CISO Tribune

Vendor comparison · 2 companies

Expel vs Third Wave Innovations

Expel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has. Third Wave Innovations helps growing businesses understand cyber risk, reduce exposure, stay insurable, and recover when something goes wrong. CISO Tribune files both under MDR and managed SOC. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Expel
  • Third Wave Innovations
Expel vs Third Wave Innovations: Products, Customers and Funding Compared
ExpelExpel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has.expel.comThird Wave InnovationsThird Wave Innovations helps growing businesses understand cyber risk, reduce exposure, stay insurable, and recover when something goes wrong.3rdwave.io
What it sells
  • Expel MDR[5][7]A managed detection and response service that works with the security tools a customer already has.
  • Ruxie[3][5]Expel's AI and automation engine used in its MDR service.
  • Security Awareness Training[1][5]Training that builds employee cyber knowledge and meets compliance training requirements.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pagesNot stated on its pages
G2 and Gartner Peer Insights
  • G2: listed, seen November 3, 2026[4]
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Not written yetFrom its own pages, Third Wave Innovations sells mainly to growing businesses, including small and midsized organizations without a full security team. The pages describe customers such as a mid-sized technology company operating in the healthcare space, a services-based organization, and a manufacturing company. Third Wave Innovations aligns security controls with what insurers expect, so organizations that want to maintain cyber insurance coverage and pass underwriting are part of its audience. Security Awareness Training addresses the training requirements of compliance standards including SOC2, PCI DSS, and HIPAA. Automated Detection & Response works with existing tools for network, identity, cloud, endpoint, and office productivity.
Last verified
September 27, 2026October 19, 2026

Where they overlap

  • MDR and managed SOC is the primary category of both Expel and Third Wave Innovations.

Where they differ, field by field

  • Third Wave Innovations is also filed under Security awareness training, Vulnerability management and Third-party risk and security ratings.
  • Expel lists Expel MDR and Ruxie. Third Wave Innovations lists Security Awareness Training.

How they differ

CISO Tribune files both Expel and Third Wave Innovations under MDR and managed SOC as the primary category. Expel sells Expel MDR, a managed detection and response service with 24x7 SOC monitoring that works with the security tools a customer already has. Third Wave Innovations also implemented MDR, with 24/7 monitoring, automated containment and verified response actions, and it integrated monitoring across Microsoft 365, identity systems and endpoint controls without replacing existing tools. Expel states a 14-minute mean time to remediate, and it names Microsoft, AWS, Google Cloud, CrowdStrike, Okta and Wiz among more than 160 technology integrations.

Expel delivers its service through the Workbench platform and uses an AI and automation engine called Ruxie, while analysts investigate and make the critical calls. Expel also offers email threat detection and response, and it describes MDR coverage of the AI attack surface. Its Security Awareness Training includes a library of over 200 short videos, customizable phishing simulations, and coverage of training requirements for SOC2, PCI DSS and HIPAA. It also offers Automated Detection & Response, which works with existing tools for network, identity, cloud, endpoint and office productivity.

Third Wave Innovations was founded in 2017 and sells mainly to growing small and midsized organizations without a full security team, with a focus on cyber insurance readiness. Its pages describe customers such as a mid-sized technology company in healthcare, a services-based organization, and a manufacturing company. Expel says its workbench infrastructure runs on GCP and AWS in the U.S.

What it sells: Expel

What Expel MDR does[5][7]
Expel MDR provides 24x7 SOC monitoring, with analysts who investigate and respond. Expel says it connects to an existing stack and correlates threats across endpoint, identity, cloud, network, SaaS and more. Expel states a 14-minute mean time to remediate.
What Ruxie does[3][5]
Expel says Ruxie gathers evidence, enriches alerts and matches patterns in seconds. Expel analysts then investigate and make the critical calls.

What it sells: Third Wave Innovations

What Security Awareness Training does[1][5]
Security Awareness Training offers a library of over 200 short videos available in multiple languages. It includes customizable phishing simulations and pre-designed courses with dashboards and reports for tracking employee progress. It addresses training requirements of compliance standards including SOC2, PCI DSS, and HIPAA.

Questions about Expel and Third Wave Innovations

What do Expel and Third Wave Innovations sell?
Expel sells Expel MDR and Ruxie. Third Wave Innovations sells Security Awareness Training.
Are Expel and Third Wave Innovations in the same category?
Yes. MDR and managed SOC is the primary category of both on CISO Tribune.
Who are Expel and Third Wave Innovations sold to?
From its own pages, Third Wave Innovations sells mainly to growing businesses, including small and midsized organizations without a full security team.

About Expel

Expel sells managed detection and response (MDR) delivered through its Workbench platform, with 24x7 human analysts working in the security tools a customer already has. Expel says its service is built so that technology makes it fast and humans make it accurate.[5]

Expel describes the service as managed detection and response with analysts who can be reached directly over Slack or Teams. Expel says customers connect Workbench to their existing stack, and Expel then correlates threats across endpoint, identity, cloud, network, SaaS and more. Expel says no agents need to be deployed and no rip-and-replace is required.[5]

Ruxie is the name Expel gives its AI and automation engine. Expel says Ruxie gathers evidence, enriches alerts and matches patterns so that Expel analysts can investigate and make the critical calls. Expel states a 14-minute mean time to remediate for its MDR service.[5]

Expel Workbench is the platform through which customers see Expel's work. Expel says customers can see every investigation and response in real time inside Workbench.[5]

Expel says its MDR covers cloud, endpoint, identity, network, SaaS, email and more, across more than 160 technology integrations. Expel names Microsoft, AWS, Google Cloud, CrowdStrike, Okta and Wiz among those integrations.[5][10]

Expel also offers email threat detection and response, in which Expel says it monitors the email environment 24x7. Expel says this works alongside Proofpoint, Mimecast, Abnormal Security and Sublime. Expel also describes MDR coverage of the AI attack surface, covering attacker use of AI, employee misuse of AI tools and attacks on customer-built AI systems, with detections mapped to MITRE ATLAS.[6][7]

Expel was started by practitioners. Dave Merkel is co-founder and Chief Executive Officer, Justin Bajko is a co-founder and Chief Strategy Officer, and Yanek Korff is a co-founder and Chief Operating Officer. Greg Notch is Chief Technology Officer.[8]

2. Expel says Workbench infrastructure runs on GCP and AWS in the U.S, and that alert data is retained up to 15 months, configurable per contract.[1][2][5][9]

Expel on the record

Sources

Expel full record

  1. [1]Workbench operations platformExpel · expel.com · published August 5, 2026 · Tier A
  2. [2]Expel announces 20 million in series b fundingExpel · expel.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Leading managed detection and response (MDR) provider | ExpelExpel · undated page, accessed October 24, 2026 · Tier A
  4. [4]Expel Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
  5. [5]Managed Detection and Response Services | Expel MDRExpel · undated page, accessed November 3, 2026 · Tier A
  6. [6]Email threat detection | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  7. [7]AI attack surface coverage | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  8. [8]Company | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  9. [9]Security and compliance support from your MDR | ExpelExpel · undated page, accessed November 3, 2026 · Tier A
  10. [10]Managed Security Solutions | ExpelExpel · undated page, accessed November 3, 2026 · Tier A

Third Wave Innovations full record

  1. [1]3rdwave.ioThird Wave Innovations · 3rdwave.io · undated page, accessed October 19, 2026 · Tier A
  2. [2]About Us | Third Wave InnovationsThird Wave Innovations · undated page, accessed November 10, 2026 · Tier A
  3. [3]Home | Third Wave InnovationsThird Wave Innovations · undated page, accessed November 10, 2026 · Tier A
  4. [4]Case Studies | Third Wave InnovationsThird Wave Innovations · undated page, accessed November 10, 2026 · Tier A
  5. [5]Security Awareness Training | Third Wave InnovationsThird Wave Innovations · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.