Filigran Unveils XTM One for AI-Driven Threat Management

The cybersecurity field is changing quickly, creating a need for innovative solutions that can address the growing complexity of threats. Today, French cybersecurity firm Filigran SAS introduced XTM One, an artificial intelligence orchestration layer designed to automate threat exposure management workflows across its platform. This launch marks a shift in how security teams can more effectively manage threats.

XTM One integrates Filigran’s OpenCTI extended threat intelligence platform with its OpenAEV exposure validation tool, establishing a continuous workflow that removes the need for manual transitions between different systems. Security analysts have traditionally had to use various tools to ingest threat intelligence, create attack scenarios, and monitor remediation efforts. XTM One automates these processes, enabling AI agents to coordinate actions throughout the lifecycle, from raw intelligence to validated defensive measures.

The platform enhances the AI-driven automation capabilities already available in OpenCTI and OpenAEV while introducing a dedicated layer for agents to collaborate across multiple products. This approach differs from earlier models that restricted AI assistance to individual tools. Co-founder Julien Richard stated, “XTM One is not AI as a feature. It is AI as the operating system for threat management. Security teams deserve automation that works the way they work.”

Equipped with prepackaged AI agents, XTM One tackles some of the most time-consuming tasks in security operations. These tasks include intelligence ingestion and enrichment, threat summarization, attack scenario generation and validation, and remediation guidance. By creating a continuous feedback loop, teams can quickly identify high-priority threats, assess their exploitability, and validate defenses—all from a single interface.

Early benchmarks from organizations using XTM show impressive results, with threat detection and response cycles speeding up by as much as 70%. Preparation times for offensive security testing have been cut by up to 80%. These efficiencies could change how companies approach cybersecurity, significantly reducing the time and resources spent on threat management.

XTM One also offers customization options for users. Customers can build and deploy their own agents, workflows, and integrations on the XTM platform. The inclusion of Bring Your Own LLM (BYOLLM) support allows organizations to use Filigran’s models or their own, which is especially attractive to regulated industries and government agencies that need to keep sensitive data within their systems.

Jean-Philippe Salles, vice president of product management at Filigran, noted that complexity has been a significant barrier to the adoption of threat intelligence. “The biggest barrier to threat intelligence adoption has always been complexity,” he said. With a natural-language interface, XTM One aims to help junior analysts become productive more quickly while relieving experienced practitioners from repetitive tasks.

The platform will be offered in three tiers to meet different organizational needs. Current customers of the Enterprise Edition of OpenCTI or OpenAEV will receive a built-in set of prepackaged agents and usage quotas at no extra cost. Organizations that want customized agent creation, workflow orchestration, and premium model packages can license XTM One separately. A free, open-source Model Context Protocol server will be available for integrating Filigran products with other AI architectures, regardless of the tier selected.

With the launch of XTM One, Filigran is positioning itself as a significant player in the cybersecurity sector, providing solutions that aim to simplify threat management for organizations of all sizes. As the threat landscape continues to change, the demand for such automation is expected to rise, making tools like XTM One essential for security teams looking to stay ahead of potential vulnerabilities.