CISO Tribune

Vendor comparison · 2 companies

Cymulate vs Filigran

Cymulate sells the Cymulate Platform, which turns validation into a continuous, adaptive process of agentic cyber defense engineering. Filigran sells the XTM Platform, an eXtended Threat Management suite in which threat intelligence, adversarial exposure validation and agentic AI orchestration work together in one threat-informed defense loop, open source at the core. CISO Tribune files both under Breach simulation and automated pen-testing. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Cymulate
  • Filigran
Cymulate vs Filigran: Products, Customers and Funding Compared
CymulateCymulate sells the Cymulate Platform, which turns validation into a continuous, adaptive process of agentic cyber defense engineering.cymulate.comFiligranFiligran sells the XTM Platform, an eXtended Threat Management suite in which threat intelligence, adversarial exposure validation and agentic AI orchestration work together in one threat-informed defense loop, open source at the core.filigran.io
What it sells
  • Cymulate Platform[3][6]Turns validation into a continuous process of agentic cyber defense engineering.
  • Cymulate Detection Studio[3][7]Automates SIEM rule validation and detection tuning.
  • XTM Platform[1][4][5][10][11][18]The eXtended Threat Management suite of OpenCTI, OpenAEV and XTM One.
  • OpenCTI[4][6][8][10][12][14]An open-source platform to organize, analyze and operationalize cyber threat intelligence.
  • OpenAEV[2][4][9][10][12][15]Adversarial exposure validation through attack simulation, autonomous pentesting and tabletop exercises.
  • XTM One[1][4][10][18]The agentic AI layer across the XTM platform.
  • OpenCRQ[11]A cyber risk quantification module, coming soon as the third open-source module of the XTM Platform.
  • OpenAEV Enterprise Edition[15]A commercial upgrade of OpenAEV with advanced features.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
2016[2][9]2022[2][3]
Ownership and funding
Not stated on its pagesPrivately held[6][13][16]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • August 4, 2026Cymulate announced the introduction of Cymulate Cowork, the Cymulate Claude Plugin and the Cymulate MCP Server.[12]
  • August 4, 2026Cymulate announced plans for a new integration with Bitsight to connect threat intelligence with continuous exposure validation.[11]
  • September 29, 2026Filigran appointed Tim Durkee as senior vice president of sales, Americas, and Mathieu Rigotto as chief information security officer.[19]
  • June 9, 2026Filigran announced XTM One, an AI-native agentic layer that automates Continuous Threat Exposure Management workflows across its XTM Platform.[18]
  • April 9, 2026Filigran announced the official launch of its Japanese organization and the start of its expansion in the Japanese market.[17]
G2 and Gartner Peer Insights
  • G2: listed, seen November 3, 2026[4]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 3, 2026[13]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Cymulate sells mainly to security teams that need continuous validation, including security operations, detection engineering, red teams and exposure management teams. Cymulate says it supports organizations of all sizes, from mid-market to enterprise, especially those with complex or evolving security stacks. Cymulate also says it serves executives, security operations and the whole security program. For detection work, Cymulate says its Detection Engineering offering is aimed at SOC and Detection Engineering teams.From its own pages, Filigran sells mainly to security teams that want threat intelligence and exposure validation in one open-source suite. The company says its users range from individuals to enterprises and government organizations. Its support plans are described as fitting teams of whatever stage and size.
Last verified
November 2, 2026October 7, 2026

Where they overlap

  • Cymulate and Filigran are both filed under Breach simulation and automated pen-testing.

Where they differ, field by field

  • Cymulate's primary category is Breach simulation and automated pen-testing; Filigran's is Threat intelligence.
  • Filigran is also filed under Exposure prioritisation and CTEM.
  • Cymulate lists Cymulate Platform and Cymulate Detection Studio. Filigran lists XTM Platform, OpenCTI, OpenAEV, XTM One, OpenCRQ and 1 more.
  • Cymulate was founded in 2016. Filigran was founded in 2022.
  • Filigran is privately held.

What it sells: Cymulate

What Cymulate Platform does[3][6]
Cymulate turns validation into a continuous, adaptive process of agentic cyber defense engineering. The platform includes a daily feed of the latest threats with a 24-hour SLA for updated attack simulations for new US Cert threat advisories. Testing results create scorecards and benchmarks for security controls, MITRE ATT&CK coverage and specific threats.

What it sells: Filigran

What XTM Platform does[1][4][5][10][11][18]
OpenCTI, OpenAEV and XTM One work as one continuous loop, from anticipation to response. Filigran says the platform makes continuous threat exposure management (CTEM) agentic.
What OpenCTI does[4][6][8][10][12][14]
OpenCTI offers 400+ one-click integrations and uses a consistent STIX 2.1 data model. It includes case management for incident-related data.
What OpenAEV does[2][4][9][10][12][15]
OpenAEV maps breach and attack simulation scenarios to MITRE ATT&CK and ATLAS. It can be deployed with or without an endpoint agent, across cloud, on-prem or multi-tenant setups.
What XTM One does[1][4][10][18]
XTM One consolidates and orchestrates all assistive and agentic AI capabilities across the XTM platform. Customers can build their own agents and bring their own LLMs. CTEM Assistant is the primary entry point of the XTM Platform.

Questions about Cymulate and Filigran

What do Cymulate and Filigran sell?
Cymulate sells Cymulate Platform and Cymulate Detection Studio. Filigran sells XTM Platform, OpenCTI, OpenAEV, XTM One, OpenCRQ and 1 more.
Are Cymulate and Filigran in the same category?
They share Breach simulation and automated pen-testing. Cymulate's primary category is Breach simulation and automated pen-testing and Filigran's is Threat intelligence.
When were Cymulate and Filigran founded?
Cymulate was founded in 2016. Filigran was founded in 2022.
Who owns Cymulate and Filigran?
Filigran is privately held.
Who are Cymulate and Filigran sold to?
From its own pages, Cymulate sells mainly to security teams that need continuous validation, including security operations, detection engineering, red teams and exposure management teams. From its own pages, Filigran sells mainly to security teams that want threat intelligence and exposure validation in one open-source suite.
What have Cymulate and Filigran announced recently?
August 4, 2026: Cymulate announced the introduction of Cymulate Cowork, the Cymulate Claude Plugin and the Cymulate MCP Server. September 29, 2026: Filigran appointed Tim Durkee as senior vice president of sales, Americas, and Mathieu Rigotto as chief information security officer.

About Cymulate

Cymulate sells the Cymulate Platform, which turns validation into a continuous, adaptive process of agentic cyber defense engineering. Cymulate says manual testing and control updates can take days to adapt to new threats. With Vero AI, Cymulate says it understands new threats, tailors validation to the customer's environment and turns findings into prioritized actions and automated security control updates.[1][3][5][7]

Cymulate says its threat library has full MITRE ATT&CK coverage. The platform includes a daily feed of the latest threats with a 24-hour SLA for updated attack simulations for new US Cert threat advisories. Cymulate safely simulates real-world attack techniques across endpoints, networks, email, web gateways and cloud environments, with integrations to the controls and SIEM to prove both prevention and detection. Testing results create scorecards and benchmarks for security controls, MITRE ATT&CK coverage and specific threats. Cymulate combines breach and attack simulation, exposure validation and actionable remediation guidance in a single platform.[1][3][5][8]

For exposure management, Cymulate says customers can automate validation as part of a continuous threat exposure management program. Cymulate lets customers push vendor-specific threat mitigation and behavior rules for immediate prevention or detection. Cymulate Auto Mitigate deploys relevant IoCs to security controls after teams follow remediation guidance for validated gaps. The Cymulate + Bitsight integration creates a closed loop between adversary intelligence and continuous exposure validation. In the Cymulate Platform, Bitsight provides relevant adversaries, campaigns, ransomware groups, APTs, TTPs, IoCs and targeting trends that are then used to focus testing and validation workflows.[3][5][6][7]

On detection, Cymulate Detection Studio automates SIEM rule validation and detection tuning against real-world attacks. Cymulate says it transforms detection engineering from a manual, resource-intensive process into a continuous, automated lifecycle. Vero AI maps rules to attack scenarios, tests detection performance, identifies gaps and recommends or generates new rules. Cymulate generates Sigma rules and vendor-specific detection rules from validated gaps and provides guided tuning for the rules customers already have. Once deployed, rules are retested against the original attack scenario to confirm they improved detection. Cymulate simulations are production-safe: they reproduce the techniques and behavior of real attacks without executing actual malicious payloads or causing damage to systems or data.[3][7][8]

Cymulate says it is built for security teams that need continuous validation across their environment, including security operations, detection engineering, red teams and exposure management teams. Cymulate says it supports organizations of all sizes, from mid-market to enterprise, especially those with complex or evolving security stacks. Cymulate says it empowers executives, security operations and the whole security program to continuously prove, prioritize and adapt security for specific threats and exposures.[3][5][8]

Cymulate was founded by former IDF intelligence officers and cyber researchers. Cymulate says its platform runs on a private AWS tenant engineered for isolation, high availability, and redundancy across multiple regions. Cymulate does not collect or store sensitive Personal Identifying Information or PCI-DSS cardholder data. Cymulate states that data stored in databases and AWS is encrypted with AES-256. Cymulate has independent external auditor attestation across the Security, Availability, Confidentiality and Privacy Trust Services Criteria, and a public SOC 3 report.[3][8]

Cymulate on the record

Sources

Cymulate full record

  1. [1]cymulate.comCymulate · cymulate.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]About usCymulate · cymulate.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Cymulate | AI-Powered Exposure ValidationCymulate · undated page, accessed October 24, 2026 · Tier A
  4. [4]Cymulate Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
  5. [5]Cymulate Platform: Real-Time Automated Security ValidationCymulate · undated page, accessed November 3, 2026 · Tier A
  6. [6]Cymulate + Bitsight | Threat Intelligence Meets Exposure ValidationCymulate · undated page, accessed November 3, 2026 · Tier A
  7. [7]Cymulate's SIEM detection and analysisCymulate · undated page, accessed November 3, 2026 · Tier A
  8. [8]Detection Engineering - CymulateCymulate · undated page, accessed November 3, 2026 · Tier A
  9. [9]About us - Learn about CymulateCymulate · undated page, accessed November 3, 2026 · Tier A
  10. [10]Security at Cymulate - CymulateCymulate · undated page, accessed November 3, 2026 · Tier A
  11. [11]Cymulate and Bitsight Integrate Threat Intelligence & ValidationCymulate · published August 4, 2026 · Tier A
  12. [12]Cymulate Debuts Cowork, Claude Plugin and MCPCymulate · published August 4, 2026 · Tier A

Filigran full record

  1. [1]filigran.ioFiligran · filigran.io · undated page, accessed October 7, 2026 · Tier A
  2. [2]Filigran redefines proactive security openbas rebrands to openaev with an ai powered enterprise editionFiligran · filigran.io · published October 29, 2025 · Tier A
  3. [3]Filigran accelerates us expansionFiligran · filigran.io · published March 23, 2026 · Tier A
  4. [4]Platform | FiligranFiligran · undated page, accessed October 31, 2026 · Tier A
  5. [5]Filigran | Uncover Threats. Take Action.Filigran · undated page, accessed October 31, 2026 · Tier A
  6. [6]Services | FiligranFiligran · undated page, accessed October 31, 2026 · Tier A
  7. [7]Support and Services | FiligranFiligran · undated page, accessed October 31, 2026 · Tier A
  8. [8]OpenCTI - Open Source Cyber Threat Intelligence Platform | FiligranFiligran · undated page, accessed October 31, 2026 · Tier A
  9. [9]OpenAEV - Adversarial Exposure Validation Platform | FiligranFiligran · undated page, accessed October 31, 2026 · Tier A
  10. [10]XTM One - Agentic AI for Threat Exposure Management | FiligranFiligran · undated page, accessed October 31, 2026 · Tier A
  11. [11]OpenCRQ - Threat-Informed Cyber Risk Quantification | FiligranFiligran · undated page, accessed October 31, 2026 · Tier A
  12. [12]Filigran Academy - Official Training | FiligranFiligran · undated page, accessed October 31, 2026 · Tier A
  13. [13]OpenCTI by Filigran Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 31, 2026 · Tier C
  14. [14]OpenCTI Enterprise Edition | FiligranFiligran · undated page, accessed November 3, 2026 · Tier A
  15. [15]OpenAEV Enterprise Edition | FiligranFiligran · undated page, accessed November 3, 2026 · Tier A
  16. [16]Software as a Service | FiligranFiligran · undated page, accessed November 3, 2026 · Tier A
  17. [17]Filigran Announces Strategic Expansion into Japan to Accelerate Proactive Cyber DefenseFiligran · published April 9, 2026 · Tier A
  18. [18]Filigran Launches XTM One, an AI-Native Platform for Automating Continuous Threat Exposure ManagementFiligran · published June 9, 2026 · Tier A
  19. [19]Filigran Accelerates Global Enterprise Growth With Executive Leadership Expansion Across Americas Sales and CybersecurityFiligran · published September 29, 2026 · Tier A

Spot a factual error? Request a correction.