What do Expel and Tenfold Security sell?

Expel sells Expel MDR and Ruxie. Tenfold Security sells Real-Time Risk Assessment.

Are Expel and Tenfold Security in the same category?

Yes. MDR and managed SOC is the primary category of both on CISO Tribune.

Vendor comparison · 2 companies

Expel vs Tenfold Security

Expel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has. Tenfold Security provides Active Penetration Testing, Real-Time Risk Assessment, Managed SIEM and CrowdStrike services. CISO Tribune files both under MDR and managed SOC. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

Expel
Tenfold Security

Add a company

Expel vs Tenfold Security: Products, Customers and Funding Compared
What it sells
	ExpelExpel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has.expel.com	Tenfold SecurityTenfold Security provides Active Penetration Testing, Real-Time Risk Assessment, Managed SIEM and CrowdStrike services.tenfoldsecurity.com
What it sells	Expel MDR^[5][7]A managed detection and response service that works with the security tools a customer already has. Ruxie^[3][5]Expel's AI and automation engine used in its MDR service.	Real-Time Risk Assessment^[3]Automates compliance with standards such as HIPAA, PCI and SOX.
Categories
Categories	MDR and managed SOC (primary category)	MDR and managed SOC (primary category) Penetration testing and red team services SIEM Security consulting and advisory
Headquarters
Headquarters	Not stated on its pages	Not stated on its pages
Founded
Founded	Not stated on its pages	Not stated on its pages
Ownership and funding
Ownership and funding	Not stated on its pages	Not stated on its pages
Named customers
Named customers	Not stated on its pages	Not stated on its pages
Recent news
Recent news	Not stated on its pages	Not stated on its pages
G2 and Gartner Peer Insights
G2 and Gartner Peer Insights	G2: listed, seen November 3, 2026^[4] Gartner Peer Insights: Not stated on its pages	G2: Not stated on its pages Gartner Peer Insights: Not stated on its pages
Who it fits
Who it fits	Not written yet	Not written yet
Last verified
Last verified	September 27, 2026	October 21, 2026

Where they overlap

MDR and managed SOC is the primary category of both Expel and Tenfold Security.

Where they differ, field by field

Tenfold Security is also filed under Penetration testing and red team services, SIEM and Security consulting and advisory.
Expel lists Expel MDR and Ruxie. Tenfold Security lists Real-Time Risk Assessment.

How they differ

CISO Tribune files both Expel and Tenfold Security under MDR and managed SOC as their primary category. Expel sells Expel MDR, a managed detection and response service with 24x7 analysts that works in the security tools a customer already has, delivered through its Workbench platform. Expel names a 14-minute mean time to remediate and describes Ruxie as its AI and automation engine, with analysts making the critical calls. Expel also lists email threat detection and response and MDR coverage of the AI attack surface.

CISO Tribune also files Tenfold Security under penetration testing and red team services, SIEM, and security consulting and advisory. Tenfold Security provides Active Penetration Testing, Real-Time Risk Assessment, Managed SIEM and CrowdStrike services. Its Real-Time Risk Assessment automates compliance with standards such as HIPAA, PCI and SOX, and its Managed SIEM is cloud-native and includes two years of secure log storage. Its CrowdStrike services include a dedicated SOC that provides around-the-clock visibility.

Expel names Microsoft, AWS, Google Cloud, CrowdStrike, Okta and Wiz among its more than 160 technology integrations. Tenfold Security describes a mid-size public university in the Midwest as a client, which it helped after a ransomware attack using Sentinel One and Velociraptor.

What it sells: Expel

What Expel MDR does^[5][7]: Expel MDR provides 24x7 SOC monitoring, with analysts who investigate and respond. Expel says it connects to an existing stack and correlates threats across endpoint, identity, cloud, network, SaaS and more. Expel states a 14-minute mean time to remediate.
What Ruxie does^[3][5]: Expel says Ruxie gathers evidence, enriches alerts and matches patterns in seconds. Expel analysts then investigate and make the critical calls.

What it sells: Tenfold Security

What Real-Time Risk Assessment does^[3]: Tenfold Security's Real-Time Risk Assessment automates compliance with standards such as HIPAA, PCI and SOX. Continuous monitoring provides instant updates and alerts.

Questions about Expel and Tenfold Security

What do Expel and Tenfold Security sell?: Expel sells Expel MDR and Ruxie. Tenfold Security sells Real-Time Risk Assessment.
Are Expel and Tenfold Security in the same category?: Yes. MDR and managed SOC is the primary category of both on CISO Tribune.

About Expel

Expel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has. Expel says its service is built so that technology makes it fast and humans make it accurate.^[5]

Expel describes the service as managed detection and response with analysts who can be reached directly over Slack or Teams. Expel says customers connect Workbench to their existing stack, and Expel then correlates threats across endpoint, identity, cloud, network, SaaS and more. Expel says no agents need to be deployed and no rip-and-replace is required.^[5]

Ruxie is the name Expel gives its AI and automation engine. Expel says Ruxie gathers evidence, enriches alerts and matches patterns so that Expel analysts can investigate and make the critical calls. Expel states a 14-minute mean time to remediate for its MDR service.^[5]

Expel Workbench is the platform through which customers see Expel's work. Expel says customers can see every investigation and response in real time inside Workbench.^[5]

Expel says its MDR covers cloud, endpoint, identity, network, SaaS, email and more, across more than 160 technology integrations. Expel names Microsoft, AWS, Google Cloud, CrowdStrike, Okta and Wiz among those integrations.^[5][10]

Expel also offers email threat detection and response, in which Expel says it monitors the email environment 24x7. Expel says this works alongside Proofpoint, Mimecast, Abnormal Security and Sublime. Expel also describes MDR coverage of the AI attack surface, covering attacker use of AI, employee misuse of AI tools and attacks on customer-built AI systems, with detections mapped to MITRE ATLAS.^[6][7]

Expel was started by practitioners. Dave Merkel is co-founder and Chief Executive Officer, Justin Bajko is a co-founder and Chief Strategy Officer, and Yanek Korff is a co-founder and Chief Operating Officer. Greg Notch is Chief Technology Officer.^[8]

2. Expel says Workbench infrastructure runs on GCP and AWS in the U.S, and that alert data is retained up to 15 months, configurable per contract.^[1][2][5][9]

Expel on the record

About Tenfold Security

Tenfold Security provides Active Penetration Testing, Real-Time Risk Assessment, Managed SIEM and CrowdStrike services. Tenfold Security works with organizations on cybersecurity challenges that range from ransomware attacks and security gaps to ongoing risk management. The Tenfold team is made up of security professionals and security-minded business professionals who want to provide a service that protects the vulnerable, in business and community.^[1][3][4][5]

Aaron Weissenfluh is passionate about securing SMBs with practical security solutions. Aaron Weissenfluh, COO of Tenfold Security, has served as a CISO for a major stock exchange.^[6]

Tenfold Security's Active Penetration Testing Services simulate real-world attacks to test a customer's detection and response capabilities. Tenfold Security's Active Penetration Testing identifies and rates vulnerabilities and provides real-time mitigation. Tenfold Security's Active Penetration Testing includes continuous monitoring and analyses.^[3]

Tenfold Security's Real-Time Risk Assessment automates compliance with standards such as HIPAA, PCI and SOX.^[3]

Tenfold Security's Managed SIEM gives 24/7 visibility into what is happening across a customer's systems and applications. Tenfold Security's Managed SIEM collects and monitors security logs in real time and alerts the Tenfold Security team to suspicious activity before it becomes a business-impacting incident. Tenfold Security's Managed SIEM is a cloud-native solution that integrates with existing tools. Tenfold Security's Managed SIEM supports compliance requirements and includes two years of secure log storage.^[3]

Tenfold Security's CrowdStrike services deliver cloud-native endpoint protection, AI-powered detection and continuous monitoring. Tenfold Security's CrowdStrike services include a dedicated SOC that provides around-the-clock visibility. Tenfold Security's CrowdStrike services include access to the full CrowdStrike product suite.^[1][3]

A mid-size public university in the Midwest, serving thousands of students across multiple campuses, was a Tenfold Security client. Tenfold Security was engaged on the day of the university's full network failure. The response to the university's ransomware attack used a parallel workstream model in which different response teams worked simultaneously on network analysis, device triage, forensics and communication. Tenfold Security deployed Sentinel One and Velociraptor across all university devices. Tenfold Security used Sentinel One for real-time endpoint detection and response and Velociraptor for rapid forensic collection and hunting for persistence mechanisms. Tenfold Security's response included identifying and closing the open RDP port and auditing all vendor access paths. Tenfold Security's response included disabling compromised accounts and resetting all credentials with enforced MFA. Tenfold Security's response included assessing which data was recoverable and which was lost through the vendor breach. Tenfold Security's response included coordinating with cyber insurance to document the incident and manage communications. Tenfold Security's response included establishing an internal communication protocol to stop the spread of misinformation. Tenfold Security built the response around the university's infrastructure, vendor relationships and operational priorities. Five days after engagement, all devices were clean and the network was fully restored.

The university now operates with continuous managed detection and response, vendor management and tested incident response procedures.

Tenfold Security on the record

Sources

Expel full record

[1]Workbench operations platformExpel · expel.com · published August 5, 2026 · Tier A
[2]Expel announces 20 million in series b fundingExpel · expel.com · undated page, accessed September 27, 2026 · Tier A
[3]Leading managed detection and response (MDR) provider | ExpelExpel · undated page, accessed October 24, 2026 · Tier A
[4]Expel Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
[5]Managed Detection and Response Services | Expel MDRExpel · undated page, accessed November 3, 2026 · Tier A
[6]Email threat detection | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
[7]AI attack surface coverage | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
[8]Company | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
[9]Security and compliance support from your MDR | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
[10]Managed Security Solutions | ExpelExpel · undated page, accessed November 3, 2026 · Tier A

Tenfold Security full record

[1]Empowering Businesses with Enterprise-Grade Cybersecurity | About Tenfold SecurityTenfold Security · undated page, accessed October 21, 2026 · Tier A
[2]tenfoldsecurity.comTenfold Security · tenfoldsecurity.com · undated page, accessed October 21, 2026 · Tier A
[3]Our Services | Tenfold SecurityTenfold Security · undated page, accessed November 10, 2026 · Tier A
[4]Case StudyTenfold Security · undated page, accessed November 10, 2026 · Tier A
[5]Enterprise-Grade Security Solutions for Small & Midsize Businesses | Tenfold SecurityTenfold Security · undated page, accessed November 10, 2026 · Tier A
[6]The CEO of Cybersecurity (And Why Most Companies Still Get It Wrong)Tenfold Security · undated page, accessed November 10, 2026 · Tier A
[7]Case Study: University Recovery in 5 Days | Tenfold SecurityTenfold Security · published July 23, 2026 · Tier A

Spot a factual error? Request a correction.