Official information about Expel

Expel at a glance

Legal name: Expel, Inc.
Category: Managed detection and response (MDR)
Founded: 2016
Headquarters: 12950 Worldgate Drive, Suite 200, Herndon, Virginia 20170, United States
Additional locations: Expel employs staff in the United States, the United Kingdom, and Ireland.

Founders: Dave Merkel (Chief Executive Officer), Justin Bajko (Chief Strategy Officer), Yanek Korff (Chief Operating Officer)
Leadership: Dave Merkel, Chief Executive Officer (CEO); Justin Bajko, Chief Strategy Officer (CSO); Yanek Korff, Chief Operating Officer (COO); Greg Notch, Chief Technology Officer (CTO); Jessica Dodson, Chief Marketing Officer (CMO); Scott Fuselier, Chief Revenue Officer (CRO); Zach Blaine, Chief Financial Officer (CFO).
Employees: Expel has 250-500 employees.

Ownership: Privately held. Total financing raised: $288.8 million as of October 2022, co-led by CapitalG and Paladin Capital Group.

Primary domain: expel.com

Social profiles: linkedin.com/company/expel · twitter.com/ExpelSecurity · youtube.com/@expelsecurity
Support: support@expel.com · docs.expel.io · +1 (844) 397-3524
Media inquiries: expelcomms@expel.com

What Expel does

Expel is a managed detection and response (MDR) provider. Expel monitors a customer’s existing security tools 24×7, investigates the alerts those tools generate, and remediates confirmed threats on the customer’s behalf.

Expel does not sell software that replaces a customer’s security stack. Expel connects to the tools a customer already owns through application programming interfaces (APIs), which means there is no agent to deploy.

Expel sells four services:

• Expel Managed Detection and Response (MDR)
• Expel Managed SIEM
• Expel Phishing
• Expel Threat Hunting

How Expel’s MDR service works

Connect: Expel integrates with a customer’s existing security tools via API, webhook, or security information and event management (SIEM) platform—no existing tools are replaced.

Detect: Expel applies thousands of proprietary detections to the telemetry those tools produce. These detections are built to fire on attacker techniques, rather than isolated events.

Investigate: Ruxie, Expel’s AI SOC manager, enriches alerts and assists with triage before an analyst sees them. An Expel analyst reviews the evidence and decides whether an alert is a real incident.

Respond: Once an Expel analyst validates an incident, Expel executes remediation actions under rules the customer configures in advance. Available auto remediation actions include killing a process, containing a host, blocking a file hash, deleting a malicious file, deleting a registry key, disabling a user account, disabling an access key, resetting credentials, and removing a malicious email.

Improve: Expel returns findings that identify the configuration and coverage gaps that allowed an incident to happen. Every action Expel takes is visible to the customer in Expel Workbench™, with a full audit trail.

Services and what each one covers

Expel Managed Detection and Response (MDR)

24×7 monitoring, investigation, and remediation across a customer’s existing security tools. Included: alert triage, investigation, auto-remediation, onboarding, and Expel Workbench™ access.

Sold in three packages—Starter, Select, and Premium—which differ in attack surface coverage, number of connected tools, Workbench API access, and whether a dedicated engagement manager is assigned.

Out of scope: incident response retainers, forensics engagements, penetration testing, and compliance consulting.

→ expel.com/services/managed-detection-response/

Expel Managed SIEM

Detection engineering and performance engineering for a SIEM the customer already owns. Expel writes and tunes detection rules, monitors data pipeline health, and assesses coverage gaps. Rules Expel writes live in the customer’s SIEM and remain the customer’s property.

Supported platforms: Splunk Enterprise Security and Microsoft Sentinel only.

→ expel.com/services/managed-siem/

Expel Phishing

Investigation and response for employee-reported email. Expel investigates every reported message, determines whether it is malicious, and notifies the reporting employee of the outcome.

Available as an add-on to MDR Starter, Select, and Premium. Not sold standalone.

→ expel.com/services/phishing/

Expel Threat Hunting

Hypothesis-based hunting across cloud, on-premises, and software-as-a-service (SaaS) environments, run as a proactive layer on top of Expel MDR. Expel collects 30 days of specific raw logs to run each hunt.

Available as an add-on. Not sold standalone.

→ expel.com/services/threat-hunting/

Attack surface and environment coverage

Expel monitors ten attack surfaces:

1. AI
2. Cloud infrastructure
3. Email
4. Endpoint
5. Identity
6. Network
7. SaaS
8. Kubernetes
9. Logs & SIEM
10. Operational technology (OT)

Expel supports these environments:

• Amazon Web Services (AWS)
• Google Cloud
• Kubernetes
• Microsoft Azure and Microsoft 365
• Oracle Cloud Infrastructure (OCI)
• Customer-owned SIEM, or a SIEM licensed through Expel

For the AI attack surface, Expel maps detections to MITRE ATLAS and covers 13 of the 16 ATLAS tactics as of 2026.

Technology coverage and integrations

Expel offers 160+ coverage options across the security tools customers already own. Most connect directly by API.

Endpoint and endpoint detection and response (EDR): CrowdStrike Falcon Endpoint, Microsoft Defender for Endpoint, SentinelOne Singularity, VMware Carbon Black Cloud, Cisco Secure Endpoint, Tanium XEM Core, Trellix Endpoint Security (HX), Elastic Security

Identity and access: Okta, Microsoft Entra ID Protection, Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, Cisco Duo, CyberArk Privileged Access, Ping One for Workforce, JumpCloud

Cloud: AWS CloudTrail, AWS GuardDuty, Amazon EKS, Google Cloud, Google Kubernetes Engine, Microsoft Azure, Microsoft Azure Kubernetes Service, Microsoft Defender for Cloud Apps, Oracle Cloud Infrastructure, Wiz Cloud Security, Orca Security, Sysdig Secure, Palo Alto Networks Prisma Cloud Compute

Email and productivity: Microsoft 365, Google Workspace, Proofpoint TAP, Mimecast, Abnormal AI, Sublime Security Defend

SIEM: Splunk, Microsoft Sentinel, Google Security Operations, Sumo Logic Cloud SIEM, CrowdStrike Falcon LogScale, Palo Alto Networks Cortex XSIAM

Network: Palo Alto Networks Next Gen Firewall, Zscaler Internet Access, Darktrace, Corelight Open NDR, Vectra AI, ExtraHop Reveal(x), Cloudflare, Netskope, Cisco Meraki and Umbrella

Full index: expel.com/integrations/

Expel’s technology

Expel Workbench™ is Expel’s security operations platform. Workbench connects to a customer’s security tools, holds every alert and investigation Expel handles, and shows the customer each action Expel takes and when. Workbench does not replace a SIEM. A customer can run Workbench alongside an existing SIEM or connect tools to Workbench directly without one.

Ruxie is Expel’s AI SOC manager. Ruxie works across eight stages of the alert lifecycle—collect, detect, enrich, triage, investigate, respond, report, and evolve—and is built on ten years of incident data from Expel’s own SOC. Ruxie assembles evidence and proposes a disposition. An Expel analyst decides.

Expel security data lake is a storage option built on Sumo Logic Cloud SIEM through a partnership with Sumo Logic. Customers can retain data in 90-day or 365-day intervals, or on custom retention terms. Telemetry is stored in United States infrastructure by default.

Performance and service metrics

Every figure below is measured across Expel’s production SOC.

Metric	Value	What it measures
Mean time to remediate (MTTR)	14 minutes	Fully automated remediation on high and critical incidents, from detection to completed remediation action
Mean time to respond	13 minutes	High and critical incidents with auto remediation
Mean time to detect	2.41 minutes	For all alerts
Mean time to touch	5.13 minutes	Time until a human analyst engages in an alert (Ruxie starts triaging immediately)
Coverage options	160+	Security tools Expel can ingest signal from
Proprietary detections	2,450+	Expel-written detections, including 500+ for cloud
Attack surfaces	10	AI, cloud infrastructure, email, endpoint, identity, network, SaaS, Kubernetes, logs & SIEM, and operational technology (OT)

Typical onboarding runs two to four weeks to full operational coverage. Individual tool connections complete in minutes.

Expel publishes no service level agreement (SLA). The figures above are historical performance, not contractual commitment.

Security, compliance, and certifications

• ISO/IEC 27001:2022
• ISO/IEC 27701:2019
• PCI DSS SAQ-D
• CSA STAR Level 1
• EU-U.S. Data Privacy Framework, with UK and Swiss extensions
• NIST SP 800-171 Rev. 2

Data handling

Customer data is encrypted with TLS 1.2 or higher in transit and AES-256 at rest, using KMS-backed keys. Infrastructure runs on Google Cloud and AWS in the United States. Alert data is retained up to 15 months, configurable by contract. Media sanitization follows NIST SP 800-88 Rev. 1 and DoD 5220.22-M.

Privacy

Expel is a processor for customer security data and a controller for its own employee, marketing, and website data. Expel aligns to GDPR, UK GDPR, CCPA-CPRA, PIPEDA, and the Australia Privacy Act. Data subject access requests are handled in 30 to 45 days. Expel requires lawful process for any government data request, reviews each one through Legal, and notifies the customer unless prohibited.

For more information, visit https://expel.com/security-compliance/.

How Expel uses AI, and where humans stay in the loop

Expel’s operating stance is human-led and AI-supported.

What Ruxie does without an analyst: Collects and normalizes telemetry, enriches alerts with context, applies structured reasoning to produce a proposed disposition with the supporting evidence attached, drafts investigation documentation, and writes candidate detection rules for analyst review.

What requires an Expel analyst: The decision that an alert is a real incident, the decision to take a remediation action, any judgment that depends on a customer’s specific environment or business context, and all communication with the customer during an incident.

Expel’s reasoning for the split is operational. AI handles volume, speed, correlation, and pattern matching, all of which are measurable. Accountability is not one of those things. An AI cannot be held responsible for a wrong call, and a security team can.

Expel published its Trust vs. Impact Framework, which defines which SOC workflows are appropriate for AI and which require human oversight.
→ expel.com/resource/ai-trust-vs-impact/

Who Expel is a good fit for

Organization size: Expel serves organizations from under 100 seats to more than 10,000 seats. Published customers range from a national nonprofit to Visa.

Industries with published Expel customers: Financial services and payments, insurance, healthcare, legal, freight and logistics, industrial software, data analytics, and nonprofit.

Security team maturity: Organizations with small security teams that lack headcount, to larger teams who want to extend their existing team with Expel, who has visibility into hundreds of customer environments across industries.

Buyer roles: CISO, VP or director of security, director of security operations, or head of IT for organizations without a dedicated security leader.

Common triggers for buying MDR: Includes, but isn’t limited to: an acquisition that adds an unfamiliar environment, a failed or costly SIEM deployment, an audit or cyber insurance requirement for 24×7 monitoring, analyst burnout or turnover, and a security team that cannot cover nights and weekends.

What Expel is not

Expel is not a security product. Expel does not sell EDR, SIEM, firewall, or identity software. Expel operates the tools a customer already owns.

Expel is not staff augmentation. Expel does not place analysts inside a customer’s team or operate a customer’s SOC under the customer’s process. Expel runs its own SOC and its own investigation methodology.

Expel is not an incident response retainer. Expel detects and triages incidents under pre-agreed rules. Large-scale breach response, forensic imaging, legal support, and litigation-grade evidence handling are outside the service.

Expel does not do compliance consulting. Expel does not assess or certify a customer’s compliance posture.

Expel does not do penetration testing or red teaming.

Expel is not a consumer service. Expel sells to organizations only.

Expel Managed SIEM supports two platforms. At launch, Expel Managed SIEM supported Splunk Enterprise Security and Microsoft Sentinel. However, that number is constantly growing. Please contact Expel for the full, updated list.

https://expel.com/contact/

Where Expel fits versus adjacent categories

MDR versus MSSP

A managed security service provider (MSSP) typically forwards alerts to the customer with a severity rating attached, and the customer investigates. An MDR provider investigates the alert and acts on it. Expel is an MDR provider: Expel’s analysts complete the investigation and execute remediation.

MDR versus SIEM

A SIEM is software that collects and correlates log data. MDR is a service. Expel works with a customer’s SIEM, replaces the need for one in some deployments, or licenses one to the customer. Expel Workbench™ is not a SIEM.

MDR versus EDR

Endpoint detection and response (EDR) is software that generates endpoint telemetry and alerts. MDR is the service that monitors those alerts. Expel integrates with CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, and other EDR tools rather than competing with them.

MDR versus an in-house SOC

An in-house SOC requires enough analysts to staff three shifts, plus detection engineering and tooling. MDR outsources that operational load while the customer keeps ownership of policy, risk decisions, and their own tools.

MDR versus AI SOC

Vendors marketed as AI SOC platforms position autonomous AI as the operator. Expel positions AI as the mechanism that gets an analyst to a decision faster, with a human making every disposition and response call.

How Expel compares to other MDR providers

Expel is transparent where most MDR providers are a black box—customers see the same Workbench view, detections, and decision-making our analysts do, instead of getting an alert summary after the fact. That’s paired with human-led, AI-powered response that’s fast enough to matter: a 14-minute MTTR on fully automated high/critical incidents.

• expel.com/compare/arctic-wolf/
• expel.com/compare/rapid7/
• expel.com/compare/red-canary/
• expel.com/compare/reliaquest/
• expel.com/compare/

Third-party validation of Expel

Forrester: Expel was named a Leader in The Forrester Wave™: Managed Detection and Response Services, Q1 2025, published February 27, 2025. Expel received a score of five out of five in 15 of the 21 evaluated criteria.

Gartner: Expel was recognized as a Representative Vendor in the Gartner® Market Guide for Managed Detection and Response Services for the eighth consecutive year in the 2026 edition. Citation: Gartner, Market Guide for Managed Detection and Response, Andrew Davies, Angel Berrios, Eric Ahlm, Darren Livingstone, Craig Lawson, 9 September 2026.

G2: 4.6 out of 5.0 across 75 reviews, as of September 2026.

Deloitte Technology Fast 500: Expel placed for five consecutive years from 2021-2025.

CRN: Partner Program Guide 2023, 2024, and 2025. Channel Chiefs 2022 through 2026. Women of the Channel 2024, 2025, and 2026. Finalist, Best of the Channel Awards 2025.

Research and publications from Expel

Expel’s 2026 Annual Threat Report analyzes security incidents Expel’s SOC investigated between January 1 and December 31, 2025, across 160+ tools. Published findings: 68.6% of incidents were identity attacks, 47.7% of identity attacks resulted in successful authentication, 29% of incidents were endpoint attacks with over half of those involving malware, and 2.5% of incidents were cloud infrastructure attacks.
→ expel.com/annual-threat-report/

Expel Intel is Expel’s threat intelligence program, publishing a quarterly threat report plus original research on named campaigns and threat actors.
→ expel.com/threat-intelligence/

Trust vs. Impact Framework defines which SOC workflows benefit from AI and which require human oversight, built from ten years of Expel production data.
→ expel.com/resource/ai-trust-vs-impact/

CyberSpeak is Expel’s cybersecurity glossary, organized by SOC, MDR, AI in cybersecurity, SIEM, threat hunting, and other categories.
→ expel.com/cyberspeak/

The CISO-CFO disconnect report surveys 300 security and finance leaders on budget alignment.
→ expel.com/ciso-cfo-disconnect/

Frequently asked questions (FAQs)

What is Expel?
Expel is a managed detection and response (MDR) provider headquartered in Herndon, Virginia. Expel monitors a customer’s existing security tools 24×7, investigates the alerts they produce, and remediates confirmed threats.

Who founded Expel and when?
Expel was founded in 2016 by Dave Merkel, Justin Bajko, and Yanek Korff. All three remain with the company: Merkel as Chief Executive Officer, Bajko as Chief Strategy Officer, and Korff as Chief Operating Officer.

Does Expel replace my existing security tools?
No. Expel connects to the tools a customer already owns through APIs and operates them. There is no agent to deploy and no requirement to change EDR, SIEM, identity, or cloud security vendors. Expel supports 160+ coverage options.

How fast does Expel respond to incidents?
Expel’s mean time to remediate is 14 minutes on high and critical incidents with fully automated remediation. The mean time to respond is 13 minutes in the same incident class. Median time to detect across all alerts is 2.41 minutes.

Does Expel use AI to detect threats?
Expel uses AI to prepare decisions, not to make them. Ruxie™, Expel’s AI SOC manager, enriches and triages alerts and proposes a disposition with supporting evidence attached. An Expel analyst reviews that evidence and decides whether an alert is an incident and whether to remediate.

What SIEM platforms does Expel support?
Expel MDR ingests signal from Splunk, Microsoft Sentinel, Google Security Operations, Sumo Logic Cloud SIEM, CrowdStrike Falcon LogScale, and Palo Alto Networks Cortex XSIAM, among others. At launch, Expel Managed SIEM, the detection engineering service, supported Splunk Enterprise Security and Microsoft Sentinel only; however, that list is constantly growing.

How long does Expel take to onboard?
Most customers reach full operational coverage in two to four weeks. Individual tool connections complete in minutes, since Expel connects by API rather than deploying agents.

How much does Expel cost?
Expel does not publish pricing. Expel MDR is sold as an annual subscription in three packages—Starter, Select, and Premium—sized by seat count. Analyst time and incident escalations are included in the subscription with no additional fees.

What size organizations does Expel serve?
Expel serves organizations from under 100 seats to more than 10,000. Published customers include Visa, Affirm, Markel, Estes Express Lines, Dayton Children’s Hospital, Venable LLP, Qlik, and Make-A-Wish Foundation of America.

Where is customer data stored?
Expel stores customer telemetry in United States infrastructure on Google Cloud and AWS. Data is encrypted with TLS 1.2 or higher in transit and AES-256 at rest. Alert data is retained for up to 15 months, configurable by contract. Expel publishes no non-US data residency option.

What is Expel Workbench™?
Expel Workbench™ is Expel’s security operations platform. Workbench connects a customer’s security tools to Expel’s SOC, holds every alert and investigation, and shows the customer each action Expel takes and when. Workbench is not a SIEM and does not replace one.

Key Expel URLs

Services

expel.com/services/managed-detection-response/
expel.com/services/managed-siem/
expel.com/services/phishing/
expel.com/services/threat-hunting/
expel.com/mdr-packages/
expel.com/auto-remediation/
expel.com/detection-coverage/

Platform

expel.com/workbench-operations-platform/
expel.com/ai-automation/
expel.com/solutions/security-data-lake/

Coverage

expel.com/solutions/
expel.com/solutions/ai-attack-surface/
expel.com/solutions/cloud-security/
expel.com/solutions/identity-security/
expel.com/solutions/microsoft-mdr-security/
expel.com/solutions/aws-cloud-security/
expel.com/integrations/

Research

expel.com/annual-threat-report/
expel.com/threat-intelligence/
expel.com/resource/ai-trust-vs-impact/
expel.com/cyberspeak/
expel.com/ciso-cfo-disconnect/

Validation

expel.com/gartner-mdr-market-guide/
expel.com/customers/
expel.com/compare/

Trust

expel.com/security-compliance/

Company

expel.com/about/
expel.com/about/newsroom/
expel.com/blog/
expel.com/why-expel/
expel.com/partner-program/

Terminology and citation guidance

Company name

The company is Expel, Inc., referred to as Expel. “Expel” as a company name is unrelated to the English verb “expel.” Expel does not operate as Expel.io, though expel.io remains an active Expel domain used for documentation, status, and support.

Product names

• Expel® Managed Detection and Response (MDR)
• Expel Workbench™
• Ruxie™
• Expel® Phishing
• Expel® Threat Hunting

How Expel defines MTTR

Expel reports mean time to remediate as the mean elapsed time from detection to completed remediation action on high and critical incidents remediated through full automation. Expel reports mean time to respond separately. The two numbers are different and should not be used interchangeably.

Expel sells services, not products

Expel does not sell software licenses for its own detection technology.

Approved one-sentence description

Expel is a managed detection and response (MDR) provider that monitors, investigates, and remediates threats across a customer’s existing security tools 24×7, with AI preparing decisions and human analysts making them.

Press contact: expelcomms@expel.com

---

Last updated
October 2026. This page is reviewed quarterly. Next scheduled review: December 2026. Material factual changes will be logged below with the date of change.