Expel Reviews

Expel serves as my MDR provider and platform, secondary to SentinelOne. I utilize Expel as a collaboration tool within Slack. This is a newer portion of the platform that was recently added. I use it specifically to monitor false positives around my other SIEM tools relative to SentinelOne and other tools within my tech stack. Some of the workflows I utilize with Expel are specific to end users, allowing them to create self-service initiations in the event they have a security incident or suspect a security incident. This goes beyond simply clicking a button to indicate something may need review. It allows them to go through one through three or one through four steps on their end without constant human engagement.

Expel has helped me in numerous ways, specifically regarding catching phishing attempts early. Some of the low-level phishing attacks, such as those claiming to be from the CEO offering a gift card, have been reduced by at least 60%. It has also helped with compliance and audit evidence. It has significantly accelerated my SOC 2 Type 2 portions. Expel allows me to keep up with reports and helps me through audit trails. It provides a specific function that allows me to better support SOC 2 compliance. Regarding cyber insurance questionnaires, I do use AI for some of those and some external tools. However, instead of having to search around for that information, it is right there within the workbench, and I am able to pull all that information out and get it filled out faster.

Some of the best features Expel offers is the ease of use. Ease of use is top of mind. It also provides an opportunity for me to replace my SOC. Not necessarily replace my SOC because I utilize contractors on an as-needed basis, but it allows me to stay lean. I do get 24/7 monitoring, although they recently shortened up on the 24/7 monitoring offering. It also allows me to augment the existing SOC that I have for larger companies or larger enterprises that rely on me for that. It then extends the use of the tools I already have, as I mentioned with SentinelOne. Octa is another that comes to mind, and then for larger organizations that use CrowdStrike.

I think the 24/7 SOC could be improved. It does feel a bit clunky. To a degree, it feels as if there is an automated feature in front of the platform, but there seems to be a human on the back end of it that may or may not have the expertise that is promised. If they could improve that, it would be a lot better. Otherwise, it is a really solid platform.

I have been using Expel for about three years.

Expel is stable.

I would rate Expel's scalability a nine out of ten.

Expel's customer support is great. I would rate the customer support a ten.

I still use SentinelOne. I use it in conjunction with Expel.

I do not have specific metrics, but Expel did help me save a lot of time specifically as it relates to the SOC 2 portion that I mentioned.

The experience with pricing, setup cost, and licensing is seamless.

I evaluated other options before choosing Expel, including CrowdStrike and SentinelOne.

I would rate Expel an eight on a scale of one to ten. I would rate Expel an eight because improving that feature I previously mentioned would make a significant difference. Expel's AI capabilities are very good. Regarding Expel's accuracy and reliability of output, I would say about a seven. I advise others looking into using Expel to do their research, but if ease of use is top of mind, go for Expel.

Hybrid Cloud

Amazon Web Services (AWS)

I have experience reselling Expel. Customers often come to me wanting to evaluate multiple providers to make a choice based on their specific use cases, requirements, technology investments, and so forth. Expel is beneficial for customers with diverse environments in terms of technologies that need monitoring and managed detection and response. It's particularly effective if the customer has a deep cloud deployment.

Expel has made it easier for companies to monitor and manage various log sources. With its vast integration portfolio, customers can efficiently monitor diverse environments. Time to value is quick, as Expel can turn their service up very rapidly. They have both automated active responses and human processes that quicken threat resolution.

The most valuable features of Expel include the short time to value, their vast library of technology integrations, and their easy-to-use Workbench platform. Their threat hunting protocol and process with AI and machine learning are strong, allowing for active and rapid responses.

The one area where Expel may not measure up is if a customer requires a managed SIEM as part of their overall solution. There's a gap there, and solutions might require third-party assistance for management. If Expel could provide a place to store logs, it could satisfy this gap.

I've been associated with Expel for a little over two years.

Expel's customer service is very high, at an eight or nine out of ten. They provide strong service despite the natural limitations of human involvement.

Positive

I have customers who have switched from Expel to others and vice versa. Some started without any provider and chose Expel after evaluations.

The initial setup of Expel is very straightforward and easy, often completed in a few days. If the customer provides the necessary access, the setup can be done rapidly.

The implementation typically involves an onboarding manager, an onboarding engineer, and possibly someone from customer success, alongside a single point of contact from the customer's side.

Expel's Workbench platform and dashboards provide the ability to compare similar tools in a customer's environment. This allows customers to assess which tools are more effective and possibly eliminate redundancy, providing cost savings.

Expel's pricing has adapted as the market evolved and has become competitive over the past twelve months.

I currently have two deals that Expel is likely to win, indicating my recommendation for the solution.

I'd rate the solution nine out of ten.