OpenCTI Enterprise Edition
Enterprise-grade governance for mission-critical CTI, with faster time to value and fewer manual tasks. Built on a strong foundation of centralized threat intelligence and real-time adversary visibility, the Enterprise Edition adds the governance, deployment flexibility, automation, agentic AI, reporting, sovereignty and dedicated support your organization needs to scale.
Trusted by governments, financial institutions and global enterprises across the world
Start with Community, scale with Enterprise
OpenCTI Community Edition offers a powerful open-source foundation and the capabilities to get started, but it is self-hosted only and less scalable. The Enterprise Edition takes that foundation to the next level, adding the automation, deployment flexibility, enterprise-grade scalability and expert support that mission-critical security operations demand.
Free-to-use, provides a strong start:
- Core threat intel and data ingestion (TAXII, RSS, CSV, connectors)
- Manual analysis, reporting, and case management
- Manual connector setup
- Basic Role Based Access Control (RBAC)
- Self-hosted deployment only
All features of OpenCTI CE plus enterprise-grade governance, automation, reporting, and sovereignty with dedicated support:
- One-click deployment of connectors, dashboards, and playbooks
- Focus on priority intelligence with PIRs
- Automate processes across the full pipeline with no-code playbooks and workflows
- Full audit logging, data segregation, and SSO
- Deployment flexibility (SaaS, on-premise, air-gapped, private cloud, BYOC)
- Agentic AI with XTM One (Starter Pack included)
Enterprise-grade control. Faster time to value.
A closer look at what OpenCTI Enterprise Edition offers and how each capability transforms the way your team works.
Focus and prioritization
Cut through the noise with PIRs that surface insights aligned to your organization type, industry, geography, risk profile and critical assets. Full-text file indexing searches structured and unstructured data alike, accelerating decision making.
No more time wasted on unlikely threats: surface real risks faster and report on what actually matters.
Automation at scale
One-click deployment of 400+ integrations. FINTEL templates and no-code playbooks reduce repetitive CTI tasks and enable real-time, event-driven response.
Faster time to value, lower engineering overhead.
Enterprise governance and sovereignty
SSO, full audit logging, data segregation and advanced RBAC (Access Control Lists) deliver the control and security capabilities enterprises and MSSPs require.
Collaborate securely across organizations, meet compliance requirements and demonstrate accountability during audits or post-incident reviews.
Deployment flexibility and reliability
Choose SaaS, on-premise, self-hosted, bring your own cloud (BYOC) or air-gapped, with full feature parity whatever the model. Backed by 12-month Long-Term Support and dedicated Filigran customer success.
No forced trade-off between capability and control, with less downtime risk and faster problem resolution.
Intelligence approval workflows
Safely open intelligence ingestion to a wider group of analysts or partners with customizable, multi-step approval workflows. Fine-grained RBAC at every step keeps quality control and data governance transparent and easy to implement.
Keep data consistent, quality-controlled and scalable. Ideal for ISACs and MSSPs.
Agentic AI with XTM One
Orchestrate the full threat management lifecycle with pre-built AI agents, AI-assisted file import, report generation, AI Insights, the Ask Ariane chat and natural language search. Create your own agents and bring your own LLM. The XTM One Starter Pack is included; additional licenses cover higher usage.
Accelerate intelligence-to-detection, scale your threat hunting and turn raw reports into structured intel in minutes.
Threat-informed defense, end to end
Combine OpenCTI with XTM One and OpenAEV to turn intel into full attack scenarios automatically and validate whether your environment is exposed. Power your CTEM program with measurable prevention, detection and response scores and recommendations tailored to your real threat landscape.
Faster, more proactive defense focused on threats that target actual weaknesses, with no time wasted on non-exploitable ones.
Ready for a Test-Drive?
Get 30 days to explore OpenCTI Enterprise Edition in our SaaS platform.
See OpenCTI Enterprise Edition in action
Four short walkthroughs of some capabilities that only ship with the Enterprise Edition.
Real business outcomes with OpenCTI Enterprise Edition
Security teams using the Enterprise Edition report measurable gains in detection, investigation and reporting speed.
88% reduction in Mean Time to Detect
Rivian’s CSOC saves several minutes on every ticket across hundreds of cases a day, and blocked 980 million IoCs.
Read case study
90% faster report generation
ClearDATA cut threat report publication from 48 hours to 5, and indicator investigations from 10 minutes to under one.
Read case study
50% reduction in investigation time
Controlware saves six months of investigation workload a year and produces 230% more detection rules without adding analysts.
Read case studyWhat our customers are saying
“Some teams came back to us saying, ‘That was so easy! We’d like to run another one.’ That showed us they were not just complying with the mandate, but really embracing the tool.”
“With OpenCTI, the enrichment process now takes seconds. Before, setting up the system and dashboards took over 40 hours.”
“OpenCTI has saved our CSOC several minutes per ticket, when the team goes through 100s of cases per day, this easily adds up to hours very quickly.”
“Thanks to very advanced data segregation and sharing capabilities, OpenCTI allows us to easily provide our customer with valuable threat intelligence information with a single platform.”
OpenCTI Enterprise Edition FAQ
Is it difficult to upgrade OpenCTI CE to EE?
No. Enter your OpenCTI Enterprise Edition license in your Community Edition instance and the enterprise features unlock immediately.
Can I get a trial of OpenCTI Enterprise Edition?
Yes. A 30-day free trial of OpenCTI Enterprise Edition SaaS lets you experience the full platform. Sign up for your 30-day trial.
What are the deployment options for OpenCTI EE?
OpenCTI EE supports flexible deployment: SaaS (Filigran-hosted, fully managed), on-premise, air-gapped environments, private cloud and bring your own cloud (BYOC) — so you keep full control over where and how your data is hosted, based on your security and compliance needs.
How do I migrate my on-premise version to SaaS?
The process is straightforward and you keep all your data and history. Our expert team handles the heavy lifting: assessing your current setup, migrating your data and configurations, and validating the new environment. You are also paired with a dedicated Customer Success representative who guides you through the transition and supports you once you are live.
What is the pricing for OpenCTI Enterprise Edition?
We have a simple, all-inclusive pricing model based on the number of instances, instance size and support services. Contact our sales team for a quote.
What is Long Term Support (LTS)?
Long Term Support gives you 12 months of support for the version you purchase, including critical bug fixes and security patches (no new features) — a safe, stable window to test, validate and deploy on your own schedule. Applicable to on-premise and air-gapped deployments only.
What kind of options do you offer for SaaS?
Filigran provides fully managed private cloud instances for OpenCTI, OpenAEV and XTM One. Each SaaS instance runs in its own infrastructure tenant to ensure strict segregation between customers, and supports unlimited users, data sources and integrations. View our SaaS hosting options.
Can I get more details on your support services?
Our fully in-house customer success team delivers prompt, professional support to keep your OpenCTI operations running smoothly. Several support plans are available depending on your needs — see the support services page.
Do you provide dedicated training for OpenCTI?
Yes. OpenCTI Enterprise Edition customers get a dedicated Customer Success representative for hands-on guidance and training, plus ongoing technical support for both SaaS and on-premise deployments.
Do you provide self-paced online training for OpenCTI?
Yes. The Filigran Academy offers self-paced online learning across three levels (OpenCTI 101, 201 and 301), combining hands-on simulations, real-world exercises and certification badges to validate your team’s expertise, with pay-per-badge and subscription options.
Explore other offerings
Discover Filigran’s value-added services designed to ensure you maximize the value of your journey with Filigran products.
Software as a Service
Filigran provides fully hosted and managed cloud private instances for every product in the XTM suite.
View SaaS hosting optionsSupport and Services
Professional assistance along your integration and usage of the platforms, with guaranteed response times and prioritization of your requests.
View our support optionsFiligran Academy
Master Filigran solutions and enhance your cybersecurity skills with engaging, hands-on learning paths designed for every level.
Explore official trainingGet started today.
Book a personalized demo to see the Enterprise Edition in action, or talk to the Filigran sales team to discuss pricing and implementation options.