Expel launches the first MDR for the full AI attack surface

Trusted coverage now extends to cover three fronts of AI risk: attackers using AI, employees misusing it, and the AI systems themselves

[TL;DR / Key Takeaways]

• What: Expel today became the only managed detection and response (MDR) provider delivering detection across the full AI attack surface: attacks launched with AI, employee AI misuse, and exposure inside the AI systems they run.
• The proof: Expel's SOC operators run detection, triage, and hunting on AI telemetry and activity, accelerated by AI rather than handed to it, with coverage mapped to 13 MITRE ATLAS tactics.

LAS VEGAS, Aug. 4, 2026 /PRNewswire/ -- Expel, the leading agentic MDR provider, today announced the first MDR solution that reaches across the full AI attack surface. Expel® Managed Detection and Response (MDR) coverage now extends to threats attackers launch with AI, the risk employees create if they misuse it, and the exposure inside the AI systems organizations are building and running.

AI moves faster than most teams can see the risk

AI is both a new attack surface and a moving target. Addressing AI risk also stalls inside most organizations, often due to a lack of visibility into AI use within the organization, and agreement on where AI risk is most prevalent. Additionally, most teams lack the expertise to accurately determine whether threats are AI-related. Rather than adding new budget or headcount to address AI security risk, most organizations are finding a faster path to coverage by extending the detection and response resources they already have. Expel is covering the full AI attack surface by incorporating its history and breadth of detection expertise, and using that foundation to build new skills, new models, and new telemetry to address emerging threats.

Expel extends its trusted MDR to the full AI attack surface

Expel is extending its MDR across the different elements of the AI attack surface. Expel operators run the coverage, accelerated by AI, not handed to it. Three capabilities are live at launch:

• Anthropic Claude integration: The integration pulls Claude Enterprise Compliance signals, including usage activity and prompt content, into Expel's detection pipeline. Where most integrations stop at activity logs, Expel's operators work the prompt content itself to surface intent, not just activity. It's the first in a growing lineup of AI-native integrations planned through 2026.
• Detections mapped to MITRE ATLAS: Expel's detection library is labeled where AI is a factor, mapped to MITRE ATLAS, and is available to customers. Coverage today includes 13 of 16 tactics.
• AI-focused threat hunting: Expel's threat hunters run structured hunts built for AI-augmented attack patterns and AI exposure.

Expel analyzes AI risk across the full attack lifecycle, enhancing existing detections to flag where AI is a factor. From there, it surfaces AI-driven activity in context with signals from identity, cloud, and other layers attackers exploit, and correlates those signals across the entire environment.

"You can't out-automate an attacker who's using the same AI you are," said Justin Bajko, Expel's Chief Strategy Officer and co-founder. "The models change weekly. What doesn't change is the judgment call in the middle of an incident, because that's still where human expertise is critical. We built this so our operators own that call across the whole AI attack surface."

Availability

AI detection coverage mapped to MITRE ATLAS is available now. Today, Expel AI-specific detections cover 13 of 16 MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) tactics. AI-focused hunt techniques are also available now to Expel Threat Hunting customers. Visit Expel's website to learn more about our AI attack surface coverage.

Additionally, James Shank, Director of Threat Operations at Expel, is unveiling the Expel AI Risk Framework in a speaking session at Black Hat USA 2026. Join James on Wednesday, August 5, at 3:50 pm PT on Pulse Stage/06 to see how the framework maps AI risk, assigns mitigation to the right departments, and reports business impact to board leadership.

About Expel
Expel is the leading agentic MDR provider. Our solutions use AI to improve the speed and accuracy of our human expertise. Expel MDR works with the tools you already have, providing coverage across critical attack surfaces such as cloud, identity, email, SIEM, SaaS, and on-prem environments, out in the open, alongside you. No black boxes. No rip-and-replace. We ask better questions to get to clearer decisions, faster action, and security operations that get stronger over time. For more information, visit our website, check out our blog, or follow us on LinkedIn.

SOURCE Expel