Expel’s founders
It started with a Tweet claiming that most players in the cybersecurity industry were providing customer service equivalent to that of taxi drivers. When David Merkel spotted it, he couldn’t stop thinking about it, and the idea for a business quickly took shape.
Merkel, along with his partners Yanek Korff and Justin Bajko, set about creating Expel, which develops managed detection and response (MDR) solutions that provide businesses with 24/7 protection for their cloud applications, infrastructure networks and endpoints. Launched in 2016, the company has raised more than $250 million through five rounds and achieved a valuation of more than $1 billion.
“The three of us were working for FireEye, and we all left in 2015, about 18 months after it acquired Mandiant for just over $1 billion,” says Merkel. “We had no idea what we would do next, but one thing was certain: we all felt that our startup days were behind us. We took some much-needed time off and vowed never to do another cyber startup again.”
The trio broke their vow almost immediately when they spotted a tweet from their friend and industry colleague Rick Holland. Working for Forrester Research at the time, Holland noted that the customers of managed security services providers (MSSPs) had endured ‘the customer service equivalent of taxi drivers,’ and that the market was ripe for disruption.
“Rick’s tweet was a seminal moment,” says Merkel. “No offense to taxi drivers, but we knew from experience that he was 100% correct. The market knew it. The customers knew it. Even the MSSPs knew it. This inspired us to get the band back together, this time as entrepreneurs, owning and growing the business, and creating a distinct culture not just for our employees, but for our customers and partners.”
They spent the better part of a week kicking ideas around by email before finally getting together in person to draft out their plans on bar napkins. “We were convinced that MSSPs were taking the wrong approach,” says Merkel. “Also, there also was no true disruptor. We were confident that the barrier to entry was low and that we had the opportunity to start a business that could easily stand out by adopting a new approach.”
Some of the most significant issues for cyber security have been around transparency. Expel set out to show its customers precisely what its analysts see and ensure they know what they’re looking at. “When we identify attack activity, we inform our customers of the root cause and how they can protect against it in the future,” says Merkel. “Because we manage a wide range of customers across multiple industries, we can identify trends as they emerge and let our customers know how to defend against them before they’re even targeted.”
Another problem for cyber companies is that as they scale, the quality of their security often starts to decline. “Companies don’t need hordes of security staff,” explains Merkel. “They need a (SaaS) technology platform that hyper-scales people. Humans are still required in ‘the last mile’ of computer networks, but with Expel, you don’t need as many people because the technology does the work.”
One of Expel’s key differentiators is its average time, from alert to complete fix, of 21 minutes, which includes the ability to detect a ransomware threat. “No one else can match this speed and efficacy of threat detection and mitigation,” says Merkel.
The company attracted the interest of investors early on, raising a $7.5 million Series A round in September 2016, led by Paladin Capital Group, with participation from New Enterprise Associates, Battery Ventures, Greycroft Partners, Lightbank and other individual investors. Last November, Expel closed $140.3 million in Series E funding, co-led by CapitalG, Alphabet’s independent growth fund, and Paladin Capital Group, which valued the company at over $1 billion.
In November, Expel was ranked the 18th fastest-growing company in North America on the 2021 Deloitte Technology Fast 500. Expel now employs 400 and since 2020 has scaled its technology platform to handle an 82% increase in security events a day, double the number of technology partners and more than double the number of security investigations it handles. Plans are underway for more aggressive growth outside the U.S., specifically focusing on EMEA.
Merkel says: “We’re continuing our mission of making security easy to understand, use and improve continuously. We aspire to be at the top end of performance for VC growth-backed startups in our industry and aim to close 2022 at just over double where we started the year in terms of revenue. As we continue to scale, it’s great to hear the same sentiments from employees when we were a smaller company, around positive experiences and how we’ve maintained the culture, remaining irreverent but effective, having fun, and creating an overall great place to work. By the way, we’re hiring!”
