Dave Merkel

Chasing Hackers for the Air Force

He went into the military after college. He told the venture firm Decibel: After college, I went into the Air Force and became a computer crime specialist in the Office of Special Investigations. His defining case involved an intruder breaking into US government and university systems. I ended up on this massive task force with the FBI and NASA. Once investigators found the man, they worked with police to arrest him. I was in my mid-twenties and it was an incredible experience. That moment sparked my interest making cybersecurity my career. Expel's biography describes those years as the era of floppy disks and 2400 baud modems.

Running Technical Security at AOL

He then spent years as a security practitioner at AOL, where he led the technical security organization. According to Expel, he created and ran the first incident response capability for AOL and Time Warner, managed software security and policy programs, and built technology for AOL's security infrastructure.

Building Products at Mandiant

He joined the incident response firm Mandiant and became its chief technology officer and vice president of products. Mandiant was at the center of two cases that changed how the public saw hacking: the Aurora attacks on Google in 2009 and the Chinese state-sponsored breach of The New York Times in 2013, which the Times allowed Mandiant to research and publish. We were able to track the hacking groups literally to the doorstep of a People’s Liberation Army building in Shanghai. He took a lesson from that period: You have to surf when the wave comes along.

FireEye bought Mandiant for about $1 billion, and he served as FireEye's global chief technology officer. He told Decibel that the deal made sense because Mandiant needed a sales-led culture to grow and FireEye already had one.

Founding Expel

The idea for Expel came in 2015 from a tweet. He told TechRound that he and his co-founders, Justin Bajko and Yanek Korff, saw an industry analyst complain that customers of managed security providers had endured the customer service equiv. of taxi drivers. He continued: With all due respect to taxi drivers, we recognised a big opportunity to change the managed security industry by delivering a more delightful security experience to organisations. Expel's analysts work on top of the tools customers already own and share every investigation in real time. We made transparency a cornerstone of Expel.

He describes early selling as faith work. You're selling a future that you're evangelizing. It’s hustle, and it’s generating faith. In 2022, after Expel raised more money, he told BankInfoSecurity that he had slowed hiring to avoid layoffs if the economy turned: I can't promise that's not going to happen. No CEO can see the future. His advice to founders is to choose their battles: Prioritize what you need to fix in your startup. There’s a bunch of stuff you may never fix, and that’s not a bad thing. Expel is based in Herndon, Virginia, and Washingtonian has put him on its list of the D.C. area's tech leaders six times.