Expel Meeting Summary - RSA Conference 2025

Although it's now a month ago, RSA Conference 2025, seems like yesterday. Richmond Advisory Group shares quick profiles of each of the companies we met with in our "RSA series". Note that some of the content may have been generated by an AI note transcriber but that all published content was reviewed and fact-checked by the profiled company. We are very grateful for the time each company spent with us. 

Background

Expel is a managed detection and response (MDR) provider founded in 2016, headquartered in Herndon, Virginia.

Richmond Advisory Group met with David Merkel (“merk” CEO) and Yonni Shelmerdine (CPO).

Core Business Operations

Expel operates in two distinct market segments: Enterprise (3,000+ employees) representing 60% of revenue and Commercial (<3,000 employees) at 40% of company revenue. The company differentiates from competitors like Arctic Wolf by focusing on customers who already have their own security products in place rather than requiring technology purchases or replacement of security tools.

Expel has achieved exceptional gross margins - significantly above the industry standard of ~60% - through their automation-first approach. All revenue is recurring with no professional services component. Key operational metrics show increasing ARR per analyst and alerts per analyst year-over-year are staying flat, demonstrating scalability across their increasing customer base. Richmond Advisory Group was skeptical at first and pressed for details, which were provided, and which confirm the claim.

MDR Offering

The core service provides 24x7 security monitoring with comprehensive coverage across multiple attack surfaces such as cloud, endpoints, networks, email, and identity platforms. Recent additions include email threat protection expanding beyond their traditional reactive approach. The company leverages 130+ technology integrations and emphasizes their "bring your own technology" model, allowing customers to maximize existing security investments.

Expel's proprietary platform, Expel Workbench™, provides automation and full transparency into SOC operations, with customers able to follow live investigations. The company maintains an industry-leading 17-minute MTTR on high/critical incidents.

Business Evolution

Recent strategic changes include new leadership appointments: Scott Fuselier as CRO (CrowdStrike background) and Yonni Shelmerdine as CPO (SentinelOne background). The company is investing heavily in thought leadership content and threat intelligence to drive brand awareness. This effort has resulted in significant website traffic increases.

AI integration has expanded beyond existing ML capabilities to include LLM applications for automated findings report generation and enhanced SOC analyst efficiency, while maintaining human oversight that enterprise customers specifically value.

Competitive Advantage

Expel competes primarily with standalone MDR providers (ReliaQuest, Red Canary) and product-backed solutions (CrowdStrike Falcon Complete). The company's key differentiators include:

●      SOC Efficiency: MTTR of 17 minutes or less on high/critical incidents

●      Technology Integration: Superior ability to ingest diverse data sources and remediate back to source systems compared to competitors

●      Transparency: Unique full-visibility approach to SOC operations, customers see what Expel analysts see and can communicate directly with their assigned analysts

●      Customer Satisfaction: 99% customer trust rating with 80+ Net Promoter Score

Finally, we discussed market consolidation and Expel believes it is well-positioned given their proven business model and strong margins. However, the management team does expect challenging economic conditions to impact buyer behavior in Q2, requiring stronger business value justification for security purchases.