Cybersecurity blog
MDR
Context is king in the new SecOps eraAI made speed cheap, and in the context era, SOCs win or lose on the quality of their calls.
![Placeholder image for [un]prompted II: Six months is a long time](https://expel.com/wp-content/uploads/2026/11/500x300-webthumb-blog-Greg-CTO-series-01.png)
Current events | 4 min read
[un]prompted II: Six months is a long timeThe model can't be your security control; it has to be the harness around it. Defenders must build and test theirs seriously, starting with what agents can reach.
Security operations | 6 min read
Pen test vs. BAS vs. red team vs. tabletop: What does your team need?Breach and attack simulation vs. penetration testing vs. red teaming vs. tabletops: what each one tests, what it costs, and the order to run them in.
Company news | 6 min read
The AI poverty line: What it means for security teamsExpel CTO Greg Notch on the AI poverty line—the divide between security teams that can wield AI and those that can't, and how to land above it.
Product | 2 min read
What we built: October 2026In October, Expel launched two new Microsoft Entra ID threat hunts, and a more accurate Alert Analysis dashboard.
Rapid response | 8 min read
Fake Claude Code extensions in Cursor: Malicious activity after the exposure windowA fake Claude Code extension in Cursor’s marketplace planted SSH backdoors on developer machines. See what Expel found and how to check every machine.
SOC | 5 min read
How AI flipped the traditional SOC model: Adapt or get left behind.The traditional SOC pyramid was built for manual triage. Here’s how the V-shaped SOC puts AI on the grunt work and human judgment where it matters.
Expel culture | 5 min read
Meet the Expletive: Karsten Chearis, Senior Manager of Solutions ArchitectureMeet Karsten Chearis, Senior Manager of Solutions Architecture at Expel. He's a Memphis native who's confident in his ability to talk to pigeons.
Rapid response | 4 min read
Storm-0940 ARTEX attacks: ConnectWise app abuse and Okta sign-upsStorm-0940 used ARTEX AI agents to abuse ConnectWise apps and Okta self-registration. Get the IOCs, detection guidance, and steps to take now.
Rapid response | 5 min read
Php2Shell PHP vulnerabilities: Unauthenticated RCE and fixesPhp2Shell is a pair of critical PHP RCE flaws that let attackers run code without logging in. Expel analyzed it in October 2026. Includes patch versions, detection guidance, and mitigations.
Current events | 4 min read
Take the practice exam first: 5 tips for acing security certificationsRusty Newton shares a science-backed way to study for security certs: start with the practice exam, quiz yourself, study in short bursts, and plan exam day.
MDR | 5 min read
Context is king in the new SecOps eraAI made speed cheap, and in the context era, SOCs win or lose on the quality of their calls.
Rapid response | 7 min read
QuartzLine: A working PDF viewer with a backdoor insideQuartzLine is a working PDF viewer with a backdoor inside, spread in part through Google Ads. See what it does in real environments, plus IOCs.