CISO Tribune

Vendor comparison · 2 companies

Expel vs SonicWall

Expel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has. SonicWall is a unified cybersecurity portfolio that helps SMBs, MSPs, and IT teams consolidate network, endpoint, cloud, and threat response across hybrid environments. CISO Tribune files both under MDR and managed SOC. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Expel
  • SonicWall
Expel vs SonicWall: Products, Customers and Funding Compared
ExpelExpel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has.expel.comSonicWallSonicWall is a unified cybersecurity portfolio that helps SMBs, MSPs, and IT teams consolidate network, endpoint, cloud, and threat response across hybrid environments.sonicwall.com
What it sells
  • Expel MDR[5][7]A managed detection and response service that works with the security tools a customer already has.
  • Ruxie[3][5]Expel's AI and automation engine used in its MDR service.
  • Capture Client[3][12]Endpoint detection and response built on SentinelOne.
  • Cloud Secure Edge[1][3][7][13][15]SonicWall's Security Service Edge (SSE) platform.
  • SonicSentry MDR[3][7][11]Managed detection and response from SonicWall analysts.
  • SonicWall Unified Management[3]A single console for managing SonicWall products.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesOwned by Francisco Partners and Elliott Management since 2016[2][3][5][6]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pages
  • May 12, 2026SonicWall announced availability of the Gen 8 NSv XS, a subscription-based virtual firewall for MSPs and MSSPs serving small and distributed environments.[18]
G2 and Gartner Peer Insights
  • G2: listed, seen November 3, 2026[4]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 4, 2026[5]
  • Gartner Peer Insights: listed, seen November 4, 2026[6]
Who it fits
Not written yetFrom its own pages, SonicWall sells mainly to SMBs, MSPs, and IT teams, and to MSSPs and distributed enterprises. Its pages name healthcare, education, local government, finance, manufacturing, and retail as the kinds of organizations it protects. TZ series firewalls are positioned for SMBs and branch locations.
Last verified
September 27, 2026September 27, 2026

Where they overlap

  • Expel and SonicWall are both filed under MDR and managed SOC.

Where they differ, field by field

  • Expel's primary category is MDR and managed SOC; SonicWall's is Firewalls and NGFW.
  • SonicWall is also filed under SASE and SSE and EDR and XDR.
  • Expel lists Expel MDR and Ruxie. SonicWall lists Capture Client, Cloud Secure Edge, SonicSentry MDR and SonicWall Unified Management.
  • SonicWall is owned by Francisco Partners and Elliott Management, since 2016.

What it sells: Expel

What Expel MDR does[5][7]
Expel MDR provides 24x7 SOC monitoring, with analysts who investigate and respond. Expel says it connects to an existing stack and correlates threats across endpoint, identity, cloud, network, SaaS and more. Expel states a 14-minute mean time to remediate.
What Ruxie does[3][5]
Expel says Ruxie gathers evidence, enriches alerts and matches patterns in seconds. Expel analysts then investigate and make the critical calls.

What it sells: SonicWall

What Capture Client does[3][12]
Capture Client is built on SentinelOne. SonicWall describes it as delivering endpoint detection and response integrated with the SonicWall ecosystem.
What Cloud Secure Edge does[1][3][7][13][15]
Cloud Secure Edge delivers secure access to internal resources and safe connections to the internet for remote and hybrid workers. It covers ZTNA, SWG, CASB, and DNS Security from one platform.
What SonicSentry MDR does[3][7][11]
SonicSentry MDR combines SonicWall telemetry with expert analysts who hunt, triage, and contain threats around the clock. For endpoints, SonicWall describes 24/7 expert monitoring and response backed by proactive threat hunting.
What SonicWall Unified Management does[3]
SonicWall Unified Management gives IT teams and MSPs a single console to manage, monitor, and respond. It covers firewalls, switches, endpoints, and Cloud Secure Edge.

Questions about Expel and SonicWall

What do Expel and SonicWall sell?
Expel sells Expel MDR and Ruxie. SonicWall sells Capture Client, Cloud Secure Edge, SonicSentry MDR and SonicWall Unified Management.
Are Expel and SonicWall in the same category?
They share MDR and managed SOC. Expel's primary category is MDR and managed SOC and SonicWall's is Firewalls and NGFW.
Who owns Expel and SonicWall?
SonicWall is owned by Francisco Partners and Elliott Management, since 2016.
Who are Expel and SonicWall sold to?
From its own pages, SonicWall sells mainly to SMBs, MSPs, and IT teams, and to MSSPs and distributed enterprises.
What have Expel and SonicWall announced recently?
May 12, 2026: SonicWall announced availability of the Gen 8 NSv XS, a subscription-based virtual firewall for MSPs and MSSPs serving small and distributed environments.

About Expel

Expel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has. Expel says its service is built so that technology makes it fast and humans make it accurate.[5]

Expel describes the service as managed detection and response with analysts who can be reached directly over Slack or Teams. Expel says customers connect Workbench to their existing stack, and Expel then correlates threats across endpoint, identity, cloud, network, SaaS and more. Expel says no agents need to be deployed and no rip-and-replace is required.[5]

Ruxie is the name Expel gives its AI and automation engine. Expel says Ruxie gathers evidence, enriches alerts and matches patterns so that Expel analysts can investigate and make the critical calls. Expel states a 14-minute mean time to remediate for its MDR service.[5]

Expel Workbench is the platform through which customers see Expel's work. Expel says customers can see every investigation and response in real time inside Workbench.[5]

Expel says its MDR covers cloud, endpoint, identity, network, SaaS, email and more, across more than 160 technology integrations. Expel names Microsoft, AWS, Google Cloud, CrowdStrike, Okta and Wiz among those integrations.[5][10]

Expel also offers email threat detection and response, in which Expel says it monitors the email environment 24x7. Expel says this works alongside Proofpoint, Mimecast, Abnormal Security and Sublime. Expel also describes MDR coverage of the AI attack surface, covering attacker use of AI, employee misuse of AI tools and attacks on customer-built AI systems, with detections mapped to MITRE ATLAS.[6][7]

Expel was started by practitioners. Dave Merkel is co-founder and Chief Executive Officer, Justin Bajko is a co-founder and Chief Strategy Officer, and Yanek Korff is a co-founder and Chief Operating Officer. Greg Notch is Chief Technology Officer.[8]

2. Expel says Workbench infrastructure runs on GCP and AWS in the U.S, and that alert data is retained up to 15 months, configurable per contract.[1][2][5][9]

Expel on the record

Sources

Expel full record

  1. [1]Workbench operations platformExpel · expel.com · published August 5, 2026 · Tier A
  2. [2]Expel announces 20 million in series b fundingExpel · expel.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Leading managed detection and response (MDR) provider | ExpelExpel · undated page, accessed October 24, 2026 · Tier A
  4. [4]Expel Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
  5. [5]Managed Detection and Response Services | Expel MDRExpel · undated page, accessed November 3, 2026 · Tier A
  6. [6]Email threat detection | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  7. [7]AI attack surface coverage | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  8. [8]Company | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  9. [9]Security and compliance support from your MDR | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  10. [10]Managed Security Solutions | ExpelExpel · undated page, accessed November 3, 2026 · Tier A

SonicWall full record

  1. [1]sonicwall.comSonicWall · sonicwall.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Francisco partners and elliott management complete acquisition of dell software groupFrancisco Partners · franciscopartners.com · published November 1, 2016 · Tier A
  3. [3]Cybersecurity That Delivers Real Business Outcomes | SonicWallSonicWall · undated page, accessed October 28, 2026 · Tier A
  4. [4]Federal Government Cybersecurity | SonicWallSonicWall · undated page, accessed October 28, 2026 · Tier A
  5. [5]SonicWall Next Generation Firewall Reviews & Product Details - G2G2 · undated page, accessed October 28, 2026 · Tier C
  6. [6]SonicWall Reviews, Ratings & Features 2026 | Gartner Peer InsightsGartner Peer Insights · undated page, accessed October 28, 2026 · Tier C
  7. [7]Cybersecurity Solutions by Use Case | SonicWallSonicWall · undated page, accessed November 4, 2026 · Tier A
  8. [8]Cybersecurity for Cloud Virtual and Hybrid Networks | SonicWallSonicWall · undated page, accessed November 4, 2026 · Tier A
  9. [9]SonicWall TZ Series: Advanced Protection for SMBs | Entry Level Next Generation FirewallsSonicWall · undated page, accessed November 4, 2026 · Tier A
  10. [10]Firewall & Network Security Services | SonicwallSonicWall · undated page, accessed November 4, 2026 · Tier A
  11. [11]Endpoint Security & Managed EDR Solutions | SonicWallSonicWall · undated page, accessed November 4, 2026 · Tier A
  12. [12]Endpoint Security Solutions | EDR, NGAV & Ransomware Protection | SonicWallSonicWall · undated page, accessed November 4, 2026 · Tier A
  13. [13]Cloud Secure Edge (CSE): ZTNA Solution | SonicWallSonicWall · undated page, accessed November 4, 2026 · Tier A
  14. [14]SonicWall VPN Clients | NetExtender & Mobile ConnectSonicWall · undated page, accessed November 4, 2026 · Tier A
  15. [15]SonicWall Unified Management | Cybersecurity PlatformSonicWall · undated page, accessed November 4, 2026 · Tier A
  16. [16]SonicWall Capture Advanced Threat Protection (ATP)SonicWall · undated page, accessed November 4, 2026 · Tier A
  17. [17]On-Premise ATP | SonicWall Capture Security applianceSonicWall · undated page, accessed November 4, 2026 · Tier A
  18. [18]SonicWall Expands Gen 8 Platform to the Cloud with New NSv XS Virtual Firewall to Help MSPs and MSSPs Deliver Managed Security Wherever Workloads RunSonicWall · published May 12, 2026 · Tier A

Spot a factual error? Request a correction.