Filigran Named a Leader in the G2 Winter 2026 Threat Intelligence Grid® Report

We are proud to share that Filigran has been named a Leader in the G2 Winter 2026 Threat Intelligence Grid® Report. This achievement marks an important moment for our team and for the global threat intelligence community that supports and contributes to our work.

At Filigran, we are building open-source and AI-augmented proactive cyber security solutions, for organizations to anticipate threats better and improve their security posture continuously. Being recognized as a Leader only a few years after our founding reflects the strong alignment between our mission and the needs of security teams worldwide. Today, more than 6,000 CTI practitioners trust Filigran to power their threat intelligence and CTEM programs, and this recognition belongs to them as much as it belongs to us.

TL;DR

• Filigran named a Leader in G2 Winter 2026 Threat Intelligence Grid® Report
• OpenCTI by Filigran receives 100% 4- or 5-star ratings and 94% recommendation rate
• Users Love Us and Regional Leader badges recognize positive customer experience and wide adoption
• OpenCTI enables organizations to centralize threat intelligence, accelerates SOC workflows, and fosters collaboration

Validated by the Threat Intelligence Community

This report is based on independent reviews from verified users and positions Filigran as a Leader because of our strong customer satisfaction and growing market presence.

According to the Winter 2026 report for Threat Intelligence:

• 100 percent of users rated OpenCTI 4 or 5 stars
• 100 percent of users believe the product is heading in the right direction
• 94 percent would recommend OpenCTI
• NPS score of 86

These results tell a simple story. Users trust the OpenCTI platform to power real threat intelligence operations in real environments and to scale with them as their CTI programs evolve.

Additional recognitions and badges

In addition to being named a Leader in the Threat Intelligence category, Filigran is proud to have earned two other notable badges on G2:

• Users Love Us: highlighting the high satisfaction and loyalty of our verified users.
• Regional Leader: recognizing strong adoption and impact across Europe and the EMEA region.

What users love most about OpenCTI

Celebrating our G2 achievements

• Trusted by security teams globally
• Loved by customers for the ease of working with us
• Driving innovation in the threat/ exposure management space

Powerful integrations that accelerate detection

OpenCTI centralizes threat intelligence and connects seamlessly with SIEMs/SOARs, internal data sources, and external feeds. Analysts can enrich, correlate, and investigate threats without switching tools, dramatically improving detection and response speed.

“OpenCTI has drastically reduced our Mean Time to Detect (MTTD) for Threat Hunting in the SOC.”

G2 Reviewer

The platform’s extensive integrations, combined with high-quality documentation and responsive support, ensure teams can implement it quickly and scale it with confidence.

Transforms how teams collaborate

OpenCTI creates a shared intelligence hub that unifies CTI, SOC, IR, vulnerability teams, and management. By centralizing data, automated workflows and CTI sharing capabilities, the platform fosters collaboration, visibility, and structured reporting across functions.

“The platform is easy to adopt and has transformed our way of working, helping to foster greater collaboration and awareness amongst multiple teams.”

G2 Reviewer

Daily usage of OpenCTI enables consistent context sharing, improved situational awareness, and streamlined communication across teams.

A community and vendor ecosystem that drives fast innovation

OpenCTI’s open-source architecture and active global community accelerate new features, improvements, and integrations. Rapid iteration ensures the platform stays aligned with the evolving needs of security teams.

“Broad community support allows for rapid development and product improvement. The platform is very approachable and easy to understand.”

G2 Reviewer

Filigran’s support team complements the community, providing hands-on guidance for implementation and optimization.

A truly centralized intelligence platform

OpenCTI serves as the backbone for cyber threat intelligence, incident response, and SOC operations. By consolidating reporting, indicators, cases, identities, and external sources into a single structured environment, teams can correlate threats faster and respond more effectively.

“It is the backbone of our cyber threat intelligence, incident response, and CSOC programs.”

G2 Reviewer

This centralization reduces operational friction, improves investigative workflows, and ensures intelligence drives actionable security decisions.

Conclusion

Being named a Leader on G2 is more than a badge for us. It reflects the results our users are achieving every day: faster detection, smarter correlation, and better collaboration across their security functions.

OpenCTI continues to grow as a platform that unifies intelligence, operations, and investigation under a single, open, community-powered ecosystem. We are grateful for the trust of the global community and excited for what comes next.

Enjoy and feel free to ask any questions about it on our Slack community channel !