llms.txt
# Filigran
> Filigran provides open source and enterprise solutions for cyber threat intelligence, adversarial exposure validation and agentic threat management.
Content is published in English (default, at the site root) and French (/fr/...), Japanese (/ja/...). The links below are the English versions; swap the prefix for the other locales.
## Platform and products
- [OpenCRQ](https://filigran.io/products/opencrq): OpenCRQ quantifies your cyber risk from live threat intelligence and validated security posture. Coming soon to the open-source XTM Platform: join the Beta.
- [OpenCTI](https://filigran.io/products/opencti): Unify, operationalize and prioritize threat intelligence with OpenCTI, the open-source threat intelligence platform trusted by thousands of organizations.
- [XTM Platform](https://filigran.io/xtm-platform): The XTM Platform is the open-source foundation of Agentic CTEM: threat intelligence, continuous exposure validation and cyber risk reduction, unified.
- [XTM One](https://filigran.io/products/xtm-one): XTM One is Filigran’s agentic AI layer for the XTM Platform – automate threat detection, hunting, and remediation across OpenCTI and OpenAEV.
- [OpenAEV](https://filigran.io/products/openaev): OpenAEV is the industry’s first open-source, threat-informed exposure validation platform: attack simulation, tabletop exercises and continuous control testing.
## Use cases
- [Attack Chaining with OpenAEV: Continuous, Automated Red Teaming](https://filigran.io/use-cases/attack-chaining): Attack Chaining: Continuous, Automated Red Teaming: See how OpenAEV's automates and orchestrates adversary simulation with automated pentesting
- [Intelligence-driven SOC](https://filigran.io/use-cases/intelligence-driven-soc): OpenCTI empowers SOC teams to run threat-informed security operations driven by intelligence from internal and external sources – the CTEM way.
- [Incident response and investigation](https://filigran.io/use-cases/incident-response-and-investigation): OpenCTI’s case management streamlines threat investigations by centralizing incident-related information, improving incident response efficiency.
- [Threat monitoring and hunting](https://filigran.io/use-cases/threat-monitoring-hunting): OpenCTI enables organizations to analyze threat intelligence in real time and across systems to detect and respond to potential threats promptly.
- [Intelligence-driven defense against disinformation](https://filigran.io/use-cases/intelligence-driven-defense-against-disinformation): Defending against disinformation and Foreign Information Manipulation & Interference requires efficient knowledge sharing and OpenCTI is here to help.
- [Intelligence-led breach & attack simulation](https://filigran.io/use-cases/intelligence-led-breach-attack-simulation): With one click, OpenAEV operationalizes threat intelligence from OpenCTI into simulation scenarios – the validation pillar of CTEM.
## Services
- [Official Training](https://filigran.io/services/filigran-academy): Official Filigran training: hands-on learning paths for OpenCTI and OpenAEV, certifications and badges, pay-per-badge or enterprise subscriptions.
- [Support and Services](https://filigran.io/services/professional-support-packages): SLA-backed Filigran support packages: unlimited questions, 24x7 premium tier, private Slack channel, health checks and integration workshops.
- [Software as a Service](https://filigran.io/services/software-as-a-service): OpenCTI and OpenAEV as fully managed cloud private instances: Enterprise Edition included, strict tenant segregation, unlimited users and integrations.
- [OpenCTI Enterprise Edition](https://filigran.io/services/opencti-enterprise-edition): OpenCTI Enterprise Edition adds enterprise governance, 400+ one-click integrations, no-code playbooks, PIRs, audit logging, SSO, agentic AI and flexible deployment to OpenCTI.
- [OpenAEV Enterprise Edition](https://filigran.io/services/openaev-enterprise-edition): Scale adversarial exposure validation with OpenAEV EE: AI-powered scenarios, AI-augmented remediation, bring-your-own-agent execution and flexible deployment.
## Guides
- [What Is Cyber Threat Intelligence?](https://filigran.io/guides/know-the-threat/what-is-cyber-threat-intelligence): Cyber threat intelligence explained in plain language: the intelligence lifecycle, the four levels of intel, STIX and MITRE ATT&CK, and how to start small.
- [What Is Automated Red Teaming?](https://filigran.io/guides/test-and-validate/automated-red-teaming): Automated red teaming, defined: how it differs from BAS, PTaaS, manual and AI red teaming, how it works, what to look for in a platform, and how to measure a program.
- [The (Definitive) List of Open Source SIEM Platforms Worth Evaluating](https://filigran.io/guides/detect-and-hunt/open-source-siem-platforms): Explore the best open source SIEM options for 2026. Learn to evaluate and choose the right platform for your security needs - and why a SIEM alone is not enough.
- [What Is Incident Response?](https://filigran.io/guides/respond-and-improve/what-is-incident-response): Incident response explained: NIST and SANS phases, severity triage, the first 48 hours, team roles, MTTD and MTTR, and how lessons feed back into defense.
## Latest blog posts
- [Saved filters in OpenCTI: build once, share with your team](https://filigran.io/blog/saved-filters-in-opencti-build-once-share-with-your-team): Saved filters in OpenCTI let you build a filter once, share it with your team, and reuse it in dashboard widgets. One definition, every view.
- [XTM Platform Q3 2026 updates: OpenCTI, OpenAEV, XTM One, and XTM Hub](https://filigran.io/blog/xtm-platform-q3-2026-updates-opencti-openaev-xtm-one-and-xtm-hub): See what's new in the XTM Platform this quarter across OpenCTI, OpenAEV, XTM One, and XTM Hub, plus how to start a free 30-day trial.
- [Stop defending alone: shared intelligence beats siloed security](https://filigran.io/blog/stop-defending-alone-shared-intelligence-beats-siloed-security): Why does shared intelligence matter? See how threat data sharing speeds response, supports compliance, and scales safely with OpenCTI.
- [The hidden cost of security tool sprawl](https://filigran.io/blog/the-hidden-cost-of-security-tool-sprawl): Security tool sprawl slows teams down. State of Threat Management data shows how connected workflows help them act on known risks faster.
- [Women in cyber threat intelligence: No typical path](https://filigran.io/blog/women-in-cyber-threat-intelligence-no-typical-path): Sixteen women share how they broke into cyber threat intelligence (CTI), and what it means for how security teams should be hiring.
- [OpenCTI and Google SecOps SOAR: Threat intel flows both ways](https://filigran.io/blog/opencti-and-google-secops-soar-threat-intel-flows-both-ways): OpenCTI and Google SecOps SOAR integration syncs threat intelligence and case data in both directions, cutting manual tab-switching for SOC teams.
- [OpenAEV v3: Adversarial exposure validation goes autonomous with attack chaining](https://filigran.io/blog/openaev-v3-adversarial-exposure-validation-goes-autonomous-with-attack-chaining): OpenAEV v3 brings autonomous Attack Chaining and adversarial exposure validation for attack path validation and automated pentesting
- [Attack Chaining: How to test and stop the way attackers get in](https://filigran.io/blog/attack-chaining-how-to-test-the-way-attackers-get-in): Attackers rarely rely on one exploit. Here's how Attack Chaining works, and why testing your defenses against multi-step breach paths matters.
- [Your SOC Doesn’t Have a Data Problem. It Has a Coordination Problem.](https://filigran.io/blog/your-soc-doesnt-have-a-data-problem): Agentic AI closes the gap between exposure data and decisions, unifying intel, validation, and detection into one SOC workflow.
- [Intelligence Approval Workflows: Ensure Data Quality and Streamline Processes](https://filigran.io/blog/intelligence-approval-workflows-octi): OpenCTI's approval workflows add multi-step reviews and RBAC so every submission is checked before it's trusted.
- [Four Ways OpenCTI Turns Data into Strategic Threat Intelligence](https://filigran.io/blog/opencti-for-strategic-threat-intelligence): OpenCTI helps security teams turn raw data into strategic threat intelligence, powering smarter long-term risk and investment decisions.
- [What We’ve Been Building in Q2: XTM Platform, OpenCTI and OpenAEV Updates.](https://filigran.io/blog/what-weve-been-building-in-q2): Explore Filigran's Q2 2026 XTM Platform updates: XTM One's agentic AI, smarter OpenCTI automation, and expanded OpenAEV multi-tenancy.
- [Custom Views in OpenCTI: Get to the Right Intelligence Faster](https://filigran.io/blog/custom-views-in-opencti): Custom Views bring the most relevant, entity-specific intelligence directly onto OpenCTI entity pages, so teams get context faster.
- [Filigran Named Outperformer in 2026 GigaOm Threat Intelligence Radar](https://filigran.io/blog/filigran-named-outperformer-in-2026-gigaom-radar): Filigran is named an Outperformer in the 2026 GigaOm Threat Intelligence Radar. See why OpenCTI stood out for integrations, AI, and CTEM.
- [State of Threat Management Survey Report: What 550 Security Professionals Reveal](https://filigran.io/blog/state-of-threat-management): Explore findings from Filigran’s State of Threat Management report, and learn why speed to action is now the gap.
- [Filigran XTM Platform Wins Hacker News Award for Best Intelligence-Powered Cybersecurity Platform](https://filigran.io/blog/filigran-wins-hacker-news-award): Filigran won The Hacker News Cybersecurity Stars Award for Best Intelligence-Powered Cybersecurity Platform, turning intel into action.
- [Filigran and CheckFirst Bring the Pravda Network into OpenCTI](https://filigran.io/blog/filigran-and-checkfirst): Bring the Pravda Network Feed into OpenCTI with Filigran and CheckFirst. Get structured, searchable FIMI intelligence you can correlate at scale.
- [Introducing Multi-Tenancy in OpenAEV: One Platform, Many Tenants](https://filigran.io/blog/multi-tenancy-openaev): OpenAEV multi-tenancy lets enterprises and MSSPs run one deployment with fully isolated tenants, centralized scenario rollout, and scoped reporting.
- [OpenCTI Playbook Library: Pre-Built Automation, One-Click Away](https://filigran.io/blog/opencti-playbook-library): Discover the OpenCTI Playbook Library: community-vetted automation templates you can configure and deploy in one click from XTM Hub.
- [Introducing XTM One: Intelligence to Validation, Closing the Loop with Agentic AI](https://filigran.io/blog/introducing-xtm-one-agentic-ai): Meet XTM One, Filigran’s agentic AI layer. Connect OpenCTI and OpenAEV to run a continuous loop from threat intel to validated remediation.
## Resources
- [State of Threat Management Report](https://filigran.io/resources/state-of-threat-management): 93% of security teams struggle to maintain an accurate view of their attack surface. Filigran's State of Threat Management report, based on 550+ global cybersecurity leaders, explores the shift from fragmented, point-in-time insight to continuous, evidence-based risk reduction and what it means for the future of proactive cyber defense.
- [Operationalizing Threat Intelligence for National Security](https://filigran.io/resources/operationalizing-threat-intelligence-for-national-security): How threat intelligence helps government agencies stay ahead of evolving cyber threats and protect critical infrastructure
- [The Continuous Advantage with CTEM](https://filigran.io/resources/the-continuous-advantage): Most security teams aren't short on data or tools, they're short on clarity. Discover how Continuous Threat Exposure Management (CTEM) replaces static assessments with a continuous, evidence-based approach to prioritizing real exposure.
- [Cyberthreats in the Financial Sector](https://filigran.io/resources/cyber-threats-to-financial-sector-2026): Exploring the 2025 evolving threat landscape of the financial sector and how to stay resilient in 2026.
- [Filigran Named an Outperformer & Challenger in the GigaOm Radar for Threat Intelligence Platforms](https://filigran.io/resources/gigaom-tip-radar-2026): GigaOm recognizes Filigran as an Outperformer & Challenger, validating our open-source, intelligence-first approach to threat management.
- [Building Cyber Resilience](https://filigran.io/resources/building-cyber-resilience): How threat intelligence and continuous security help comply with UK's Cyber Assessment Framework (CAF)
- [A Practical Guide to Threat-Informed Defense for Federal Agencies](https://filigran.io/resources/a-practical-guide-to-threat-informed-defense-for-federal-agencies): How Federal Agencies Can Align Security Operations with Real-World Adversary Behavior. A Step-by-Step Framework for Operationalizing Threat-Informed Defense.
- [A Practical Guide to Threat-Informed Defense](https://filigran.io/resources/practical-guide-to-threat-informed-defense): A step-by-step guide to help organizations proactively align security operations with real-world threats using a Threat-Informed Defense strategy.
- [Elevating Threat Intelligence – How to Choose the Right Solution that Scales for You](https://filigran.io/resources/elevating-threat-intelligence): Organizations today are required to continuously monitor their threat landscape and take remedial actions. Adapt a full-featured enterprise TIP such as OpenCTI allows cybersecurity teams turn raw data into actionable, strategic intelligence.
- [OpenCTI at Rivian: 88% Faster Detection](https://filigran.io/resources/opencti-at-rivian-88-faster-detection): How Rivian cut threat detection time by 88% with unified threat intel, automation, and simulation-driven testing using OpenCTI.
- [OpenCTI for MSSP](https://filigran.io/resources/opencti-for-mssp): A 5-phase maturity model that helps MSSPs evolve from basic threat data collection to delivering premium security services.
- [Architecting OpenCTI for Classified Airgapped Environments](https://filigran.io/resources/architecting-opencti-for-classified-airgapped-environments): Delve into best practices for deploying threat intelligence platforms in highly secure, air-gapped settings, ensuring robust multi-level security and operational efficiency.
- [The Intelligence Gap: What’s Missing in Your Cyber Strategy](https://filigran.io/resources/the-intelligence-gap-what-is-missing-in-your-cyber-strategy): How continuous Threat Management helps CISO stay ahead by prioritizing what really matters
- [Strengthening National Cyber-Resilience in Government](https://filigran.io/resources/strengthening-national-cyber-resilience-in-government): Discover strategies to bolster national cyber-resilience by proactively mitigating threats, improving incident response, and ensuring continuity with advanced threat management tools.
- [Threat Intelligence Sharing & Collaboration](https://filigran.io/resources/threat-intelligence-sharing-collaboration): Explore how government agencies can streamline ISAC operations and enhance intelligence sharing through the powerful capabilities of OpenCTI and OpenBAS.
- [Effortless Report Generation – Inform Your Executives with a Click](https://filigran.io/resources/askai-playbook-powered-dashboards): AskAI and Playbook-Powered Dashboards help CTI teams automate reporting, justify cybersecurity investments, and deliver executive-ready intelligence in real time.
- [Need visibility on who does what in your CTI platform?](https://filigran.io/resources/audit-logging-and-rbac): Audit Logging & Role-Based Access Control let you track every change, assign the right permissions, and stay compliant with frameworks like GDPR, ISO/IEC 27001, and NIST CSF.
- [Reduce your Time to Detection with Automated Workflows](https://filigran.io/resources/automated-workflows-webinar): Streamline investigations with automated workflows—helping your team reduce Time to Detect, Investigate, and Remediate threats with greater efficiency.
- [Strengthening Oil and Gas Cyber Defenses](https://filigran.io/resources/oil-gas-industry-report-2024): How Threat Intel Platforms can better protect Oil and Gas against emerging threats
- [Enhancing financial sector cybersecurity](https://filigran.io/resources/finance-industry-report-2024): Discover the evolving cyber threat landscape in the financial sector and how OpenCTI enables faster incident response.
- [Integrating Recorded Future in OpenCTI](https://filigran.io/resources/integrating-recorded-future-in-opencti): Discover how Recorded Future data integrates into OpenCTI to enrich your threat intelligence.
- [Navigating OpenAEV](https://filigran.io/resources/navigating-openaev): Learn how OpenAEV helps validate your organization’s security tools and procedures through scenarios, simulations, and over 1,600 customizable injects.
## Customer stories
- [How OpenCTI Saved 15 Workdays Monthly by Replacing 3 Platforms for a Global Defense Leader](https://filigran.io/customer-stories/how-opencti-saved-15-workdays-monthly-by-replacing-3-platforms-for-a-global-defense-leader): How OpenCTI replaced 3 platforms and saved 15 workdays monthly for a global aerospace and defense leader.
- [How a leading luxury manufacturer strengthens its cyber defense with OpenCTI](https://filigran.io/customer-stories/how-a-leading-luxury-manufacturer-strengthens-its-cyber-defense-with-opencti): How a leading French luxury group built a high-performance internal CERT and threat intelligence capability with OpenCTI.
- [Intrinsec’s enhanced cybersecurity operations with OpenCTI](https://filigran.io/customer-stories/intrinsecs-enhanced-cybersecurity-operations-with-opencti): How Intrinsec optimized its threat intelligence offering and practices through the strategic adoption of OpenCTI.
- [From 5 Days to A Few Seconds: ASRG Scaled Automotive Threat Management with OpenCTI](https://filigran.io/customer-stories/asrg-scaled-automotive-threat-management-with-opencti): Discover how ASRG collaborated with Filigran and leveraged OpenCTI to build a trusted, community-driven threat intelligence platform for the automotive industry.
- [OpenCTI Becomes Controlware’s Engine for Scalable Threat Hunting](https://filigran.io/customer-stories/opencti-controlware-scalable-threat-hunting): Controlware built an intelligence-driven detection framework with OpenCTI to scale threat hunting across multiple XDR platforms.
- [Cutting Threat-Hunting Time by 85%: A Game-Changer for ClearDATA](https://filigran.io/customer-stories/cleardata-cut-threat-hunting-time-by-85): How ClearDATA cut threat-hunting time by 85% and investigation time by 90% with OpenCTI.
- [How Switzerland’s FDFA Trains Smarter with OpenAEV](https://filigran.io/customer-stories/how-switzerlands-fdfa-trains-smarter-with-openaev): To streamline simulations and reduce workload, the Swiss FDFA chose OpenAEV by Filigran, enhancing operational readiness across 170 global sites, including embassies and consulates.
- [How Rivian achieves a 95% reduction in response time with OpenCTI](https://filigran.io/customer-stories/how-rivian-achieves-a-95-reduction-in-response-time-with-opencti): Explore how Rivian leveraged OpenCTI to tackle data silos, improve threat detection and scale their cybersecurity operations effortlessly.
## Conferences
- [THREAD 2026](https://filigran.io/thread): THREAD is the annual gathering of the threat intelligence and cyber defense community. Intelligence, exposure and action — in one room. October 15, 2026, Les Jardins de Saint-Dominique, Paris.
## Pages
- [Use Case Library](https://filigran.io/use-cases): OpenCTI and OpenAEV use cases highlight our capabilities in operationalizing threat intelligence and accelerating your path to Continuous Threat Exposure Management.
- [OpenCTI Enterprise Edition Free Trial](https://filigran.io/opencti-enterprise-edition-free-trial): Get 30 days to explore all OpenCTI Enterprise Edition functionalities and enr
