Name: Expel Expel MDR
Brand: Expel

Buyer fit

Good fit when

✓Mid-market and enterprise organizations with existing security tools wanting vendor-agnostic MDR
✓Security teams that value transparency and want to see every SOC action in real time
✓Multi-cloud environments needing broad integration coverage including Oracle Cloud

Watch out when

×Organizations wanting platform-native MDR from a single vendor (Expel requires existing security tools)
×Companies needing OT/ICS coverage
×Budget-constrained SMBs, pricing reportedly starts around $11,640/year (third-party figure) and scales with coverage

Coverage

EndpointIncluded

Cloud workloadsIncluded

IdentityIncluded

SaaSIncluded

Network / NDRIncluded

OT / IoTNot offered

5 of 6 attack surfaces in the base price; the rest are separately priced.

EDR

CrowdStrikeMicrosoft DefenderSentinelOneCarbon BlackPalo Alto CortexElasticCybereason

SIEM

SplunkMicrosoft SentinelPalo Alto Cortex XSIAMGoogle ChronicleExabeamSecuronixSumo LogicIBM QRadar

Cloud

AWSMicrosoft AzureGoogle Cloud PlatformOracle Cloud InfrastructureAmazon EKSAzure Kubernetes ServiceGoogle Kubernetes EngineWizLaceworkOrca Security

Additional capabilities

100% Transparency (full audit trail of every SOC action)Configurable Auto-Remediation via APIManaged Phishing ResponseKubernetes Security (EKS, AKS, GKE)Oracle Cloud MDR (industry-first)Custom Behavioral Detection Engine

Incident response

Monitoring

24/7 · 24x7 shift rotation from US-based operations. IGXGlobal partnership extends international coverage

First response

Configurable: auto-act per your playbook, or escalate for approval · Custom playbooks supported

Containment

Endpoint isolation · Process kill · Network containment · Account disable · File quarantine

Notification

Slack · Teams · Email · Portal

Response SLA

Not disclosed · No formal SLA published.

IR included

No, separate retainer

Pricing

Indicative cost

$89k/yr

500 cloud resources (1, marketplace

Minimum

Not published

Trial

Available

product trial, MDR is POV

Warranty

None

Custom pricing scoped by coverage type rather than by seat count.

Checked Jul 2026

Sourced figures

$88,800/yr for 500 cloud resources (12-mo, paid upfront)

Cloud infrastructure dimension, Unit = 500 resources, 12-month contract paid…

AWS Marketplace (Expel MDR) · checked Jul 2026

Marketplace list

avg ~$199,661/yr (41 purchases; $54,028-$302,483)

Aggregated across 41 reported purchases. Deployment ranges: small (<500 assets)…

Vendr · checked Jul 2026

Reseller/contract

from $11,640/yr (entry), mid-market $50k-$200k/yr

Entry annual price for base coverage. mdrcost describes as buyer-reported base and…

mdrcost.com and TrustRadius · mdrcost June 2026 update;

Third-party estimate

How pricing works+

Custom, scoped by coverage type rather than seat count: cloud infrastructure by resources, on-prem by endpoints, SaaS by user accounts, phishing by email count. Cost is driven by the number of integrated technologies and telemetry volume, not per-employee.

Three MDR tiers, no prices on the vendor site: Starter (cloud, identity, network, and endpoint coverage with endpoint auto-remediation), Select (adds cloud control plane, SaaS apps, multi-surface auto-remediation), Premium (adds unlimited integrations, Workbench API access, dedicated engagement manager).

Cost caveats

–Threat hunting, phishing response, and vulnerability prioritization are separate add-ons; base tiers include remediation recommendations and endpoint auto-remediation, with multi-surface auto-remediation starting at Select
–Onboarding and professional services can be billed separately (third-party estimate $10,000-$50,000+)
–Annual escalation clauses of roughly 3-7% per year reported by an aggregator

2 more+

–Pricing is integration and telemetry driven, so adding tools or verbose cloud logging mid-term can raise cost
–Third-party reports of year-one free capabilities becoming paid at renewal (unverified by vendor)

What costs extra (5)+

–Threat hunting (add-on to all MDR tiers, not in base)
–Phishing response / Expel for phishing (separate service, priced by email count)
–Vulnerability Prioritization (separate service)
–Multi-surface auto-remediation (Select tier and above; Starter includes endpoint auto-remediation only)
–Additional integrations, SIEM and data lake coverage (raises price)

Warranty conditions+

Expel does not offer a breach warranty as of July 2026. Competitors including Bitdefender, Sophos, and Rapid7 do.

Figures from named sources only (vendor pages, marketplaces, resellers, public procurement records, buyer reports), each dated. Nothing here is our estimate.

Team and access

Analysts

Direct employees · Part of ~508 total employees. Exact SOC analyst count not disclosed. Tierless SOC model: experienced analysts handle alerts from day one, no L1/L2/L3 escalation tiers.

Channels

Slack · Teams · Email · Portal

Data access

Full Query Access

Portal

Expel Workbench provides full transparency: audit trail of every analyst action, Event Search (hostname, username, IP, file hash), complete investigation timelines from triage to closure, real-time collaboration with SOC analysts, and public REST API for custom data access.

Account manager

Dedicated

Reputation

Very Positive

Forrester Wave MDR Leader Q1 2025 (5/5 in 15 of 21 criteria). Gartner Peer Insights 4.6/5 (142 reviews). G2 4.8/5. PeerSpot 9.0/10. Widely praised for transparency, integration breadth, and speed. Primary criticism: threat hunting and incident response are add-ons, not included.

What customers praise

✓Full transparency into every analyst action via Workbench platform
✓Rapid API-first onboarding (hours, not weeks) with 160+ integrations
✓Configurable auto-remediation with full customer control over what gets automated

Common complaints

×Threat hunting is an add-on, not included in base MDR
×No breach warranty, unlike some competitors
×Limited APAC/global SOC presence, North America primary

Generally very positive. Expel frequently recommended alongside Red Canary and CrowdStrike Falcon Complete for organizations with existing security investments wanting a transparent, collaborative MDR partner.

Questions to ask

1.
Threat hunting is an add-on. What is the additional cost, and what specific hunt frequency and methodology will our environment receive?
2.
What are the exact auto-remediation actions available for our specific tool stack, and can we see a demo of the configurable approval workflows?
3.
How does pricing scale as we add more integrations, coverage areas, or cloud resources beyond the initial contract?
4.
What is the data retention period for our security data in Workbench, and how do we export all data if we leave?
5.
Since incident response is not included, what IR partners do you recommend, and how does the handoff work during a major incident?
6.
What SLA commitments can you provide in writing beyond published MTTR metrics?

Evidence

This profile verified

Feb 27, 2026

This profile updated

Jul 18, 2026

Sources reviewed

Primary source

Expel public MDR page

Main public source used for the provider profile.

Public-data caveats

–No public contractual response-time SLA is recorded for this profile.
–No public breach warranty is recorded.
–Response authority may depend on pre-approval and contract scope.

Also consider

Buyer fit

Good fit when

✓Mid-market and enterprise organizations with existing security tools wanting vendor-agnostic MDR
✓Security teams that value transparency and want to see every SOC action in real time
✓Multi-cloud environments needing broad integration coverage including Oracle Cloud

Watch out when

×Organizations wanting platform-native MDR from a single vendor (Expel requires existing security tools)
×Companies needing OT/ICS coverage
×Budget-constrained SMBs, pricing reportedly starts around $11,640/year (third-party figure) and scales with coverage

Coverage

EndpointIncluded

Cloud workloadsIncluded

IdentityIncluded

SaaSIncluded

Network / NDRIncluded

OT / IoTNot offered

5 of 6 attack surfaces in the base price; the rest are separately priced.

EDR

CrowdStrikeMicrosoft DefenderSentinelOneCarbon BlackPalo Alto CortexElasticCybereason

SIEM

SplunkMicrosoft SentinelPalo Alto Cortex XSIAMGoogle ChronicleExabeamSecuronixSumo LogicIBM QRadar

Cloud

AWSMicrosoft AzureGoogle Cloud PlatformOracle Cloud InfrastructureAmazon EKSAzure Kubernetes ServiceGoogle Kubernetes EngineWizLaceworkOrca Security

Additional capabilities

Incident response

Monitoring

24/7 · 24x7 shift rotation from US-based operations. IGXGlobal partnership extends international coverage

First response

Configurable: auto-act per your playbook, or escalate for approval · Custom playbooks supported

Containment

Endpoint isolation · Process kill · Network containment · Account disable · File quarantine

Notification

Slack · Teams · Email · Portal

Response SLA

Not disclosed · No formal SLA published.

IR included

No, separate retainer

Pricing

Indicative cost

$89k/yr

500 cloud resources (1, marketplace

Minimum

Not published

Trial

Available

product trial, MDR is POV

Warranty

None

Custom pricing scoped by coverage type rather than by seat count.

Checked Jul 2026

Sourced figures

$88,800/yr for 500 cloud resources (12-mo, paid upfront)

Cloud infrastructure dimension, Unit = 500 resources, 12-month contract paid…

AWS Marketplace (Expel MDR) · checked Jul 2026

Marketplace list

avg ~$199,661/yr (41 purchases; $54,028-$302,483)

Aggregated across 41 reported purchases. Deployment ranges: small (<500 assets)…

Vendr · checked Jul 2026

Reseller/contract

from $11,640/yr (entry), mid-market $50k-$200k/yr

Entry annual price for base coverage. mdrcost describes as buyer-reported base and…

mdrcost.com and TrustRadius · mdrcost June 2026 update;

Third-party estimate

How pricing works+

Cost caveats

–Threat hunting, phishing response, and vulnerability prioritization are separate add-ons; base tiers include remediation recommendations and endpoint auto-remediation, with multi-surface auto-remediation starting at Select
–Onboarding and professional services can be billed separately (third-party estimate $10,000-$50,000+)
–Annual escalation clauses of roughly 3-7% per year reported by an aggregator

2 more+

–Pricing is integration and telemetry driven, so adding tools or verbose cloud logging mid-term can raise cost
–Third-party reports of year-one free capabilities becoming paid at renewal (unverified by vendor)

What costs extra (5)+

–Threat hunting (add-on to all MDR tiers, not in base)
–Phishing response / Expel for phishing (separate service, priced by email count)
–Vulnerability Prioritization (separate service)
–Multi-surface auto-remediation (Select tier and above; Starter includes endpoint auto-remediation only)
–Additional integrations, SIEM and data lake coverage (raises price)

Warranty conditions+

Expel does not offer a breach warranty as of July 2026. Competitors including Bitdefender, Sophos, and Rapid7 do.

Figures from named sources only (vendor pages, marketplaces, resellers, public procurement records, buyer reports), each dated. Nothing here is our estimate.

Team and access

Analysts

Direct employees · Part of ~508 total employees. Exact SOC analyst count not disclosed. Tierless SOC model: experienced analysts handle alerts from day one, no L1/L2/L3 escalation tiers.

Channels

Slack · Teams · Email · Portal

Data access

Full Query Access

Portal

Account manager

Dedicated

Reputation

Very Positive

What customers praise

✓Full transparency into every analyst action via Workbench platform
✓Rapid API-first onboarding (hours, not weeks) with 160+ integrations
✓Configurable auto-remediation with full customer control over what gets automated

Common complaints

×Threat hunting is an add-on, not included in base MDR
×No breach warranty, unlike some competitors
×Limited APAC/global SOC presence, North America primary

Questions to ask

1.
Threat hunting is an add-on. What is the additional cost, and what specific hunt frequency and methodology will our environment receive?
2.
What are the exact auto-remediation actions available for our specific tool stack, and can we see a demo of the configurable approval workflows?
3.
How does pricing scale as we add more integrations, coverage areas, or cloud resources beyond the initial contract?
4.
What is the data retention period for our security data in Workbench, and how do we export all data if we leave?
5.
Since incident response is not included, what IR partners do you recommend, and how does the handoff work during a major incident?
6.
What SLA commitments can you provide in writing beyond published MTTR metrics?

Evidence

This profile verified

Feb 27, 2026

This profile updated

Jul 18, 2026

Sources reviewed

Primary source

Expel public MDR page

Main public source used for the provider profile.

Public-data caveats

–No public contractual response-time SLA is recorded for this profile.
–No public breach warranty is recorded.
–Response authority may depend on pre-approval and contract scope.

Also consider

Expel MDR

Buyer fit

Good fit when

Watch out when

Coverage

EDR

SIEM

Cloud

Additional capabilities

Incident response

Pricing

Sourced figures

Cost caveats

Team and access

Reputation

What customers praise

Common complaints

Reddit

Questions to ask

Evidence

Sources reviewed

Public-data caveats

Also consider

Browse related

By size

By region

By compliance

By integration

By industry

Further reading

Expel MDR

Buyer fit

Good fit when

Watch out when

Coverage

EDR

SIEM

Cloud

Additional capabilities

Incident response

Pricing

Sourced figures

Cost caveats

Team and access

Reputation

What customers praise

Common complaints

Reddit

Questions to ask

Evidence

Sources reviewed

Public-data caveats

Also consider

Browse related

By size

By region

By compliance

By integration

By industry

Further reading