OpenAEV

Overview

OpenAEV is a security validation platform for teams that need to exercise both technical defenses and crisis response. It is a strong fit for organizations with mature security operations; smaller teams may find its breadth and Enterprise Edition’s custom pricing difficult to justify.

Filigran, founded in 2022 and headquartered in Paris, develops OpenAEV. The company lists SOC 2 Type 2, ISO 27001:2022, and GDPR trust items.

Key features

Threat-led simulations and attack chaining

OpenAEV uses cyber threat intelligence to shape breach and attack simulations, with scenarios mapped to MITRE ATT&CK and ATLAS. Teams can create custom scenarios, schedule work continuously, enrich indicators, and connect actions into attack paths based on findings. Attack chains can be orchestrated manually or autonomously using dedicated agents. That combination supports recurring, threat-informed validation, but it is likely more platform than a team seeking occasional, narrowly scoped tests needs.

Coverage spans endpoints, asset groups, people, teams, and network hosts, along with email, phishing landing pages, SMS, phone-based social engineering, and media pressure. STIX/TAXII support, reporting, workflow automation, and case management round out the operational toolkit.

Exercises and exposure tracking

Structured tabletop exercises let teams assess readiness, escalation, coordination, communication, and response. Adversarial Exposure Scoring tracks posture over time and maps coverage against MITRE ATT&CK and domain-based controls. Together, these features connect simulated activity with both measurable exposure and human response, making OpenAEV relevant beyond teams focused solely on endpoint testing.

Integrations and governance

OpenAEV has 30+ integrations, including connections for OpenCTI, threat feeds, EDR/XDR, SIEM, and SOC playbooks. Community Edition includes OpenCTI security coverage integration, prepackaged scenarios, Threat Arsenal, atomic testing, tabletop exercises, scoring, CVE findings, alert fetching, and RBAC. Enterprise Edition adds SSO, full audit logging, data segregation, and advanced role-based access controls. The latter matters for organizations with stricter governance needs; teams needing only core exercises can start with the community feature set.

Pricing

The freemium model offers a free Community Edition and a 30-day Enterprise Edition SaaS trial. The trial gives teams a time-limited way to explore the platform before deciding whether Enterprise deployment and support fit their needs.

Community Edition is the sensible starting point for organizations able to operate an on-premise installation and rely on community support. It gives up Enterprise’s deployment choices, advanced integrations, AI features, and vendor-backed SLAs. Enterprise is the better fit when SaaS or more specialized deployment options, governance, or service commitments are important, but its quote-based cost requires a direct purchasing decision rather than a published price comparison. Enterprise support includes a customer support portal and a dedicated Customer Success Manager, with standard 8×5 and premium 24×7 options.

Platforms

OpenAEV supports API, Linux, self-hosted, and web access. Deployments can be cloud, on-premise, or multi-tenant, with or without an endpoint agent; Enterprise Edition also offers air-gapped and bring-your-own-cloud options. Components are available as Docker images and manual installation packages, while Kubernetes is recommended for production deployments. This flexibility suits organizations with deployment constraints, though the on-premise Community Edition places operational responsibility on the adopting team.

Who it's for

OpenAEV is aimed at cybersecurity and crisis management teams that want to connect threat-led simulations, exposure measurement, and response exercises. Its scenario breadth and tracking are most useful where security and crisis teams can coordinate ongoing exercises. Filigran says Enterprise Edition is trusted by governments, financial institutions, and enterprises; organizations with strict governance or deployment requirements have Enterprise options, while smaller teams can assess the core experience through Community Edition.

Pros and cons

• Pros: Technical attack simulations and structured crisis exercises share one platform, supporting a joined-up view of defense and response.
• Pros: MITRE ATT&CK and ATLAS mapping, exposure scoring, and continuous scheduling support repeatable validation rather than isolated exercises.
• Pros: Community Edition is free forever and includes core simulations and tabletop exercises, giving teams an on-premise entry point.
• Cons: Community Edition is on-premise and backed by community support, so teams seeking hosted service or vendor SLAs need Enterprise.
• Cons: Enterprise pricing depends on instances, instance size, and support, making costs less predictable before obtaining a quote.
• Cons: The wide mix of technical and human attack surfaces may be excessive for teams looking only for a focused simulation capability.

Alternatives

For a narrower threat-intelligence lookup use case, IBM X-Force Exchange has a free plan, but that tier does not include X-Force API access. If open-source licensing is the priority, ThreatForge offers a free Community Edition under AGPL-3.0-or-later. Security Vision TIP is a paid threat intelligence platform with sales-calculated pricing; consider it when that platform category, rather than combined simulation and crisis exercises, is the priority.

SOCRadar Extended Threat Intelligence Platform offers dark-web monitoring plans starting at 600.00 USD per month for one domain and one seat, a more targeted choice for that monitoring scope. Group-IB Attack Surface Management is a paid alternative whose Standard pricing depends on confirmed external assets. Flashpoint Ignite has pricing by request, while Anomali Platform requires contacting sales for pricing. AhnLab V3 Internet Security is a paid Windows product with subscription plans, rather than a platform for attack simulation and crisis exercises.

Browse our Threat Intelligence Platforms and Breach and Attack Simulation Software lists to compare by category.

Verdict

Choose OpenAEV if your cybersecurity and crisis management teams need a shared system for threat-led attack validation, exposure tracking, and structured response exercises. Its free, on-premise Community Edition provides a credible route to core capabilities; look elsewhere if you need a narrowly focused tool, or prefer not to operate the community deployment and cannot accommodate a custom Enterprise quote.