Who does what
Provider
- Investigate contracted alerts around the clock
- Show investigations and actions in Workbench
- Execute enabled, analyst-directed response
Your team
- Maintain connected tools, licenses and access
- Configure allowed actions and exceptions
- Complete assigned remediation and recovery
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- Network
- SaaS Applications
- Containers & Kubernetes
Details
Service scope
Best for Mid-market and enterprise teams keeping their existing security tools
Response control
Analysts decide when to act. You enable each action, grant permissions and define exceptions. Failed actions can return to your team.
Package boundaries
Starter includes endpoint auto-remediation. Select adds cloud control-plane and SaaS coverage plus multi-surface actions. Premium adds unlimited integrations and API access.
Additional services
MDR integration with a SIEM does not include the separately offered Managed SIEM service. Confirm phishing and hunting entitlements too.
Full service analysis
Expel MDR investigates alerts from existing security tools and executes enabled containment actions after an analyst decides to respond. You maintain the tools and permissions, define exceptions and complete actions or recovery outside Expel’s access.
- Your team owns
- Maintaining connected tools, licenses and integration permissions
- Enabling allowed response actions and defining business exceptions
- Completing assigned remediation, rotating compromised keys and owning recovery
Analyst-directed response
Expel automates execution after an analyst decides to act on an incident. Customers enable actions and grant the required permissions. For example, AWS key deactivation does not include key rotation or updating dependent applications.
MDR and SIEM scope
An MDR connection can investigate alerts from your SIEM. Expel also sells Managed SIEM with detection engineering and pipeline health work. Confirm that service separately before treating it as part of the MDR subscription.
Commercial scope
The marketplace price applies to a cloud-infrastructure unit of 500 resources, paid upfront for one year. Starter, Select and Premium differ in surfaces, integrations and API access. Confirm the package in the quote rather than comparing only the annual figure.
Pricing & contract
Cloud package: $88,800 / 12 months for 500 resources One AWS Marketplace cloud-infrastructure dimension. Confirm resource definitions, package entitlements and current terms. Do not extrapolate it to endpoint or full-environment pricing.
AWS cloud-infrastructure offer: $88,800 USD for a 500-resource unit, paid upfront for 12 months. It is a scoped marketplace example, not a price for every MDR package.
- Billing
- Tiered, Custom
Tradeoffs & buying questions
Strengths
-
Keep existing endpoint tools and SIEM
Works across existing security tools without replacing your endpoint tools or SIEM
-
Visible investigations, evidence and response actions
Workbench shows analyst investigations, evidence and response actions
-
Pre-approved containment through supported integrations
Supported integrations allow pre-approved containment across multiple security tools
Considerations
-
Package controls coverage and integration limits
Covered surfaces, integration limits and API access differ by package.
-
Response needs enabled actions and permissions
Response requires enabled actions, supported vendor permissions and correctly defined exceptions.
-
Marketplace price covers a specific cloud package
The public marketplace figure covers a cloud-infrastructure package, not every MDR environment.
Ask before buying
- Which package includes our surfaces, integrations and API access?
- Which actions are enabled, excluded or handed back after failure?
- How does the quote count resources and separate MDR from added services?
Customer feedback
Customers value
-
2024–2025 G2 accounts, many invited and incentivized, value responsive analysts and after-hours coverage
Several 2024–2025 G2 customers, many invited and incentivized, praise analyst responsiveness and round-the-clock coverage for lean teams.
-
Customers describe useful investigation visibility and integrations
Customer accounts describe useful investigation visibility and integration with existing security tools.
Reported concerns
-
2024–2025 accounts report repeated context requests or duplicate alerts
Some 2024–2025 customers report duplicate alerts or repeated questions after providing business context.
-
Some report integration gaps and limited reporting customization
Customers report gaps in particular integrations and limited customization of reporting or alerts. Confirm required capabilities before signing.
Integrations
Platform / SIEM
- Splunk
- Microsoft Sentinel
- Google SecOps
1 more integrations
- Sumo Logic
Endpoint
- CrowdStrike Falcon
- SentinelOne
- Microsoft Defender for Endpoint
3 more integrations
- Palo Alto Cortex XDR
- Carbon Black
- Cybereason
Cloud
- AWS
- Azure
- Google Cloud
1 more integrations
- Oracle Cloud Infrastructure
Other integrations
- Okta
- Microsoft 365
- Google Workspace
2 more integrations
- Wiz
- Salesforce
Common questions
Does Expel MDR replace the entire SOC?
It investigates and contains threats through connected tools. Your team retains licenses, response permissions, exceptions and recovery. Additional Managed SIEM work needs its own scope.
Can Expel contain threats automatically?
Yes. Enabled actions execute automatically after an analyst decides to respond. The available actions depend on the package, supported vendor tools, permissions and exceptions. Work that Expel cannot complete returns to your team.
What does the public Expel price cover?
AWS Marketplace lists a cloud-infrastructure dimension at $88,800 for 12 months, paid upfront, with a unit of 500 resources. Confirm the resource definition and package entitlements. It is not a price for every MDR deployment.
Company details
- Headquarters
- Herndon, Virginia
- Founded
- 2016