Expel Public-Source Startup Diligence Report
The diligence thesis is that Expel's Enterprise Tech positioning can support venture-scale value only if private records confirm durable revenue or partnership economics, defensible product performance, sufficient runway, clear IP/control rights, and manageable execution risk.
Expel Public-Source Startup Diligence Report
Expel appears to be an active private unicorn based on CB Insights and public company sources, with credible public evidence for market/category presence, product positioning, and selected ecosystem signals. The report should be used as a diligence roadmap, not an underwriting conclusion, because core financial, customer, legal, HR and technical records are private.
Expel competes with specialist MDR firms and large platform vendors that can bundle detection and response.
Diligence request: Request private data-room evidence, management walkthrough, supporting contracts, board materials, KPI history, and independent expert review tied to this risk.
Expel sells practitioner-led, AI-augmented SOC operations; performance evidence and SLA history are private.
Diligence request: Request private data-room evidence, management walkthrough, supporting contracts, board materials, KPI history, and independent expert review tied to this risk.
Any MDR outage, detection miss, customer breach, or data-handling issue could damage trust and renewals.
Diligence request: Request private data-room evidence, management walkthrough, supporting contracts, board materials, KPI history, and independent expert review tied to this risk.
CB Insights verifies unicorn status but not revenue quality, renewal rates, CAC payback or unit economics.
Diligence request: Request private data-room evidence, management walkthrough, supporting contracts, board materials, KPI history, and independent expert review tied to this risk.
Expel publicly positions AI/automation in SOC workflows; false positives/negatives and human-in-the-loop controls require private evidence.
Diligence request: Request private data-room evidence, management walkthrough, supporting contracts, board materials, KPI history, and independent expert review tied to this risk.
Public financial diligence for Expel verifies only unicorn-list valuation and selected investor signals; detailed financial statements, projections, debt, tax, backlog and accounting policies are private.
not publicly verifiable confidence: low
Public financial diligence for Expel verifies only unicorn-list valuation and selected investor signals; detailed financial statements, projections, debt, tax, backlog and accounting policies are private.
| Metric | Public value | Evidence status | Private diligence request |
|---|---|---|---|
| Revenue / ARR | Not publicly disclosed | not_publicly_verifiable | Audited statements, ARR bridge, revenue recognition policy |
| Gross margin / unit economics | Not publicly disclosed | not_publicly_verifiable | Gross margin by product/customer, COGS, support costs |
| Cash burn and runway | Not publicly disclosed | not_publicly_verifiable | Monthly burn, cash balance, debt, board plan |
not publicly verifiable confidence: low
Public financial diligence for Expel verifies only unicorn-list valuation and selected investor signals; detailed financial statements, projections, debt, tax, backlog and accounting policies are private.
not publicly verifiable confidence: low
Public financial diligence for Expel verifies only unicorn-list valuation and selected investor signals; detailed financial statements, projections, debt, tax, backlog and accounting policies are private.
| Stakeholder | Public position | Diligence caveat | Verification |
|---|---|---|---|
| Paladin Capital Group | Public investor / tracker or company-page signal | Ownership percentage, security class and preferences not public | partially_verified |
| Greycroft | Public investor / tracker or company-page signal | Ownership percentage, security class and preferences not public | partially_verified |
| Scale Venture Partners | Public investor / tracker or company-page signal | Ownership percentage, security class and preferences not public | partially_verified |
| Option holders and employee pool | Not public | Request cap table, option ledger, warrants and SAFEs | not_publicly_verifiable |
partially verified confidence: medium
Public financial diligence for Expel verifies only unicorn-list valuation and selected investor signals; detailed financial statements, projections, debt, tax, backlog and accounting policies are private.
| Date | Event | Amount / valuation | Investors / parties | Verification |
|---|---|---|---|---|
| 2021-11-18 | CB Insights unicorn tracker listing | $1.00B | Paladin Capital Group, Greycroft, Scale Venture Partners | verified |
| Latest private financing terms | Not publicly disclosed | not_publicly_verifiable | Company / investors | not_publicly_verifiable |
| Current cash runway | Not publicly disclosed | not_publicly_verifiable | Company / board | not_publicly_verifiable |
Only public valuation anchor was used.
Public pages describe Expel's product/platform scope, but product-level revenue, margins, roadmap costs and independent performance validation are not public.
partially verified confidence: medium
Public pages describe Expel's product/platform scope, but product-level revenue, margins, roadmap costs and independent performance validation are not public.
| Product / platform | Audience | Public evidence | Verification |
|---|---|---|---|
| Managed Detection and Response (MDR) | Target customers / partners in Enterprise Tech | 24x7 managed detection and response service for organizations using endpoint, cloud, identity, email and other security tools. | partially_verified |
| Managed SIEM | Target customers / partners in Enterprise Tech | Detection engineering and managed support for existing SIEM environments. | partially_verified |
| Cloud Detection and Response | Target customers / partners in Enterprise Tech | Cloud-focused detection and response service for cloud workloads and control planes. | partially_verified |
| Phishing | Target customers / partners in Enterprise Tech | Investigation and response service for phishing inboxes. | partially_verified |
| Workbench / Ruxie AI automation | Target customers / partners in Enterprise Tech | Operations platform and AI/automation engine used to enrich investigations and support SOC workflows. | partially_verified |
| Offering | Public pricing | Monetization signal | Diligence request |
|---|---|---|---|
| Managed Detection and Response (MDR) | Not publicly posted | Likely enterprise / partner-negotiated economics; public price cards not found | Contracts, ASP, discounting, gross margin |
| Managed SIEM | Not publicly posted | Likely enterprise / partner-negotiated economics; public price cards not found | Contracts, ASP, discounting, gross margin |
| Cloud Detection and Response | Not publicly posted | Likely enterprise / partner-negotiated economics; public price cards not found | Contracts, ASP, discounting, gross margin |
| Competitor pricing | Mixed / not directly comparable | Competitors use licensing, subscription or product sales models depending on market | Competitive pricing benchmark |
Public sources show customer, partner, supplier or ecosystem signals, but top-customer revenue, concentration, churn and severed relationships require private confirmation.
partially verified confidence: medium
Public sources show customer, partner, supplier or ecosystem signals, but top-customer revenue, concentration, churn and severed relationships require private confirmation.
| Customer / partner | Use case or relationship | Public evidence | Verification |
|---|---|---|---|
| Named case-study customers | Customer / partner / ecosystem signal | Expel publishes customer pages and case studies; active contract status and ARR are not public. | partially_verified |
| Enterprise security teams | Customer / partner / ecosystem signal | Primary buyer persona inferred from MDR, SIEM, cloud, endpoint, identity and email service pages. | partially_verified |
| Technology alliance partners | Customer / partner / ecosystem signal | Expel partner pages emphasize integrations and partner program distribution. | partially_verified |
| Forrester Wave proof point | Customer / partner / ecosystem signal | Expel page navigation references Forrester Wave Leader in MDR services Q1 2025. | partially_verified |
partially verified confidence: medium
Public sources show customer, partner, supplier or ecosystem signals, but top-customer revenue, concentration, churn and severed relationships require private confirmation.
| Partner | Nature | Public evidence | Open diligence item |
|---|---|---|---|
| Named case-study customers | Strategic relationship / ecosystem signal | Expel publishes customer pages and case studies; active contract status and ARR are not public. | Contract economics, exclusivity, term, revenue contribution |
| Enterprise security teams | Strategic relationship / ecosystem signal | Primary buyer persona inferred from MDR, SIEM, cloud, endpoint, identity and email service pages. | Contract economics, exclusivity, term, revenue contribution |
| Technology alliance partners | Strategic relationship / ecosystem signal | Expel partner pages emphasize integrations and partner program distribution. | Contract economics, exclusivity, term, revenue contribution |
| Forrester Wave proof point | Strategic relationship / ecosystem signal | Expel page navigation references Forrester Wave Leader in MDR services Q1 2025. | Contract economics, exclusivity, term, revenue contribution |
not publicly verifiable confidence: low
Public sources show customer, partner, supplier or ecosystem signals, but top-customer revenue, concentration, churn and severed relationships require private confirmation.
not publicly verifiable confidence: low
Public sources show customer, partner, supplier or ecosystem signals, but top-customer revenue, concentration, churn and severed relationships require private confirmation.
not publicly verifiable confidence: low
Public sources show customer, partner, supplier or ecosystem signals, but top-customer revenue, concentration, churn and severed relationships require private confirmation.
| Supplier / dependency | Role | Public evidence | Concentration risk |
|---|---|---|---|
| Security telemetry vendors | Operational dependency | Service depends on integrations with endpoint, cloud, identity, email, SIEM and related tools. | not_publicly_verifiable |
| Cloud infrastructure providers | Operational dependency | Workbench/data-lake service likely depends on cloud hosting; exact provider spend and concentration are private. | not_publicly_verifiable |
| Human SOC analysts | Operational dependency | Service quality depends on expert availability, training, staffing and retention. | not_publicly_verifiable |
Competitive diligence indicates a crowded Enterprise Tech market; win/loss, pricing pressure and customer preference data are not public.
partially verified confidence: medium
Competitive diligence indicates a crowded Enterprise Tech market; win/loss, pricing pressure and customer preference data are not public.
| Competitor | Segment | Product overlap | Differentiator to test | Source basis |
|---|---|---|---|---|
| Arctic Wolf | Relevant adjacent market | MDR / security operations platform competitor. | Validate win/loss, pricing and moat against target | Analyst public-market scan |
| Red Canary | Relevant adjacent market | MDR competitor focused on managed detection and response. | Validate win/loss, pricing and moat against target | Analyst public-market scan |
| CrowdStrike Falcon Complete | Relevant adjacent market | Managed endpoint detection and response from a large public security vendor. | Validate win/loss, pricing and moat against target | Analyst public-market scan |
| Sophos MDR | Relevant adjacent market | Managed detection and response competitor. | Validate win/loss, pricing and moat against target | Analyst public-market scan |
| ReliaQuest | Relevant adjacent market | Security operations platform and MDR competitor. | Validate win/loss, pricing and moat against target | Analyst public-market scan |
| Axis | Target position | Competitor pressure | Evidence status |
|---|---|---|---|
| Technology differentiation | Publicly claimed / partially verified | High | partially_verified |
| Distribution / partnerships | Some public partner evidence | Medium to high | partially_verified |
| Pricing power | Not public | Unknown | not_publicly_verifiable |
| Regulatory / compliance maturity | Partially visible | High | partially_verified |
Qualitative map based on public information.
GTM evidence comes from public website, partner/customer and content signals; pipeline, sales productivity, CAC and budget adequacy are not publicly verifiable.
partially verified confidence: medium
GTM evidence comes from public website, partner/customer and content signals; pipeline, sales productivity, CAC and budget adequacy are not publicly verifiable.
| Channel | Region | Public evidence | Gap |
|---|---|---|---|
| Direct enterprise / partner sales | United States / global | Company pages emphasize contact, partner or customer motions | Pipeline, quota and bookings not public |
| Strategic partnerships | Global | Public partner/customer pages identify ecosystem relationships | Contract economics not public |
| Owned content and events | Online | Press, blog, news, trust or technology pages create inbound demand | Traffic, conversion and CAC not public |
| Signal | Public evidence | Diligence value | Verification |
|---|---|---|---|
| Company website | Active product and company pages reviewed | Confirms current operating presence | verified |
| Press/news pages | Public announcements or resources reviewed | Shows messaging and product roadmap signals | partially_verified |
| Customer/partner pages | Vendor-published proof points reviewed | Supports reference pipeline but not ARR | partially_verified |
partially verified confidence: medium
GTM evidence comes from public website, partner/customer and content signals; pipeline, sales productivity, CAC and budget adequacy are not publicly verifiable.
partially verified confidence: medium
GTM evidence comes from public website, partner/customer and content signals; pipeline, sales productivity, CAC and budget adequacy are not publicly verifiable.
not publicly verifiable confidence: low
GTM evidence comes from public website, partner/customer and content signals; pipeline, sales productivity, CAC and budget adequacy are not publicly verifiable.
not publicly verifiable confidence: low
GTM evidence comes from public website, partner/customer and content signals; pipeline, sales productivity, CAC and budget adequacy are not publicly verifiable.
R&D diligence relies on public product/platform pages and leadership signals; technical validation packages, budget, staffing and milestone plans require private records.
partially verified confidence: medium
R&D diligence relies on public product/platform pages and leadership signals; technical validation packages, budget, staffing and milestone plans require private records.
| Name | Role | Background / public signal | Verification |
|---|---|---|---|
| Dave Merkel | Co-founder / CEO public profile signal | Public company materials and industry references associate Merkel with Expel leadership; verify current role directly. | partially_verified |
| Yanek Korff | Co-founder public profile signal | Public company materials and industry references associate Korff with Expel founding team; verify current operating role directly. | partially_verified |
| Justin Bajko | Co-founder public profile signal | Public company materials and industry references associate Bajko with Expel founding team; verify current operating role directly. | partially_verified |
| Expel SOC leadership | Security operations leadership | Named team composition, reporting lines and attrition are not public in the reviewed sources. | partially_verified |
partially verified confidence: medium
R&D diligence relies on public product/platform pages and leadership signals; technical validation packages, budget, staffing and milestone plans require private records.
| Project | Status | Expected date | Verification |
|---|---|---|---|
| Managed Detection and Response (MDR) | Publicly positioned; commercial/technical milestones private | Not publicly disclosed | 24x7 managed detection and response service for organizations using endpoint, cloud, identity, email and other security tools. |
| Managed SIEM | Publicly positioned; commercial/technical milestones private | Not publicly disclosed | Detection engineering and managed support for existing SIEM environments. |
| Cloud Detection and Response | Publicly positioned; commercial/technical milestones private | Not publicly disclosed | Cloud-focused detection and response service for cloud workloads and control planes. |
| Phishing | Publicly positioned; commercial/technical milestones private | Not publicly disclosed | Investigation and response service for phishing inboxes. |
| Workbench / Ruxie AI automation | Publicly positioned; commercial/technical milestones private | Not publicly disclosed | Operations platform and AI/automation engine used to enrich investigations and support SOC workflows. |
Management and personnel diligence is limited to public leadership and careers/operating signals; HR census, compensation, attrition and employee-relations matters are private.
partially verified confidence: medium
Management and personnel diligence is limited to public leadership and careers/operating signals; HR census, compensation, attrition and employee-relations matters are private.
Public titles do not establish full reporting lines.
partially verified confidence: medium
Management and personnel diligence is limited to public leadership and careers/operating signals; HR census, compensation, attrition and employee-relations matters are private.
| Function | Region | Public evidence | Diligence request |
|---|---|---|---|
| Executive leadership | United States | Public leadership/about pages reviewed | Employment agreements, succession plan |
| R&D / product | United States | Product/platform pages imply technical organization | Headcount by function, attrition, hiring plan |
| Sales / customer success | United States | Customer/partner/GTM pages imply commercial organization | Quota, productivity, turnover |
| Open roles / careers | United States | Careers page or public operating page reviewed where available | Offer letters, comp bands, retention |
partially verified confidence: medium
Management and personnel diligence is limited to public leadership and careers/operating signals; HR census, compensation, attrition and employee-relations matters are private.
| Name | Role | Tenure / prior roles | Source |
|---|---|---|---|
| Dave Merkel | Co-founder / CEO public profile signal | Public company materials and industry references associate Merkel with Expel leadership; verify current role directly. | Company/public profile evidence |
| Yanek Korff | Co-founder public profile signal | Public company materials and industry references associate Korff with Expel founding team; verify current operating role directly. | Company/public profile evidence |
| Justin Bajko | Co-founder public profile signal | Public company materials and industry references associate Bajko with Expel founding team; verify current operating role directly. | Company/public profile evidence |
| Expel SOC leadership | Security operations leadership | Named team composition, reporting lines and attrition are not public in the reviewed sources. | Company/public profile evidence |
not publicly verifiable confidence: low
Management and personnel diligence is limited to public leadership and careers/operating signals; HR census, compensation, attrition and employee-relations matters are private.
not publicly verifiable confidence: low
Management and personnel diligence is limited to public leadership and careers/operating signals; HR census, compensation, attrition and employee-relations matters are private.
not publicly verifiable confidence: low
Management and personnel diligence is limited to public leadership and careers/operating signals; HR census, compensation, attrition and employee-relations matters are private.
not publicly verifiable confidence: low
Management and personnel diligence is limited to public leadership and careers/operating signals; HR census, compensation, attrition and employee-relations matters are private.
| Name / group | Role | Departure date | Evidence status |
|---|---|---|---|
| Senior departures | Not publicly compiled | Not public in reviewed sources | not_publicly_verifiable |
| Voluntary attrition | All functions | Not public | not_publicly_verifiable |
| Reduction-in-force history | All functions | No verified public schedule in reviewed sources | inconclusive |
Legal diligence is limited to public web, regulatory or company-page signals; counsel schedules, contracts, IP ownership, insurance and regulatory matters require private data-room review.
not publicly verifiable confidence: low
Legal diligence is limited to public web, regulatory or company-page signals; counsel schedules, contracts, IP ownership, insurance and regulatory matters require private data-room review.
| Case | Court / docket | Filed date | Status |
|---|---|---|---|
| Public docket sweep | Not performed beyond public web search in this run | not_publicly_verifiable | Request counsel litigation schedule |
| Material threatened claims | Not public | not_publicly_verifiable | Request legal representation letter |
not publicly verifiable confidence: low
Legal diligence is limited to public web, regulatory or company-page signals; counsel schedules, contracts, IP ownership, insurance and regulatory matters require private data-room review.
| Defendant | Court / docket | Filed date | Status |
|---|---|---|---|
| Public docket sweep | Not performed beyond public web search in this run | not_publicly_verifiable | Request counsel litigation schedule |
| IP enforcement / contract claims | Not public | not_publicly_verifiable | Request IP and commercial dispute schedule |
partially verified confidence: medium
Legal diligence is limited to public web, regulatory or company-page signals; counsel schedules, contracts, IP ownership, insurance and regulatory matters require private data-room review.
partially verified confidence: medium
Legal diligence is limited to public web, regulatory or company-page signals; counsel schedules, contracts, IP ownership, insurance and regulatory matters require private data-room review.
| Asset | Jurisdiction | Status | Source / caveat |
|---|---|---|---|
| Expel brand, Workbench platform, service agreements, security data handling controls, SOC processes, and customer telemetry integrations are material legal/compliance diligence areas; public sources do not disclose full IP assignments or contracts. | United States / global | partially_verified | Public company/regulatory sources; request full schedules |
| Employee invention assignments | United States / global | not_publicly_verifiable | Request executed assignments |
| Open-source / third-party licenses | Global | not_publicly_verifiable | Request OSS scan and license register |
not publicly verifiable confidence: low
Legal diligence is limited to public web, regulatory or company-page signals; counsel schedules, contracts, IP ownership, insurance and regulatory matters require private data-room review.
not publicly verifiable confidence: low
Legal diligence is limited to public web, regulatory or company-page signals; counsel schedules, contracts, IP ownership, insurance and regulatory matters require private data-room review.
partially verified confidence: medium
Legal diligence is limited to public web, regulatory or company-page signals; counsel schedules, contracts, IP ownership, insurance and regulatory matters require private data-room review.
| Agency | Action | Date | Status |
|---|---|---|---|
| Relevant sector regulators | No complete docket review in public-source run | Current through public pages reviewed | inconclusive |
| Privacy / data / safety agencies | Not publicly verifiable from reviewed sources | Current through public pages reviewed | not_publicly_verifiable |
| Industry-specific compliance bodies | Evidence depends on target sector | Current through public pages reviewed | partially_verified |
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | Expel appears on CB Insights' current unicorn tracker at $1.00B. | verified high | SRC-001 |
| EC-002 | Expel's public product and business-model positioning is externally visible. | partially verified medium | SRC-002SRC-003 |
| EC-003 | Expel has public customer, partner, or ecosystem proof points. | partially verified medium | SRC-004SRC-005 |
| EC-004 | Expel's competitive market is crowded and capital intensive. | partially verified medium | SRC-001SRC-002 |
| EC-005 | Expel's GTM motion can be inferred only from public web and partner signals. | partially verified medium | SRC-002SRC-004 |
| EC-006 | Expel has public R&D or platform-development evidence. | partially verified medium | SRC-003SRC-006 |
| EC-007 | Expel has public management and operating-presence signals. | partially verified medium | SRC-006SRC-010SRC-011 |
| EC-008 | Expel's material legal/IP/regulatory exposure is only partially visible publicly. | partially verified medium | SRC-002SRC-003SRC-004SRC-005 |
| EC-009 | Expel's audited financial statements, current revenue, ARR, gross margin, cash runway and debt schedule were not publicly found. | not publicly verifiable low | SRC-001 |
| EC-010 | Expel's customer concentration and revenue-by-customer data are not publicly verifiable. | not publicly verifiable low | SRC-004SRC-005 |
| ID | Publisher | Title | Accessed |
|---|---|---|---|
| SRC-001 | CB Insights | CB Insights: The Complete List Of Unicorn Companies | 2026-06-12 |
| SRC-002 | Expel | Expel about page | 2026-06-12 |
| SRC-003 | Expel | Expel MDR service page | 2026-06-12 |
| SRC-004 | Expel | Expel cloud detection and response page | 2026-06-12 |
| SRC-005 | Expel | Expel customers page | 2026-06-12 |
| SRC-006 | Expel | Expel partners page | 2026-06-12 |
| SRC-007 | Expel | Expel integrations page | 2026-06-12 |
| SRC-008 | Expel | Expel Workbench operations platform page | 2026-06-12 |
| SRC-009 | Expel | Expel AI and automation page | 2026-06-12 |
| SRC-010 | Expel | Expel Trust vs. Impact Framework | 2026-06-12 |
| SRC-011 | Expel | Expel partner program page | 2026-06-12 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.