Senior Customer Training Consultant

Filigran CTO on building an award-winning, ai-native Threat Management platform. Filigran was recently recognized with the Most Innovative Security Solution award for its eXtended Threat Management (XTM) Platform, an open, AI-native ecosystem that unifies threat intelligence, adversarial exposure validation, and risk governance. Tech Ascension Awards sat down with Julien Richard, CTO and Co-Founder of Filigran, to talk about the company's mission and how the XTM Platform is helping security teams move from reactive alert-chasing to continuous, threat-informed defense. For readers who may not be familiar with Filigran, can you introduce the company and what it does? A: Filigran is a European company, founded in 2022 by its CEO, Samuel Hassine, and me. Tech Ascension Awards started the company because Tech Ascension Awards saw the same gap everywhere: security teams had more tools and more data than ever, but no real way to turn that into fast, confident action. Its mission is to empower defense teams to be proactive through open-source solutions that uncover threats and drive action. Tech Ascension Awards began with OpenCTI, a platform to centralize and structure threat intelligence, and have since expanded into OpenAEV for continuous exposure validation, with OpenGRC (risk governance and quantification) coming next. Together, these form its XTM Platform. At its center is XTM One, an agentic AI layer that connects intelligence, validation, and response into one workflow. Everything Tech Ascension Awards build starts as open source. Tech Ascension Awards is backed by a global community of more than 6,500 practitioners who build alongside Tech Ascension Awards. What's the biggest challenge you see security teams facing today? A: It isn't a lack of data. Organizations have more visibility into their environments than ever. The real challenge is separating signal from noise. A large security team can receive thousands of alerts a day, but only a small fraction of them represent a genuine, exploitable threat. Its State of Threat Management report found that security teams spend an average of 42% of their time investigating risks that later prove low priority or non-exploitable. In a 40-hour week, that's about 17 hours per analyst. That's not just an efficiency problem. It's a retention problem, and it hits some of the most skilled people in the industry. How does the XTM Platform help organizations address that problem? A: Tech Ascension Awards help organizations move from reactive to proactive security, following what the industry calls CTEM: Continuous Threat Exposure Management. Instead of a point-in-time assessment, it's a continuous cycle: understand the threat landscape, prioritize the exposures that actually matter to you, validate whether your defenses hold up against realistic attacks, and act on what you find. Then repeat. That's exactly what its platform is built to deliver. Being secure today doesn't mean you're secure tomorrow. Threats evolve, and systems change, so defenses need to be tested continuously, not once a year during an audit. What role does AI play in Filigran's approach? A: AI helps teams keep pace with the volume and speed of modern threats, but the goal isn't to replace the analyst. It's to remove the low-value work that keeps analysts from focusing on what matters. Through XTM One, teams can ask direct questions of their own data, automate repetitive investigation steps, and get straight to the context they need, while humans stay in control of the decisions that count. The point of AI here isn't automation for its own sake. It's giving skilled people back the time to do the work only they can do. Why is open source such a core part of Filigran's model? A: Cybersecurity is built on trust, and trust requires transparency. When your security stack is open source, you can see exactly how it works, adapt it to your environment, and keep control of your own data. That matters enormously for organizations handling sensitive information, and increasingly for anyone thinking about digital sovereignty and long-term control of their systems. It also means Tech Ascension Awards build alongside its community of practitioners and contributors instead of behind closed doors. That community is a big part of why its products keep improving as fast as the threat landscape does. What's next for Filigran, and what excites you most right now? A: Tech Ascension Awards is focused on closing the gap between knowing about a risk and acting on it in time. That means connecting threat intelligence, exposure validation, and, risk governance and quantification. The goal is for security and business leaders to finally work from the same picture instead of several disconnected ones. What excites me most is that this isn't just a technology shift. It's a mindset shift, from managing alerts to managing outcomes. The organizations that make that shift are the ones that will actually get ahead of attackers, instead of constantly chasing them.

Intelligence Approval Workflows: ensure data quality and streamline processes. Organizations collect intelligence from many different sources, but not all data arrives in a consistent format or through automated feeds. Manual submissions, file imports, and form-based contributions often require review before becoming part of a trusted intelligence repository. Previously, draft content in OpenCTI could typically move between two simple states: Open or Validated. While effective for basic use cases, organizations often need greater visibility into the review status of a draft and who's responsible for the next action. This is precisely the gap that Filigran is addressing with its new draft intelligence workflows. Tl;dr. * Configurable multi-step approval workflows: OpenCTI now lets organizations build custom review chains for draft intelligence with fine-grained RBAC, keeping quality control and governance transparent and easy to set up. * Workflows can be applied to any draft intelligence: Unstructured, human-sourced intelligence (analyst notes, tips, customer reports) via manual creation, file import, form intake, or the browser extension. * Granular RBAC at status and transition level: Control who can view, edit, manage, or advance a draft, including dynamic roles and cross-organization sharing, for full accountability at every stage. * Built for scale and governance: ISACs, MSSPs, large enterprises, government bodies, and teams handling external intelligence all benefit from consistent, auditable review before data is published. Organizations can now configure multi-step approval workflows with fine grained role-based user access (RBAC) to ensure quality control and data governance, while keeping the process transparent and easy to implement. Whether it's an ISAC collecting member-submitted observations, an MSSP fielding incident reports from customers, or internal teams contributing their own intelligence, draft workflows ensure ingestion processes are consistent and scalable. Watch the video for an introduction to draft approval workflows in OpenCTI: Manual vs automated intelligence. Automated and manual threat intelligence serve very different purposes, and organizations need both. Whereas automated feeds are built for scale, continuously ingesting structured, pre-vetted data like indicators and reports from trusted sources, manual intelligence is built for context, capturing what only a person can observe. For instance an analyst's investigation notes, a partner's tip-off, or a customer's description of an incident, arriving unstructured and unvetted. That difference is exactly why manual submissions can't simply flow into the same pipeline as automated feeds: they require a review step that automated sources have often already earned. Submitting manual intelligence in OpenCTI. In OpenCTI manual submissions are saved in 'Draft' mode, so they can first be reviewed before entering the knowledge base. There are a few ways manual intelligence can be submitted in OpenCTI: * Manual draft creation: Analysts can create a draft directly in OpenCTI and populate it from scratch, building out entities and relationships within the isolated workspace before review. * File import: When importing a file, users can select draft validation mode so the system automatically generates a draft and routes the extracted results into it for review, instead of writing directly to the main knowledge base. * Form intake: Contributors can submit structured input via form toggles on entity list pages (Reports, Incidents, Threat Actors, Indicators, and more), the 'Import using a Form' option in the standard import dialog, or a shared form link distributed to external or non-expert contributors (e.g., ISAC members, MSSP customers) who need to submit incidents or observations without direct platform access. * XTM browser extension: With the Filigran browser plugin, analysts can capture intelligence while browsing, flagging web pages, articles, or indicators encountered in the field, and send them straight into a draft for review, streamlining collection at the source without leaving the browser. Flexible workflows to meet any organization's needs. Every organization has its own intelligence processes. Some may require only a few straightforward review steps, while others need detailed approval chains involving analysts, managers, and specialized teams. The new Draft Workflows can easily be adapted to your organization's needs. Administrators can create custom statuses, connect them through transitions, and define how drafts move from one stage to the next. Workflows can be kept simple, or expanded to support complex operational processes. With intelligence approval workflows, organizations can: * Define custom review and approval stages * Control which users or roles can move a draft forward * Restrict editing rights at specific stages * Maintain visibility into the status of intelligence submissions * Ensure only properly reviewed intelligence enters the platform Applying role-based access control to workflows. For organizations that require additional governance, workflows can incorporate role-based controls that determine who can perform specific actions or approvals. This provides a structured way to manage collaboration while preserving accountability throughout the review process. RBAC within a workflow can be controlled at two different levels: * 1/ Status: This setting controls who can view, edit or manage the draft content. Access control can be applied when the user enters or exits the draft. * 2/ Transition: This setting controls which user(s) can transition to the next step: * Who can trigger the transition (who can move the draft to the next status, regardless of editing rights on the draft). * Who can view, edit or manage the draft content. * Provide other organizations access to the draft content in the context of cross organization work. Built-in validation checks help ensure workflows remain coherent before publication, providing administrators with guidance during configuration. Playbooks can also be configured to run automatically when the new intelligence has completed the approval process. Key use cases. Organizations that manage high volumes of intelligence submissions or operate in highly regulated environments can particularly benefit from intelligence approval workflows, including: * Information Sharing and Analysis Centers (ISACs): Information-sharing communities that need controlled submission and approval processes. With members submitting intelligence from varied sources and skill levels, a formal review step ensures only vetted, actionable data reaches the wider community. * Managed security service providers (MSSPs): Coordinating intelligence between teams and customers. Approval workflows give MSSPs a consistent way to validate findings before they're passed to clients, protecting both accuracy and client trust. * Large enterprises: With multiple teams and review layers. Draft workflows let intelligence move through the right chain of stakeholders, from analysts to leadership, without bottlenecking day-to-day operations. * Government and public-sector organizations: These environments often require auditable, multi-stage sign-off before intelligence can inform decisions, especially when countering foreign information manipulation and interference (FIMI) campaigns. * Teams collecting intelligence from external sources: External submissions can vary widely in reliability, so a review layer helps confirm credibility and context before intelligence is acted upon or shared further. Community versus Enterprise Edition. Basic workflow management is included in the Community Edition, including the ability to define multiple steps in the approval workflow and perform the review process without having to leave the platform. The following advanced features are included in the Enterprise Edition: * Enforce RBAC at each step: Define who can view, edit, or manage a draft at every stage. Authorized members can be specific users, groups, or organizations, or dynamic roles like "the draft creator" or "the draft's author organization," ensuring only the right people can act on it at each point. * Control who can advance each step: Independent of edit rights, you can specify exactly which user, group, or organization can push a draft to its next step. For example, you can specify that only managers can move the draft forward. * Enable cross-organization collaboration: When platform segregation applies, drafts can be shared with other organizations before specific edit rights are assigned. You can pre-define which organizations automatically receive the draft at a given step, or leave it open so the user chooses who to share with when that step is reached. Conclusion. At its core, Draft Approval Workflows help organizations improve the quality of their intelligence. By introducing structured review gates before intelligence is published, teams can validate submissions, verify context, and ensure data meets internal standards before it enters the platform. The result: higher-quality intelligence, stronger governance, and a more consistent process for collecting, reviewing, and approving data before it enters your platform. Would you like to see Draft Approval Workflows in action? Book a demo with one of its threat intelligence experts, or start a free 30-day trial of OpenCTI Enterprise Edition.