Filigran makes threat intelligence earn its keep

At Rivian, somebody had done the careful work. A blocklist had been assembled, populated with known bad indicators, and entrusted to a threat intelligence platform. Weeks later, the team discovered that the platform was failing to export the list correctly. The knowledge existed. The protection they expected from it did not.

That small, uncomfortable detail explains the opening for Filigran, the cybersecurity company behind OpenCTI. Security teams can collect enormous amounts of information about attackers. Getting that information into a working defense is another problem, with its own plumbing, maintenance bills and opportunities for disappointment.

01 The list is not the defense

Rivian brought intelligence and case management together in OpenCTI. Its engineers used Terraform and AWS infrastructure to adapt the deployment, moving from proof of concept to production in 30 days. In Filigran’s account of the project, the automaker reports a 95% improvement in response times and nearly 88% lower mean time to detect over 12 months.

Those are results from one customer, published by its vendor. The more portable lesson is the original failure: check that intelligence reaches the place where a decision becomes an action. A beautiful collection of dangerous domains cannot block anything by itself.

02 Give the facts some relationships

Samuel Hassine, Filigran’s CEO, had encountered the difficulties of threat intelligence at France’s national cybersecurity agency, ANSSI. Julien Richard, its CTO, brought experience leading data and AI engineering teams. They founded Filigran in 2022 around open-source work that was already underway.

OpenCTI organizes information using STIX 2.1, a shared language for describing cyber threats. An analyst can connect a malware family to an attacker, a technique, a campaign and the indicators appearing in an investigation. The product’s knowledge graph makes those relationships searchable and visible. Context survives the journey between reports and teams.

This puts Filigran in the threat intelligence platform market, alongside alternatives such as ThreatConnect. Its wider portfolio also overlaps exposure-validation vendors such as Picus. The useful distinction is its combination of an open-source foundation, a common intelligence model and connected validation tools. It can feed existing security systems; it does not require every control to come from Filigran.

That position also makes partners useful. Filigran lists Recorded Future, Splunk, Tanium and Sekoia.io among its technology alliances. A September 2026 agreement with SEK puts OpenCTI and OpenAEV into managed security services across five Latin American countries. For customers, the route to adoption can run through the security provider they already use. For Filigran, those relationships offer distribution without requiring every organization to build its own specialist intelligence team.

03 Free has an operations bill

ClearDATA, which serves healthcare organizations, supplies the other half of the story. Its team found commercial software too rigid and self-managed infrastructure too demanding. Eventually it moved to managed OpenCTI Enterprise Edition. The attraction was room to customize without spending so much engineering time keeping the platform running.

“The modularity and configurability of data streams was the first and biggest differentiator for us.”

Cody Pickren / ClearDATA

Automated enrichment and correlation helped ClearDATA reduce indicator investigations from about ten minutes to under one, according to its published customer story. The company also reports cutting threat-hunting completion time from roughly a week to under 24 hours. Its experience makes the buying decision unusually legible: pay to recover scarce analyst and engineering hours.

OpenCTI’s Community Edition has no licence charge. Enterprise software adds capabilities and vendor support; SaaS shifts hosting to Filigran. Self-hosting still means operating services such as a search backend, Redis and RabbitMQ. An organization without infrastructure capacity should count those hours before choosing its deployment. ClearDATA’s example shows why a zero licence fee is an incomplete budget.

04 Rehearse the part that can go wrong

OpenAEV extends the idea into practice. Formerly OpenBAS, it became OpenAEV in October 2025 as Filigran widened its focus from breach and attack simulation to continuous adversarial exposure validation. Teams use threat intelligence to select scenarios, run tests, inspect gaps and check improvements.

Sometimes the weak point is human coordination. Switzerland’s foreign ministry needed repeatable crisis exercises across a network of 170 locations. OpenAEV could deliver exercise messages through familiar channels, including Outlook and SMS. The department’s case study reports 80% less preparation time. The product’s territory includes a simulated emergency landing in somebody’s inbox, well beyond a technical attack test.

OpenAEV v3, released in September 2026, added attack chaining: the result of one action can determine the next. That matters because a realistic attack is a sequence of discoveries. Testing isolated techniques can miss the way several small weaknesses combine.

05 More threads, one problem

Filigran raised a €15 million Series A and a $35 million Series B in 2024, followed by a $58 million Series C led by Eurazeo in October 2025. The money has supported international expansion and a broader product set. Its timeline records more than 200 employees by March 2026.

XTM One, launched in June 2026, coordinates AI agents across intelligence and validation workflows, with support for an organization’s own language models and on-premises deployment. October’s product update added approval controls for sensitive agent actions. OpenCRQ, unveiled in public beta at the October 15 THREAD event, takes the next step toward expressing cyber risk financially.

The practical thing to copy is smaller than the portfolio: follow one relevant threat from a report to a defensive action, then test the result. Without maintained data, working integrations and someone responsible for remediation, another platform adds another queue. Filigran’s case rests on making those connections useful enough that people keep using them.