In short: Blackpoint MDR is a 24/7 endpoint managed detection and response service. Blackpoint's patented agent and its Microsoft Defender integration feed a human-led, AI-assisted SOC that isolates compromised devices and stops attacks as they happen. It is quoted on the endpoints you protect and your CompassOne package.
What Blackpoint MDR is
Blackpoint MDR puts a security operations centre behind your endpoints. Its agent watches for the behaviour attackers show once they are inside a network: lateral movement between machines, misuse of privileged accounts and abuse of legitimate IT and remote access tools. When activity is confirmed as malicious, the SOC uses active response to contain it, typically by isolating the device and stopping the malicious processes, and then tells us what happened.
Two things shape Blackpoint's approach:
- It acts, not just alerts. The SOC is built to contain threats itself at any hour rather than handing a ticket to someone who is asleep.
- It focuses on attacker tradecraft. Detection concentrates on how intruders move and use legitimate tools, which catches attacks that do not rely on a known piece of malware.
Blackpoint MDR is delivered on the CompassOne platform and can be combined with Blackpoint ITDR for identities.
What the Essentials MDR package includes
Blackpoint's entry package for endpoints, CompassOne Essentials MDR, includes:
| Included | What it means for you |
|---|---|
| 24/7 SOC with active response | Confirmed threats are contained at any hour |
| MDR with the Blackpoint EDR agent | Blackpoint's own detection on each device |
| RMM and agent support | The agent is deployed and maintained through standard tools |
| Microsoft Defender and Windows Security integration | Defender alerts are watched by the SOC as well |
| Security Posture Rating and asset inventory | A score and a list of what you have, to track over time |
| Some endpoint security integrations | Wider coverage arrives on Core and Standard |
Identity protection is not part of Essentials MDR; it is in Essentials ITDR and in the higher packages. On Core and Standard the same agent also supports vulnerability management and application control.
How Blackpoint MDR is licensed
Blackpoint MDR is quoted on the endpoints you protect, meaning each laptop, desktop or server running the agent, together with the CompassOne package.
| Option | What it adds |
|---|---|
| Essentials MDR | 24/7 endpoint MDR, Defender integration, posture rating and asset inventory |
| Core | Adds ITDR, vulnerability management, Cloud Posture and application control |
| Standard | Adds network integrations and SIEM with 365 days of log storage |
Blackpoint offers monthly or annual pricing, and we confirm the term with your quote. If you already license Microsoft Defender for Endpoint through Microsoft 365, Blackpoint works with it rather than replacing it, so you are not paying for a second antivirus. Those Microsoft licences are handled by Forever Group's Microsoft licensing team. Ask us for a quote for your endpoint count.
Requirements and deployment
- Operating systems: Windows and macOS laptops, desktops and Windows servers
- Deployment: the agent is pushed out through your RMM or device management tool; no on-premises server is needed
- Microsoft Defender: optional but recommended; Blackpoint's agent adds detections Defender Antivirus alone may miss, and the SOC acts when Defender does not contain a threat
- Response preferences: who the SOC should notify and how, agreed with us at setup
On the Standard package, firewall and network logs can be collected through integrations, which helps spot an attacker using stolen remote access credentials.
Who Blackpoint MDR suits and how we help
Blackpoint MDR suits organisations with servers and a mix of devices who want 24/7 containment without building a SOC, particularly those already invested in Microsoft Defender. It is also a common answer to cyber insurers asking for round-the-clock monitoring.
We deploy the agent, check Defender is configured properly, agree response preferences and make sure SOC notifications reach us out of hours. After an incident we handle the clean-up: rebuilding or cleaning the device, resetting credentials and closing the gap that let the attacker in. Endpoint numbers and renewals are managed on your normal invoice. Compare other services in EDR, XDR and MDR.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How is Blackpoint MDR priced?
Blackpoint does not publish prices. MDR is quoted on the number of endpoints running the agent and the CompassOne package, on monthly or annual terms. Ask us for a quote for your numbers.
Does Blackpoint MDR replace my antivirus?
No. Blackpoint works alongside Microsoft Defender rather than replacing it. Its own agent adds detection of attacker behaviour, and the SOC watches Defender alerts too.
Which devices does Blackpoint MDR cover?
Windows and macOS laptops and desktops, and Windows servers, through the Blackpoint agent. Tell us about any other systems you run and we will confirm current support before you buy.
Will Blackpoint isolate a device without asking?
The SOC is designed to contain confirmed threats straight away, typically by isolating the device and stopping malicious processes, and then notify us. We agree contacts and notification preferences with you during setup.