Filigran: OpenCTI, security products and an open-source business

Filigran sells a way to organise cyber threat knowledge and turn it into a working security programme. Its best-known product, OpenCTI, has a community edition as well as commercial enterprise capabilities. OpenAEV adds security validation and organisational exercises. For a defence supplier, intelligence team or technology partner, the useful distinction is between adopting the software, buying additional capabilities and asking Filigran to operate and support the service.

The company’s public customer material makes those distinctions tangible. Healthcare services provider ClearDATA describes moving from running its own OpenCTI environment to enterprise support. An automotive research association uses the platform to share structured knowledge. Switzerland’s foreign ministry uses the product now called OpenAEV for crisis exercises. These are different purchasing needs, even though Filigran places them within its extended threat management, or XTM, offering.

A French company with an international workforce

Filigran dates its commercial launch to October 2022 and identifies Samuel Hassine and Julien Richard as its founders. The French legal entity has an earlier registration date: the government register records FILIGRAN, SIREN 901384479, as created in June 2021, with its current registered headquarters in Paris. A legal incorporation date and the launch of the present business describe different milestones. French government company record, Series C announcement.

The private company announced completion of a $58 million Series C on 6 October 2025. Eurazeo’s Growth team led the round, with Deutsche Telekom’s T.Capital and existing investors Accel and Insight Partners participating. Filigran said the money would support international expansion and product development. The announcement identifies financial backers but does not provide a current capitalisation table or establish that any one investor controls the company.

Its workforce is distributed rather than concentrated entirely at the Paris address. A people article carrying an 18 March 2026 date describes employees across 18 countries. The current opening says 220-plus employees, while its summary still refers to crossing 200. That makes the page useful evidence of scale, but an imperfect historical headcount snapshot. The same article’s 6,500-plus organisations includes customers, partners and community users; it is not a count of enterprise subscription accounts. Workforce and community description.

Current annual turnover remains undisclosed in the sources supporting this profile. Neither fundraising nor the government register’s old financial field provides a reliable substitute for a current consolidated sales figure.

OpenCTI’s commercial boundary

OpenCTI’s role is to structure intelligence so analysts can connect reports, observations and their organisational context. That is different from promising an exclusive stream of intelligence: the platform’s value also depends on the sources and knowledge its users bring into it. A supplier integrating public research or customer information therefore needs to distinguish software rights from permission to distribute the underlying data.

The official documentation separates Community Edition, licensed under Apache 2.0, from Enterprise Edition, governed by a separate enterprise licence. Source visibility does not make every enterprise feature available under the community licence. Filigran provides the enterprise keys; its SaaS customers receive Enterprise Edition, while ordinary enterprise use on a customer’s own premises requires an agreement. OpenCTI edition and licensing documentation.

That boundary gives potential integrators a practical starting point. A community-based demonstration can establish whether a data model or workflow is useful. Production requirements may subsequently change the hosting arrangement, support responsibility or licence. The cost comparison should follow that actual transition, rather than treating every OpenCTI installation as either a free hobby project or a fully managed commercial service.

For intelligence publishers, the complementary editorial issue is preserving provenance and analytic standards in an OSINT product. A well-organised platform cannot, by itself, turn a weak source into a well-supported conclusion.

ClearDATA: paying to change the operating burden

ClearDATA’s published account provides a concrete example of that transition. Its cyber threat intelligence leader, Cody Pickren, describes limited engineering capacity and the effort involved in maintaining an internally operated environment. The organisation first evaluated OpenCTI within its intelligence workflow and moved to Enterprise Edition as its requirements grew.

The important commercial detail is the support model. ClearDATA describes moving time away from maintaining infrastructure and towards analysis, while retaining the ability to adapt data streams and integrate with its existing security services. This is a customer explanation of why it bought a different operating arrangement, rather than evidence that a particular deployment model will save every organisation the same amount of work. ClearDATA customer account.

For a defence contractor with a small internal intelligence function, that example frames a specific decision: which work must remain inside the organisation, and which platform responsibilities can sensibly be supplied externally? For a managed service provider, the same distinction affects whether the platform is an internal tool or part of the service delivered to customers.

ASRG: sharing across an industry

The Automotive Security Research Group presents a different use case. In Filigran’s case study, founder John Heldreth explains the difficulty of using a platform designed for internal knowledge when the association needed to exchange information externally. Maintaining separate systems and manually moving information between them created work for a small core team.

The account describes OpenCTI’s structured data model, including STIX 2.1, as useful for interoperability. It also identifies traceability during enrichment as a requirement: the association wanted to retain an explanation of where information came from and how it changed. ASRG customer account.

This is relevant to industrial consortia because the product sits between organisations that may have different tools and different rules for sharing. Adoption by an association does not make all its members Filigran customers. It does demonstrate why an organisation might value a common information structure even when its participants retain separate commercial interests. OSINT Combine’s company profile provides a related example of a business whose value also depends on making information usable within a defined analyst workflow.

OpenAEV and the Swiss diplomatic example

On 29 October 2025, Filigran announced that OpenBAS was becoming OpenAEV and introduced a paid Enterprise Edition. The announcement retained a free community edition while adding commercial automation, hosting and support options. The relevant product role is assessing readiness and organising validation, including human participation in exercises; it is broader than storing intelligence. Product rename and enterprise launch.

Filigran’s Swiss Federal Department of Foreign Affairs case study describes a pilot beginning in early 2023, an initial exercise in February 2024 and full deployment in April 2025. Those events predate the OpenAEV name. The case uses current branding retrospectively, so the dates should be read as adoption of the platform that now carries that name.

The department’s crisis manager, Margaux Messerli, describes the value of fitting exercises into familiar working channels and allowing local teams to organise them with central support. The case places that work within a diplomatic network of more than 170 representations. It does not disclose a licence count, contract value or separate purchase by every site. Swiss FDFA customer account.

Commercially, the example broadens Filigran’s audience beyond specialist cyber analysts. A crisis-management organisation is buying repeatable preparation and coordination. A supplier assessing this market should therefore examine the department responsible for training and support, rather than assuming that every sale follows a security operations centre’s procurement process.

What the growth disclosures actually show

Filigran’s 23 March 2026 US expansion announcement reported nearly fourfold year-on-year growth in North American annual recurring revenue and 29 new enterprise and government customers over the preceding year. It also reported 119% net revenue retention. These are company-defined operating measures, with no absolute revenue base supplied in the announcement. US expansion release.

Those disclosures support a picture of commercial expansion, but they do not reveal recognised group turnover. The more useful follow-up evidence would show how enterprise adoption develops alongside the community: additional named customers, clearer hosting and support choices, and documented transitions between product families.

Filigran’s position is strongest where structured intelligence, adaptable software and ongoing service meet a particular organisational need. ClearDATA, ASRG and the FDFA illustrate different versions of that need. The evidence supports those specific relationships and product choices; it does not establish universal performance, undisclosed contract values or the company’s present shareholder percentages.