TL;DR
- Expel’s machine learning is transparent, and designed with (and for) humans
- We use machine learning to lighten the tedious workload of analysts, doing things like classifying automated marketing emails
- By teaching our tech with our people, we’re watching performance increase rapidly
In an era where cyber threats are evolving at lightning speed, machine learning (ML) stands as a critical technological ally, offering adaptive, intelligent protection. It’s currently supporting the fight across our industry in various ways. It can help identify security breaches, detect phishing attempts, analyze user behavior to establish baselines, and even forecast potential future attack trends.
It’s important to recognize that even while ML offers powerful solutions, humans bring something fundamental—contextual understanding, nuanced judgment, and deep cybersecurity expertise. Many security companies rely on opaque ML models making decisions in a black box. Expel’s ML is transparent, methodical, and deliberately designed with human expertise at its core.
How does Expel keep humans in the loop for machine learning?
What is Expel’s automated marketing email (AME) classification model?
Our specialized machine learning model does something deceptively simple, yet incredibly powerful. When a phishing alert comes in, it quickly assesses whether it’s a benign marketing email, or a potential threat. It cuts through the noise so our analysts can focus on what really matters, and quickly separates dangerous phishing attempts from the mountains of routine marketing emails flooding inboxes.
How does Expel inject SOC expertise into its ML training process?
Continuous learning: Our process begins with curating a comprehensive dataset of recent phishing alerts. Our analysts work collaboratively in structured labeling sessions for every model retrain, leveraging their collective expertise to:
- Individually review and hand-label each alert
- Discuss edge cases and trends
- Reach consensus on challenging classifications
The result is a rigorously vetted dataset, where our analysts inject their wisdom into every training cycle. Every time our analysts manually review and label an alert, they’re not just checking a box. They’re teaching our ML the nuanced art of distinguishing between a harmless marketing email and a potentially devastating phishing attempt.
Quarterly deep dives: Our comprehensive model assessments go beyond simple metrics. Our Data Science and SecOps teams collaborate to:
- Conduct comprehensive performance reviews
- Analyze edge cases and potential improvement areas
- Develop targeted enhancements, ensuring our classification remains razor-sharp and adaptive
What results has Expel’s human-in-the-loop ML approach achieved?
By incorporating human-in-the-loop learning, we’ve nearly doubled our system’s ability to recognize harmless marketing emails. After implementing this process in September 2024, our recognition rate went from 13.3% to 26.4% to date.
ML in cybersecurity shouldn’t be about replacing human judgment, but instead about amplifying it. Our hands-on approach ensures that our threat detection isn’t just fast, but able to capture the subtle contextual insights that only human expertise can provide.
Frequently asked questions
What does Expel’s automated marketing email (AME) classification model do?
It quickly assesses whether an incoming phishing alert is a benign marketing email or a genuine potential threat, filtering routine marketing noise out of the analyst queue so they can focus on real phishing attempts.
How often does Expel retrain its AME model?
Every model retrain includes a structured labeling session where analysts individually hand-label alerts, discuss edge cases, and reach consensus on difficult classifications — supplemented by quarterly deep-dive performance reviews from the Data Science and SecOps teams.
How much has Expel’s human-in-the-loop process improved its marketing email recognition?
Its recognition rate went from 13.3 percent to 26.4 percent since implementing the process in September 2024 — nearly doubling the system’s ability to correctly identify harmless marketing emails.
Does Expel’s machine learning replace human analysts?
No. Expel’s approach is designed to keep humans in the loop, using analyst expertise to train and continuously improve the models rather than letting ML make decisions independently in a black box.
What is “human-in-the-loop” machine learning?
An approach where human experts continuously review, label, and validate the data a model learns from, rather than training a model once and letting it operate without ongoing human oversight and correction.
