Dave Merkel was done. Not tired, not between ventures, not enjoying the ceremonial week off that ambitious people call a sabbatical. Done. He had left FireEye in the middle of 2015 after roughly 18 months as global chief technology officer, following its billion-dollar acquisition of Mandiant. He had built products, managed practitioners, lived through nation-state intrusions and watched cybersecurity turn from a specialist concern into front-page news. His verdict on another security startup was refreshingly unambiguous: never again.
Then, in November, he saw a tweet. An industry analyst compared the customer service offered by old managed-security providers to the experience of taking a taxi. The market, the analyst said, was ready to be disrupted. Merkel agreed, scrolled on and discovered that his brain had declined to scroll with him.
The complaint stayed. Eventually he began talking with two former Mandiant colleagues, Yanek Korff and Justin Bajko. The three met at a local bar and, in the most suspiciously cinematic detail of an otherwise practical story, wrote names on the back of a napkin. These were the people they would want if they actually did the thing Merkel had said he would never do. A dozen names appeared. More strikingly, they thought those people might say yes.
“My entire career has been an accident, except for my first job.”Dave Merkel, on the route that found him
The assignment he tried to refuse
The first job had been deliberate because the Air Force paid for his computer-science education at the University of Colorado Boulder. The career it produced was not. Merkel entered federal law enforcement and expected to chase ordinary criminals. Then the service remembered what it had purchased: a computer-science degree. He was told to go to Washington and pursue hackers instead.
He resisted, which in the military is a kind of vigorous prelude to doing exactly what one has been told. Cybercrime in that era involved floppy disks, 2400-baud modems and considerably less corporate choreography. One investigation put Merkel, then in his mid-twenties, on a task force with the FBI and NASA. The group pursued a hacker breaking into government and educational institutions, identified him and worked with local police to close the case. The unwanted assignment became the work.
An accidental career, in five turns
When Merkel left the Air Force, the dot-com boom was warming up. He joined AOL in 1998 and spent seven years directing security operations. He created and ran the first incident-response capability for AOL and Time Warner, managed software-security and policy programs, and built parts of the company’s security infrastructure. The scale mattered. AOL was not a quiet laboratory. It was where millions of people met the internet, often for the first time, accompanied by a dial tone and poor password judgment.
By 2006, he felt he had gone about as far as he could there. Kevin Mandia, whom Merkel had known from the Air Force, was building a small breach-response company called Mandiant. Mandia had an idea for an endpoint product and one persuasive line: Merkel could build the tool he wished he had at AOL. Merkel joined a product operation of about ten people. The build team was him and one developer.
When the niche reached the front page
Mandiant caught a historic wave. Operation Aurora, disclosed by Google in 2010, changed how companies talked about Chinese state-linked intrusions. In 2013, after The New York Times revealed that attackers had occupied its network, Mandiant’s work helped trace the wider campaign to the doorstep of a People’s Liberation Army building in Shanghai. Cyber espionage was no longer a murmur among specialists. It had a skyline, a street address and a place above the fold.
Merkel is careful about the role of timing. Luck put Mandiant on the right water; recognition and execution kept it upright. “You have to surf when the wave comes along,” he has said. The company made him CTO in 2011. FireEye acquired Mandiant at the end of 2013 for roughly $1 billion.
Merkel assumed an acquisition would soon make his role redundant. Instead, FireEye chief executive Dave DeWalt offered him the global CTO job. It lasted about a year and a half. The company treated him well; he simply knew it was time to go. What exhausted him was not the mission. It was the theater around the mission: fear-based marketing, red logos, fancy words that made modest value sound mystical, and the ritual combat of enterprise buying and selling.
His objection to red has a small comic footnote. Merkel is colorblind, so sometimes he cannot see it. His larger point is harder to miss. An industry that sells confidence had grown fond of frightening customers first. It promised perfect foresight, then hid the work behind a portal of handsome but unhelpful metrics. Merkel wanted no more of it. The tweet made him wonder whether the thing worth building was precisely the opposite.
A company that would show its homework
Expel’s founders divided their lanes without much suspense. Merkel was unwilling to work for anyone again, so he would be CEO. Korff, a meticulous operator, would run the machinery. Bajko understood people and emotion better than either of them. The useful ingredient was not perfect agreement. It was enough trust to disagree before resentment acquired office furniture.
The product thesis was equally direct. Customers already owned endpoint tools, network tools, cloud tools and SIEMs. They did not need another decorative widget. They needed someone to make those investments work together, investigate the alerts, explain what was happening and help fix it. Expel would build the operating platform first, automate as much repeatable work as possible and put people at the end of the line for the two jobs software handled poorly: unfamiliar judgment and human relationships.
The operating equation
Transparency became part of the architecture, not merely the copywriting. Customers could follow investigations in Workbench as they happened. Early brand rules rejected red, fear and phrases such as “market leading” when the company had about five customers. The humor carried a commercial argument: if a provider was good, it could show the work without draping it in thunder.
In November 2021, Expel raised $140.3 million in Series E financing at a valuation above $1 billion. Merkel credited automation with lifting analyst effectiveness by 260 percent and cited a customer Net Promoter Score above 80. The company had turned visibility and service into measurable operating choices. It was still a security company, of course, and therefore still obliged to use the word “platform.” But at least the platform had to do something.
Trust is a management system
Merkel’s internal model resembles the product. Decisions should be made close to the problem by the person with sufficient context. This accepts an uncomfortable fact: somebody will occasionally get it wrong. The alternative is to require executive permission until speed, ownership and good people have all quietly left the building.
When peers cannot agree, Merkel expects what he calls graceful escalation. They bring the dispute upward, make their cases and accept a decision. He once relayed advice from Mandia that a CEO makes three or four decisions a year that truly matter and that only the CEO can make. The remainder is mostly window dressing. It is a cheerful description of the office until one notices the burden hidden inside the number. The rare decisions count.
One arrived in 2024, when Merkel invited Mandia to join Expel’s board. They had known each other for roughly 30 years, beginning in the Air Force. Mandia had hired Merkel to build at Mandiant; now Merkel wanted his old colleague’s help taking Expel beyond early adopters. The ambition was concrete: meet companies where they are, including those without the money, appetite or staffing to behave like elite security shops.
“Every time we shut something down, every time we make the bad nation-state actors or other criminal go away, it’s super cool. We get to be the good guys.”Why the work still matters after nearly three decades
AI, with an adult in the room
The latest security boom has delivered a new set of grand claims. Merkel’s response is less a rejection of AI than a demand that it earn its permissions. Expel had been automating operations since 2016, long before generative AI rearranged every conference agenda. In his formulation, speed and judgment must remain in balance. Autonomy can expand within a particular workflow when accuracy is demonstrated. It should not arrive as a bulk shipment because a demo looked marvelous.
The principle grows from incident response. During an attack, the customer is not having an abstract technology experience. Livelihoods and jobs may be at risk. Software can process signal volumes no analyst could tolerate. A person still needs to recognize the unprecedented, explain a consequential choice and be present in the fight. The adversary is human, too, and will study whatever behaviors defenders automate.
This makes Merkel a peculiar kind of futurist: one willing to say he does not know what next week’s headline will be. He jokes readily, distrusts polished origin myths and insists that founders’ past successes are usually edited more generously than their present struggles. His own story contains luck, a resisted posting, a friend’s invitation, an acquisition he did not control and a tweet he could not forget.
The through line is not destiny. It is attention. Pay attention when an assignment reveals a vocation. Pay attention when a tool you need does not exist. Pay attention when customers are being sold dread instead of help. Pay attention when the names on a napkin are people you trust enough to call. For someone whose career was supposedly an accident, Merkel has been notably deliberate about what happens after the collision.