OpenCTI review 2026: threat intelligence features, STIX2 data model, Community vs Enterprise Edition pricing, and how it compares to other CTI platforms.
OpenCTI is an open-source cyber threat intelligence platform originally developed in 2018 inside ANSSI, the French national cybersecurity agency, to organize its own knowledge about cyber threats. It was later open-sourced under the Luatix nonprofit, with ANSSI as a founding member, before becoming the flagship product of Filigran, a Paris-based cybersecurity company founded in 2022.
The platform structures threat data using the STIX2 standard, letting security teams ingest information from commercial feeds, internal telemetry, and open-source intelligence, then correlate, visualize, and act on it from a single unified interface.
OpenCTI ingests threat data from multiple sources and structures it around the STIX2 knowledge schema, modeling indicators, threat actors, malware, and campaigns along with their relationships for investigation and correlation.
The Enterprise Edition extends this with automated playbooks, priority intelligence requirements (PIRs), AI-powered file import, automated report generation, and natural language search, aimed at larger security operations teams that need scale and workflow automation.
OpenCTI's Community Edition is free and fully open source, giving teams a complete threat intelligence platform they can self-host at no licensing cost.
The Enterprise Edition adds advanced scalability, automation, and expert support for mission-critical security operations, but pricing is not publicly published; organizations must contact Filigran for a private quote, with a 30-day free trial available to evaluate the added functionality.
Yes, the Community Edition is free and fully open source; the Enterprise Edition adds advanced features and requires a custom quote from Filigran.
OpenCTI originated in 2018 at ANSSI, the French national cybersecurity agency, and is now developed commercially by Filigran, a Paris-based company founded in 2022.
OpenCTI structures threat intelligence using the STIX2 (Structured Threat Information Expression) knowledge schema.
The Enterprise Edition adds automated playbooks, priority intelligence requirements, AI-powered file import, report generation, and NLP search on top of the free Community Edition.
OpenCTI and its companion product OpenBAS are used by more than 6,000 public and private organizations, including government agencies and large enterprises.
Yes, Filigran offers a 30-day free trial to explore Enterprise Edition functionality before purchasing.
Filigran, the company behind OpenCTI, has raised over $100 million across seed, Series A, B, and C rounds from investors including Accel, Insight Partners, and Eurazeo.