Introduction
Expel was founded in 2016 in Herndon, Virginia, by Dave Merkel, Yanek Korff, and Justin Bajko, three security industry veterans who had previously worked together at FireEye and its Mandiant incident-response arm. The company’s own account of its founding is blunt about its motivation: as Expel puts it on its about page, ‘traditional MDRs sold you noise, not protection,’ hiding behind portals full of superficial metrics instead of showing customers the actual work being done on their behalf, and Expel was built specifically to be the MDR service its founders wished they could have bought themselves.
What the company does
Expel’s platform, the Expel Workbench, delivers managed detection and response (MDR), threat hunting, phishing triage, and remediation support, structured so customers can watch investigations unfold in real time rather than receiving only a distilled summary after an analyst has finished working an alert. Customers can choose how closely they want to follow along — reviewing live investigation activity as it happens, or simply receiving notifications at each major step from the start of an investigation until it closes — giving them a level of visibility into the MDR process that Expel positions as a direct alternative to the more opaque reporting typical of the category.
Who it serves
Expel serves both commercial and government organizations that want managed detection and response coverage but are specifically motivated by the transparency of Expel’s investigation process, rather than choosing an MDR vendor purely on price or headline feature list. That transparency-first positioning has proven durable enough to carry Expel from a 2016 founding to unicorn status by 2021, competing against both larger, longer-established security vendors offering MDR as an add-on service and newer, more specialized MDR-only providers.
Company background
Dave Merkel serves as Expel’s chief executive, with co-founder Yanek Korff as chief operating officer and co-founder Justin Bajko as chief strategy officer, a founding team that has remained intact and in senior operating roles since the company’s 2016 launch — a notable degree of founder continuity for a company that has since raised nearly $300 million in venture funding. On October 3, 2022, Expel announced an increase to its Series E round, led by Alphabet’s independent growth fund CapitalG and Paladin Capital Group, with participation from existing investors including Scale Venture Partners, March Capital, Index Ventures, and Battery Ventures, bringing its total funding to $288.8 million.
Product and AI capabilities
Expel has layered automation and machine-learning-assisted triage into the Expel Workbench to help its analysts manage alert volume across a large, multi-tenant customer base, but the company’s differentiation has consistently centered on how it presents and communicates that work to customers rather than on claims of fully autonomous detection. As MDR competitors have increasingly marketed AI-driven, largely automated response capabilities, Expel’s transparency-first model — letting customers see the specific reasoning and steps behind a detection — has remained a distinguishing feature that is harder for less transparent competitors to replicate quickly, regardless of how much automation sits underneath the surface. The Workbench also aggregates phishing-report triage and threat-hunting findings into the same customer-visible timeline used for MDR investigations, so a customer sees one consistent record of activity across all of Expel’s services rather than separate reports from each service line.
Key developments
Expel’s 2021 unicorn valuation and its October 2022 Series E extension to $288.8 million in total funding both came during a period when demand for managed security services was accelerating industry-wide, driven by a persistent shortage of in-house security talent at mid-market and enterprise organizations alike. The company has continued to compete for both commercial and government MDR contracts in the years since, operating in a segment that has grown increasingly crowded as larger security vendors add managed offerings alongside their core products.
Why it matters
Expel’s insistence on visible, step-by-step investigation transparency is a useful benchmark for readers evaluating MDR vendors more broadly: it surfaces a genuine tension in the managed-security market between vendors that want customers to trust an opaque, largely automated black box and vendors, like Expel, betting that customers will pay a premium to actually see what is happening inside their own security operations. Founded and still led by veterans of one of the industry’s most storied incident-response organizations, Expel is also a useful example of former practitioners building a company explicitly around a frustration with the tools they used to rely on, and its intact founding team nearly a decade in suggests that frustration has translated into a durable, coherent product philosophy rather than a slogan that faded after the company scaled.
Sector context
Within Brel’s cybersecurity coverage, Expel competes in the managed detection and response category alongside Arctic Wolf and Deepwatch, distinguishing itself specifically through investigation transparency rather than through scale or breadth of adjacent services. All three vendors sell a broadly similar core service, which makes stated differences in transparency, pricing, and analyst staffing models some of the more meaningful ways for prospective customers to compare them.
Sources and references
This profile is based on Expel’s official about page describing its founding motivation and team, Paladin Capital Group’s official announcement of Expel’s 2022 Series E extension, and Tracxn’s company profile for funding and founder details.