CV001, CV002, CV003, CV004, CV005]

8.2 Price discipline and financing context

The public financing record is incomplete and internally inconsistent across third-party sources. StartupHub records $197 million of total funding and a $190 million Series C on June 8, 2023; Growth Engineer reports $214 million total raised while also listing an unknown Series D. Neither source establishes post-money valuation, share price, liquidation preferences, debt, dilution, or the current capital structure. Pricing is similarly opaque: a competitor comparison says Blackpoint uses custom partner quotes and does not publish pricing, while another directory reports an $8–15 per-endpoint range without an independently verified contract sample. These gaps preclude a defensible revenue multiple, DCF, or target return today. [CV006, CV007, CV008, CV009, CV010]

8.3 Scenarios, exit readiness, and diligence gates

A bull case requires evidence that MSP distribution converts into durable, expanding recurring revenue with acceptable gross margins and low concentration, while the AI and human SOC model improves response economics without increasing liability or false-positive costs. The base case is a differentiated but privately opaque growth company that merits monitoring rather than immediate underwriting. The bear case combines undisclosed terms with pricing pressure, partner or customer concentration, slower commercialization, or a down-round after growth expectations reset. The current record does not support probability-weighted dollar valuations, so the scenarios use decision gates and valuation discipline instead of false precision. A financing decision should wait for a current cap table, cohort metrics, audited or management financials, and customer concentration data.[CV011, CV012, CV013, CV014, CV015, CV016]

8.4 Exhibits