Blumira's SOC Auto-Focus and MSP Program Updates: Practical Wins for Operations
Blumira has launched SOC Auto-Focus, an AI-powered investigation tool that helps security and IT teams respond to threats with more speed and clarity. The company also rolled out major updates to its MSP Partner Program to give providers more flexibility, scale, and training support-without adding headcount.
AI that supports analysts, not replaces them
Much of the market sells automation as a replacement for people. Blumira took a different route. "We asked ourselves what the primary security considerations are when using AI in a security operations workflow," said Matt Warner, Co-founder and CEO at Blumira. "The error we often see is accepting the overpromises of its capabilities."
Auto-Focus is built to enrich context so humans make faster, better decisions. It pulls from Blumira's detection rules, proven workflows, and attack pattern data to explain what's happening, why it matters, and what similar activity usually means. As Warner put it, "Auto-Focus augments human judgment, not replaces it."
Blumira also leans into transparency and control to beat "AI fatigue." "A perfect tool that teams are reluctant to use isn't a useful tool at all," Warner said. Each finding includes a clear workflow, giving less-experienced admins a path to action while they learn on the job.
This approach meets a real workforce problem: limited budgets, thin teams, and fewer junior hires getting hands-on reps. The latest ISC2 workforce study highlights these constraints, reinforcing the need for tools that build skill while improving outcomes. See ISC2's Workforce Study.
What operations teams can expect from SOC Auto-Focus
- Faster triage: Context-rich findings reduce back-and-forth and shorten time-to-response.
- Explainable outcomes: Clear "what/why/typical" guidance builds trust and creates an audit trail.
- Skill transfer built in: Step-by-step workflows upskill junior staff and reduce dependency on a few senior SMEs.
- Consistent execution: Findings map to best-practice workflows, improving repeatability across shifts and teams.
MSP Partner Program: flexibility without extra headcount
Blumira's updated MSP Partner Program focuses on how providers actually operate. New tiered editions remove annual commits and support different business models. That means you can scale offerings with less contract friction.
Partner enablement got a major boost. The new Partner Portal expands onboarding, training, and support. Providers get guidance on using the MSP Portal for a quick view across all client accounts and on configuring those accounts to match client needs.
For cost-sensitive clients, Blumira added a Respond Core package. It delivers core detection and response with shorter retention periods, giving MSPs a lower-commit option without sacrificing essentials.
Channel strategy and compliance enablement
MSSPs and MSPs face rising client demands from compliance and the growing misuse of AI by attackers. Many can't hire a fresh team of experts. Blumira's model helps providers meet requirements with the people they already have, while growing in-house expertise over time.
Partner tiers evolve with a provider's maturity and include ongoing education. Blumira is also expanding support for CMMC Level 1 and Level 2, including a comprehensive program and shared responsibility matrices to speed up certification efforts. Learn more about CMMC at the DoD's official page: CMMC Overview.
Operational takeaways
- Set decision boundaries: Use Auto-Focus for context; keep final decisions with analysts. Document this in your runbooks.
- Integrate workflows: Map Auto-Focus steps to ticketing, paging, and comms so actions move without stalls.
- Track what matters: Measure MTTA/MTTR, false positives, and escalations by shift to prove value and refine rules.
- Develop bench strength: Assign juniors to handle low-to-medium findings using the built-in guidance to build confidence.
- Plan for compliance: Use partner resources and responsibility matrices to map features to CMMC controls.
- Right-size retention: Choose Respond Core for clients that don't need longer-term storage; upgrade where audits demand it.
If you're building AI literacy across operations and security, explore practical training by role and function: AI Courses by Job. For structured upskilling, see Popular AI Certifications.
Your membership also unlocks:
