Blog
Threat intel
Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRsHow the threat group used a zero-day vulnerability to disable the target's EDR, preventing it from intervening in their ransomware attack.
Rapid response | 2 min read
The “first” fully agentic ransomware is here, but we aren’t panicking (yet): Meet JadePufferAnalysis of agentic ransomware JadePuffer: human operator, LLM agent limits, and why fundamentals still protect defenders.
Product | 2 min read
What we built: June 2026See what Expel shipped in June 2026, including two new threat hunts and updated CrowdStrike Falcon detection coverage.
Threat intel | 18 min read
Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRsHow the threat group used a zero-day vulnerability to disable the target's EDR, preventing it from intervening in their ransomware attack.
MDR | 5 min read
How one payments network does it all: Scaling without headcount, and keeping humans in the loopAffirm's security team covers dozens of AWS accounts. Here's how their MDR keeps pace with human-in-the-loop judgment as they scale—without adding headcount.
Product | 4 min read
Ruxie AI now covers every stage of the threat lifecycleExpel extends Ruxie with new agentic AI capabilities across every stage of the threat lifecycle—from enrichment and detection to response and reporting.
Product | 3 min read
New Ruxie AI power-up: Blocked malware triage agent clears the noiseRuxie, our AI SOC manager, has a new power-up that automatically enriches and triages blocked malware alerts end to end, saving analysts time.
Expel culture | 4 min read
Meet the Expletive: Christina Freeman, Principal Go-to-market Systems EngineerMeet Christina Freeman, Expel’s Principal Go-to-market Systems Engineer. She has the palate of a 9-year-old and the hobby of a 90-year-old.
MDR | 4 min read
The AI SOC debate is missing the pointHuman-led, AI-supported isn't just a tagline. Expel's CSO and VP of Product Marketing break down the MDR market, the AI SOC boom, and how it all shakes out.
Threat intel | 4 min read
Patch Tuesday: June 2026 (Expel’s version)This month's Patch Tuesday includes 204 CVEs and three zero-day vulnerabilities. We're also diving into a recent Copy Fail incident.
Current events | 3 min read
What the heck is Nerdy 30?The Nerdy 30 is Expel's LinkedIn Live series where real security practitioners talk about nerdy topics for exactly 30 minutes.
Product | 2 min read
What we built: May 2026See what Expel shipped in May 2026—including three new threat hunts, a new alert grid view in Workbench, and a Ruxie-powered blocked malware triage agent.
MDR | 4 min read
9 questions to ask about your SIEM (and what the answers reveal)Is your SIEM performing—or just running? Nine diagnostic questions to assess your detection program's real maturity, from data ingestion to rule hygiene.