Expel pricing.
Per-technology-integration subscription. The buyer is charged for the EDR / SIEM / cloud / identity sources Expel monitors, not per-endpoint. BYO-SIEM supported.
Expel does not publish a list price on its official page in 2026 (Quote-only ('Get a Quote' on official page)). Field-reported bands cluster at 4,000 to 12,000 USD per integration / month, sourced from G2 deal data, channel-partner listings, and Reddit r/cybersecurity quote dumps verified 2026-06-19.
Ledger entry
What changes the quote
The headline hybrid band moves with endpoint count, contract length, 24x7 vs business-hours coverage, the inclusion of an incident-response retainer, whether the customer brings their own SIEM, and the compliance overlay (HIPAA, PCI, CMMC L2, FedRAMP, DORA). See /annex/quote-decoder for the question ladder that decodes a Expel quote line by line.
What is bundled and what gets line-itemed
Bundled into the base subscription: 24x7 SOC monitoring, EDR licence (where vendor-supplied), portal access, standard onboarding. Line-itemed at extra cost: ingest overage above the contracted GB/day, non-standard log sources, dedicated tenancy, evidence packs for regulated frameworks, IR retainer hours, and contract off-boarding. Cross-reference /annex/hidden-costs for the full schedule.
Recent changes
Workbench AI-assist features expanded 2025-2026; integration catalogue continues to grow; Workbench portal still the differentiator vs CST-style delivery.
Source
Primary source: https://expel.com/services/managed-detection-and-response/, verified 2026-06-19. Inferred-band sourcing note: G2 and PeerSpot review quotes 2025-2026; band widens with environment complexity.
See notes to the ledger for the source-mark legend and the inferred-band derivation methodology.