Expel
Expel's analysts monitor and investigate alerts from the endpoint, identity, cloud and email tools a company already runs, and customers can watch each investigation as it happens in a shared platform.
CyberReviewed Editorial Team · Updated · expel.com
Company details
- Score
- 6.4/10Ranked 9 of 12 (tied)
- Category
- MDR and SOC services
- Founded
- 2016
- Headquarters
- Herndon, Virginia
- Leadership
- Dave Merkel, co-founder and CEO
- Funding disclosed
- $288.8 million total
- Pricing
- Quote; AWS Marketplace lists a cloud tier at $88,800 per year
- Best fit
- Mid-market and enterprise teams with existing security tools
Our take
Expel fits organizations that already own EDR, identity and cloud security tools and want an outside team to watch them around the clock with full visibility into the work. Small businesses without those tools will get more from a provider that supplies its own technology.
Scores by criterion
| Criterion | Score |
|---|---|
| Pricing transparency | 5 |
| Product scope and fit | 8 |
| Company durability | 6 |
| Evidence of adoption | 6 |
| Ease of adoption | 7 |
| Overall score (average of the five) | 6.4 |
Each criterion is defined on our methodology page.
Analysts on top of existing tools
Expel provides round-the-clock monitoring, triage, investigation and threat hunting delivered by its own analysts.2 It does not require its own endpoint agent. It integrates with the tools a customer already runs, such as Microsoft Defender, Microsoft Entra ID (formerly Azure AD) and email security products, and its analysts investigate alerts in a shared platform called Expel Workbench.2 Customers can see how each alert is triaged, enriched and investigated, and the company markets this visibility as a main feature.2
One public price point
Expel does not publish a rate card on its website, but its AWS Marketplace listing gives one public reference point: a one-year contract covering cloud infrastructure in a 500-resource unit, paid upfront, at $88,800.2 The listing prices cloud resources only, and most customers receive a scoped quote. In a 2023 assessment cited by BankInfoSecurity, Forrester described Expel as one of the more expensive MDR providers.3
Funding and a 2023 layoff
Dave Merkel, Yanek Korff and Justin Bajko founded Expel in 2016.3 Its Series E, co-led by CapitalG and Paladin Capital Group, closed at $140.3 million in November 2021 at a valuation above $1 billion, and an October 2022 extension took the round to $171.3 million and total funding to $288.8 million.1 In June 2023 the company laid off about 60 of its roughly 600 employees, citing shifts in the market.3 In late 2025 Bajko moved into the role of chief strategy officer.4
Expel and Huntress
Against Huntress, Expel is aimed at a more mature buyer. Huntress supplies its own agent and products at published unit prices; Expel adds analysts and detection logic on top of tools the customer has already chosen. Reviews on the AWS Marketplace listing praise the transparency of the Workbench and alert quality, while one reviewer asks for more consistent depth across integrations and more control over tuning.2
Teams without their own tools
Organizations without existing EDR or identity tooling, and those that want one vendor to supply the whole stack, are a better match for a provider that bundles its own technology.
What customers say
Quoted word for word from public reviews and posts on Reddit, retrieved October 21, 2026. Each quote links to the review or post it comes from.
Where it helps
We looked at a few and ended up favoring vendors like Expel because pricing scaled with usage, no SIEM was required, and we weren’t paying for a bunch of unused “platform” features.
Sources
- Expel, Additional Series E investment brings total funding to $288.8 million, October 3, 2022
- AWS Marketplace, Expel Managed Detection and Response, accessed October 20, 2026
- BankInfoSecurity, Expel lays off 10% of workers, June 12, 2023
- Expel, Co-founder Justin Bajko transitions to chief strategy officer
