Freedom251 › Managed Detection and Response Services
Expel MDR
What Expel MDR is
Expel MDR is a paid managed detection and response service available through web and API connections. It watches customers’ existing security tools continuously, investigates alerts, and remediates confirmed threats. Ruxie enriches and triages alerts and proposes a disposition with evidence, while an Expel analyst makes the final decision. Expel says it covers ten attack surfaces, including AI, cloud infrastructure, email, endpoint, identity, network, SaaS, Kubernetes, logs and SIEM, and operational technology. The service lists more than 160 integration options, with most connections made directly through APIs. Workbench brings alerts, investigations, and response actions into one view but does not replace a SIEM. All packages include 24×7 SOC coverage, investigation and response, auto-remediation, Workbench, and reporting. Expel reports a 14-minute mean time to remediate high and critical incidents when remediation is fully automated. Pricing is on request for annual, seat-count-sized subscriptions; phishing and threat hunting are add-ons.
Who it suits
Expel MDR suits organizations seeking continuous monitoring, coordinated incident response, and coverage across multiple security surfaces. It is designed for teams connecting existing security tools through APIs.
What it does well
- 24×7 SOC coverage
- Ten attack surfaces monitored
- 160+ integration options
- Auto-remediation included
- Workbench tracks investigations
What to know first
- Pricing available only on request
- Annual subscriptions sized by seats
- Phishing and threat hunting cost extra
- Workbench does not replace a SIEM
Limits
There is no free plan, and all three packages are annual subscriptions sized by seat count. Phishing and threat hunting are add-ons; alert data retention is up to 15 months and can be configured by contract.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Starter | Annual subscription; contact Expel for pricing · Seat-count sized · cloud, identity, network, and endpoint coverage · endpoint auto-remediation · Workbench | On request |
| Premium | Annual subscription; contact Expel for pricing · Seat-count sized · includes Select · unlimited technology integrations · Workbench API access · dedicated engagement manager | On request |
| Select | Annual subscription; contact Expel for pricing · Seat-count sized · includes Starter · cloud control plane and SaaS app coverage · multi-surface auto-remediation | On request |
As expel.com lists them, read 11 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Expel website
- Contact Expel for package pricing
- Choose a seat-count-sized annual package
- Connect security tools through API integrations
- Work with Expel during onboarding toward operational coverage
- Use Workbench to review investigations and response actions
Verdict
Expel MDR combines around-the-clock monitoring, analyst-led decisions, and automated response across a broad integration set. Buyers should account for annual seat-based contracts and separately priced add-ons.
Questions
How is Expel MDR priced?
Pricing is on request. The three MDR packages are annual subscriptions sized by seat count.
What is included in every package?
Each package includes 24×7 SOC coverage, Workbench access, threat investigation and response, auto-remediation capabilities, and transparent reporting.
Which integrations are available?
Expel lists more than 160 coverage options, including CrowdStrike, Okta, AWS, Microsoft, Google Cloud, Splunk, and Wiz. Most connect directly by API.
Does Workbench replace a SIEM?
No. Workbench connects to security tools, displays Expel-managed alerts and investigations, and records actions, but it does not replace a SIEM.
How quickly can coverage start?
Expel says most customers reach full operational coverage in two to four weeks, while individual API tool connections take minutes.
Are phishing and threat hunting included?
They are offered as add-ons rather than included package features.
Facts from Expel MDR's own pages
- AI and analysts
- Ruxie enriches and triages alerts and proposes a disposition with evidence, while an Expel analyst makes the decision. · expel.com, 11 Oct 2026
- Coverage
- Expel says it monitors ten attack surfaces, including AI, cloud infrastructure, email, endpoint, identity, network, SaaS, Kubernetes, logs and SIEM, and operational technology. · expel.com, 11 Oct 2026
- Data handling
- Expel says customer telemetry is stored in U.S. infrastructure, encrypted with TLS 1.2 or higher in transit and AES-256 at rest, and alert data is retained for up to 15 months, configurable by contract. · expel.com, 11 Oct 2026
- Founded
- 2016 · expel.com, 28 Sept 2026
- Headquarters
- Herndon, Virginia, United States · expel.com, 28 Sept 2026
- Integrations
- Expel lists 160+ coverage options, including CrowdStrike, Okta, AWS, Microsoft, Google Cloud, Splunk, and Wiz; most connect directly by API. · expel.com, 11 Oct 2026
- Limits
- Expel says pricing is not published and the three MDR packages are annual subscriptions sized by seat count; phishing and threat hunting are offered as add-ons. · expel.com, 11 Oct 2026
- Onboarding
- Expel says most customers reach full operational coverage in two to four weeks and individual tool connections take minutes through API integrations. · expel.com, 11 Oct 2026
- Package inclusions
- All MDR packages include 24×7 SOC coverage, Workbench access, threat investigation and response, auto-remediation capabilities, and transparent reporting; analyst time and incident escalations have no additional fees. · expel.com, 11 Oct 2026
- Response time
- Expel reports a 14-minute mean time to remediate high and critical incidents when remediation is fully automated. · expel.com, 11 Oct 2026
- Security certifications
- Expel lists ISO/IEC 27001:2022, ISO/IEC 27701:2019, SOC 2 Type II Security, PCI DSS SAQ-D, CSA STAR Level 1, and NIST SP 800-171 Rev. 2 among its active certifications and attestations. · expel.com, 11 Oct 2026
- Service
- Expel MDR monitors customers’ existing security tools around the clock, investigates alerts, and remediates confirmed threats. · expel.com, 11 Oct 2026
- Support
- Expel says its service includes 24×7 coverage, support from onboarding through everyday questions, and direct access to SOC experts. · expel.com, 11 Oct 2026
- Workbench
- Workbench connects to customer security tools, displays alerts and investigations handled by Expel, and records the actions Expel takes; it does not replace a SIEM. · expel.com, 11 Oct 2026