Filigran XTM One

Filigran XTM One is an AI orchestration layer that connects the company's OpenCTI threat intelligence platform and OpenAEV exposure validation tool into a continuous, agent-driven workflow. It is built for security operations and threat intelligence teams already running Filigran's open-source stack who want ingestion, summarisation, attack simulation and remediation guidance handled by coordinated agents rather than manual handoffs.

Filigran XTM One, launched in June 2026, is an AI orchestration layer — the company calls it an AI-native cockpit — that sits above Filigran's existing eXtended Threat Management suite and automates continuous threat exposure management end to end. Rather than embedding an assistant inside each individual tool, XTM One coordinates pre-packaged agents across the full lifecycle: intelligence ingestion and enrichment, threat summarisation and reporting, attack scenario generation and validation, and remediation guidance. Those agents interact as a continuous loop, so a team can identify a threat in OpenCTI, generate and run an emulation of it through OpenAEV, and validate whether existing defences hold, all from one interface. The underlying products are substantial open-source projects in their own right: OpenCTI structures, stores and visualises technical and non-technical threat data on the STIX2 standard behind a GraphQL API, carries roughly 9,800 GitHub stars under an Apache 2.0 community licence, and integrates with MISP, TheHive and MITRE ATT&CK; OpenAEV, formerly OpenBAS, handles adversary emulation and security validation. Filigran reports over 6,000 organisations using its products, including Bouygues Telecom, Capgemini, EDF, Rivian and the Swiss federal foreign affairs department, with more than 230 verified single-click integrations covering SentinelOne, CrowdStrike, Recorded Future and Mandiant. Commercially, pre-packaged agents are included at no extra cost for Enterprise Edition customers, custom agents and workflow orchestration are separately licensed, and a free open-source MCP server is available. The platform supports bring-your-own-LLM and on-premises deployment. Filigran was founded in October 2022 in Paris and raised a $58 million Series C in October 2025.

Category

Governance & Security

Pricing

Free, Subscription, Contact for pricing

Target Market

CISOs, Threat Intelligence Analysts, Security Operations Leads, CTOs, Government Security Teams

Deployment

Open-source, Self-hosted, Cloud-first, Hybrid

Founded

2022

Headquarters

Paris, France

Customers

6,000+ organisations using Filigran products

• ✓
  Pre-packaged agent library

  Ready-made agents cover intelligence ingestion, enrichment, summarisation, scenario generation, validation and remediation guidance out of the box.

• ✓
  Continuous CTEM loop

  Agents interact so threat identification, exploitability testing and defence validation run as one cycle rather than sequential manual handoffs.

• ✓
  Bring your own LLM

  Teams can use Filigran's models or plug in their own, which matters for sovereignty and data-residency-constrained buyers.

• ✓
  On-premises deployment

  The stack can be self-hosted rather than consumed as SaaS, supporting air-gapped and regulated government environments.

• ✓
  OpenCTI threat intelligence foundation

  STIX2-native storage and visualisation with a GraphQL API, roughly 9,800 GitHub stars and an Apache 2.0 community licence.

• ✓
  230+ single-click integrations

  Verified connectors for SentinelOne, CrowdStrike, Recorded Future, Mandiant, MISP, TheHive and MITRE ATT&CK reduce integration effort.

• ✓
  Open-source MCP server

  A free Model Context Protocol server lets external agent frameworks query the threat management stack directly.

• •
  Automated intelligence enrichment

  Ingestion agents pull and enrich feeds continuously so analysts start from structured, contextualised intelligence rather than raw reports.

• •
  Intel-driven adversary emulation

  A threat surfaced in OpenCTI is turned into an OpenAEV attack scenario automatically, closing the gap between knowing and testing.

• •
  Executive threat reporting

  Summarisation agents draft threat reports from underlying intelligence, cutting the manual writing load on senior analysts.

• •
  Control validation after an advisory

  When a new advisory lands, agents generate the matching scenario and validate whether current defences actually stop it.

• •
  Sovereign deployment for government teams

  On-premises hosting with a customer-supplied LLM lets public sector bodies run agentic CTEM without sending data to a vendor cloud.

There is a genuine free path: OpenCTI and OpenAEV community editions are open source under Apache 2.0 and the XTM One MCP server is free. Pre-packaged XTM One agents are bundled at no additional cost for existing Enterprise Edition customers, which makes the upgrade cheap if you already pay for Filigran; custom agents and workflow orchestration sit in a separately licensed custom tier. No list prices are published for either commercial tier, so enterprise cost requires a sales conversation.

This page was written from 5 sources, 3 on domains other than filigran.io.

1. 1.filigran.io — filigran.iovendor
2. 2.filigran.io — filigran announces a new 58 million funding round to accelervendor
3. 3.siliconangle.com — filigran launches xtm one automate threat exposure managemen
4. 4.securityweek.com — filigran raises 58 million in series c funding
5. 5.github.com — opencti