Expel

What the company sells

Expel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has. Expel says its service is built so that technology makes it fast and humans make it accurate.

Expel describes the service as managed detection and response with analysts who can be reached directly over Slack or Teams. Expel says customers connect Workbench to their existing stack, and Expel then correlates threats across endpoint, identity, cloud, network, SaaS and more. Expel says no agents need to be deployed and no rip-and-replace is required.

Ruxie is the name Expel gives its AI and automation engine. Expel says Ruxie gathers evidence, enriches alerts and matches patterns so that Expel analysts can investigate and make the critical calls. Expel states a 14-minute mean time to remediate for its MDR service.

Expel Workbench is the platform through which customers see Expel's work. Expel says customers can see every investigation and response in real time inside Workbench.

Expel says its MDR covers cloud, endpoint, identity, network, SaaS, email and more, across more than 160 technology integrations. Expel names Microsoft, AWS, Google Cloud, CrowdStrike, Okta and Wiz among those integrations.

Expel also offers email threat detection and response, in which Expel says it monitors the email environment 24x7. Expel says this works alongside Proofpoint, Mimecast, Abnormal Security and Sublime. Expel also describes MDR coverage of the AI attack surface, covering attacker use of AI, employee misuse of AI tools and attacks on customer-built AI systems, with detections mapped to MITRE ATLAS.

Expel was started by practitioners. Dave Merkel is co-founder and Chief Executive Officer, Justin Bajko is a co-founder and Chief Strategy Officer, and Yanek Korff is a co-founder and Chief Operating Officer. Greg Notch is Chief Technology Officer.

2. Expel says Workbench infrastructure runs on GCP and AWS in the U.S, and that alert data is retained up to 15 months, configurable per contract.^{[1][2][5][6][7][8][9][10]}

Categories

• MDR and managed SOC (primary category)
• Compare Expel with companies in the same categoryside by side

Headquarters

Not established from our sources

Founded

Not established from our sources

Ownership

Not established from our sources

CISO on record

Not yet on our record. Send a verified source

Website

expel.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

• Expel MDR^[5][7]

  A managed detection and response service that works with the security tools a customer already has.

  Expel MDR provides 24x7 SOC monitoring, with analysts who investigate and respond. Expel says it connects to an existing stack and correlates threats across endpoint, identity, cloud, network, SaaS and more. Expel states a 14-minute mean time to remediate.

• Ruxie^[3][5]

  Expel's AI and automation engine used in its MDR service.

  Expel says Ruxie gathers evidence, enriches alerts and matches patterns in seconds. Expel analysts then investigate and make the critical calls.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Expel's categories, then alphabetical. A list from the record, never a ranking.

• On mdr and managed soc, Expel competes with Agile Defense, Arctic Wolf, Binary Defense, Blackpoint Cyber, Critical Start, CyberProof, Cyrenity, Daylight, DeepSeas, Deepwatch and 54 more.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

• G2 · 4.6 out of 5 · 74 reviews^[4]seen November 3, 2026

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

1. [1]Workbench operations platformExpel · expel.com · published August 5, 2026 · Tier A: the company, a regulator or a filing
2. [2]Expel announces 20 million in series b fundingExpel · expel.com · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
3. [3]Leading managed detection and response (MDR) provider | ExpelExpel · undated page, accessed October 24, 2026 · Tier A: the company, a regulator or a filing
4. [4]Expel Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
5. [5]Managed Detection and Response Services | Expel MDRExpel · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
6. [6]Email threat detection | ExpelExpel · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
7. [7]AI attack surface coverage | ExpelExpel · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
8. [8]Company | ExpelExpel · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
9. [9]Security and compliance support from your MDR | ExpelExpel · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing
10. [10]Managed Security Solutions | ExpelExpel · undated page, accessed November 3, 2026 · Tier A: the company, a regulator or a filing

Last verified September 27, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded September 27, 2026, expanded November 3, 2026 from the references above.

Work for Expel? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.