The Question Every Growing MSP Eventually Faces
For Net Friends, “Our Power Is Our People” is the operating principle behind nearly three decades of IT, infrastructure, and cybersecurity work for legal, insurance, and other compliance-driven clients. The Durham, North Carolina-based MSP has resolved 1.25 million support tickets and earned two spots on the Channel Partners MSP 501 list.
For nearly a decade, that commitment included a 12-person, award-winning in-house Security Operations Center. Following a client acquisition, CEO John Snyder faced a decision familiar to maturing MSPs: continue scaling the team internally or deliver the same standard of protection through a dedicated partner.
In late 2024 and early 2025, Net Friends discovered that identity attacks had become the dominant threat across its client base, concentrated in off-hours and long weekends. Security awareness training and EDR tools alone were proving ineffective, and many days involved multiple P1 security incident tickets due to credential theft. John anticipated that clients would need a stronger defense capable of operating 24/7/365 without overburdening the internal team.
A Deliberate Evaluation
Net Friends was deliberate about what a partner needed to deliver. The company sought a human-led SOC, integrations with tools it already used or planned to adopt, including Microsoft Defender, and evidence of effective technology, mature processes, and long-term expertise.
Net Friends evaluated Huntress, Petra, and other MDR vendors against those criteria, consulting trusted security practitioners along the way.
Net Friends ultimately chose Blackpoint for its respected SOC and product portfolio, which offered a path to expand and strengthen customers’ security postures over time.
“My clients trust me to make the best decision for them, to choose vendors that run their businesses well, maintain strong trust centers, and undergo rigorous audits and certifications,” John said. “Blackpoint is absolutely one of the decisions I’m most proud of.”
True to Net Friends’ people-first philosophy, John repositioned his analysts to lead client relationships and triage, while Blackpoint’s SOC assumed round-the-clock detection and response as an extension of the internal team.
Proof From Day One
Net Friends runs Compass One Essentials for ITDR and MDR, monitoring compromised credentials and suspicious activity alongside malware. Their team works directly with Blackpoint’s SOC to tune detection for clients with unique needs, like frequent travelers. That collaboration reduces false alarms without sacrificing the ability to catch real account takeovers, making Blackpoint feel like an extension of the team rather than a vendor.
The value of that coverage became clear on the first day with a new customer. After CompassOne Essentials for ITDR was deployed, it detected two breaches that predated the client’s relationship with Net Friends, one that included using stolen credentials to redirect a payroll payment. The discovery confirmed John’s concern that inherited client environments could contain serious, undetected threats.
In April 2026, CompassOne Essentials for MDR flagged a suspicious DLL that signaled an early-stage intrusion attempt on a workstation and immediately isolated the endpoint. Net Friends and the SOC then cleaned the device, traced the entry point, and returned it safely to production within minutes, while John’s team remained in control of the client relationship.
Security as a Business Advantage
Compass One’s consolidated dashboard saves Net Friends an estimated 10–15 hours each week by reducing the time spent checking separate portals. Every attack caught by ITDR and MDR can also prevent an incident that might otherwise require 10-20 hours of a senior technician’s time to investigate and remediate.
Those time savings compounds. Net Friends can redirect them to client onboarding, service improvements, and proactive security work.
The benefits extend to monthly reporting as well. CompassOne provides client-ready reports, which Net Friends quickly customizes through the API to give each customer a personalized view of their IT environment, cybersecurity posture, and compliance status.
Looking Ahead
With identity driving most cyberattacks, John sees ITDR as an essential layer of modern security, and Blackpoint as the partner that helps Net Friends stay ahead as threats evolve. His advice to other MSPs? Bring a security partner in from the moment a new client comes on board. That proactive approach strengthens client protection, gives the team more time to focus on relationships, and ensures expert coverage is always in place.
“I don’t know what risks will emerge in 2027, but I’m confident that partners like Blackpoint will stay ahead of evolving trends and help me mitigate new risks in the months and years ahead.”
