Expel’s Alex Glass on MDR, AI and the MSSP opportunity

Expel has spent the past year putting partners at the center of its business. The company now operates through a 100% channel model, with MSSPs and MSPs playing a bigger role in how it sells and delivers managed detection and response services.

At the same time, Expel is expanding beyond MDR. It has added managed SIEM services for Microsoft Sentinel and Splunk Enterprise Security and is using AI to help with alert triage and other parts of the threat investigation process.

For MSSPs, the key questions are about customer ownership and how much of the SOC can be automated without losing human judgment. In this interview, Alex Glass, vice president of global channel sales and alliances at Expel, explains how the channel model is working, why the company moved into managed SIEM, and how it views the growing number of AI security claims focused on speed.

MSSP Alert: MDR is a crowded market, and many vendors sound similar on paper. What makes Expel different, and what are partners really buying into?

Alex Glass: At our core, we are an MDR company focused on providing 24/7 security monitoring to help organizations detect threats, minimize risk, and automate incident response.

A few things set us apart. One is our bring-your-own-technology approach. Instead of forcing customers to migrate to a proprietary stack, we work with the security tools they already have and plug into their existing architecture through APIs.

We also provide full transparency through Expel Workbench, our dashboard. Internal security teams can see what Expel analysts are doing in real time, how we investigate threats, and how we review detection rules. We do not want to provide a black box. We want customers to understand what we are doing, why we are doing it, and how our detection strategy works. We can also create customized detection rules within their environments.

Partners appreciate that they can go to customers who already have a security stack, including tools the partner may have sold, without telling them they need to rip and replace everything to use Expel. We can work with the technology decisions the customer has already made and provide the level of service they expect from Expel.

MSSP Alert: Expel recently moved deeper into managed SIEM with services for Microsoft Sentinel and Splunk Enterprise Security. What drove that move?

Alex Glass: It was a combination of natural service progression, market demand, and partner feedback. We see customers who need managed SIEM services, and some of our partners already provide that work, while others do not. Several partners told us they could create more opportunities with customers if Expel offered a managed SIEM service.

It also reflects how customer environments are evolving. Customers want to take some of the workload off their security teams, and they understand that Expel has the capability to provide that service. Channel partners certainly influenced those discussions.

MSSP Alert: How much of Expel’s business is channel-led today?

Alex Glass: At the start of last year, we moved to a 100% channel model. Every net-new go-to-market deal includes a partner, and our partner community also brings us opportunities within its customer base.

In some of our strongest partnerships, the opportunity mix is close to 50-50 between partner-originated and Expel-originated business. Expel’s sales leadership and account executives have bought into the channel model, which has been critical to implementing it successfully. Our teams also provide strategic partners with opportunities to grow and expand into potential new clients.

MSSP Alert: Where is Expel investing most heavily for partners: enablement, co-selling, integrations, service delivery or revenue opportunities?

Alex Glass: It is a combination of all of those areas because we have several routes to market. We work with technology alliance partners and try to create mutual go-to-market opportunities around key integrations. We also work with traditional cybersecurity partners that focus on security outcomes for their clients.

We have an incident response partner route to market, which has grown over the past year and a half to two years. The MSP and MSSP market is another continuing area of growth in the United States and globally. More managed service providers are taking on security responsibilities for customers, and AI is becoming increasingly relevant to MSPs, MSSPs and traditional channel partners focused on security outcomes.

MSSP Alert: MSSPs do not want a vendor to take over the customer relationship and reduce them to a referral partner. How much control do MSSPs retain when working with Expel?

Alex Glass: We work with MSSPs in much the same way we work with customers. We provide the service and Workbench for them to use, but engagement with the end customer is determined by the MSSP relationship. We allow the MSSP to take the lead.

Each engagement is different. Some MSSPs want us to interact with the end customer, while others do not. We handle that case by case because those customer relationships are important to our partners. We do not want partners to think we are coming in to take over. We are there to supplement their capabilities, support them and help drive outcomes for their customers. We step in where they need us, whether that involves customer engagement or working directly with the partner.

MSSP Alert: Has Expel experienced channel tension or conflict with partners?

Alex Glass: We have not uncovered any recently, although conflict can arise from time to time in most organizations. The most important factor is communication. As long as communication is active, open and transparent, partners can maintain trust even when a situation does not go the way they hoped. Whether the news is good or bad, I want to share it with the partner community quickly. Partners may not always like the answer, but they appreciate openness and honesty. Trust can make or break a channel program and a company’s route to market, so it is the most important part of building and running a channel organization.

MSSP Alert: What is Expel’s AI strategy, and how is AI already being used in its MDR operations?

Alex Glass: Expel has been using AI for quite a while, although historically, we were not as vocal about what we were doing. Our recent announcement was intended to explain more clearly to the market how we are using it. Customers are also asking better questions than they were a year ago. They have seen the demos, and now they want to know whether the technology can run at scale in their environment.

AI can handle alert triage at volume and enrich context before an analyst touches an item in the queue. Ruxie was originally more of a triage bot, but it now functions as an agentic AI system that works alongside our human analysts and covers the full threat lifecycle.

Our approach has always kept humans in the loop. The question is not whether AI belongs in the SOC. It does. The question is whether removing human judgment is the right decision for customers today, and we do not believe it is. The market appears to be moving toward a middle ground that combines AI with human oversight. Expel has AI, humans in the loop, and 10 years of data behind the service. That is what customers and partners are asking for.

MSSP Alert: Some vendors are emphasizing very fast AI-driven MDR response times. How does Expel evaluate those claims?

Alex Glass: I look at several things. Where does AI hand off to a human, and what triggers that handoff? What models are being used and how were they trained?

Speed is only one part of the equation. You can collect data, detect activity, enrich information, and triage quickly, but you still need to ask whether the investigation is complete and whether the measurement includes time to respond. Speed, efficiency, and the quality of the outcome are related, but they are not always the same thing. The goal should be to drive the right outcome, not simply the fastest number.

MSSP Alert: What should partners expect from Expel over the next year?

Alex Glass: Partners will continue to see Expel evolve as the security landscape changes. They can rely on us to continue providing a service focused on customer outcomes across enterprise, commercial, and SMB environments. Customer needs differ, so we need to support a broad range of organizations while still being able to tailor the service.

Partners can also expect Expel to remain transparent and trustworthy. We will do what we say we are going to do, and if a deal or customer situation does not work out as a partner hoped, we will communicate that as early and clearly as possible. We are a 100% channel company, and we will continue to show partners that Expel provides both strong capabilities and a partner organization they can trust.

MSSP Alert: Do you see a gap between more mature partners that have adopted AI and partners that are earlier in their security journey?

Alex Glass: Yes, and much of that comes down to education and enablement. We share our view of the service, the market, and the direction of the industry with partners. Partner maturity varies, especially around AI in the SOC.

More mature security partners tend to understand why customers are exploring AI SOC offerings and what outcomes they are trying to achieve. They can show customers newer AI-focused companies alongside established providers that offer a similar AI experience and have years of industry experience. They also understand the broader market and can present several options based on the customer’s desired outcome.

For partners with less security experience who are building their capabilities, we can provide context and enablement. Analysts and channel publications also help partners understand the changing landscape. The market is increasingly bringing human expertise and AI-driven SOC capabilities together.

MSSP Alert: Are smaller businesses facing a greater security need than large enterprises, and are they becoming a larger opportunity for Expel and its partners?

Alex Glass: Larger organizations usually have more resources to dedicate to cyber threats, while smaller businesses are seeing an increase in security incidents and may not have the internal controls or teams to protect themselves. That is where MSPs and MSSPs can provide services that smaller customers might not otherwise be able to access.

We see a good mix of enterprise, commercial, and SMB customers. Their desired outcomes may differ, but many of the vulnerabilities and areas where they need help are similar. They are all trying to create a more secure environment, and Expel can help across those different customer sizes.