How Major League Soccer strengthens cloud security operations with Expel on AWS

About Major League Soccer

Tim Somrah: Major League Soccer is the preeminent soccer league here in North America. We’re composed of 27 clubs in the United States and three in Canada.

For an organization with clubs across two countries, security operations have to work at league scale. That means consistent visibility across the environment, no matter when something happens.

The challenge: Around-the-clock visibility and a strong response cadence

Tim Somrah: Our primary challenge was to make sure that we have around-the-clock visibility and a strong response cadence built into our security operation services. We wanted partners that understood both scale and speed.

Those two requirements shaped the search. MLS wasn’t only looking for a tool that could detect activity. It needed partners who could cover the environment at all hours and respond quickly when something mattered.

Why AWS and Expel: A combination that fit

MLS found what it was looking for in the combination of AWS’s cloud infrastructure and Expel’s managed service.

Tim Somrah: AWS offered a strong foundational cloud infrastructure. Expel offered a very high-tier managed service. The combination of those two made it a perfect fit for us.

For cloud-first organizations, the infrastructure layer and the security operations layer have to work together. AWS provides the foundation, and Expel’s team monitors, investigates, and responds on top of it, so the League’s security team isn’t left to stitch that coverage together on its own.

Onboarding: Up and running in a single morning

Getting value quickly matters, especially for lean security teams that can’t afford long, disruptive deployments.

Tim Somrah: The onboarding with Expel and AWS was frictionless and very collaborative. Within the first morning of collaborating, we were able to get up and running, and we were able to see value right away.

A collaborative onboarding across both partners meant MLS didn’t have to coordinate between vendors or wait weeks to see results.

Day-to-day value: Faster triage, clearer results

The real test of an MDR partnership is what it changes in the day-to-day. For MLS, that shows up in how quickly the team can separate risky activity from benign activity in the cloud.

Tim Somrah: Expel’s value shows up in our day-to-day operational activity. We were able to glean insights very quickly from anomalous cloud activity and correlate them quickly to whether or not they’re risky or benign in our infrastructure.

Cloud environments generate a steady stream of unusual-looking activity, and most of it turns out to be harmless. The hard part is knowing which is which. By correlating anomalous activity and reaching a verdict quickly, Expel helps MLS skip the guesswork.

Tim Somrah: Faster triaging, clearer results, and quicker insights into activities that are happening in the environment mean more time for my team to focus on actual risk and prioritizing those.

The result: Security that enables growth

Tim Somrah: For MLS, security has to enable growth. With AWS and Expel, MLS is able to maintain visibility, act quickly, and really focus in on the risk that matters most to the organization and the league.

That’s the outcome Expel is built to deliver: continuous coverage and clear answers, so security teams can spend their time on the risks that matter instead of chasing every alert.

Frequently asked questions about Expel and AWS

Why did Major League Soccer choose Expel and AWS?

MLS wanted around-the-clock visibility and a strong response cadence, from partners that understood both scale and speed. According to Tim Somrah, AWS provided a strong foundational cloud infrastructure and Expel provided a very high-tier managed service, and the combination was a perfect fit.

How quickly could MLS see value from Expel?

Quickly. Tim Somrah described the onboarding with Expel and AWS as frictionless and very collaborative, with the team up and running and seeing value within the first morning of working together.

How does Expel help with cloud security on AWS?

Expel monitors cloud activity, correlates anomalous activity, and determines quickly whether it’s risky or benign. For MLS, that means faster triage, clearer results, and quicker insights, so the security team can focus on actual risk. Learn more about Expel’s cloud security solutions.

Why does MDR matter for cloud-first organizations?

Cloud environments produce a large volume of activity that needs to be monitored around the clock. An MDR partner handles continuous monitoring, investigation, and response, which frees internal teams to concentrate on the risks that matter most to the business. Learn more about Expel’s MDR services.

Key takeaways

Coverage and speed both matter: MLS needed around-the-clock visibility and a strong response cadence, from partners who understood scale and speed.

The right pairing makes a difference: AWS’s cloud foundation and Expel’s managed service combined into a fit that neither could deliver alone.

Fast onboarding means fast value: A collaborative, frictionless onboarding got MLS up and running within the first morning.

Clearer triage frees up time: Quickly separating risky from benign cloud activity means more time for the team to focus on actual risk.

Security should enable growth: For MLS, visibility, speed, and focus on the risks that matter most support the business rather than slow it down.

This transcript has been edited and condensed for clarity and readability. Video filmed at AWS NY Summit 2026.

To learn how Expel’s managed detection and response and cloud security solutions can give your team around-the-clock visibility on AWS, schedule a demo today.