Expel drafts Mandiant's founder onto its board to chase $100M-to-$500M ARR growth

A managed cybersecurity startup providing an outsourced security team that monitors companies' security tools and threat alerts.

That managed security can grow from $100M to $500M ARR by reaching the companies that will never be early adopters — with Mandiant credibility on the board.

Founded in 2016. CEO David Merkel and Kevin Mandia met roughly 30 years ago in the Air Force; Mandia later brought Merkel in to help build Mandiant's managed cybersecurity service offering.

Reached $100M ARR in 2023 with about 450 employees; on 1 October 2024 hired Kevin Mandia — Mandiant's founder and CEO until Google bought the company, now a Ballistic Ventures general partner — as an independent director.

The hire targets the growth constraint, not the product: credibility with mainstream buyers, not more early adopters.

Mandiant's founder brings the brand name that makes 'outsourced security team' safe to buy for companies without security staff.

A 30-year working relationship lowers the risk of a celebrity board seat — Mandia already knows Merkel's playbook from Mandiant.

A board seat is a scaling instrument: hire the person whose name opens the market you can't yet enter, not the one who fills a governance slot.

As of the 1 October 2024 announcement, Expel was pursuing a $500 million ARR goal with all exit options, including an IPO, on the table. No revenue updates appear in the material.