Expel
Expel provides managed detection and response security services using AI and human analysts.
- Categories
- Managed detection and response, Managed security services, Incident response, Email security
- Based in
- Herndon, United States
- Founded
- 2016
- Ownership
- Private
- Certifications
- ISO/IEC 27001, ISO/IEC 27701, SOC 2 Type II, PCI DSS SAQ-D, CSA STAR Level 1, EU-U.S. DPF, NIST SP 800-171 Rev. 2
About Expel
Expel provides managed detection and response (MDR) security services. It sells to organisations that need 24x7 monitoring and response across attack surfaces such as cloud, email, endpoint, identity, network, SaaS, and AI. The company uses its own security operations platform, Expel Workbench, and an AI and automation engine called Ruxie. Expel says its analysts work directly with customers through Slack or Teams and use the tools customers already have. It also offers phishing detection and response, where employees report suspicious emails and Expel triages and investigates them. Expel states it is a Leader in the Forrester Wave for MDR Services, Q1 2025. It reports a 14-minute mean time to remediate for critical and high incidents with auto-remediation. The company says it provides full access to Workbench so customers can see every action taken.
Products
- Expel WorkbenchAn AI-powered security operations platform that connects customer tools, correlates signals, and provides a transparent view of analyst actions.
- Ruxie AIAn AI and automation engine that enriches alerts, triages evidence, and supports faster investigations across the threat lifecycle.
- Expel MDRA managed detection and response service with 24x7 human analysts who use customer tools and context to investigate and remediate threats.
- Expel PhishingA service that triages reported phishing emails, investigates malicious content, and provides remediation guidance.
Ownership and deals
- Raised $31m in a Series E roundInvestors CapitalG and Paladin Capital GroupReport on the Expel funding round of October 2022 (opens in a new tab)
Acquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. Funding rounds from 2022 onwards come from Return on Security's weekly Security, Funded newsletter. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Amounts are in US dollars.