The human-AI SOC partnership: How Expel built automation before the hype | RVASec 2026

Introduction

Chuck Harold: I’ve been out of it a little bit, maybe about a year. Took a year off, and all of a sudden everything has exponentially grown and changed with AI overnight. When I started doing this 13 years ago, it was zero trust. Really? You were trusting people before, now you’re zero trust? It’s all these buzzwords and sales things.

But your approach to me, which is the title of our show today—the Human-AI SOC Partnership—is: you know what? We have these tools in place. We’ve been using them. Why are we reinventing the wheel? Why are we doing bolt-ons for AI? Why not use the AI we have? Let’s enhance it.

I think you have a different approach. Give us some background on what you guys are doing that’s different.

The 2016 thesis: Security operations is a technology problem

Dave Merkel: Just for anybody watching, context of what Expel does: we’re a managed detection and response provider. We are the SOC for many of our customers, or we are a part of their hybrid SOC. Maybe they have operators, but we also have operators.

My co-founders and I did Mandiant before this. I built the endpoint platform there, and then my co-founders built Mandiant’s managed detection and response offering—same kind of premise.

But when we built Expel back in 2016, we had a fundamental thesis: “This actually is really a technology problem.”

You still have people. We weren’t thinking you’re going to eliminate all the humans out of your security operations center. But there’s so much of what they do that you can make software.

We raised the money to build a platform to run security operations first. For us, that means integrating with the customer’s tech stack. They get to bring their security strategy, they get to bring their favorite vendors for their attack surfaces—an endpoint product, a network product, a SIEM, cloud, whatever it might be.

Our job is to plug into that with our platform and then produce the last-mile security outcome using mostly technology along the way, and then human beings at the very end for the two things they’re really good at: judgment around things you’ve never seen before, and relationships.

Dave Merkel: Because if it’s go time, if the bad people come to town, that’s a human moment for an organization. You are being attacked, your livelihood is at stake. If you’re on the security team, your job is at stake. You want to know that somebody is there in the fight with you.

This foundational philosophy—established eight years before the current generative AI boom—positioned Expel to integrate modern AI capabilities seamlessly rather than bolting them on as an afterthought.

The self-driving car analogy: How to build AI incrementally

Dave Merkel: Even back in 2016, we had thinking around: How far can we push this from a software standpoint? Can we make the whole thing software?

Our thought process was very similar to how you see technologies like self-driving cars evolving. You don’t take a bunch of us nerds and put us in a closet and we come out with a self-driving car. That’s not how that works.

What you do is you build a car, and then you instrument the heck out of it. Maybe you already know how to do a couple of features. Maybe you already have adaptive cruise control nailed down.

Then you put a driver in the seat that you control—you put in an F1 driver, not my teenagers. You let the driver drive, and then you measure, and then you iterate.

Dave Merkel: So adaptive cruise control becomes lane change, becomes exit ramp, becomes stop sign, stoplight, whatever it might be. And then at any time, if something is happening that the driver can’t handle—something you haven’t seen before, like a cat jumps out behind the garbage bin—the driver’s there to take the wheel and still produce the outcome, which is you get home safe.

That’s how we thought about building our company all the way back in 2016: Let’s build it that way. Let’s start providing service to customers, and then as things change—and they always change—we’re constantly iterating and continuing to turn that change into software and not human labor.

This incremental approach explains why Expel’s AI integration feels natural rather than forced:

The attack surface you’re protecting changes: New technologies emerge, cloud adoption increases, remote work expands the perimeter.

The technologies protecting that attack surface change: CrowdStrike, Defender, and other security products evolve. Entire new product categories come into being—CNAPP, CDR, whatever it might be.

The attacker changes: Because turns out they get a vote. Attack techniques evolve, new threat actors emerge, and adversaries adapt to defenses.

All that stuff is in flux. As all that is happening, you’re constantly iterating.

Why today’s AI fits into yesterday’s architecture

Dave Merkel: As we fast-forward to today, Chuck, because we have that substrate—that foundation—what I’m basically doing is saying, “Oh, I have this computer science that did the following things before. This new computer science…”

The interesting computer science of the day in the AI realm is large language models. “Oh, it can do that problem better. Let me change that out.”

But the flow is still the same. I have an alert pipeline, and I’m making decisions between certain types of computer science. When do I use agentic stuff? When do I use people? But the goal at the end of the day is still the outcome for the customer: alert to fix as fast as we possibly can, get the attacker out, and reduce your risk.

That’s what we’ve done since inception. It’s just this new advent of computer science and its accessibility that lets us go even further with it, and it fits right in with how we envisioned the company at the beginning.

Chuck Harold: I understood everything you said. You said it very well. It was very logical, very involved. But it was just kind of a linear explanation of everything—it’s stepped, it’s incremental, and it grows and builds upon itself. And then you switched to AI, and all of a sudden it’s better because it was built incrementally.

I think this is a great way to do it. You guys have a unique offering. Everybody keeps talking about “Hey, let’s put out another tool to our security stack.” And it’s like, “Heck, I got 125 already. I don’t need 126.” That’s not this. This is different.

The real problem: Too much signal, not too little

Dave Merkel: It’s interesting you mentioned that. A lot of times for our customers, what we tend to see in terms of the challenges they’re facing—sometimes it is a lack of signal. Sometimes it’s “Here’s this thing I need to protect,” and there is no signal that they can grab onto to try and do effective detection and response. That problem still exists. I don’t want to pretend like it doesn’t.

But a more common problem that we see is they’ve made significant security investments. The problem they’re solving isn’t that they want to buy another box or a widget or a thing. It’s operationalizing it—producing value, reducing risk using the signal they already paid for, and doing so 24/7 in a way where they’re not paying the opportunity cost.

Even our smaller customers don’t have a SOC per se. They don’t have a 13-person, 24x7x365 operation. But they’ve got maybe a handful of security engineers and a stack of work 10X the size of the resources they have.

Dave Merkel: The last thing they want to do is spend their time and energy staring at this stuff 24×7 to provide protection. They know their business better than we ever will. They probably have other strategic things they want to spend their time on.

Our job is to operationalize what they’ve already invested in, produce the outcome they paid for—both with their existing investments and with us—which is keep the bad guys out. Then they can spend their valuable people time producing more strategic outcomes for the business, which is good for everybody.

The signal abundance challenge: We see a bounty of signal, but trying to get value out of it is a significant challenge.

This reframes the AI conversation in security: It’s not about generating more alerts or adding more detection capabilities. It’s about extracting value from the overwhelming amount of security data organizations already have—using AI to do what humans can’t: process massive signal volumes at scale while maintaining context and prioritizing what actually matters.

Asterisk: As new attack surfaces pop up—of which AI now is one—you usually start over with a signal deficit, and you have to work your way into having enough signal. But in general, organizations face signal abundance, not scarcity.

What distinguishes forward-thinking AI adoption from catching up

Chuck Harold: When I was at Black Hat 13 years ago, a company came up and said, “We solve problems now, but then we go to the future and say, ‘What if a bad guy could do this?’ Let’s try and solve that threat before it gets here.” Kind of like what I’m thinking you’re doing.

How does a company distinguish between a service like yours that’s literally working in the future—you’ve been doing it in the past, so you’re in the future—versus somebody that’s just catching up? “Oh yeah, I just signed into Claude yesterday. We’re using AI in our company.” Two different things. They sound the same. We’re all using AI, but we’re using it to very different degrees.

Dave Merkel: When I think about my specific space—the zip code of cybersecurity that we occupy, which is detection and response operations, security operations—that’s where we live, and we produce those outcomes for customers so they don’t have to.

The kinds of things that distinguish folks thinking about at least the bleeding edge of the now, if not the future… The only reason I hesitate on the future is if you were going to ask me what news headline I’m going to see next week or what Anthropic is going to release, I don’t freaking know. I have no clue. Future prediction is really tough right now.

But you at least have to live fully in the now and in where your modern customers are at.

Dave Merkel: The area that we specialize in is not each individual detection technology or security technology a customer might deploy. There are entire companies that focus on the endpoint, entire companies that focus on cloud detection and response, et cetera. I’m not going to be better than they are at that specific discipline.

What I’m going to be able to do is understand: As I bring all those things together and think about mixing all those technologies into my detection strategy, what now can I do? What new detection value can I add where I can maybe help find something that the customer might otherwise miss if they were just looking in those silos?

And number two: Because we’ve been around for a while, there are hundreds and hundreds of Expel customers. Those are hundreds and hundreds of environments that I have the privilege and opportunity to monitor and protect. I get to see a lot of stuff.

Dave Merkel: How do I combine the signals? How do I combine the things I get to see across a wide range of customers, customer types, and verticals to improve both detection outcomes and response outcomes for my customers?

That’s what I think is interesting about our business. When I’ve talked to other providers in our space that I think are good—and they exist, I’m not going to trash competitors—they have at least some of that mindset in terms of: Don’t just eat the alert stream off the single product, but how do you get a more complete picture?

How does that picture need to change as you add different product categories, as they evolve, and different attack surfaces?

Dave Merkel: It’s going to be very interesting to see—a company is using Claude or whatever, and there’s a telemetry stream we’ll be able to get out of that and/or products designed to protect that surface. How does that surface interact with all the other surfaces we already monitor, and where’s our chance to add value there?

Those are the kinds of things we tend to think about when we’re trying to make sure we can keep pace with the attacker.

Attacker-defender asymmetry and the compressed AI cycle

Chuck Harold: You said something I generally agree with—there will be some asymmetry for a little bit.

Dave Merkel: The reason for the asymmetry is attackers don’t necessarily have change controls. Or maybe they do, but they tend to be a lot more aggressive. Their ability to adopt technology and use it aggressively against you—you’ve got to catch up. And they don’t have to get it right all the time. You do.

That’s that classic attacker-defender asymmetry for any kind of offense-defense problem. So there’s no question we will see a little bit of an imbalance initially.

But you mentioned catching up. If I think back on my career doing this work, that is what I have tended to see: Yes, there’s going to be some pain, but the same technologies that enable attackers also can enable defenders, and there is a détente that eventually forms. I do think that will be true.

The thing I don’t know as much about and is probably most concerning to me—not gloom and doom concerning like the sky is falling, I don’t want to preach that message—is if we take a look at cycle time around anything AI.

Dave Merkel: From technology exists, to adoption, to evolution, to how much more capable it’s getting and how quickly it’s getting there. Its progression through the hype cycle—”Oh, AI, it’s amazing,” then down to the trough of disillusionment, but now crawling out again.

It’s progressing through the same kinds of transitions other technologies did. I’d probably go back and look at cloud as an example. We can see all the same patterns from the late 2000s into the 2010s.

It’s just that the time cycle is radically compressed. Something that may have taken a couple years in cloud time might take a couple months in AI time to progress through that transition.

That’s the one thing that might be a little different this time: It’s not clear what steady state is. In terms of, attacker and defender have détente and now that’s the détente? Or does the AI stuff keep evolving? Probably.

Dave Merkel: Do we fall into asymmetry again, and the attacker has advantage, then the defender has to catch up? That’s one thing that may turn out to be a little different—a repetition of cycle where you’re constantly managing.

The attacker gets the upper hand, and we’re going to have to catch up, and that’s happening very quickly. That could continue for a much longer period of time than something like cloud, where sure, cloud infrastructure was constantly evolving—S2, S3, Lambda functions, this and that. But the pace was much more manageable.

We are going to have to adapt to a faster pace of evolution as defenders. And sometimes that’s not just us defenders on the security teams—it’s defenders as organizations.

Dave Merkel: That means:

• Accept more change control risk
• Be willing to update and adopt effective technologies faster
• Abandon ineffective technologies, particularly in your security stack, faster

I do think there may be some of the same motion, but it needs to happen much quicker in order for us to manage that ongoing push and pull between attacker and defender.

Why Expel’s approach is different: Not another tool

Chuck Harold: You guys have a unique offering. Everybody keeps talking about “Hey, let’s put out another tool to our security stack.” And it’s like, “Heck, I got 125 already. I don’t need 126.” That’s not this. This is different.

The distinction matters enormously for security teams already drowning in tools, alerts, and complexity:

Traditional AI approach: Bolt-on solutions

Many vendors are adding AI as a new component:

• AI-powered endpoint detection (add to existing EDR)
• AI threat intelligence platform (new tool in the stack)
• AI security copilot (separate interface to learn)
• AI-enhanced SIEM (requires reconfiguration and tuning)

Each adds:

• Another integration to manage
• Another vendor relationship
• Another alert stream to triage
• Another tool for analysts to learn
• Another cost line item in the security budget

Expel’s approach: Enhanced foundation

Expel’s AI integration leverages the platform built since 2016:

• Same customer integrations (no new tools to deploy)
• Same workflow and interface (Workbench remains the command center)
• Enhanced automation within existing alert pipeline
• Improved signal extraction from technologies customers already use
• Humans still handle judgment and relationships—AI just makes them more effective

Dave Merkel: What I’m basically doing is saying, “Oh, I have this computer science that did the following things before. This new computer science—large language models—can do that problem better. Let me change that out.”

But the flow is still the same. I have an alert pipeline, making decisions between certain types of computer science. When do I use agentic stuff? When do I use people? But the goal is still the outcome for the customer: alert to fix as fast as we possibly can, get the attacker out, reduce your risk.

Operationalizing existing investments, not adding to the pile

The most common problem Expel sees isn’t lack of security tools—it’s lack of operational capacity to extract value from tools customers already own.

Enterprise customers typically have:

• Significant security investments across multiple vendors
• Comprehensive coverage of attack surfaces
• Mature security strategies and frameworks
• Challenge: Too much signal, not enough analysts to process it 24/7

Smaller customers (200-400 person fintechs, fast-growing startups, financial services) typically have:

• Handful of security engineers
• Stack of work 10X the size of their resources
• Strategic initiatives they want to pursue
• Challenge: Can’t afford to spend valuable engineering time staring at alerts

Both face the same fundamental issue: They’ve already paid for the signal. They need someone to operationalize it.

Dave Merkel: Our job is to operationalize what they’ve already invested in, produce the outcome they paid for—both with their existing investments and with us—which is keep the bad guys out. Then they can spend their valuable people time producing more strategic outcomes for the business.

This is fundamentally different from vendors saying “buy our AI-powered tool to solve your problems.” Expel is saying, “we’ll make your existing tools work better using AI you don’t have to manage.”

The advantage of seeing across hundreds of environments

Dave Merkel: Because we’ve been around for a while, there are hundreds and hundreds of Expel customers. Those are hundreds and hundreds of environments I have the privilege and opportunity to monitor and protect. I get to see a lot of stuff.

How do I combine the signals, and how do I combine the things I get to see across a wide range of customers, customer types, and verticals to improve both detection outcomes and response outcomes?

This collective intelligence creates compounding value:

• Pattern recognition at scale: When a new attack technique appears in one customer environment, Expel can immediately check: Have we seen this before? Is this happening elsewhere? What worked to stop it?
• Cross-environment correlation: Attackers don’t just target one company. Seeing the same infrastructure, techniques, or campaigns across multiple customers reveals broader attack patterns.
• Detection refinement: Rules and detections are tested across diverse environments—different industries, sizes, tech stacks—resulting in more robust, lower-false-positive detections.
• Faster threat response: Lessons learned defending one customer immediately benefit all others. There’s no delay waiting for threat intelligence reports or vendor updates.
• Emerging threat identification: Novel techniques or new attack surfaces become visible faster when you’re monitoring hundreds of environments rather than one.

This is where AI amplifies human expertise rather than replacing it: Analysts can’t manually correlate patterns across hundreds of environments, but AI can surface those connections for human judgment.

What makes the current AI moment different (and concerning)

Dave Merkel: The thing I don’t know as much about and is probably most concerning to me—not gloom and doom, the sky is falling—but if we take a look at cycle time around anything AI: technology exists, adoption, evolution, how capable it’s getting and how quickly.

It’s progressing through the same transitions other technologies did. I’d go back to cloud as an example. We can see the same patterns from the late 2000s into the 2010s.

It’s just that the time cycle is radically compressed. Something that took a couple years in cloud time might take a couple months in AI time.

That’s one thing that might be different this time: It’s not clear what steady state is. Attacker and defender have détente—or does the AI stuff keep evolving? Probably. Do we fall into asymmetry again? Attacker has advantage, defender has to catch up?

Dave Merkel: That’s one thing I’m concerned about—that could continue for a much longer period of time than cloud, where infrastructure was constantly evolving, but the pace was manageable.

We are going to have to adapt to a faster pace of evolution as defenders. And sometimes that’s not just security teams—it’s defenders as organizations:

• Accept more change control risk
• Update and adopt effective technologies faster
• Abandon ineffective technologies faster

This compressed cycle creates operational stress: Security teams must evaluate, test, deploy, and refine new capabilities in months rather than years—all while maintaining existing operations, managing current threats, and avoiding disruption to the business.

Frequently asked questions about human-AI SOC partnerships

How is Expel’s AI approach different from other security vendors adding AI features?

Expel built a platform-first approach starting in 2016 with the thesis that security operations is fundamentally a technology problem. Rather than bolting AI onto existing products, Expel integrates modern AI capabilities into the automation substrate already running security operations. Customers don’t deploy new tools—they benefit from enhanced automation within the same Workbench platform and workflows they already use.

What role do humans play in an AI-augmented SOC?

Humans focus on the two things they excel at: judgment around things never seen before, and relationships. When an organization is under attack, that’s a human moment—people want to know someone is in the fight with them. AI handles the repetitive, high-volume signal processing that humans can’t scale to, leaving analysts to apply expertise where it matters most.

Can AI eventually replace SOC analysts entirely?

No, according to Expel’s philosophy. The self-driving car analogy applies: You build incrementally, automating what you can while keeping expert “drivers” (analysts) ready to take the wheel when something unexpected happens. Full autonomy requires handling every possible scenario, which isn’t realistic for security operations where novel threats constantly emerge.

How does Expel operationalize existing security investments?

Expel integrates with customers’ existing security stack—endpoint products, network tools, SIEMs, cloud security platforms—and uses automation to extract detection and response value from that signal. Rather than replacing tools, Expel makes them work better together, correlates signals across silos, and provides 24×7 operations without customers needing to hire large SOC teams.

What’s the biggest challenge organizations face with security signal?

Contrary to popular belief, most organizations don’t lack signal—they have too much. They’ve invested in multiple security products generating thousands of alerts daily. The challenge is operationalizing that signal: triaging alerts, investigating incidents, coordinating response, and doing it all 24×7 without burning out the handful of security engineers they have. AI helps by processing volume at scale while maintaining context.

How fast is the AI cycle compared to previous technology transitions?

Radically compressed. What took years in cloud adoption cycles might take months in AI. This creates operational stress: security teams must evaluate, adopt, and refine new capabilities much faster while maintaining current operations. Organizations may need to accept more change control risk and abandon ineffective technologies faster to keep pace.

Will attackers always have an advantage with AI?

Initially, yes—attackers adopt aggressively without change controls and don’t have to get it right every time. Defenders face organizational constraints and must maintain availability. However, historically, the same technologies that enable attackers also enable defenders, and a détente forms. The concern with AI is whether this cycle repeats continuously at compressed timescales rather than reaching steady state.

Key takeaways

Dave Merkel’s perspective on the human-AI SOC partnership reveals important insights:

Platform-first thinking enables AI integration: Expel’s 2016 thesis that security operations is a technology problem created the substrate for seamlessly integrating modern AI. Organizations starting from scratch today face steeper adoption curves.

Incremental beats revolutionary: Build like self-driving cars—instrument everything, start with what you can automate, put experts in control, measure and iterate. Don’t expect to go from zero to full autonomy overnight.

Humans for judgment and relationships: AI excels at scale and pattern recognition. Humans excel at novel situations and the human moments when organizations are under attack. The partnership combines strengths rather than replacing one with the other.

Signal abundance, not scarcity: Most organizations don’t need more alerts or tools—they need to operationalize the security investments they’ve already made. The challenge is extracting value from overwhelming signal, not generating more.

Cross-environment intelligence multiplies value: Seeing patterns across hundreds of environments reveals threats that single-organization monitoring would miss. AI makes this correlation tractable at scale.

AI cycle time is compressed: What took years in cloud adoption might take months in AI. This demands faster organizational adaptation—more tolerance for change control risk, faster adoption of effective technologies, faster abandonment of ineffective ones.

Détente may not be permanent: Unlike previous technology transitions that reached steady state, AI may continuously evolve, creating repeated cycles of attacker advantage and defender catch-up at compressed timescales.

No one knows the future: Even experts can’t predict what Anthropic or other AI companies will release next week. Organizations must live fully in the now while building foundations flexible enough to integrate future capabilities.

Don’t add tools, operationalize existing ones: The answer to security challenges isn’t tool 126 in your stack. It’s making tools 1-125 work together effectively using automation that processes signal at scale.

The outcome still matters most: Whether using 2016 automation or 2026 AI, the goal remains unchanged—alert to fix as fast as possible, get the attacker out, reduce risk. Technology changes, but the mission doesn’t.

Looking ahead: Quantum and beyond

Chuck Harold: Quicker meaning what? Quantum computing?

Dave Merkel: That’ll be another conversation. Because when quantum computing gets here, we’re talking about simultaneous past, present, and future. Who knows what that’s going to do?

I do not have the physics to sit here and have a meaningful conversation around quantum other than to say: Everybody holding significant crypto, watch out. Unless blockchains adopt post-quantum cryptography, the old-school stuff will be vulnerable.

Other than that, I cannot begin to predict what kinds of things change in that world.

Chuck Harold: “Interesting times,” goes the proverb and/or curse.

Dave Merkel: Exactly.

This transcript has been edited and condensed for clarity and readability.

This interview was conducted at RVASec 2026 in Virginia. For more insights on how Expel approaches AI and automation in security operations, or to see how Expel’s MDR services operationalize your existing security investments, schedule a demo today.