An open-source alternative to Blackpoint Cyber, for MSPs that run the SOC themselves

What each product is

Blackpoint delivers MDR backed by its own 24/7/365 SOC, a team the company describes as staffed by former NSA, DIA, and CIA operators. CompassOne, its platform, bundles security posture, asset inventory, ITDR, and the LogIC streamlined SIEM; the Standard tier includes 365 days of log storage.

SocTalk is an Apache 2.0 licensed AI-first SOC platform you install and operate yourself. One control plane runs a dedicated Wazuh manager and indexer per customer on your own Kubernetes, on storage you own and size. The AI triages, investigates, and proposes; escalations and external actions go to your team's review queue.

How response works

Blackpoint markets a human-led, AI-accelerated SOC that responds actively on the partner's behalf. Its AI SOC Agent, launched July 2026, autonomously contains high-confidence identity threats in Microsoft 365 and Google Workspace, with a reported average containment under 2 minutes.

SocTalk treats containment as a human decision. The AI renders verdicts, but isolating an endpoint or disabling an account is always a proposal a named analyst approves; no autonomous mode exists. One design removes the wait for partner approval, the other keeps every external action behind your team's sign-off.

Deployment

Blackpoint is cloud-delivered SaaS with a proprietary agent, sold through partner agreements and the Pax8 marketplace; no self-hosted option is described in its public materials. SocTalk runs on stock Kubernetes 1.30+, from k3s on a single VM to on-prem clusters to EKS, AKS, or GKE, and works air-gapped. A demo VM boots in minutes; production installs take about an hour.

Pricing and terms

Blackpoint's pricing is not published; quotes come through partner agreements. Contract terms and data-export-on-exit terms are likewise not documented publicly. SocTalk is free under Apache 2.0, with no license fee, per-endpoint charge, or community versus enterprise split. You pay for infrastructure and LLM tokens; a managed SocTalk Cloud option exists. There is nothing to cancel on exit, since the data (Postgres, Wazuh indexes, audit logs) already lives on your cluster.

Where Blackpoint is the better fit

Blackpoint supplies the SOC staffing itself. A real 24/7/365 human team detects and responds on your behalf, and nights, weekends, and holidays are their staffing problem.

Speed on identity attacks is another. SocTalk's analyst-approval gate is a deliberate design choice and does not attempt the unattended sub-2-minute containment Blackpoint reports.

Packaging is also simpler. Agent, SOC service, and LogIC SIEM ship as one product family from a vendor with an annual SOC 2 Type II audit, report available under NDA through its Trust Center, provisioned through channels MSPs already use. No cluster to build, no stack to operate.

Where SocTalk differs

Your analysts keep delivering the SOC while the AI compresses the work. Deterministic ingest filters resolve much of the noise before any model call, routine cases auto-close, and the same team handles roughly 5-10x the alert volume. Customer relationship, data plane, and delivery stay with you.

Human control is structural. Escalations always pass human review, guardrail policies can only make triage stricter, and every decision lands in an append-only audit log. With self-hosted software there is no vendor attestation to inherit; your own audit logs, per-tenant isolation, and compliance export support SOC 2-style audits of the operation. Models are per-tenant choices, from Anthropic to OpenAI-compatible endpoints to fully local Ollama with no data leaving your infrastructure.

The economics are inspectable. Wazuh is fully open source, there is no SocTalk platform license, and the recurring costs are your own infrastructure and LLM tokens, and local models can take the token spend to zero. Leaving is a helm uninstall rather than a contract event.