Product Overview

Expel

Founded in May 2016 by ex-Mandiant/FireEye veterans Dave Merkel, Justin Bajko, and Yanek Korff, Expel takes a deliberate stance: no proprietary agent, full transparency into SOC activity via the Workbench portal, and integration with whatever security tools the customer already owns. The company reached unicorn status in November 2021 and was named a Leader in The Forrester Wave for MDR Services, Q1 2025. Independent and private.

Last updated February 28, 2026

Founded

2016

Pricing

Custom (contact sales)

Verify with vendor

Deployment

Cloud

Managed Security Service Providers

SOC 2 Type II

Key Features

+MDR across endpoint, cloud, SaaS, identity, Kubernetes, and network

+Managed SIEM

+Phishing investigation and response

+Threat hunting

+Auto-remediation / automated containment with customer approval

+Expel Intel threat intelligence

+24/7 SOC monitoring with named MTTR commitments

Pros & Cons

Pros

+Genuinely vendor-neutral: no Expel agent, integrates with existing EDR/SIEM/cloud stack
+Transparent operations via Workbench (customers see every analyst action in real time)
+Strong public commitments such as a 13-minute MTTR for critical threats
+Founding team's Mandiant lineage gives credibility in IR and detection engineering

Cons

–'Bring your own tech' means customers must already own (and license) suitable EDR/SIEM/cloud tooling
–Premium pricing relative to bundled MSSP offerings
–Limited public pricing; sales-led

Best For

Teams that already own a quality EDR/SIEM/cloud stack and want a transparent, vendor-neutral SOC layered on top

Community & Practitioner Evidence

Community Sources

🔗 Other Resources

→
Expel — About[Expel]
→
Expel on Crunchbase[Crunchbase]

User Reviews

Takes about 2 minutes. Your review helps other security teams.

No reviews yet. Be the first to share your experience!