Expel Managed Detection and Response (MDR)

Expel serves as my MDR provider and platform, secondary to SentinelOne.

I utilize Expel as a collaboration tool within Slack. This is a newer portion of the platform that was recently added. I use it specifically to monitor false positives around my other SIEM tools relative to SentinelOne and other tools within my tech stack.

Some of the workflows I utilize with Expel are specific to end users, allowing them to create self-service initiations in the event they have a security incident or suspect a security incident. This goes beyond simply clicking a button to indicate something may need review. It allows them to go through one through three or one through four steps on their end without constant human engagement.

Expel has helped me in numerous ways, specifically regarding catching phishing attempts early. Some of the low-level phishing attacks, such as those claiming to be from the CEO offering a gift card, have been reduced by at least 60%. It has also helped with compliance and audit evidence. It has significantly accelerated my SOC 2 Type 2 portions.

Expel allows me to keep up with reports and helps me through audit trails. It provides a specific function that allows me to better support SOC 2 compliance. Regarding cyber insurance questionnaires, I do use AI for some of those and some external tools. However, instead of having to search around for that information, it is right there within the workbench, and I am able to pull all that information out and get it filled out faster.

Some of the best features Expel offers is the ease of use. Ease of use is top of mind. It also provides an opportunity for me to replace my SOC. Not necessarily replace my SOC because I utilize contractors on an as-needed basis, but it allows me to stay lean.

I do get 24/7 monitoring, although they recently shortened up on the 24/7 monitoring offering. It also allows me to augment the existing SOC that I have for larger companies or larger enterprises that rely on me for that. It then extends the use of the tools I already have, as I mentioned with SentinelOne. Octa is another that comes to mind, and then for larger organizations that use CrowdStrike.

I think the 24/7 SOC could be improved. It does feel a bit clunky. To a degree, it feels as if there is an automated feature in front of the platform, but there seems to be a human on the back end of it that may or may not have the expertise that is promised. If they could improve that, it would be a lot better. Otherwise, it is a really solid platform.

I have been using Expel for about three years.

Expel is stable.

I would rate Expel's scalability a nine out of ten.

Expel's customer support is great. I would rate the customer support a ten.

I still use SentinelOne. I use it in conjunction with Expel.

I do not have specific metrics, but Expel did help me save a lot of time specifically as it relates to the SOC 2 portion that I mentioned.

The experience with pricing, setup cost, and licensing is seamless.

I evaluated other options before choosing Expel, including CrowdStrike and SentinelOne.

I would rate Expel an eight on a scale of one to ten. I would rate Expel an eight because improving that feature I previously mentioned would make a significant difference.

Expel's AI capabilities are very good.

Regarding Expel's accuracy and reliability of output, I would say about a seven.

I advise others looking into using Expel to do their research, but if ease of use is top of mind, go for Expel.

Hybrid Cloud

Amazon Web Services (AWS)

What do you like best about the product?

I like the way the details were shared, how the alerts are prioritised, and the proactive approach to immediate remediation.

What do you dislike about the product?

Some alerts get triggered by a bot called ruxie, and those sometimes don’t include much detail. I’d like to see more details and better context in those alerts.

What problems is the product solving and how is that benefiting you?

Expel triggers alerts that other tools missed, which helped us avoid multiple breaches.

What do you like best about the product?

Expel has delivered the most value for us through its combination of high-fidelity detection, transparent investigation workflows, and a truly collaborative MDR experience. The Expel Workbench stands out as a core feature. We use it daily to see exactly how alerts are triaged, enriched, and investigated across our integrated tools (Microsoft Defender, Azure AD, email security, etc.). Instead of a black-box SOC, we get clear timelines, analyst notes, and evidence, which significantly improves trust and speeds internal decision-making.

From a workflow perspective, Expel has reduced alert fatigue and operational overhead in a very real way. Our team no longer spends hours chasing low-confidence alerts or stitching together context from multiple consoles. Expel’s correlation and enrichment mean that when an issue is escalated to us, it’s already validated, scoped, and prioritized. That alone has saved us dozens of hours per month and allowed our internal staff to focus on higher-value risk reduction work rather than constant reactive triage.

One unexpected benefit has been how much Expel improves security maturity over time, not just incident response. Their analysts routinely identify configuration gaps, logging blind spots, and detection opportunities that we wouldn’t have surfaced as quickly on our own. Those insights have directly informed improvements to our controls, tuning decisions, and roadmap. The relationship feels less like “outsourced monitoring” and more like an extension of our security team, which is rare in MDR services.

Overall, Expel has provided measurable improvements in response speed, signal quality, and team efficiency, while also raising confidence with leadership by delivering clear, defensible incident narratives when it matters most.

What do you dislike about the product?

While Expel delivers strong detection and response capabilities, there are a few areas where the experience could be improved. One challenge is the depth and parity of integration across supported tools. Some data sources provide rich context and seamless workflows, while others feel more limited, leading to inconsistencies in investigations depending on the technology involved. This occasionally requires our team to pivot back into native vendor consoles for full validation, reducing some of the efficiency gains of a centralized MDR platform. Deeper, more uniform integration across all supported tools would further streamline investigations.

Another area for improvement is customization and tuning visibility. Although Expel handles alert triage very well, there are times when we would benefit from more granular control or clearer insight into detection logic, suppression rules, or escalation thresholds, especially for environments with unique risk tolerances. Limited self-service tuning can make it harder to quickly adapt detections to evolving business or threat conditions without engaging support.

Finally, reporting and metrics, while clear at an incident level, could be more flexible for executive and program-level reporting. Creating customized reports that map directly to internal KPIs, compliance requirements, or frameworks like NIST or ISO sometimes requires additional manual effort. More configurable dashboards and exportable reporting options would improve leadership visibility and reduce time spent translating operational data into executive-ready insights.

Overall, these are refinement opportunities rather than fundamental gaps. Addressing integration consistency, tuning transparency, and reporting flexibility would further strengthen Expel’s value, particularly for mature security teams seeking both operational excellence and strategic insight.

What problems is the product solving and how is that benefiting you?

Before using Expel, we struggled with high alert volume, inconsistent signal quality, and limited internal capacity to monitor multiple security platforms 24/7. Alerts were coming from endpoint, identity, and email tools, but our team spent too much time validating false positives, correlating events across consoles, and determining whether something actually warranted escalation. This created response delays and made it difficult to maintain confidence that real threats wouldn’t be missed during off-hours.

After implementing Expel, we gained continuous, high-fidelity monitoring with expert-driven triage and correlation across our existing security stack. Instead of reacting to raw alerts, we now receive validated, contextualized incidents with clear timelines, scope, and recommended actions. This has reduced alert noise by an estimated 80–90%, cut investigation time from hours to minutes, and improved our mean time to respond by more than 50%.

Expel also solved a staffing and scalability problem. We no longer need to over-hire or maintain a fully staffed internal SOC to achieve enterprise-grade monitoring. This has resulted in meaningful cost avoidance while still giving us 24/7 coverage and consistent response quality. Internally, our security team can now focus on proactive risk reduction, architecture improvements, and control maturity rather than constant reactive triage.

Finally, Expel addressed visibility and confidence gaps with leadership. We struggled to clearly explain incidents and response actions to executives in a defensible, non-technical way. Now, Expel’s detailed incident narratives and evidence-backed reporting allow us to communicate what happened, why it mattered, and how it was contained, building trust and speeding decision-making.

In short, we struggled with alert overload, limited coverage, and slow response, but now we operate with validated detections, faster response, and significantly less operational burden, resulting in measurable time savings, reduced risk exposure, and a more resilient security program overall.

What do you like best about the product?

I really appreciate how Expel offers a wide range of API integrations, which makes it easy to connect with other tools in our security ecosystem. Their platform also provides a clean and intuitive interface for viewing all incidents and investigations in one place, which streamlines our workflow and improves visibility.

What do you dislike about the product?

I wish Expel offered a mobile app for easier visibility when I’m away from my workstation. I’d like to see more timely and effective responses from the SOC team when comments are added to incidents or investigations, as that can sometimes feel a bit lacking. The escalation process could also use improvement, such as having a clear procedure to initiate a call for critical incidents. Lastly, some of their integration documentation could benefit from more frequent updates to keep pace with constant API changes from tools like Microsoft and others.

What problems is the product solving and how is that benefiting you?

Expel helps our SOC by creating specific detections for a wide range of alerts and security anomalies. I really value that they thoroughly investigate everything before escalating to us, which reduces noise and ensures we only deal with actionable items. Since we’re a small SOC team internally, having Expel handle much of the threat detection workload allows us to focus on higher-priority incidents and strategic projects that need more attention.

What do you like best about the product?

Their Soc team does due diligence and deep research about any incident and provide with a lot of information regarding a case.

What do you dislike about the product?

Their onboarding process was not super smooth as they will let you follow their instructions to connect everything. They have great documentation but sometimes as new customer you want to be assisted over a call to make sure you have configured everything correctly.

What problems is the product solving and how is that benefiting you?

MDR. We dont have our own security operations center or security team to look at our environment 24x7 and we have partnered with Expel to address this issue. They have been great so far in their detection and reporting.