Cybersecurity blog
Threat intel
SynkLoader: when you throw in everything but the kitchen sinkDiscover a new malware family, SynkLoader. See how we reverse-engineered its phishing tactics to expose its attack chain.
MDR | 5 min read
Context is king in the new SecOps eraAI made speed cheap, and in the context era, SOCs win or lose on the quality of their calls.
Rapid response | 5 min read
QuartzLine: A working PDF viewer with a backdoor insideQuartzLine is a working PDF viewer with a backdoor inside, spread in part through Google Ads. See what it does in real environments, plus IOCs.
Current events | 2 min read
Patch Tuesday: October 2026 (Expel’s version)Microsoft's October release is the largest in its history with 1,414 CVEs. Two of them are zero-days already exploited in the wild, so patch ASAP.
Current events | 2 min read
This cybersecurity awareness month, skip the phishing test—play a game insteadSkip another phishing test this cybersecurity awareness month. Download Oh Noes!, Expel's free incident response tabletop game, no form required.
Product | 2 min read
What we built: September 2026In September 2026, Expel's product team launched one new Ruxie power-up and one new threat hunt. Learn more about each here.
MDR | 4 min read
Why three security leaders still won’t let AI make the callThree SOC leaders from Riot Games, Markel, and ZoomInfo explain why adding AI to your SOC isn't a one-size-fits-all solution.
Security operations | 4 min read
“Are we secure against AI agents?” is a question we couldn’t answer wellExplore a strategic risk model CISOs can use for AI: six control planes that show where you can act, and ten risk domains that show where risk surfaces.
Data & research | 3 min read
AI-augmented, still human-led: What changed in the 2026 Gartner Market Guide for Managed Detection and ResponseThe Gartner 2026 MDR insights added "AI-augmented" to the definition and kept the human-led requirement. Here's what changed.
Expel culture | 4 min read
Meet the Expletive: Todd Bane, Director of Professional ServicesMeet Todd Bane, Director of Professional Services at Expel. He came up through bank IT and the Pentagon, and he restores tractors.
Product | 3 min read
New Ruxie AI power-up: Precedent engine turns repetitive alerts into faster decisionsRuxie's precedent engine feature is a long-term memory for Expel's SOC, using AI to instantly recognize when a new alert matches previous historical cases.
Threat intel | 3 min read
Patch Tuesday: September 2026 (Expel’s version)September's Patch Tuesday is Microsoft's biggest ever at 964 CVEs, with two exploited zero-days. Plus a critical Adobe Commerce flaw that can't wait.
Product | 2 min read
What we built: August 2026This month we released MDR for AI—coverage for the AI attack surface—along with CSV exports and a new home for product documentation.