Filigran
Filigran provides an open-source eXtended Threat Management (XTM) cybersecurity platform combining threat intelligence (OpenCTI), adversarial exposure validation (OpenAEV), and agentic AI orchestration (XTM One), serving 6,000+ organizations across government, technology, financial services, healthcare, and automotive sectors globally.
- Company typePrivate
- Founded2019
- HeadquartersParis, France
- Headcount251–500
- GTM typeB2B
- OfferingSoftware
What Filigran does
Filigran is a Paris-headquartered cybersecurity software company founded in 2019 by Samuel Hassine (CEO) and Julien Richard (CTO), operating a platform-plus-modules architecture branded as the eXtended Threat Management (XTM) platform. The platform unifies four core products: OpenCTI, an open-source cyber threat intelligence platform supporting STIX 2.1 and MITRE ATT&CK with graph-based entity correlation; OpenAEV (formerly OpenBAS, rebranded November 2025), an adversarial exposure validation and breach-and-attack-simulation platform; XTM One, an AI-native agentic orchestration layer launched in 2026; and XTM Hub, a community-driven content and integration portal. The technology stack combines open-source knowledge management with pre-built AI agents for autonomous CTEM workflows, exposing nearly 300 pre-built one-click integrations across SIEM, SOAR, EDR/XDR, vulnerability management, and ITSM ecosystems.
Filigran monetizes through a freemium-to-enterprise model: free community editions of OpenCTI and OpenAEV drive adoption within a 6,500+ member open-source community, while revenue is generated via annual subscription licensing for OpenCTI Enterprise Edition and OpenAEV Enterprise Edition, SaaS cloud hosting with a 99.98% SLA and BYOC option, on-premise and air-gapped deployments for government/classified environments, and professional services including the Filigran Academy training program. Enterprise pricing is quote-based, with a one-month free trial available for the Enterprise tiers. The customer base spans 6,000+ organizations, with named logos including the FBI, European Commission, Swiss FDFA, Swiss Federal Administration, Thales, Capgemini, EDF, Bouygues Telecom, Rivian, ClearDATA, and Controlware, concentrated in government/public sector, technology, financial services, healthcare, and automotive verticals.
The company distributes through direct enterprise field sales (CRO- and CCO-led), an MSSP channel program, technology alliances (including Recorded Future, CheckFirst, Censys, CrowdStrike, SentinelOne, Mandiant, Elastic), and a product-led self-serve motion via free community editions. Operating geographies include Paris (global headquarters), the United States (regional HQ), Germany, Saudi Arabia, and Japan, with the team distributed across 18 countries. As of 2026 Filigran has raised over $100 million across four funding rounds (Seed €5M June 2023, Series A €15M February 2024, Series B $35M October 2024, Series C $58M October 2025) from a tier-one investor syndicate led by Eurazeo (Series C), Insight Partners (Series B), and Accel (consistent since Series A), with additional backing from Moonfire Ventures, Deutsche Telekom's T.Capital, and Motier Ventures.
Filigran firmographics
Firmographics- Name
- Filigran
- Legal name
- Filigran Inc.
- Website
- https://filigran.io
- Company type
- Private
- Founded year
- 2019
- Operating status
- Operating
- Headcount range
- 251–500 employees
- Short description
- Filigran provides an open-source eXtended Threat Management (XTM) cybersecurity platform combining threat intelligence (OpenCTI), adversarial exposure validation (OpenAEV), and agentic AI orchestration (XTM One), serving 6,000+ organizations across government, technology, financial services, healthcare, and automotive sectors globally.
- Ownership category
- akta.pro rank
Filigran industry classification
Industry- Product category
- Cybersecurity Threat Intelligence & Exposure Management
- NAICS
- Security Systems Services (except Locksmiths) (561621), Computer Systems Design Services (541512), Other Computer Related Services (541519)
- SIC
- Services-Prepackaged Software (7372), Services-Computer Programming Services (7371)
- akta.pro primary industry
- Threat Intelligence Services (BPAEADAC)
- akta.pro secondary industries
- Extended Detection & Response (XDR) (HDADAEAB), Endpoint Security Managed Services (EDR/XDR) (BPAEADAH), Risk Intelligence, Threat Monitoring & Crisis Response (Harmful trends, coordinated abuse) (BPAAALAN)
Keywords
Where Filigran is headquartered
LocationHeadquarters
- HQ city
- Paris
- HQ country
- France
- HQ region
- Europe
Offices5 records
Markets served
Filigran business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations
Revenue model
- OpenCTI Enterprise Edition Subscription: Annual subscription licensing for OpenCTI Enterprise Edition with premium support, advanced features, and SLA guarantees. Provided as SaaS or on-premise deployment.
- OpenAEV Enterprise Edition Subscription: Annual subscription licensing for OpenAEV Enterprise Edition with advanced automation, multi-tenancy, and enterprise support capabilities.
- SaaS Cloud Services: Cloud-hosted SaaS deployment model with availability guarantees (99.98% SLA) and managed infrastructure. Includes BYOC (Bring Your Own Cloud) option for data sovereignty.
- Professional Services: Training and professional services provided on a case-by-case basis, including Filigran Academy training programs and implementation support.
- Community Edition (Freemium): Free community edition of OpenCTI and OpenAEV driving adoption and community growth, with conversion to enterprise editions.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Others | Community Edition - Free open-source tier |
| Subscription | Annual | Enterprise Edition - Annual subscription |
| Subscription | Annual | SaaS Deployment Option |
| Freemium | Monthly | Trial - 1 month free |
Go-to-market motion3 records
Distribution channels6 records
Marketing channels9 records
Filigran product offering
Product offeringCore offering
Filigran develops and sells the open-source eXtended Threat Management (XTM) platform, which combines a cyber threat intelligence platform (OpenCTI), an adversarial exposure validation / breach-and-attack simulation platform (OpenAEV), and an AI-native agentic orchestration layer (XTM One) for Continuous Threat Exposure Management (CTEM). The platform is offered as free open-source community editions, enterprise editions (on-premise, SaaS, or air-gapped), and accompanying training via Filigran Academy.
Product overview
Filigran provides an open-source eXtended Threat Management (XTM) platform that unifies threat intelligence, security validation, and remediation. The XTM Platform is a platform-plus-modules architecture comprising: OpenCTI (cyber threat intelligence platform for organizing and operationalizing threat knowledge), OpenAEV (adversarial exposure validation platform for simulating attacks and validating defenses), XTM One (AI-native orchestration layer enabling autonomous CTEM with pre-built agents), and XTM Hub (community-driven central hub for resources and integrations). Enterprise editions add managed hosting, premium support, and advanced automation. The platform enables organizations to anticipate and manage threats end-to-end, closing the gap between knowing about threats and acting on them.
Differentiator
Problem solved
Functional benefit
Brands
- OpenCTI: Cyber threat intelligence platform for organizing threat intelligence, enhancing and disseminating actionable insights. An open-source platform for threat intelligence management.
- OpenAEV
- XTM One
- XTM Hub
- XTM Platform
- Filigran Academy
Products and services
- XTM Platform Unified eXtended Threat Management platform that combines threat intelligence, adversarial exposure validation, and cyber risk management into a single continuous defense ecosystem. Used by enterprises, government agencies, and MSSPs to shift from reactive defense to proactive, threat-informed security operations.
- OpenCTI Open-source cyber threat intelligence platform that helps organizations understand their threat landscape, organize intelligence, and disseminate actionable insights. Supports STIX 2.1, MITRE ATT&CK, and graph-based entity relationships. Used by security teams, CTI analysts, SOC operators, and government agencies.
- OpenAEV Adversarial Exposure Validation platform (formerly OpenBAS) for breach and attack simulation, tabletop exercises, and intelligence-driven attack scenarios. Enables organizations to simulate real-life attacks and validate defenses against realistic TTPs.
- XTM One AI-native cockpit and agentic orchestration layer across the XTM Platform that supercharges OpenCTI and OpenAEV workflows for faster CTEM. Provides pre-built AI agents that autonomously correlate threat intelligence, validate security controls, prioritize remediation, and generate threat-hunting packages and dashboards.
- OpenCTI Enterprise Edition Enterprise-grade version of OpenCTI with managed hosting, premium support (Standard or Premium tiers), advanced customization capabilities, audit logging, role-based access control, and 99.98% availability SLA.
- OpenAEV Enterprise Edition
Quantifiable outcome
- 70% faster threat detection and response (MTTD & MTTR)
- +12 more outcomes
Companies that use Filigran
Customer profileNamed customers13 records
Segments6 records
Ideal customer profiles4 records
Filigran technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration13 records
AI capability7 records
Feature6 records
Filigran partnerships and signals
Strategic signalPartnerships
Five partnerships are on record, tiered core and minor.
- CheckFirstcorePartnership to bring Pravda Network Feed into OpenCTI. CheckFirst's dataset of 7+ million Pravda network articles accessible inside OpenCTI through dedicated import connector. Enables structured, real-time FIMI (Foreign Information Manipulation and Interference) intelligence for hybrid threat analysis. Feed available as annual subscription with tiered pricing.
- Recorded FuturecoreStrategic partnership to enhance threat intelligence integration. Filigran's OpenCTI platform upgraded by incorporating Recorded Future's threat data. Collaboration aims to improve threat detection, response, and overall cybersecurity posture for clients across various sectors. Integration available for download; requires Recorded Future license.
- MSSP PartnerscoreManaged Security Service Provider partner program. MSSPs deliver managed services using Filigran platforms including OpenCTI and OpenAEV. Multi-tenancy capability enables MSSPs to manage multiple client environments from single platform deployment.
- Solutions ProvidersminorSolutions provider partners that implement and integrate Filigran solutions for enterprise customers.
- TrebleminorB2B technology PR agency supporting Filigran's marketing and communications. Treble's Cybersecurity Practice Group includes Filigran among its clients for specialized domain expertise and high-velocity campaign execution.
Scale indicators14 records
Recent moves11 records
Expansion highlights8 records
Filigran competitors and assessment
Company assessmentDirect peers
- Anomali: Anomali is a direct competitor in the threat intelligence platform (TIP) space, offering similar capabilities to OpenCTI for ingesting, correlating, and operationalizing threat data. Both serve enterprise and government customers and compete on integration breadth and analytics.
- ThreatConnect: ThreatConnect is a direct TIP peer combining threat intelligence, security orchestration, and analytics. It targets the same enterprise and federal buyer as Filigran and competes on workflow automation and STIX-based data modeling.
- AttackIQ: AttackIQ is the closest direct competitor to OpenAEV in the breach and attack simulation (BAS) and continuous security validation market. Both provide adversary emulation aligned to MITRE ATT&CK to validate enterprise defenses.
- SafeBreach: SafeBreach is a direct BAS/exposure validation peer to OpenAEV, offering breach and attack simulation and security control validation for enterprise SOCs. Both compete on scenario coverage and integration with the wider security stack.
- Cymulate: Cymulate is a direct BAS and exposure management peer to OpenAEV, with a comparable continuous threat exposure validation offering that includes attack simulations and purple-team automation for enterprises.
- Pentera: Pentera is a direct BAS/exposure validation peer focused on automated security validation for enterprises; it competes head-to-head with OpenAEV on adversary emulation and remediation prioritization.
Broad incumbents
- Recorded Future: Recorded Future is a large incumbent threat intelligence provider and Filigran partner; it sells finished threat intel feeds and a broader intelligence platform that overlaps with OpenCTI but at a much larger scale and price point.
- Mandiant (Google Cloud): Mandiant (now part of Google Cloud) is a broad incumbent in threat intelligence and incident response that overlaps with Filigran's threat intel use cases; it offers intelligence plus services at a much larger scale.
- CrowdStrike: CrowdStrike is a broad incumbent EDR/XDR leader extending into threat intelligence and exposure validation; its Charlotte AI agentic capabilities compete directionally with Filigran's XTM One across overlapping enterprise buyer bases.
Emerging players
- MISP (open-source): MISP is an open-source threat intelligence sharing platform that overlaps with OpenCTI in malware/indicator sharing and STIX support; both serve community-driven threat intel workflows and compete for open-source-first security teams.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks6 records
Key highlights7 records
Customer concentration
Filigran social profiles
Digital presenceFiligran compliance and trust
Trust signalCompliance2 records
Filigran financial estimates
Financial estimateRevenue estimate
Valuation estimate
Filigran leadership team
Management profileNumber of profiles
Profiles10 records
Filigran subsidiaries and ownership
Company hierarchySubsidiaries4 records
Filigran funding detail
Funding detailFunding overview
Funding rounds4 records
Investors10 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Filigran M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Filigran
What does Filigran do?
Filigran develops and sells the open-source eXtended Threat Management (XTM) platform, which combines a cyber threat intelligence platform (OpenCTI), an adversarial exposure validation / breach-and-attack simulation platform (OpenAEV), and an AI-native agentic orchestration layer (XTM One) for Continuous Threat Exposure Management (CTEM). The platform is offered as free open-source community editions, enterprise editions (on-premise, SaaS, or air-gapped), and accompanying training via Filigran Academy.
Is Filigran a public or private company?
Filigran is a private company. It is classified as venture growth investor backed and is currently operating.
When was Filigran founded?
Filigran was founded in 2019. It employs 251 to 500 people.
Where is Filigran based?
Filigran is headquartered in Paris, France, in the Europe region.
How does Filigran make money?
Five revenue lines are on record. OpenCTI Enterprise Edition Subscription is the primary driver. The others are openAEV Enterprise Edition Subscription, saaS Cloud Services, professional Services and community Edition (Freemium).
Who are Filigran's main competitors?
Direct peers on record are Anomali, ThreatConnect, AttackIQ, SafeBreach, Cymulate and Pentera. Broad incumbents are Recorded Future, Mandiant (Google Cloud) and CrowdStrike. MISP (open-source) is listed as an emerging player.
Does Filigran have an API?
Yes. Filigran's OpenCTI platform offers import connectors for third-party integrations. The platform includes a CheckFirst Import Connector for Pravda Network Feed that handles API authentication, pagination, state persistence, and batch ingestion automatically. The platform supports STIX 2.1 for structured data modeling and integrates with various threat intelligence sources through connectors. Developer documentation is at docs.opencti.io/latest.
What industry is Filigran in?
Filigran's product category is Cybersecurity Threat Intelligence & Exposure Management. Its primary akta.pro industry code is BPAEADAC, Threat Intelligence Services, with a secondary code of HDADAEAB, Extended Detection & Response (XDR). Its NAICS code is 561621 and its SIC code is 7372.