Jon Murchison Came Back to the Keyboard

The most revealing thing a founder can surrender is not a title. It is distance. In June 2025, Jon Murchison stopped being chief executive of Blackpoint Cyber, the company he had started eleven years earlier, and became its executive chairman. The move might have looked like a familiar piece of corporate choreography: experienced operator arrives, founder moves upstairs, everyone uses the word “scale” until the press release runs out of breath. Murchison described a more interesting bargain. Gagan Singh would run the company. Murchison would move closer to product design, cyber response operations and the managed service providers who use what Blackpoint makes.

It was a peculiar promotion toward the machinery. For a man whose career began with networks, the logic was sound. Blackpoint had grown large enough that leading it meant spending less time with the problems that had made him build it. International expansion, acquisitions and a new platform demanded an executive who enjoyed scaling the institution. Murchison wanted to stay near the signal.

The first systemHe started with the network

Before cybersecurity became an industry of glossy maps and menacing red dots, Murchison was interested in the plain plumbing of computing. He started in network engineering and IT operations. Building networks, he has said, was the fascination. The job offered a satisfying combination: strict rules, hidden dependencies and the permanent possibility that one small change would produce an entirely different result.

After college, he considered the military or the intelligence community. The National Security Agency won. Murchison spent more than twelve years planning and executing high-priority national security missions as a computer operations specialist. His concise description of the work is better than any cinematic version: he operated like an adversary, looking for weaknesses, exploiting networks and using offensive techniques on behalf of the right side.

“The actual task of catching hackers isn't the toughest part; it's building a world-class organization.”Jon Murchison

That education left him with an asymmetrical view of defense. Attackers do not care how a security team has arranged its vendor contracts. They care about the credential that opens a door, the machine that creates a bridge and the quiet sequence of actions that lets them travel. A defender staring at ten separate consoles may own ten respectable products and still miss the story connecting them.

Murchison's commercial thesis followed from that observation. Detection should focus on behavior and movement, not wait politely for known malware to announce itself. Response should happen while the incident is alive. The software should provide context, and a security operations center should be able to act. This became the core of Blackpoint's managed detection and response model.

The second systemA company is another network

Blackpoint was founded in 2014 by Murchison and other veterans of U.S. defense and intelligence work. Its early identity centered on SNAP-Defense, a security operations and incident response platform built to expose malicious behavior, including lateral movement inside a network. Customers could use the product or consume it as a round-the-clock managed service. The arrangement paired software with people who could interpret and respond.

Then the founder discovered that organizations possess their own lateral movement. An idea passes from engineering to marketing, from marketing to a partner, and from the partner to a customer whose patience has a very different half-life. Every handoff can distort the signal. Murchison has called go-to-market work both art and science. He also gives it a military-flavored name: the Green Beret Go-to-Market Model.

The phrase is theatrical, but the model is practical. Managed service providers already know IT. Blackpoint tries to strengthen the surrounding business: pricing, packaging, education, customer acquisition and service delivery. The company sells through these partners, so their fluency becomes part of the product. A brilliant alarm that nobody can explain, sell or support remains a very clever orphan.

Capital amplified the test. Blackpoint raised $6 million in 2018 and announced Series B financing in 2020. In June 2023, Bain Capital Tech Opportunities led a $190 million growth investment with participation from Accel. The number is arresting. Murchison's response to it was less champagne than checklist. He spoke about fundamentals, hiring and execution. Money can widen a company's options; it cannot decide among them.

His hiring philosophy sounds like something borrowed from a locker room, but it carries an engineer's respect for tolerances. Put the right players on the field, he says, and even an ordinary strategy can work. Put the wrong ones there and a fine plan becomes an expensive diagram. For Blackpoint, the standard extends beyond résumés. A managed response service operates when its customers are asleep, frightened or both. Judgment has to survive the night shift.

The loud dashboard problemSeeing more is not seeing clearly

Murchison is unusually direct about security fashion. He has criticized traditional security information and event management systems as useful for compliance while often inadequate for stopping hackers. He resists applying zero-trust controls everywhere simply because the slogan sounds responsible. In dynamic environments, rigid application controls can turn every printer driver and Windows update into a small bureaucratic crisis. Security exists to support the operation, he argues, and friction without genuine risk reduction is merely expensive irritation.

His recurring target is fragmentation. Endpoint, identity and cloud systems may each produce a score, an alert and a bill. An attacker sees one environment. When a compromised cloud administrator can use a management service to push malicious software onto local machines, the categories beloved by vendors collapse in seconds. The defense has to follow the same path in both directions.

CompassOne, introduced in 2025, is Blackpoint's attempt to draw those fragments into one operating picture. It combines security posture with response, bringing asset discovery, vulnerability information, cloud context and managed detection closer together. The promise is not a prettier collection of warnings. It is a clearer decision about what requires action now.

A real incident Murchison has discussed makes the abstraction less tidy. Attackers compromised a Microsoft Intune global administrator account and used it to distribute credential-stealing malware across endpoints. Blackpoint's operations team spotted unusual PowerShell activity, isolated machines and worked with the customer to disable the malicious policy. Cloud Response found additional compromised accounts. The episode crossed identity, cloud management and local devices in minutes. Any defense arranged as three unrelated departments would have spent precious time introducing them.

This is why Murchison talks about the attacker's “how” more than the “who.” Attribution may satisfy curiosity and support later investigation. During an active intrusion, method is the usable fact. Which credential changed? Which administrative tool moved next? Which host suddenly behaved like an employee with impossible ambitions? The route matters before the return address.

“From day one, my passion has been grounded in product design, strategy, cybersecurity response operations and engaging directly with our MSP partners.”Jon Murchison, on becoming executive chairman

Fast company, slow lessonThe practitioner refuses to disappear

Murchison's advice to aspiring security executives is stubbornly unfashionable: remain an active practitioner and build a strong foundation in IT. The recommendation reveals his suspicion of altitude. A leader can rise so far above the system that every problem arrives as a slide, scrubbed of the awkward facts that would have made the answer obvious.

His enthusiasms away from Blackpoint have a similar mechanical quality. He has raced spec Miatas on road courses where roughly three dozen to fifty near-identical cars make equipment a poor excuse. He follows skiing and snowmobiling, listens to music and has happily wandered into podcast speculation about autonomous-vehicle lanes. Curiosity, for him, seems most comfortable when it has moving parts.

A field of equal cars is an appealing metaphor for security, though Murchison would probably object to the neatness. On the track, common horsepower reveals judgment. In a security operations center, tools shared across the market can do the same. The meaningful differences appear in recognition, coordination and the nerve to act before certainty becomes a luxury.

The executive-chairman role gives him room to work on those differences while Singh handles the next stage of organizational scale. Murchison remains involved in high-level strategy, acquisitions, international expansion, cyber response and partner relationships. The founder has not vanished into a ceremonial boardroom. He has moved sideways, toward the parts of the company where his pattern recognition remains most useful.

There is a tidy corporate lesson available here about knowing one's strengths. The messier lesson is better. A founder's most valuable work changes as the company grows, and the grander title may be the smaller job. Murchison spent years learning how intruders move through systems. His latest maneuver applies the same attention to his own organization: remove the bottleneck, put the right operator in the right seat, then follow the signal back to where the action is.