Filigran launches XTM One to speed threat response

Filigran has launched XTM One, an AI layer for its threat management platform that links OpenCTI and OpenAEV in a single workflow.

XTM One is designed to automate Continuous Threat Exposure Management workflows across the platform. Filigran said the software coordinates AI agents across tasks including intelligence ingestion and enrichment, threat summarisation, attack scenario generation, validation, remediation guidance and dashboard creation.

The launch reflects a wider push by cybersecurity suppliers to reduce the manual work involved in moving threat intelligence between separate systems. Security teams often collect data in one tool, test scenarios in another, and track remediation in separate dashboards, creating delays and extra work for analysts.

Filigran said XTM One adds a dedicated orchestration layer on top of functions already present in OpenCTI and OpenAEV. It drew a distinction between AI features that assist with individual tasks inside one product and an orchestration approach that connects processes across products, from initial intelligence gathering to defensive action.

According to Filigran, organisations using the broader XTM Platform have recorded up to 70% faster threat detection and response cycles and up to 80% less preparation time for offensive security testing. The announcement did not include detailed methodology for those figures.

Regional pressure

Filigran tied the launch to operational pressure on security teams in Southeast Asia, citing findings from its State of Threat Management survey of 550 security decision-makers and practitioners worldwide, including 50 in Singapore.

The research found that only 31% of organisations in the region have a consolidated view of cyber risk exposure, compared with 52% in North America. It also found that 27% use threat intelligence within a continuous, automated validation process.

"Security teams across Southeast Asia are under enormous pressure. They're dealing with a growing volume of threats, a shortage of experienced analysts, and tools that weren't built to work together. What we see consistently in this region is organisations that have invested heavily in detection but still can't answer one fundamental question: are we actually prepared for the threats targeting us right now?" said Kevin Vanhaelen, SVP APJ, Filigran.

Filigran argues that the gap between threat intelligence and action remains a central issue for many organisations. It positions XTM One as a way to connect cyber threat intelligence work with exposure validation and remediation in a more continuous process.

"XTM One enables a step-change improvement in this. It provides the connective tissue that practitioners can use to turn the intelligence they have into action that the business can take. We're seeing businesses look to their CTI teams to provide a more integrated, automated approach, and that's exactly what XTM One enables," said Skeeles.

Deployment options

A key part of the launch is deployment flexibility. Filigran said XTM One supports Bring Your Own LLM arrangements, allowing organisations to use either models supplied by Filigran or their own within the platform.

The software also supports on-premises deployment. That may appeal to regulated industries and public-sector bodies that need to keep sensitive security data within their own infrastructure because of data residency and sovereignty requirements.

Filigran said customers can build and deploy custom agents, workflows, skills and integrations. It also offers what it described as a standalone free open-source MCP server, intended to let organisations integrate Filigran products into their own AI architectures regardless of licensing tier.

Commercial model

XTM One is available in three tiers. Existing Enterprise Edition customers of OpenCTI or OpenAEV receive a built-in set of pre-packaged AI agents, a usage quota and BYOLLM support at no additional cost.

Customers that want custom agent creation, workflow orchestration, MCP integrations and premium model packages can license XTM One separately. Filigran did not disclose pricing.

The launch builds on Filigran's position in open-source cyber threat intelligence software through OpenCTI, which it describes as widely deployed. Its platform strategy now centres on combining threat intelligence, exposure validation and cyber risk management functions under a broader XTM approach.

An endorsement included in the announcement came from Chris Novak, former Vice President of Global Cybersecurity Solutions at Verizon Business. "The ability to turn intelligence into decisive action is a true competitive advantage. Filigran has given our teams the clarity and confidence to make faster, better-informed decisions, reducing our exposure to risk and allowing us to focus our resources where they matter most. They lead with a customer-centric approach that delivers not only security outcomes, but also enables organisations to move forward with confidence."