How Insight Global secures and monitors the cloud with Expel

Case studies · Cole Finch

A candid conversation about how one of North America’s largest staffing companies transformed its security operations with managed detection and response (MDR)—moving from alert overload to actionable intelligence while maintaining comprehensive visibility across cloud-native platforms.

Featuring:

  • Jonathan Waldrop, Sr. Director, Cybersecurity, Insight Global

Additional resources

Introduction

Effective MDR alert management isn’t about generating more alerts—it’s about delivering the right alerts with clear, actionable remediation steps. For security teams drowning in notifications from multiple tools and platforms, the challenge isn’t detection capability. It’s separating genuine threats from noise while maintaining the visibility needed to protect critical business operations.

Jonathan Waldrop, Senior Director for Cybersecurity at Insight Global, shares how his team partnered with Expel to transform their approach to MDR alert management, enabling them to focus on response rather than endless triage across their cloud-native infrastructure.

 

The MDR alert management challenge at Insight Global

Jonathan Waldrop: Hi, my name is Jonathan Waldrop. I’m the senior director for cybersecurity at Insight Global. Insight Global is a recruiting and staffing company servicing North America. We provide various types of professional services for recruiting and staffing.

The main benefit that we have from working with Expel is the effectiveness and the efficiency of the alerts that we receive. We don’t have to wonder “are we getting enough alerts?” We don’t have to wonder “are we getting too many?” because the alerts that we have always come with very actionable, very detailed steps to remediate.

We have a lot of information coming in from a lot of really cool devices, appliances, and programs. We’re very blessed to have that technology, but with a team of our size, it was a bit overwhelming at times. We wanted to make sure that we focused and addressed every issue, alert, or concern that came across appropriately.

 

Why Insight Global chose Expel for MDR alert management

Insight Global’s security team needed more than another monitoring tool. They needed a partner who could consume data from multiple sources, filter out the noise, and deliver high-quality alerts that their team could act on immediately.

The key things that brought us toward Expel was really the only organization we found that could consume and ingest so many different types of data from different types of technology platforms.

Another key area that Expel provides is the transparency in the workbench. So we have the ability to look and see the alert as that analyst sees it. It really helps my team become very efficient and effective, and we can focus time on that response.

This transparency fundamentally changed how Insight Global’s security team operates. Rather than working in the dark or receiving alerts without context, they gained visibility into the entire investigation process. The Expel Workbench provides not just alerts, but the reasoning, evidence, and recommended actions that enable rapid response.

Cloud security monitoring and MDR integration

For organizations operating in cloud-native environments, MDR alert management becomes even more complex. Cloud resources generate different types of telemetry, require different detection strategies, and present unique security challenges compared to traditional on-premises infrastructure.

Jonathan Waldrop: One of the key areas that Expel has excelled in has been in helping us secure and monitor the cloud—providing alerts from our cloud resources, partnering with our cloud compute environment, as well as other security telemetry and platforms that we leverage that are cloud-native platforms.

Expel’s ability to integrate with cloud-native security platforms means Insight Global doesn’t need to choose between comprehensive cloud coverage and manageable alert volumes. The MDR service adapts to their cloud architecture, ingesting telemetry from multiple sources while maintaining the same high standard for alert quality and actionability.

 

The impact of effective MDR alert management

The transformation in Insight Global’s security operations goes beyond reducing alert fatigue. It fundamentally changed how their team approaches security.

Jonathan Waldrop: Security is a critical component of the service that we provide to Insight Global’s clients and our consultants. We owe it to our clients to secure their data as if it were our own. We maintain and uphold Insight Global’s commitment to securing that information, and Expel is a key part of the strategy to continue to secure that.

When MDR alert management works effectively, security teams gain several critical advantages:

  • Confidence in coverage: Teams no longer worry whether they’re monitoring the right things or missing critical signals. The combination of comprehensive data ingestion and expert filtering ensures genuine threats surface quickly.
  • Reduced analyst burden: Instead of spending hours triaging false positives and low-priority alerts, analysts focus on investigation and response. Every alert that reaches the team deserves attention and includes clear guidance on what to do next.
  • Faster response: With actionable remediation steps included in every alert, response times decrease dramatically. Teams don’t need to research attack patterns, determine appropriate countermeasures, or guess at remediation steps.
  • Strategic focus: When tactical alert triage is handled effectively, security teams gain bandwidth for strategic initiatives—improving security architecture, addressing systemic vulnerabilities, and planning for emerging threats.

 

MDR as a trusted security partner

The relationship between Insight Global and Expel demonstrates what effective MDR partnerships look like. It’s not just a vendor relationship—it’s an extension of the security team.

Jonathan Waldrop: Expel is absolutely a trusted partner and a key and critical piece of our security posture and security strategy at Insight Global.

This level of trust develops when MDR providers consistently deliver on their core promises: high-quality alerts, transparent investigations, rapid response support, and genuine partnership in protecting the organization. For security leaders evaluating MDR options, these partnership qualities often matter more than feature lists or technology specifications.

 

Frequently asked questions about MDR alert management

Q: What makes MDR alert management different from traditional SIEM alerts?

MDR alert management combines automated detection with expert analysis and filtering. While SIEMs generate alerts based on rules and patterns, MDR services like Expel add human expertise to eliminate false positives, enrich context, and provide actionable remediation guidance. You receive fewer alerts, but every alert matters.

Q: How does effective MDR alert management reduce security team burnout?

Alert fatigue is a leading cause of analyst burnout. When teams receive hundreds of low-quality alerts daily, they become desensitized and may miss genuine threats. Effective MDR alert management filters noise, prioritizes real threats, and provides clear remediation steps—allowing analysts to focus on meaningful work rather than endless triage.

Q: Can MDR services handle alerts from cloud-native platforms?

Yes. Leading MDR providers integrate with cloud security tools, container platforms, serverless environments, and cloud-native detection systems. They ingest telemetry from cloud resources, apply expert analysis, and deliver the same high-quality alerts regardless of whether threats originate from cloud or on-premises infrastructure.

Q: What should organizations look for in MDR transparency?

Look for MDR providers who show their work. This includes visibility into how alerts are investigated, what evidence analysts reviewed, why they reached specific conclusions, and what actions they recommend. Platforms like Expel Workbench allow security teams to see investigations as they unfold, not just final verdicts.

Q: How does MDR alert management scale with organizational growth?

Quality MDR scales by maintaining consistent alert standards regardless of environment size. As organizations add new technologies, expand to cloud platforms, or increase their security tool footprint, the MDR provider adapts—ingesting new data sources while continuing to deliver high-quality, actionable alerts without overwhelming the security team.

Q: What makes an alert “actionable” in MDR?

Actionable alerts include clear remediation steps, relevant context about the threat, evidence supporting the detection, and guidance on priority and urgency. Rather than simply notifying teams that something happened, actionable alerts tell teams exactly what to do next and why it matters.

Q: How do MDR providers ensure they’re not missing critical alerts while filtering noise?

Leading MDR providers combine automated detection with human analysis at scale. They use AI and automation to triage large volumes of signals, but analysts review and validate findings before escalating to customers. This hybrid approach maintains comprehensive coverage while ensuring only genuine threats reach security teams.

 

Key takeaways for MDR alert management

Organizations looking to improve their MDR alert management should consider these lessons from Insight Global’s experience:

Prioritize data integration capabilities: Choose MDR providers who can consume telemetry from your entire technology stack—especially cloud-native platforms and diverse security tools. Comprehensive visibility is the foundation for effective alert management.

Demand transparency: Select MDR partners who show their investigative work, not just conclusions. Understanding how analysts reached their findings builds trust and helps your team learn from each investigation.

Expect actionability: Every alert should include clear, detailed remediation steps. If your MDR provider simply notifies you of problems without guidance on solutions, you’re only getting half the value.

Value quality over quantity: More alerts don’t mean better security. The goal is receiving the right alerts—genuine threats with sufficient context to respond effectively.

Look for partnership, not just service: The best MDR relationships feel like an extension of your security team. Look for providers who understand your business, adapt to your needs, and communicate as partners rather than vendors.

Measure what matters: Track metrics like mean time to respond, alert-to-incident ratio, and analyst satisfaction with alert quality. These indicators reveal whether your MDR alert management is truly effective.

 

The future of MDR alert management

As attack surfaces expand and threats grow more sophisticated, effective MDR alert management becomes increasingly critical. Organizations can’t simply hire their way out of alert fatigue—the talent shortage and volume of signals make that approach unsustainable.

The future lies in combining human expertise with advanced automation, maintaining transparency throughout investigations, and delivering genuinely actionable intelligence to security teams. Providers who master this balance will help organizations defend against tomorrow’s threats while keeping today’s security teams focused, effective, and engaged.

For Insight Global, the partnership with Expel demonstrates that effective MDR alert management isn’t just possible—it’s essential for modern security operations.

Resources home