Samuel Hassine gave threat intelligence a common language

A spreadsheet is an excellent place to keep a budget. Give it an international cybercrime campaign, its infrastructure, its victims and its changing tactics, and its social graces begin to fail. Samuel Hassine encountered the larger version of this problem at France's national cybersecurity agency, ANSSI. The information existed. Making the pieces useful together was another matter. His answer became OpenCTI, the open-source threat intelligence platform he created with Julien Richard. The company followed the software.

That order matters. Filigran, which the pair founded in 2022, grew around an existing community and an existing problem. Hassine had already been responsible for cyber threat intelligence inside the French state. He knew the awkward distance between collecting information and being able to act on it. A report could describe an adversary beautifully and still leave an analyst doing the clerical work of connecting it to everything else.

Today he is Filigran's CEO, based in Paris, with Richard as CTO. The job has expanded from making a tool work to making an organisation work around it. Yet the central question has barely moved: how does knowledge about an attacker reach the person who can do something useful with it?

The problem had a government address

Hassine's experience at ANSSI included work in its security operations centre and leadership of its threat intelligence activity. He subsequently became Director of Security Strategy and Operations for EMEA at Tanium. That combination put him on both sides of a familiar institutional divide: understanding an adversary and operating the systems that must withstand one.

OpenCTI began in 2018, while he was at ANSSI. In his account of its origins, the frustration was practical. Technical indicators lived apart from strategic knowledge about campaigns, methods and targets. One might recognise a suspicious digital trace without having the context to understand its significance. A library whose books refuse to acknowledge one another is a difficult place to conduct an investigation.

“I couldn’t find the right tool on the market so I took matters into my own hands.”

Samuel Hassine, 2021

The choice to make the platform open source gave other organisations access to the machinery. They could organise their own intelligence, select relevant feeds and connect the results to tools they already used. Its usefulness depended on context: which industry an organisation operated in, which threats concerned it, and how much confidence it placed in a particular piece of information.

Hassine's ambition also included smaller organisations with limited access to specialist intelligence. That is a demanding audience for a technically sophisticated product. An experienced analyst may tolerate a steep staircase. Someone doing three security jobs at once would be grateful for a lift.

When spare time became insufficient

Richard belongs near the beginning of this story, rather than in a footnote beneath a funding announcement. The two developed the underlying tools together, initially alongside other responsibilities. Hassine brought his experience of intelligence and crisis management; Richard brought engineering and product leadership. Their partnership crossed the same boundary that the software was meant to cross: an operational need had to become something people could actually use.

By 2023, thousands of organisations were interacting with their platforms. The community included people from government agencies and large enterprises. Success created a distinctly unromantic complication. Institutions putting important software into production wanted contracts, support and a dependable development roadmap. Enthusiasm is welcome in a procurement meeting. It rarely satisfies every box on the form.

Filigran gave the work a commercial home. The founders offered technical support, managed cloud hosting, training and professional services around the products. They also committed to maintaining the open-source foundations. This was a way to pay for sustained engineering while allowing the community to keep using and improving the software.

In the launch announcement, the business already described more than 30 customers across nine countries and four continents. The international dimension arrived early. Hassine was therefore building a company for people whose common ground was their work, rather than their postcode. The promise required documentation, integrations and people who would answer when something broke.

A government user who sends code back

The FBI connection offers a useful glimpse of how Hassine's open-source argument works in practice. In November 2023, he described the FBI Cyber Division's use of OpenCTI and its contributions to the project. Those contributions included work on the interface, classification management and tracking threat actors. An institution associated with guarded information was helping improve publicly available software.

For Hassine, the relationship also fitted a broader network. MITRE and New York City Cyber Command provided input on the product and its direction. Investigators and defenders needed to organise information internally and exchange it across organisational boundaries. A common platform could make the second task less laborious without making the first irrelevant.

There is a quiet reversal here. Open source can be discussed as a gift bestowed by a developer upon grateful users. In this case, some users brought their own engineering work to the table. The software gained capabilities from the people who depended on it. Hassine's role included keeping that exchange useful to a community extending well beyond any single institution.

The rehearsal belongs beside the intelligence

Collecting knowledge was only part of his plan. Filigran also developed attack simulation capabilities, bringing OpenEx into OpenBAS in 2024. The product is now called OpenAEV. The underlying idea connects what defenders know about threats with exercises that test their readiness for them. Information earns its keep when it changes a decision, a test or a response.

Hassine's description of the platform extends beyond an attack on a machine. Scenarios can include technical actions, tabletop exercises and communications pressure. A cyber incident has people in it: analysts, business teams, legal advisers and communicators. The software reflects that wider cast, allowing different kinds of exercise to sit inside the same scenario.

That makes an interesting demand of a founder who came from intelligence. His product has to help users discover where their own arrangements fall short. Prevention, detection and human response become things to examine over time. A handsome dashboard can be pleasing company; an exercise that reveals an overlooked weakness has a more useful sort of charm.

Four rounds, one continuing obligation

The financing arrived in stages. In June 2023, Filigran announced a €5 million seed round led by Moonfire Ventures. Its team had passed 20 employees. Hassine laid out an agenda spanning engineering, customer success, integrations and the less glamorous administrative work that growing companies acquire. More resources meant more capacity to deliver the roadmap already taking shape.

February 2024 brought a €15 million Series A led by Accel and plans for subsidiaries in the United States and Australia. The company described a team of more than 40. International expansion meant local support as well as new commercial opportunities. A global user community is easier to celebrate than to serve across time zones.

In October that year, Insight Partners led a $35 million Series B, with Accel and Moonfire also participating. Partnerships included organisations such as Google, CrowdStrike and Recorded Future. The network around the founders was broadening, alongside a product portfolio intended to connect intelligence, testing and risk decisions.

October 2025 added a $58 million Series C led by Eurazeo, with support from Deutsche Telekom's T.Capital, Accel and Insight Partners. Total funding passed $100 million. The money supported expansion and further product development, including risk management and the XTM One AI platform. For Hassine, the practical obligation remained familiar: make a growing body of knowledge easier for other people to use.

A wider definition of the adversary

His interests also reach into the borderland between cybersecurity and geopolitics. In 2023, Hassine described work adapting OpenCTI to analyse disinformation and foreign information manipulation. The problem again involved connecting actors, campaigns and techniques. Some adversaries operate across both cyber operations and influence activity; keeping the analytical worlds entirely separate can obscure those relationships.

The work involved organisations including Debunk.eu and the DISARM Foundation, alongside standards discussions. That detail is revealing about the kind of enterprise he is building. Before information can travel usefully, people need ways to describe it consistently. Agreement on a data model rarely provides a thrilling anecdote at dinner. It can, however, save everyone considerable trouble the following morning.

During his November 2024 visit to Japan, Hassine discussed using AI to structure documents, make querying easier and help the platform become more proactive. These were concrete jobs for the technology. The ambition was to reduce the knowledge required to ask a useful question, so that people could work with the intelligence without first becoming specialists in its internal model.

By October 2026, he and Richard were opening THREAD in Paris, bringing practitioners, partners and customers together. It supplied a fitting scene for this particular career: a community gathered around tools that began with two collaborators and a difficult information problem. Hassine's recurring ambition is accessible, actionable threat intelligence. The test of that ambition happens at someone else's desk, when a connection becomes clear enough to change what they do next.