Ruxie: Expel’s AI SOC manager

Expel’s AI SOC Manager, Ruxie, orchestrates how AI is applied across the lifecycle so AI can handle the heavy lifting across the full threat lifecycle—ingesting signals from your security stack, enriching alerts with context, correlating related events, and automating investigations end-to-end for lower-risk findings. Ruxie works with human analysts by providing them a complete picture so they can make faster, better-informed decisions. AI handles speed. Humans handle judgment—no shortcuts.

An AI SOC model puts autonomous systems in charge of planning, investigating, and responding to threats with minimal human involvement until the AI determines it can’t fulfill its goal. Some vendors propose replacing human analysts entirely with agentic SOC analysts that can plan, investigate, respond, and adapt autonomously. The result puts humans as an overseer of AI instead of actively involved. A human-led AI SOC flips that model: AI handles the data processing and grunt work, while experienced analysts make the consequential calls when judgment is required. In an AI-augmented SOC, human analysts focus on the findings AI surfaces—exercising judgment on threat status, authorizing response, and managing complex investigations that require contextual knowledge and creative thinking. Expel’s approach is the latter: AI as a force multiplier, not a substitute for human expertise.

Agentic AI refers to systems that can autonomously pursue goals, take sequences of actions, and adapt their approach based on feedback, without requiring human direction at each step. The key distinction in responsible deployment is that agentic AI accelerates and informs human decisions rather than replacing them at high-stakes decision points.

AI platforms can process data fast, but they don’t bring context, judgment, or accountability. AI is only useful if you give it the right job to do—it isn’t some mystical force that fixes everything. Using an AI SOC platform still requires humans-in-the-loop to review, provide feedback, and handle escalations for decisions the AI can’t make autonomously. To get it to a working state requires time, patience, and a lot of hands-on work by expert analysts. With an MDR service, the service provides that expert oversight and tuning. MDR pairs AI speed with human expertise across the full threat lifecycle: detection, investigation, response, and continuous improvement. Expel’s model is designed with a human in the loop to ensure every investigation our expert SOC analysts close makes the AI smarter and the detections sharper. And unlike typical black-box MDRs, Expel Workbench™ shows AI-driven explanations of every step analysts and bots take. The result is faster outcomes and stronger security posture over time, not just faster alert processing.