Arctic Wolf vs Expel while the overnight queue has nobody on payroll

51% of attacks occur between 8 p.m. and 8 a.m. in Arctic Wolf’s 2025 Security Operations Report, the figure cited on its security teams page. That page says this is the window when most IT and security staff are offline.

If nobody on your team is rostered overnight, the queue still fills. Managed detection and response is the service hired to triage and work those alerts. Arctic Wolf’s MDR FAQ pairs every deployment with a Concierge Security Team and has that team deploy Arctic Wolf Sensors, Arctic Wolf Agents, and cloud connectors. Expel’s MDR page says there are no agents to deploy: the tools you already own supply the signal, and Expel analysts work it in Expel Workbench.

What follows is which tools each service will actually watch, how onboarding starts, who is allowed to isolate a host, and which response clock is written into a contract rather than a headline.

Overview

	Arctic Wolf	Expel
Primary use case	24×7 managed detection and response delivered by a Concierge Security Team on the Aurora platform	24×7 managed detection and response on the security tools you already run, investigated in Expel Workbench
What you hand it	A network the Concierge Security Team can sensor, plus Arctic Wolf Agents and cloud connectors. Existing log sources can be monitored too	API or log access to the EDR, identity, cloud, network, SaaS, or SIEM you already pay for. No Expel agent
Who watches overnight	Arctic Wolf’s SOC. The security teams page says more than 1,000 security engineers support 24×7 triage	Expel’s SOC, 24x7x365, with Ruxie assembling context and analysts making the call
Day-to-day workflow	Named Concierge Security Team tunes thresholds, opens incidents, and stays on them until close	Analysts investigate in Workbench. You can see each investigation and each response as it happens
License/pricing	Quote-required. See Editions	Quote-required. See Editions
Who operates it	Arctic Wolf’s Concierge Security Team and SOC, with your staff on containment decisions	Expel analysts, with response actions tracked in Workbench for your team

We read Arctic Wolf’s security teams page, MDR FAQ, and Aurora MDR supplemental terms last updated 2026.08 on 3 Oct 2026. We read Expel’s MDR service page and MDR packages page the same day. We did not deploy a sensor, connect a tenant, or sit in either queue, so this is not a hands-on bake-off. The Arctic Wolf image is the Aurora MDR marketing hero. The Expel image is the MDR service hero, including the live promo bar, not a docs page and not an error page.

Arctic Wolf

Expel

Arctic Wolf and Expel both still sell under those names. Arctic Wolf closed its purchase of BlackBerry’s Cylance endpoint assets on 3 Feb 2025 and sells that line as Aurora Endpoint Security. On 23 Feb 2026 it announced the acquisition of Sevco Security for exposure assessment. Those are products Arctic Wolf bought, and the MDR service is still sold as Arctic Wolf. Aurora Endpoint Security stays out of the comparison with Expel. Expel’s company page still presents Expel as its own company.

The same comment says the service is expensive, and that the time back assumes agents, cloud sensors, and network infrastructure are already in place.

Editions and pricing

Neither vendor published a dollar rate on the pages opened 3 Oct 2026. Arctic Wolf’s /pricing path returned not found. Expel’s /pricing path redirects to the packages page, which names three packages and no price.

	Arctic Wolf	Expel
How you buy it now	Aurora Managed Detection and Response, standalone or inside a Security Operations Bundle, per the Aug 2026 supplemental terms	Starter, Select, and Premium on the packages page. Phishing and threat hunting are listed there as add-ons on all three
Public price (3 Oct 2026)	Quote-required. FAQ prices the service on users, servers, and internet egress points. No dollar amount	Quote-required. No dollar amount on the service page or the packages page
Who is named on the account	A Concierge Security Team is standard on every MDR deployment, per the FAQ	Concierge-led onboarding is listed for the packages. A dedicated engagement manager is a Premium line
Retention and ingestion	FAQ says unlimited log retention and search are in core MDR. Supplemental terms last updated 2026.08 say 90-day log retention unless the order form buys another period, and they list unlimited data ingestion separately	Not a retention-tier page. The service page lets you pull telemetry into Workbench or have Expel manage the SIEM
Main buying consideration	Get the retention period onto the order form. The FAQ and the Aug 2026 terms do not say the same thing	Ask whether threat hunting is inside the package or the add-on. The service page lists hunting with the service. The packages page lists it as complementary

What has to be installed

The overnight service cannot see an alert that never arrives. The two onboarding stories start in different places.

	Arctic Wolf	Expel
What their team deploys	Arctic Wolf Sensors (virtual or physical in the Aug 2026 terms), the Arctic Wolf Agent, and cloud connectors. The terms include one vSensor 100 series in the component list	No endpoint agent and no appliance. Packages onboarding is API access to tools you already run. The page says many customers are live in days and most reach full coverage in two to four weeks
Tools you already own	FAQ also monitors existing sources: Active Directory, authentication, endpoint, firewalls, IDS/IPS, mail, SaaS and IaaS, SSL-VPN, and web gateways	Service page names 160+ integrations, including Microsoft, AWS, Google Cloud, CrowdStrike, Okta, and Wiz, and says the stack does not have to be replaced
External exposure checks	FAQ lists external network scanning in core MDR. The component table in the Aug 2026 terms does not repeat that line	Not described as an Arctic Wolf-style external scan on the pages opened. Coverage is the integrated cloud, identity, network, and endpoint signals
Supported tools	Help documentation updated 6 Apr 2026 lists cloud, endpoint, and syslog integrations, including AWS, Microsoft Azure, Google Cloud, Microsoft 365, Okta, CrowdStrike Falcon, SentinelOne, Wiz, Palo Alto firewalls, and Fortinet. The same page says logs can arrive from a source that does not yet have rulesets or parsing, and the Concierge Security Team confirms whether that source is fully supported. The service also deploys its own sensor and agent	The Help Center integrations article lists direct API, collector, syslog, and SIEM-path connections, including AWS CloudTrail and GuardDuty, Microsoft Azure, Google Cloud, Microsoft 365, Microsoft Defender for Endpoint, CrowdStrike, Okta, Wiz, SentinelOne, and Palo Alto. Rows marked investigative-only are queried during an investigation and are not bulk detection sources; that article says hunting is not currently available for them. The SLA defines a Supported Product as this list, which Expel may add, remove, or change
Onboarding	The MDR FAQ says the Concierge Security Team learns the topology, deploys sensors, agents, and cloud connectors, and sets external scans, alert thresholds, and country allowlisting. A public count of days until full coverage was not found on that FAQ or in the Aug 2026 supplemental terms	The packages page says there is no endpoint agent, many customers are live in days, and most reach full coverage in two to four weeks. That timeline is on the service pages. The triage SLA separately excludes the first 60 days of onboarding from the measured commitment
Main buying consideration	Will you accept their sensor and agent as the collection path, even if some logs already exist?	Will the tools you already license cover the surfaces you want watched, with credentials your team can grant?

Who closes the incident

Detection without a person who can isolate the host is still an email in the morning. The useful split is who is already authorized to take that action, and which clock the contract measures. A remediation headline is not that clock.

	Arctic Wolf	Expel
Who decides	The Concierge Security Team investigates, opens tickets for critical events, and manages the workflow until the incident is closed	Ruxie gathers context. Analysts decide. The automation FAQ says response workflows run after analyst validation
Containment	Managed Containment: the Concierge Security Team works with you to isolate the threat at the network and the host. Remediation guidance is part of the FAQ list	Service FAQ says analysts take containment and remediation actions rather than only escalating. Packages list endpoint auto-remediation on Starter and multi-surface auto-remediation on Select
What you can see	Incident detail (sites, systems, when it was detected) and resolution notes managed by the Concierge Security Team	Workbench shows each investigation and each response. Metrics named on the service page include detect time, respond time, alert volume, true positive rate, and auto-remediation actions
Who may isolate	On Windows, the Agent Containment Driver installs by default so Arctic Wolf can isolate that host’s network traffic during an incident or when you ask (agent containment doc updated 7 Apr 2026; driver doc updated 28 Sep 2026). The MDR FAQ says the Concierge Security Team works with you to start Managed Containment at the network and the host. A written rule that every isolation waits on a separate approval ticket was not found on those pages	Auto remediations stay off until a Workbench administrator enables them. The Help Center says analysts decide when and what to remediate inside those settings, and the product automates the action rather than the decision. The action starts from an Incident, except Managed Phishing, which can also start from an investigation. A deny-listed file, path, host, or inbox is handed back to your team. You can turn a remediation off in Workbench
Contractual commitment	Aurora MDR supplemental terms last updated 2026.08 include onboarding, one vSensor 100 series, unlimited data ingestion, use of the Arctic Wolf Agent, ITSM ticketing if you elect it, and 90-day log retention unless the order form buys another period. Equipment not returned within 90 days after you stop is invoiced at replacement cost. Copies of confidential information are removed at equipment return or 120 days after expiration, whichever is earlier. A public minute-based triage or remediation commitment was not found in those terms or on the MDR FAQ	The SLA page states two commitments. Workbench availability is 99.95% each calendar month for the named MDR products plus Managed Phishing, Hunting, and Vulnerability Prioritization. Misses credit 10%, 25%, or 50% of one month of fees, capped at 50% of that month, if you email credit@expel.io within 30 days. The triage SLA, for MDR including cloud control plane, cloud workload, endpoint and network, and SaaS and identity, is mean time to triage: 15 minutes for Critical, 30 minutes for High, and 180 minutes for Medium, as a monthly mean, 24×7. A missed month credits 7 days of the annual subscription fee, under the same 50% cap and 30-day request. The first 60 days of onboarding are excluded, as are phishing alerts, low severity, tuning alerts, on-demand investigations, and other exclusions named on that page
Marketing time figure	No numeric mean-time figure on the MDR FAQ or the security teams page opened 3 Oct 2026	The packages page states a 14-minute MTTR on critical and high incidents that use auto-remediation. The service page uses 14-minute MTTR in a heading and, in the FAQ, a 15-minute mean time to remediate. Those lines are not on the SLA page. The contract clocks when triage starts, not when remediation finishes
Main buying consideration	Will the order form state the retention period, and will you accept containment from the driver that is already on the Windows agent?	Which auto-remediations will an administrator enable before go-live, and will you hold the vendor to the triage SLA rather than the 14-minute headline?

Choose Arctic Wolf when you want their sensor, their agent, and a named Concierge Security Team on the subscription, and the order form states the log-retention period. Choose Expel when the tools you already license stay in place, a Workbench administrator has enabled the remediations you will allow, and the commitment you rely on is the triage SLA rather than the 14-minute remediation headline. Neither page showed a dollar rate on 3 Oct 2026.