Steve Kelley Rejects Autonomous Agent Swarms Over Accuracy, Compute Cost Concerns
In a significant leadership transition, Expel has appointed Steve Kelley, the former president of Bitdefender, as its new chief executive officer. Kelley’s new role comes with the critical objective of leveraging agentic AI to enhance the operational efficiency of the company’s Security Operations Center (SOC). The move reflects Expel’s commitment to integrating advanced technology in a way that preserves human oversight, particularly in areas related to the detection and management of cybersecurity threats.
Kelley’s announcement marks a pivotal moment for the Washington D.C.-area managed detection and response (MDR) firm, which has tasked him with the ongoing development of Roxy, an internal AI assistant designed to work in tandem with human analysts. This assistant aims to automate the triage of security threats while ensuring that human intelligence remains central to the decision-making process. Kelley officially took up his new role on Monday, succeeding co-founder Dave Merkel, who remains on the board to provide strategic guidance and support during this transition phase.
In an interview with Information Security Media Group (ISMG), Kelley articulated his views on the role of AI in cybersecurity, stating that while AI excels at processing large datasets and applying existing knowledge, it often struggles when faced with novel threats. "AI is very good at synthesizing known, existing knowledge and applying that to massive datasets using massive amounts of compute," he said. However, he emphasized the limitations of AI in terms of creative critical thinking regarding new threats and attacks. "That’s where we think human-in-the-loop is essential," he added, highlighting the necessity of human intervention in addressing complex security challenges.
Prior to his leadership role at Expel, Kelley spent over three years at WillJam Ventures, where he played a key role in carving out AT&T Cybersecurity and overseeing multiple acquisitions aimed at strengthening its cybersecurity offerings. His diverse experience also includes a tenure as president and general manager of the Business Solutions Group at Bitdefender, as well as a position as the chief revenue officer at GoSecure.
Kelley voiced Expel’s foundational commitment to enhancing SOC efficiency, a vision that aims to reduce alert fatigue while maximizing the efficacy of security protocols. He noted that the company boasts some of the highest gross margins in the MDR sector, underscoring the value and effectiveness of its operational model. Merkel’s continued involvement on the board is expected to smooth the transition by ensuring continuity in technical direction and strategic oversight.
"First and foremost, it was created around a vision of making the SOC more efficient," Kelley stated. This commitment is reflected in the development of Roxy, the agentic AI that complements human analysts in handling routine security tasks like email phishing header analysis. Kelley explicitly rejected the idea of fully autonomous agent-swarm approaches, citing significant risks such as system drift, unmonitored deviations, and escalating computing costs that can lead to false outcomes.
"You can almost think of Roxy as another super operator that we have in the software working alongside our human operators and analysts," Kelley explained. This model not only processes basic security events and alerts but also guarantees that comprehensive analysis and detection services are available to customers. Kelley stressed that the human component is critical; without operators to validate AI outputs, the potential for unforeseen complications increases, which could leave clients vulnerable.
While Kelley acknowledged that mergers and acquisitions (M&A) are not the primary focus for Expel, his experience in this area positions the company favorably to explore strategic opportunities should they arise. He underscored that any future acquisitions must align with Expel’s technological capabilities and corporate culture, ensuring a smooth fit into the existing structure of the firm.
As Expel looks to future growth avenues, Kelley pointed to international expansion, deeper market penetration, and collaborations with external Managed Security Service Providers (MSSPs) as key strategies. The executive team will prioritize revenue growth, profitability, and customer retention while focusing on employee engagement.
"The number of inputs that come into the SOC are more and more diverse," Kelley noted, indicating that the firm is investing in its data ingestion pipeline to process a broader range of enterprise data sources more effectively. These initiatives aim to enhance the operational efficiency of the SOC while providing cost-effective solutions for clients.
Expel’s strategic approach under Kelley’s leadership demonstrates a nuanced understanding of the intersection between advanced technologies and human expertise, highlighting the ongoing importance of human oversight in the rapidly evolving landscape of cybersecurity.