Expel MDR now covers Claude Chat, with Code and Cowork in early access

Key Takeaways

• AI agents: Expel MDR coverage for Anthropic's Claude Code and Claude Cowork is now available in early access.
• General availability: Expel MDR coverage of Claude Chat is now generally available to all Expel MDR customers.
• AI framework: The Expel AI Risk Framework sorts AI security risk into 10 domains so security leaders can assign owners and report business impact to the board.

Herndon, Va., November 12, 2026 - Expel, the leading agentic MDR provider, today announced early access MDR coverage for Anthropic's Claude Code and Claude Cowork. Claude Chat is also now generally available as a new coverage option for Expel® Managed Detection and Response (MDR) customers. Expel MDR now covers how customer organizations use Claude end to end, and correlates Claude activity with their identity, SaaS, and endpoint signals.

Expel also released a free AI Risk Framework to help security leaders scoping AI risk better understand and map AI risk across 10 domains. The news builds upon Expel's August launch of MDR coverage for the full AI attack surface.

AI adoption is outpacing the security programs needed to protect it

Organizations are incorporating AI into workstreams faster than they can secure it. In Boston Consulting Group's (BCG) Cybersecurity Spending and AI Threat Trends for 2026 report, only 41% of surveyed cybersecurity leaders said they have formal AI governance policies in place, and only 23% have applied monitoring or logging to AI agents.

AI tools change faster than internal security teams can build expertise on them. Few organizations have the budget or headcount to stand up a dedicated AI security program, and AI risk spans so many teams that ownership often goes unassigned.

Organizations now get coverage across the full suite of Claude solutions

Expel covers AI the same way it covers identity, SaaS, and endpoint: Expel investigates every alert, and customers get clear answers they can act on, without adding headcount.

• Claude Code and Claude Cowork coverage, early access: Expel pairs Claude Cowork and Claude Code session data with endpoint telemetry, giving customers two independent records of the same session, monitoring for suspicious file execution and upload, recursive credential search, and reverse shell incidents.
• Claude Chat coverage, generally available: Organizations get detection coverage for administrative activity, user activity, and prompt content inside Claude Chat, with detections for data exfiltration through conversations, memory poisoning, credential exposure, and use of unsanctioned tools. Ruxie, Expel's AI SOC manager, checks each action against the user's identity and endpoint activity, so customers know whether an action came from the real user.

"When an AI agent runs on an employee's laptop with their credentials, the hardest question in an investigation is whether the employee meant for it to happen," said Justin Bajko, Expel's Chief Strategy Officer and co-founder. "Answering it takes comparing the agent's session record and the endpoint's record side by side. Most organizations already have the endpoint half, and we connect the two so their security teams get an answer they can act on, based on the relevant context."

Expel framework helps security leaders scope AI risk and decide where AI belongs in the SOC

Organizations scoping AI risk can also use the Expel AI Risk Framework, a free resource that helps security leaders map AI risk, assign mitigation to the right teams, and report business impact to the board. Developed by James Shank, Expel's Director of Applied Threat Research, the framework sorts AI security risk into 10 domains. Teams can also use it to decide where AI can take on SOC work and where judgment should remain with a human.

About Expel

Expel is the leading agentic MDR provider. Our solutions use AI to improve the speed and accuracy of our human expertise. Expel MDR works with the tools you already have, providing coverage across critical attack surfaces such as cloud, identity, email, SIEM, SaaS, and on-prem environments, out in the open, alongside you. No black boxes. No rip-and-replace. We ask better questions to get to clearer decisions, faster action, and security operations that get stronger over time. For more information, visit our website, check out our blog, or follow us on LinkedIn.

Contact:

Dave Heffernan
[email protected]
Method Communications on behalf of Expel