Expel bets on AI agents in the SOC, but with humans in charge: pushing back on the "autonomous swarm"

By BankInfoSecurity · November 10, 2026.

Expel, a US managed detection and response (MDR) provider, a service that monitors and responds to security threats on behalf of other companies, has named Steve Kelley as CEO, BankInfoSecurity reports. Kelley started on Monday. He replaces Dave Merkel, a co-founder who had led the company since 2016 and will stay on its board of directors.

Expel has tasked him with using agentic AI to make its security operations center (SOC, the team that monitors alerts around the clock) more efficient. The main tool is Roxy, an in-house AI assistant that, in Kelley's words, works as "another super-operator" alongside human analysts. Roxy automates high-volume, standard triage, such as analyzing the headers and metadata of phishing emails.

The most notable part is what Expel rules out. Kelley says the company rejects fully autonomous agent-swarm approaches because of four risks: system drift, unsupervised deviations, false results and rising token compute costs. Humans validate outputs, handle complex escalations and deal with new attack vectors.

His argument is clear: AI is very good at synthesizing existing knowledge across large volumes of data, but it struggles with novel threats. He adds a specific warning: agents tend to iterate on themselves, and if they go off course early, nobody may notice after a month, but three, four or five months later they are detecting different things.

On the business side, Kelley comes from WillJam Ventures and was previously president of Bitdefender's business solutions unit. He says acquisitions will not be the focus, though he sees opportunities in a fragmented MDR market. He also points to international expansion, the commercial segment and work with managed service providers (MSSPs and MSPs). The company is also investing in its data ingestion pipeline and in detections against AI-powered attacks and against drift in internal agents.

Our take: Kelley's message is both technical judgment and commercial positioning, and the two should be kept apart. It makes sense for a managed services provider to argue that humans remain essential: that is what it sells. But the risk he describes, the silent drift of an agent that degrades months later, is real and rarely discussed. It matches a view we have argued: the danger of an agent is not that it answers badly, but that it acts badly without anyone noticing. The gap between testing agents and knowing how to govern them is still the real bottleneck.

More broadly, cybersecurity is where you can most clearly see the division of roles coming to many professions: the machine takes on the repetitive, high-volume work, and human value shifts to what is new and to judgment. In the short term that means fewer entry-level analyst jobs, which are exactly the ones that do routine triage. It is a hard transition, and that should be said plainly. One question remains open: how will expert analysts be trained if the entry rung disappears?

In the long term, a SOC where AI absorbs the noise and people focus on creative work is a hopeful direction: cheaper, more accessible defenses for companies that cannot afford them today. One caveat: Expel provides no figures here on Roxy's effectiveness or data to verify its margins. Without them, the thesis is sensible, but it remains a company claim.