Blog
Threat intel
Patch Tuesday: April 2026 (Expel’s version)We're highlighting two critical CVEs, and we're also reviewing the Axios npm compromise from the end of March.
Threat intel | 4 min read
InstallFix: Not the application you were looking forInstallFix is a new watering hole attack we're seeing, and it leverages Claude Code as the lure. Here's what you need to know.
Threat intel | 3 min read
Patch Tuesday: April 2026 (Expel’s version)We're highlighting two critical CVEs, and we're also reviewing the Axios npm compromise from the end of March.
SOC | 9 min read
Why AI won’t replace your security team (and what it will do instead)AI won't replace your security team, but it'll change what the job looks like. Here's what AI can and can't do in a SOC, and what skills matter most.
MDR | 6 min read
Why identity security is a verb, not a nounIdentity security doesn't end at login. See how attackers bypass MFA, steal sessions, and why continuous post-authentication detection is non-negotiable.
Current events | 5 min read
What RSAC 2026 actually taught usWhat RSAC 2026 actually surfaced: AI hype fatigue, a broken value conversation in security services, and an attack surface most teams aren't watching.
Rapid response | 2 min read
Security alert: Axios npm supply chain attackThe Axios npm package suffered a supply chain attack from March 30-31. The malicious packages are no longer active, but here's what you need to know.
Product | 3 min read
What we built: March 2026In March, Expel shipped four new features and one new integration we're sharing with you, including our new Mimecast email integration.
Product | 2 min read
Mimecast customers: Expel MDR for Email is now available for youExpel MDR coverage for email now supports Mimecast, adding a fourth email security integration to our lineup.
Expel culture | 4 min read
Meet the Expletive: Ben Brigida, Senior Director, SOC OperationsMeet Ben Brigida, Expel's Senior Director of SOC Operations and learn how he went from hunting bats to hunting threats.
Current events | 5 min read
The UK’s policy debate isn’t just a consumer story, it’s an enterprise security problem68.6% of incidents involved identity-based attacks targeting remote access. Here's why the UK's VPN debate is an enterprise security problem.
Threat intel | 3 min read
On the radar: ChatGPT StealerMalicious browser extensions are secretly monitoring and stealing users' AI conversations, known as prompt poaching. Here's what to look for.
Product | 2 min read
Your SIEM, our detection engineering, no black boxes: Introducing Expel Managed SIEMWe're launching Expel Managed SIEM: a transparent, co-managed service for Splunk and Microsoft Sentinel paired with Expel MDR.