OpenCTI by Filigran Reviews & Product Details

OpenCTI is an open-source threat intelligence platform designed to help users manage and operationalize threat intelligence effectively. Built by practitioners for practitioners, OpenCTI aims to break down data silos and ensure that threat intelligence is not only accessible but also actionable. This platform facilitates the seamless flow of threat intelligence across various security systems, making it relevant by integrating business context and enabling the creation of comprehensive threat exposure reports for enhanced executive visibility. The target audience for OpenCTI includes cybersecurity professionals, threat analysts, and organizations looking to improve their threat intelligence capabilities. By providing a centralized platform for threat data, OpenCTI allows users to visualize, link, and enrich threat intelligence, fostering collaboration among teams and enhancing the overall security posture of an organization. The platform is particularly beneficial for organizations that need to streamline their threat intelligence processes and ensure that critical information is readily available to decision-makers. Key features of OpenCTI include its unified and consistent data model based on the Structured Threat Information Expression (STIX) standard. This allows users to integrate diverse threat data sources into a single framework, making it easier to analyze and respond to threats. The platform supports various data formats and can ingest information from multiple feeds, enabling users to maintain a comprehensive view of the threat landscape. Additionally, OpenCTI offers advanced visualization tools that help users identify patterns and relationships within the data, facilitating more informed decision-making. Moreover, OpenCTI enhances the operationalization of threat intelligence by providing users with the tools to enrich their data with contextual information. This capability allows organizations to tailor their threat intelligence to their specific business needs, ensuring that the information is not only relevant but also actionable. By generating detailed threat exposure reports, OpenCTI empowers executives with the insights needed to understand their organization's risk landscape and make informed strategic decisions regarding cybersecurity investments and initiatives. Overall, OpenCTI stands out in the realm of threat intelligence platforms by prioritizing collaboration, accessibility, and contextual relevance. Its open-source nature encourages community involvement and continuous improvement, making it a valuable resource for organizations seeking to enhance their threat intelligence capabilities and strengthen their cybersecurity defenses.

Seller

Filigran

Discussions

OpenCTI by Filigran Community

Languages Supported

English, French

Solution Type

Best-of-Breed

Overview by

Samuel Hassine

Pricing

Pricing provided by OpenCTI by Filigran.

OpenCTI Enterprise Edition

View More Pricing Information

OpenCTI by Filigran Integrations

(12)

Verified by OpenCTI by Filigran

Show More Integrations

G2 reviews are authentic and verified.

Here's how.

Kieran G.

Information Security & Third Party Assurance

Mid-Market (51-1000 emp.)

7/21/2026

"Friendly, Expert Onboarding and a Truly Beneficial Platform"

5/5

What do you like best about OpenCTI by Filigran?

From the initial call through onboarding and the bi-weekly catch-ups, the whole team has been super friendly and helpful. The SMEs are incredibly knowledgeable about the platform. There was an initial learning curve when I first started using the platform, but once you’re up to speed, it becomes a very beneficial tool for our business. Review collected by and hosted on G2.com.

What do you dislike about OpenCTI by Filigran?

Can't fault it the tool when you are up to speed it works really well Review collected by and hosted on G2.com.

Verified User in Financial Services

Mid-Market (51-1000 emp.)

7/14/2026

"OpenCTI Centralizes Threat Intelligence with Strong STIX/TAXII Integrations and Responsive Support"

4.5/5

What do you like best about OpenCTI by Filigran?

OpenCTI provides a good interface for exploring relationships between threat intelligence objects, while its extensive STIX/TAXII support and connectors make integration with existing CTI feeds and data easy. The platform offers good value by centralizing intelligence into a single knowledge base, and its ability to automate helps reduce manual effort. Filigran's support team has been responsive throughout onboarding and deployment. Regular cadence calls helps to highlight new updates to the platform or issues to be solved. Review collected by and hosted on G2.com.

What do you dislike about OpenCTI by Filigran?

OpenCTI has a steep learning curve due to its rich data model, numerous features and administrative roles and permissions. New users may initially find the interface and features overwhelming, particularly during the initial deployment and configuration phase. That said, Filigran offers comprehensive training courses and regular cadence calls that helps users understand the platform and adopt best practices. Review collected by and hosted on G2.com.

Jeroen d.

Senior Security Analyst - CTI

Enterprise (> 1000 emp.)

2/16/2026

"OpenCTI: The Threat Intelligence Platform That Lets Us Focus on Intelligence"

5/5

What do you like best about OpenCTI by Filigran?

The ability for as a team to use OpenCTI to create an automated feedback loop between our CTI team and the SOC is really powerful. When our SOC colleagues need more context or want us to investigate something further, OpenCTI automatically captures those RFIs and routes them back to us.

This bidirectional flow makes our intelligence actually actionable and keeps everyone connected - something that's genuinely hard to find in other platforms.

What makes this work so well is that OpenCTI handles the full intelligence spectrum. As I often tell my team: "Higher management has an Threat Intel question, we turn to OpenCTI for answers." Whether it's strategic assessments, tactical deep-dives, or operational IOCs, we can work through the Pyramid of Pain and deliver what's needed.

The platform is flexible enough to fit exactly how we work, but solid enough that it just works from day one. That means we spend our time on threat analysis instead of platform administration, which is exactly what we need." Review collected by and hosted on G2.com.

What do you dislike about OpenCTI by Filigran?

The technical overhead of self-hosting can be overwhelming. We ran our own OpenCTI instance for about a year, and while it gave us valuable insight into how the platform works technically, which actually helped us use it more effectively. The maintenance, updates, and infrastructure management required significant attention. That's time we'd rather spend on threat analysis.

To be clear, this isn't a criticism of OpenCTI itself. Any complex platform has this challenge when you self-host. We ultimately made the decision to migrate to Filigran's hosted OpenCTI platform, and it's been the right call. We kept all the power and capabilities of OpenCTI without the operational hassle.

For teams that want to focus on intelligence work rather than platform administration, I'd definitely recommend considering the hosted option from the start. Review collected by and hosted on G2.com.

What problems is OpenCTI by Filigran solving and how is that benefiting you?

OpenCTI solved several critical problems we were facing. We previously had threat intelligence scattered across multiple tools and sources, with manual processes for ingestion and correlation. Our old TI platform simply didn't deliver what it promised, and we struggled to provide timely, actionable intelligence to our SOC and management.

OpenCTI gave us a way to centralize and correlate everything. Now all our threat data, regardless of source, is in one place and properly contextualized and enriched. The biggest benefit has been enabling our SOC's detection and response capabilities.

OpenCTI lets us transform raw threat data into intelligence that's actually relevant to our organization's threat landscape. The automated feedback loop means our SOC can quickly request additional context when needed, which has cut our average response time to RFIs by roughly 60%.

For our stakeholders (from CISOs to Directors), OpenCTI enables us to deliver proper, actionable intelligence based on actual threats to our organization. We've increased our intelligence product output, while spending less time on tool- and platform administration.

Whether it's a strategic briefing for management or operational IOCs for the SOC, OpenCTI gives us the capability to deliver what's needed faster and with better quality. The platform has transformed us from struggling with tools to actually doing the intelligence work we're meant to do. Review collected by and hosted on G2.com.

Tal K.

Co-Founder and CBO

Small-Business (50 or fewer emp.)

9/14/2026

"Easy Threat Intelligence Feed Integration with Great UI/UX at Scale"

4.5/5

What do you like best about OpenCTI by Filigran?

Easy integration of Threat Intelligence feeds. Good UI/UX that help with easy flows. Best at large scale data management. Review collected by and hosted on G2.com.

What do you dislike about OpenCTI by Filigran?

Nothing missing for integrating as a provider. Review collected by and hosted on G2.com.

Jonathan C.

Développeur logiciels

Enterprise (> 1000 emp.)

7/24/2026

"Scalable, Clear Platform with Strong Integrations and Excellent Support"

5/5

What do you like best about OpenCTI by Filigran?

The scalability and clarity of information within the platform. UI/UX is fine. A lot of integration for an MSSP : for example SIEM or BAS. No opinion on the price by my side. Global support, onboarding and human proximity are really appreciated. Review collected by and hosted on G2.com.

What do you dislike about OpenCTI by Filigran?

Not seen anything disliked at the moment. Review collected by and hosted on G2.com.

Verified User in Computer & Network Security

Small-Business (50 or fewer emp.)

7/28/2026

"A powerful tool for managing, automating, and modeling cyber threat intelligence"

4.5/5

What do you like best about OpenCTI by Filigran?

The ability to ingest and correlate data presented through an investigative map makes it possible to visualize and analyze virtually any type of threat. Review collected by and hosted on G2.com.

What do you dislike about OpenCTI by Filigran?

In certain advanced scenarios, the tool’s power can also become a weakness, since it demands a high level of expertise for more complex configurations and for creating automated tasks. Review collected by and hosted on G2.com.

Verified User in Construction

Enterprise (> 1000 emp.)

7/29/2026

"Centralization, sharing, and capitalization of Threat Intelligence"

4/5

What do you like best about OpenCTI by Filigran?

I particularly appreciate the power and flexibility of OpenCTI. The platform allows for effectively structuring CTI information while remaining highly adaptable to different use cases. This tool truly promotes the capitalization of events and the sharing of information. Review collected by and hosted on G2.com.

What do you dislike about OpenCTI by Filigran?

Some connectors are not yet perfectly functional, particularly the connector to MISP. Review collected by and hosted on G2.com.

Verified User in Financial Services

Enterprise (> 1000 emp.)

2/5/2026

"Fast evolving platform with expected growing pains understands CTI analysis and industry standards"

4.5/5

What do you like best about OpenCTI by Filigran?

Adherence to industry standards such as MITRE and STIX. Ability to quickly pivot between related threats and reporting. Flexibility to integrate existing workflows and automate using visual playbooks. Regular feature updates. Review collected by and hosted on G2.com.

What do you dislike about OpenCTI by Filigran?

Growing pains with a fast growing startup. Inconsistent customer success experience. Inconsistent adoption of STIX standard across different connectors introducing false or fragmented data. Despite this there are clear indications of progress being made in these areas. Review collected by and hosted on G2.com.

What problems is OpenCTI by Filigran solving and how is that benefiting you?

OpenCTI is a night and day experience compared to our old "industry leading" Threat Intel Platform (TIP) that had become complacent and stagnated. Using OpenCTI we have been able to integrate multiple analysis and escalation workflows that previously lived outside our TIP. Where we had to wait years for requested functionality to be implemented in our last TIP we have had several feature requests already completed in the first year of contract with Filigran. We now have a better visibility of the threats our organization is facing and how they interlink. While STIX adoption could be improved with several of our essential connectors what we already have has allowed better pivoting between named threats and related reporting. Review collected by and hosted on G2.com.

Verified User in Automotive

Enterprise (> 1000 emp.)

7/29/2026

"Seamless Multi-Report Connectivity in One Place"

5/5

What do you like best about OpenCTI by Filigran?

The platform connects to multiple reports, which makes it much easier to work across different report sources and manage information from each one in a single place. Review collected by and hosted on G2.com.

What do you dislike about OpenCTI by Filigran?

I’d appreciate having more connectors available for the ticketing platform. Review collected by and hosted on G2.com.

Cody P.

2/13/2026

"Centralized Threat Intel with Some Setup Challenges"

4/5

What do you like best about OpenCTI by Filigran?

I really appreciate OpenCTI by Filigran for its open-source OSINT focus and community mentality. The playbook and dashboard functionality are particularly high-value for our team, as they free us up to do high-level analysis instead of getting bogged down with automating and coding. Review collected by and hosted on G2.com.

What do you dislike about OpenCTI by Filigran?

Some of the feature support is unclear and we've found initial documentation gaps that slow down adoption while we build experience or read between the lines. Additionally, some features demo nicely in the test environment examples or make sense at a high level, but when implementing in a real-world environment, there are technical grey areas and significant integration effort needed to get the OpenCTI resources to perform. Review collected by and hosted on G2.com.