CISO Tribune

Vendor comparison · 2 companies

Expel vs Leonardo

Expel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has. Leonardo provides cyber security and digital resilience offerings including managed SOC services, incident response, threat intelligence, investigation support systems and secure analytics platforms for governments, critical infrastructure operators and enterprises. CISO Tribune files both under MDR and managed SOC. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Expel
  • Leonardo
Expel vs Leonardo: Products, Customers and Funding Compared
ExpelExpel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has.expel.comLeonardoLeonardo provides cyber security and digital resilience offerings including managed SOC services, incident response, threat intelligence, investigation support systems and secure analytics platforms for governments, critical infrastructure operators and enterprises.leonardo.com
What it sells
  • Expel MDR[5][7]A managed detection and response service that works with the security tools a customer already has.
  • Ruxie[3][5]Expel's AI and automation engine used in its MDR service.
  • SOC Managed Services[2]A family of security operations center services that provide round-the-clock cyber security detection and monitoring for national and international customers.
  • Cyber professional services[2]Consulting services that help customers develop cyber strategy and governance programs.
  • Incident handling and response services[2]A team of consultants that responds to cyber attacks, supported by artificial intelligence technologies.
  • Threat Intelligence[2]Continuous monitoring and analysis of the open web and dark web to detect and predict cyber threats.
  • Investigation Support Systems[2]Proprietary platforms that support government and law enforcement agencies in investigation, intelligence and crime interdiction activities.
  • Secure Analytics[2]Analytics platforms that process large volumes of data, including from IoT infrastructures, to secure the delivery of critical services for industrial and government organizations.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pages
  • August 4, 2026Leonardo US Cyber & Security Solutions introduced SignalTrace as the new name for its electronic signature detection solution, previously called EOC Plus.[3]
  • March 12, 2026Leonardo presented to the financial community an update to its Industrial Plan to 2030, including medium-term targets.[5]
G2 and Gartner Peer Insights
  • G2: listed, seen November 3, 2026[4]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 10, 2026[4]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Not written yetNot written yet
Last verified
September 27, 2026October 12, 2026

Where they overlap

  • MDR and managed SOC is the primary category of both Expel and Leonardo.

Where they differ, field by field

  • Leonardo is also filed under Incident response and forensics, Threat intelligence and Security consulting and advisory.
  • Expel lists Expel MDR and Ruxie. Leonardo lists SOC Managed Services, Cyber professional services, Incident handling and response services, Threat Intelligence, Investigation Support Systems and 1 more.

How they differ

CISO Tribune files both Expel and Leonardo under MDR and managed SOC as their primary category, but the rest of what each sells differs. Expel sells Expel MDR, a managed detection and response service that works with the security tools a customer already has, delivered through its Workbench platform with 24x7 analysts. Expel also offers email threat detection and response, and it describes MDR coverage of the AI attack surface. Expel names Microsoft, AWS, Google Cloud, CrowdStrike, Okta and Wiz among its integrations.

Leonardo sells SOC Managed Services, a family of security operations center services that provide round-the-clock detection and monitoring. CISO Tribune also files Leonardo under incident response and forensics, threat intelligence, and security consulting and advisory. Its products include Incident handling and response services, Threat Intelligence, Cyber professional services, Investigation Support Systems for government and law enforcement agencies, and Secure Analytics platforms. Leonardo's registered head office is in Rome, Italy.

Expel says its Ruxie engine gathers evidence and enriches alerts so that its analysts can investigate and make the critical calls. Expel states a 14-minute mean time to remediate for its MDR service. On August 4, 2026, Leonardo US Cyber & Security Solutions introduced SignalTrace as the new name for its electronic signature detection solution, previously called EOC Plus. On March 12, 2026, Leonardo presented to the financial community an update to its Industrial Plan to 2030.

What it sells: Expel

What Expel MDR does[5][7]
Expel MDR provides 24x7 SOC monitoring, with analysts who investigate and respond. Expel says it connects to an existing stack and correlates threats across endpoint, identity, cloud, network, SaaS and more. Expel states a 14-minute mean time to remediate.
What Ruxie does[3][5]
Expel says Ruxie gathers evidence, enriches alerts and matches patterns in seconds. Expel analysts then investigate and make the critical calls.

Questions about Expel and Leonardo

What do Expel and Leonardo sell?
Expel sells Expel MDR and Ruxie. Leonardo sells SOC Managed Services, Cyber professional services, Incident handling and response services, Threat Intelligence, Investigation Support Systems and 1 more.
Are Expel and Leonardo in the same category?
Yes. MDR and managed SOC is the primary category of both on CISO Tribune.
What have Expel and Leonardo announced recently?
August 4, 2026: Leonardo US Cyber & Security Solutions introduced SignalTrace as the new name for its electronic signature detection solution, previously called EOC Plus.

About Expel

Expel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has. Expel says its service is built so that technology makes it fast and humans make it accurate.[5]

Expel describes the service as managed detection and response with analysts who can be reached directly over Slack or Teams. Expel says customers connect Workbench to their existing stack, and Expel then correlates threats across endpoint, identity, cloud, network, SaaS and more. Expel says no agents need to be deployed and no rip-and-replace is required.[5]

Ruxie is the name Expel gives its AI and automation engine. Expel says Ruxie gathers evidence, enriches alerts and matches patterns so that Expel analysts can investigate and make the critical calls. Expel states a 14-minute mean time to remediate for its MDR service.[5]

Expel Workbench is the platform through which customers see Expel's work. Expel says customers can see every investigation and response in real time inside Workbench.[5]

Expel says its MDR covers cloud, endpoint, identity, network, SaaS, email and more, across more than 160 technology integrations. Expel names Microsoft, AWS, Google Cloud, CrowdStrike, Okta and Wiz among those integrations.[5][10]

Expel also offers email threat detection and response, in which Expel says it monitors the email environment 24x7. Expel says this works alongside Proofpoint, Mimecast, Abnormal Security and Sublime. Expel also describes MDR coverage of the AI attack surface, covering attacker use of AI, employee misuse of AI tools and attacks on customer-built AI systems, with detections mapped to MITRE ATLAS.[6][7]

Expel was started by practitioners. Dave Merkel is co-founder and Chief Executive Officer, Justin Bajko is a co-founder and Chief Strategy Officer, and Yanek Korff is a co-founder and Chief Operating Officer. Greg Notch is Chief Technology Officer.[8]

2. Expel says Workbench infrastructure runs on GCP and AWS in the U.S, and that alert data is retained up to 15 months, configurable per contract.[1][2][5][9]

Expel on the record

Sources

Expel full record

  1. [1]Workbench operations platformExpel · expel.com · published August 5, 2026 · Tier A
  2. [2]Expel announces 20 million in series b fundingExpel · expel.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Leading managed detection and response (MDR) provider | ExpelExpel · undated page, accessed October 24, 2026 · Tier A
  4. [4]Expel Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
  5. [5]Managed Detection and Response Services | Expel MDRExpel · undated page, accessed November 3, 2026 · Tier A
  6. [6]Email threat detection | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  7. [7]AI attack surface coverage | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  8. [8]Company | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  9. [9]Security and compliance support from your MDR | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  10. [10]Managed Security Solutions | ExpelExpel · undated page, accessed November 3, 2026 · Tier A

Leonardo full record

  1. [1]cybersecurity.leonardo.comLeonardo · cybersecurity.leonardo.com · undated page, accessed October 12, 2026 · Tier A
  2. [2]Cyber digital solutionsLeonardo · cybersecurity.leonardo.com · undated page, accessed October 12, 2026 · Tier A
  3. [3]Leonardo US Cyber & Security Solutions, Inc. Introduces SignalTrace™, the Next Evolution in Electronic Signature Detection TechnologyBusiness Wire · published August 4, 2026 · Tier A
  4. [4]Leonardo.Ai Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed November 1, 2026 · Tier C
  5. [5]Update to the business plan, including objectives and prioritiesLeonardo · published March 12, 2026 · Tier A

Spot a factual error? Request a correction.