Filigran XTM One: Automating continuous threat exposure management

- Automates continuous threat exposure management (CTEM) workflows 

- Enables full model flexibility and on-premises deployment

- Reduces analyst workload and time-to-value

Filigran, the open-source threat management company, has released XTM One, an AI-native agentic layer that automates CTEM workflows across the Filigran XTM Platform. 

XTM One introduces a dedicated AI orchestration layer that connects OpenCTI and OpenAEV into a single, continuous workflow. 

Filigran explained that traditionally, security teams would have to move manually between tools, ingesting threat intelligence in one system, building attack scenarios in another, and tracking remediation in separate dashboards. XTM One automates those handoffs by coordinating AI agents across the lifecycle, creating a continuous path from raw threat intelligence to validated defensive action while preserving full visibility and control. 

The XTM Platform already includes AI-powered automation across OpenCTI and OpenAEV. XTM One takes a fundamentally different approach: a dedicated orchestration layer where agents coordinate across products, not just assist within them. 

XTM One introduces a coordinated system of prepackaged AI agents that automate some of the most time-intensive security workflows, including:

● Intelligence ingestion and enrichment

● Threat summarisation and reporting

● Attack scenario generation and validation

● Remediation guidance and dashboard creation

Teams can find the threats that matter most, test their exploitability, and validate their defences from a single interface.

Early platform benchmarks indicate organisations using the XTM Platform have achieved:

● Up to 70% faster threat detection and response cycles

● Up to 80% less preparation time for offensive security testing

"Security teams across Southeast Asia are under enormous pressure. They're dealing with a growing volume of threats, a shortage of experienced analysts, and tools that weren't built to work together. What we see consistently in this region is organisations that have invested heavily in detection but still can't answer one fundamental question: are we actually prepared for the threats targeting us right now?” said Kevin Vanhaelen, SVP APJ, Filigran.

Filigran's State of Threat Management report, a survey of 550 security decision-makers and practitioners including 50 in Singapore, found that 31% of organisations in the region have a consolidated view of their cyber risk exposure, compared to 52% in North America. Just 27% use threat intelligence within a continuous, automated validation process.

“XTM One enables a step-change improvement in this. It provides the connective tissue that practitioners can use to turn the intelligence they have into action that the business can take. We're seeing businesses look to their CTI teams to provide a more integrated, automated approach, and that's exactly what XTM One enables," said Damian Skeeles, Senior Manager of Solution Engineering, Filigran.

"The ability to turn intelligence into decisive action is a true competitive advantage. Filigran has given our teams the clarity and confidence to make faster, better-informed decisions, reducing our exposure to risk and allowing us to focus our resources where they matter most," said Chris Novak, former VP, Global Cybersecurity Solutions, Verizon Business.

"They lead with a customer-centric approach that delivers not only security outcomes, but also enables organisations to move forward with confidence."

XTM One gives organisations full control over how AI operates within their security environment. Security teams can build and deploy custom agents, workflows, skills, and integrations, while "bring your own LLM" (BYOLLM) support allows organisations to use Filigran-provided models or their own.

The platform supports on-premises deployment, enabling highly regulated organisations and government agencies across Singapore and Southeast Asia to keep sensitive data within their own infrastructure, meeting the data residency and sovereignty requirements that financial institutions and public sector bodies in the region must comply with.

Details

XTM One is available in three tiers. Existing Enterprise Edition customers of OpenCTI or OpenAEV receive a built-in set of pre-packaged AI agents, a usage quota and BYOLLM support at no additional cost. Organisations requiring advanced capabilities, including custom agent creation, workflow orchestration, Model Context Protocol (MCP) integrations, and premium model packages, can license XTM One separately.

A standalone, free, open-source MCP server is also available, allowing organisations to integrate Filigran products into their own AI architectures regardless of licensing tier.

Request a demo at filigran.io

CTI stands for cyber threat intelligence and LLM for large language model.