The French start-up Filigran is expanding its open-source XTM Platform with attack simulation, risk quantification and AI agents, and sees growth in DACH driven by NIS2, DORA and sovereignty.
At it-sa 2026 in Nuremberg, Filigran explained how its open-source XTM Platform is meant to turn threat intelligence into measurable resilience. In a conversation with Security Storage Channel Germany, Jermain Njemanze, VP Solution Engineering at the French company, described attack simulation, agentic AI and a broad partner network as the drivers of its growth in the DACH region.
Filigran SAS is a French start-up, founded in 2022, that emerged from the open-source community. Its flagship product is OpenCTI, a threat intelligence platform that the company positions as a workbench for analysts who need to understand which threats actually concern them. According to Filigran, more than 7,000 members now belong to its community. The code is published on GitHub, and Njemanze says the software is updated more than once a week. The free version, he adds pointedly, is only free if your own time has no value. That is where the commercial side begins: hosting, deployment, maintenance in the cloud, rented bare metal, Kubernetes, bring-your-own-cloud or on-premises operation, plus training and day-to-day support. Partners offer many of these services, and Filigran says it wants them to understand the product first and the company second.
The second building block is OpenAEV, which automates attack simulations to test an organization’s security ecosystem and uncover gaps. Njemanze contrasts it with classic penetration tests: valuable, but costly, and their reports are only a snapshot in time. Automated testing, by contrast, can run continuously, even on an hourly basis. OpenAEV connects to SIEM systems such as Splunk, executes payloads and, according to Njemanze, needs no additional agents; an agentless mode is available as well. The aim is tangible results in reducing risk, and the strategic umbrella is continuous threat exposure management (CTEM), which Filigran describes as the direction of its product strategy. For security teams that collect large volumes of threat data but struggle to act on it, the promise is a measurable link between intelligence, detection and response.
Two newer products extend the portfolio. OpenCRQ is intended to express the value of threats in euros and thereby make cyber risk quantifiable. It is still in alpha; a beta as a community edition is planned for this year to gather feedback. Filigran had announced that it would present the beta program at THREAD, its first own conference, held on 15 October in Paris with speakers from Accenture, Centrica, Thales and the FBI. XTM One, in turn, is the AI component of the platform: with agentic AI, it is designed to accomplish concrete use cases. A hands-on lab at THREAD was to cover tasks such as triaging threat reports and turning intelligence into attack scenarios. Njemanze argues that AI lowers the entry barrier for threat intelligence, in his words AI for good. The company also points to synergies among its products and to its community, whose feedback is meant to shape the roadmap.
THREAD itself follows the community model, according to Filigran: the free one-day event at Les Jardins de Saint-Dominique was billed as hands-on labs and workshops instead of vendor pitches. Thales was to share its experience, while practitioners from Dassault Systèmes, Hermès and Richemont were scheduled to report on what worked in practice. Closed-door roundtables for CISOs were planned on CTEM, NIS2 and DORA. Users can also vote on the XTM Platform roadmap, the company says.
Regulation is a strong argument in the DACH market. Under DORA and NIS2, companies must be able to demonstrate resilience, and Filigran presents continuous testing as a way to do so. Sovereignty plays a role as well. Njemanze points out that customers can host the platform themselves or have Filigran do it, with identical behavior in both cases, whereas other vendors rely on AWS or other US clouds. Public-sector customers in particular value transparency and the assurance that no backdoors exist, which an open code base is meant to support. According to Njemanze, French and other governments trust the software, and a founder previously worked for the French government.
Filigran names Controlware, Airbus, Marriott, Thales, Capgemini and Rivian as references. Thales, for example, builds its own services on Filigran products, such as reports and audits of customer environments. This reflects the go-to-market approach: system integrators and service providers build their offerings around the platform. Filigran reaches them through webinars, blogs and conferences, including events for managed service providers. Njemanze described it-sa as very busy. The company is growing, has staff in Germany and wants to expand further in DACH.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de