In short: Blackpoint CompassOne is Blackpoint Cyber's security platform. Essentials gives you 24/7 MDR or ITDR with a posture rating and asset inventory. Core combines MDR and ITDR and adds vulnerability management, Microsoft 365 configuration management and application control. Standard adds SIEM with 365 days of log storage.
What CompassOne is
CompassOne is the platform Blackpoint Cyber launched in 2025 to bring its services together. Before it, Blackpoint customers used the Blackpoint Response portal for MDR; CompassOne keeps the same 24/7 SOC and detection technology and adds the prevention and visibility features that reduce how often the SOC needs to act.
The building blocks are:
- Managed detection and response (MDR) for endpoints, with active response from a human-led, AI-assisted SOC
- Identity threat detection and response (ITDR) for Microsoft 365, Google Workspace and Cisco Duo
- Security Posture Rating, a score for each organisation built from its assets, findings and integrations, so you can track progress over time
- Asset inventory of devices, identities, applications and SaaS accounts
- Vulnerability management that prioritises weaknesses by how much they matter in your environment, with dark web monitoring included
- Cloud Posture, which monitors Microsoft 365 settings and alerts when security configuration drifts or is weakened
- Application control, blocking risky and abused applications using rules curated by Blackpoint's SOC, in monitor-only or blocking mode
- SIEM for logging and compliance, with real-time event collection
Integrations connect CompassOne to PSA, firewall, password management and vulnerability tools, with availability depending on the package.
CompassOne packages compared
| Feature | Essentials ITDR | Essentials MDR | Core | Standard |
|---|---|---|---|---|
| 24/7 SOC, Security Posture Rating and asset inventory | Yes | Yes | Yes | Yes |
| ITDR for Microsoft 365, Google Workspace and Cisco Duo | Yes | No | Yes | Yes |
| MDR with the Blackpoint EDR agent | No | Yes | Yes | Yes |
| Microsoft Defender and Windows Security integration | No | Yes | Yes | Yes |
| Vulnerability management, including dark web monitoring | No | No | Yes | Yes |
| Cloud Posture for Microsoft 365 | No | No | Yes | Yes |
| Application control | No | No | Yes | Yes |
| Endpoint security integrations | No | Partial | Yes | Yes |
| Vulnerability management integrations | No | No | Yes | Yes |
| Network security integrations, such as firewall logs | No | No | No | Yes |
| SIEM with 365 days of log storage | No | No | No | Yes |
Essentials is offered for ITDR, MDR or both, so you can start with the area where you feel most exposed. Core is the first package that brings endpoint MDR and identity ITDR together with the prevention features. Some integrations carry extra terms and fees, and Blackpoint can change the package contents, so we always quote against the current package sheet.
How CompassOne is licensed
A CompassOne quote is made up of:
- the package: Essentials (ITDR, MDR or both), Core or Standard
- the number of endpoints running the Blackpoint agent for MDR
- the number of user accounts protected by ITDR in Microsoft 365, Google Workspace or Cisco Duo
- any integrations that carry their own fees
Blackpoint offers monthly or annual pricing. If your numbers are stable, a committed term is worth comparing with a monthly one, and we set out the options side by side. Moving from Essentials to Core or Standard later does not mean starting again: the agent and identity connections stay in place. Ask us for a quote.
Requirements and deployment
- Endpoints: the Blackpoint agent is deployed to Windows and macOS devices through your RMM or device management tool, and works alongside Microsoft Defender and Windows Security.
- Identities: an administrator authorises Blackpoint against your Microsoft 365, Google Workspace or Cisco Duo tenant through a short guided set-up.
- Integrations: on Standard, firewall and network logs (for example from Sophos Firewall, Palo Alto Networks or Ubiquiti UniFi) can be collected into the SIEM; password manager events, such as those from LastPass, can also be brought in.
- Cloud Posture and vulnerability scanning are switched on from the console on Core and Standard.
No on-premises server is needed; CompassOne is a cloud platform.
Who each package suits
- Essentials suits organisations that need 24/7 detection and response on either endpoints or identities, with a clear posture rating, and already handle patching and vulnerability scanning elsewhere.
- Core suits most growing businesses: endpoint and identity coverage together, with vulnerability management, application control and Microsoft 365 configuration checks in one console, means fewer tools and a clearer fix list.
- Standard suits organisations that must keep security logs for compliance, insurers or customers, and want a SIEM without running their own.
For more on each service see Blackpoint MDR and Blackpoint ITDR.
How we help
We scope your endpoints, accounts and existing tools, recommend a package and quote the available terms. We deploy the agent, connect identity platforms and integrations, and agree response preferences with you. Each month we review the posture rating and vulnerability findings with you and carry out fixes if you want us to. Licence changes and renewals sit on your Forever Systems invoice. Browse more vulnerability management tools.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between CompassOne Essentials and Core?
Essentials covers either ITDR or MDR (or both), with the 24/7 SOC, a Security Posture Rating and asset inventory. Core includes both MDR and ITDR and adds vulnerability management with dark web monitoring, Cloud Posture for Microsoft 365, application control and more integrations.
Does CompassOne include a SIEM?
Yes, in the Standard package. It adds SIEM logging and compliance reporting with 365 days of log storage, on top of everything in Core.
Is CompassOne replacing Blackpoint Response?
Yes. Blackpoint is moving customers from the Blackpoint Response portal to CompassOne, which keeps the same SOC coverage and adds prevention and posture features. If you run Blackpoint Response today, we can plan the move.
Can I buy CompassOne for identities only?
Yes. CompassOne Essentials ITDR covers Microsoft 365, Google Workspace and Cisco Duo identities without the endpoint agent, and you can add endpoint MDR later.