Blackpoint Cyber, DefenseStorm, Guardz and Huntress

About DefenseStorm

DefenseStorm sells a cyber risk management platform designed exclusively for U.S. banks and credit unions. DefenseStorm backs its platform with a 24X7 Collaborative SOC of banking-fluent cybersecurity analysts. DefenseStorm cites 200+ banks and credit unions alongside 16,000+ banking-specific controls mapped across industry control frameworks, regulatory guidance, and exam procedures.^[1]

DefenseStorm governs its AI capabilities with seven Built for Banking AI Principles, mapped to NIST AI RMF and CRI FS AI RMF. DefenseStorm states that every AI output is explainable to a non-technical professional. DefenseStorm describes AI capability as growing step by step, under explicit policy, with human-in-the-loop boundaries. DefenseStorm says 12 years of banking-only threat patterns, examiner expectations, and industry control frameworks inform every AI output.^[1]

DefenseStorm offers managed detection and response (MDR) built for the attack patterns, industry control frameworks, and operational realities of financial institutions. DefenseStorm states that a US-based, senior banking-fluent cybersecurity analyst collaborates with the customer on a case, 24x7x365. DefenseStorm analysts work alongside AI-enhanced triage to investigate with banking context and generate structured evidence for governance reporting. DefenseStorm describes a co-managed approach in which customers view configuration logs showing how their environment is monitored 24/7 by DefenseStorm cybersecurity experts.^[4]

GRID Active Threat Surveillance gathers and analyzes data from all types of sources, technology, tools, and systems and identifies threats in the customer's environment. GRID Active Threat Surveillance now includes an Incident Similarity feature that applies machine learning to incident monitoring and management. Customers can add EDR functionality and Vulnerability Management Services, both integrated with the GRID Active platform, to their cybersecurity risk management solution. DefenseStorm vulnerability scanning lets customers assess their system and discover weaknesses an adversary may be able to exploit. Employee Activity Monitoring is included with Threat Surveillance and monitors user access, permissions and actions. DefenseStorm integrations can include tools for intrusion detection, firewalls, threat intelligence platforms, and identity and access management systems. DefenseStorm has a team of cybersecurity experts covering implementation, product training and ongoing platform support. A DefenseStorm security engineer who began in 2020 developed DefenseStorm's EDR Service. DefenseStorm appointed its Director of Cyber Threat Intelligence in 2022, and that role is responsible for nearly all facets of the EDR service. DefenseStorm uploads IOCs related to a vulnerability into its ThreatMatch Feed.^[1][4][5][6]

DefenseStorm turns every alert, investigation, and decision into structured evidence mapped to CRI Profile, NIST CSF 2.0, and exam procedures. DefenseStorm offers continuous control monitoring across 16,000+ controls. DefenseStorm risk scoring is shaped by real alerts and incidents. DefenseStorm governance aligns to FFIEC examination procedures, GLBA Safeguards requirements, the NIST Cybersecurity Framework (including CSF 2.0), NCUA expectations, and the CRI Profile.^[7]

GRID Active Risk Assessment and Governance Package aligns an institution's risk and governance to evidence the effectiveness of control in its risk assessment. GRID Active Risk Assessment and Governance Package lets institutions filter risk assessments to create smaller assessments such as an eBanking risk assessment, or one large information security risk assessment encompassing all risks in the register. Pre-mapped Task Schedule templates schedule program activities, and the activities map into framework and self-assessment directives as evidence. DefenseStorm lets customers schedule governance and monitoring activities to align with their cyber security compliance program cadences. GRID Active Reporting lets financial institutions customize reports based on audience and timing. DefenseStorm's governance product is integration-ready across core banking, digital banking, authentication, and cloud platforms.^[1][4][7][8]

DefenseStorm unifies threat operations, risk intelligence, governance, and AI in GRID Active, its intelligent data engine. DefenseStorm states that one provider replaces separate SIEM, EDR, SOC, risk assessment, vulnerability management, brand management, security awareness training, and governance tools. DefenseStorm runs risk and governance on the same platform as its threat operations. DefenseStorm's governance product connects cyber risk assessments, control monitoring, evidence collection, and board reporting into one continuous program.^[7]

DefenseStorm describes its solution as co-managed, cloud-based and compliance-automated, designed specifically for the cyber threat and compliance demands facing the financial services industry.^[1][4][7]

About Guardz

Guardz sells an MSP-ready security platform that brings identity, endpoint, email, data, awareness, and exposure protection together. Guardz says attackers move across identities, email, endpoints, web, and data. Guardz connects the entire workspace through a unified data fabric, enabling autonomous detection, investigation, prioritization, and response. Guardz describes one data fabric with three layers, including intelligence that learns and agents that triage and respond. Guardz says it automatically correlates signals across customer environments so a team can see what matters, act faster, and show the value behind each action.^[1][2]

Identity Threat Detection & Response (ITDR) verifies MFA and security settings, and benchmarks and analyzes user behavior to flag suspicious activity. ITDR monitors identity behavior across the cloud to detect unusual activity, correlate risk signals and trigger targeted responses. Guardz natively integrates with M365 and GWS to run analysis across the most critical cloud logs without complex integrations or service accounts. Guardz lets teams suspend compromised accounts and isolate users in a single action to contain attacks before they spread.^[2]

Guardz offers AI-native EDR with SentinelOne embedded and Managed AV with Windows Defender, which Guardz says ensure real-time protection across devices. SentinelOne provides the endpoint engine, and Guardz makes it operational across clients. Managed AV supports Windows and Macs, while SentinelOne EDR supports Windows, Mac and Linux. Kill, Quarantine, Remediate, Roll-Back and Isolate Device can be automated, triggered by the MSP or executed by the MDR team. SentinelOne licenses are included in the Ultimate Plan, and alerts are managed by the Guardz MDR team. Guardz agents can be deployed through RMM and MDM flows with minimal end-user involvement. Alerts from Guardz can be sent through email and syslog into existing workflows.^[2]

AI runs response playbooks at machine speed to contain threats and automate remediation, with 24/7 MDR experts handling cases that need human investigation and action. MDR adds human investigation and response around the clock.

Guardz email protection uses an API-based and AI-native engine to prevent credential theft, ransomware, and impersonation threats in real time. Check Point Harmony powers Guardz Email Security, stopping email threats with connected security operations for MSPs across clients. Cloud Data Protection works by analyzing user activity and behavior within cloud applications to identify and prevent threats. Guardz scans the settings, security configurations, user activity logs and token grants of cloud applications through public APIs.^[2]

Guardz offers web security through a browser extension that escalates risk around employees exposed to malicious sites, web redirects, and unsafe extensions. Prisma Browser for Business uses the context of the active browsing session to detect and block threats as users encounter them. Guardz connects browser blocks and policy events with identity, email, and endpoint activity. Guardz scans for open ports and public exposures to prevent malicious actors from accessing vulnerable and outdated services. Guardz continuously monitors the internet for leaked credentials and exfiltrated data.

Guardz offers pre-scheduled security awareness training that alters behavior and limits human-driven cyber risks before they escalate. Guardz helps teams plan, launch and track automated training campaigns that boost employee vigilance and shut down human-driven risks. Campaign frequency can be set monthly, bi-monthly, or quarterly. Guardz Phishing Simulation empowers MSPs to run lifelike, AI-generated attacks tailored by tone, industry, and language. Training videos and phishing simulations are available in more than 70 languages. Failed simulations trigger an awareness issue, and admins can assign instant training.^[2][14][15]

Guardz builds its platform for MSPs. Guardz lets MSPs centrally navigate the security of multiple clients, either aggregated or in their unique individual environments. MSPs can set global configurations once and push them across every client, with automated detection and remediation working continuously in the background. Prospecting Reports scan a client's public-facing assets to uncover security gaps. Evidence mapping reports how Guardz security controls align with frameworks like SOC 2, ISO 27001, HIPAA, and GDPR. Guardz client reports are delivered monthly, quarterly, or on-demand and highlight threats, risk, and mitigation activity.^[1][3][16]

About Huntress

Huntress products are built to protect organizations of all sizes. Huntress security experts manage endpoints and identities for over 285K organizations.^[4]

Huntress Managed EDR provides 24/7 coverage with human threat hunters who validate threats. Huntress Managed ITDR is designed to detect, respond to and resolve identity-based threats such as account takeovers, business email compromise and unauthorized logins. Huntress Managed ITDR covers the continuous monitoring side of identity and access requirements in Microsoft 365 and Google Workspace. Huntress Managed ITDR detects identity-based techniques such as adversary-in-the-middle attacks, business email compromise and MFA bypass.^[1][5][6]

Huntress Managed ITDR is built to detect existing malicious inbox rules from the moment a tenant is onboarded. Huntress telemetry includes signals from both Azure Active Directory and Microsoft Exchange, covering events from role escalations to suspicious inbox rules and mailbox permission updates.^[7]

Learning Mode previews policy impact before anything changes.^[3]

The Huntress Managed SAT platform provides short episodes featuring storylines that train learners on security awareness topics. The Huntress team can fully manage a customer SAT program, including creating, curating and scheduling learning. Huntress builds monthly learning plans and phishing campaigns based on the threats compromising people every day. Huntress Managed SAT integrates with email, Slack and Microsoft Teams to notify users about learning assignments. Huntress Managed SAT syncs with an identity provider to keep employees updated in the Huntress platform. Huntress offers a Custom Content Creator Tool for training teams on elements of the business that go beyond SAT. Huntress Managed Security Awareness Training for GDPR teaches employees about GDPR privacy compliance in less than 10 minutes. Huntress Phishing Simulated Training corrects users in the moment when they fail a phishing test.^{[1][3][4][5][8][9]}

Inside the Huntress 24/7 SOC, a proprietary AI-powered investigation system assists with investigating, correlating and summarizing, while in-house analysts own the decisions that demand human expertise. Athena is built to work alongside the human SOC experts at Huntress. Athena gathers context, connects telemetry and drafts incident reports before a human looks at the investigation. Athena groups behavior across endpoints, identities, logs and users into a single investigation. More than 40 specialized agents run the same playbooks and guardrails the Huntress analysts use. Huntress states that AI is a tool to augment human expertise, not replace it. The Huntress Adversary Tactics and SOC teams work together by hunting, tracking and analyzing novel threats around the world.^[1][11]

Huntress makes compliance support accessible to all businesses, including those undergoing CMMC Level 2 audits. Huntress combines managed endpoint, identity and log monitoring with 24/7 AI-centric SOC review. Managed SAT tracks whether employees complete training, flags risky behaviors and produces participation records. Huntress is channel-first, and most teams purchase Huntress through a partner. Huntress offers partner pricing to MSPs and resellers through its partner program. Huntress pricing is based on the number of endpoints, identities, learners and data sources.^{[1][3][6][7][8][10]}