OpenAEV

OpenAEV is an Adversarial Exposure Validation platform for cybersecurity and crisis management teams. It creates attack simulations, stress tests, and crisis exercises. Breach and attack scenarios draw on cyber threat intelligence and map to MITRE ATT&CK and ATLAS. Attack Chaining can connect actions into paths based on findings, with manual or agent-based orchestration. Tabletop exercises provide a structured way to assess readiness, escalation, coordination, communication, and response. Adversarial Exposure Scoring tracks posture over time and maps coverage to MITRE ATT&CK and domain-based controls. The product lists more than 30 integrations, connecting areas such as OpenCTI, threat feeds, EDR/XDR, SIEM, and SOC playbooks. Deployment options include cloud, on-premise, and multi-tenant environments; Enterprise also lists air-gapped and bring-your-own-cloud options. Community Edition is free for on-premise core simulations and tabletop exercises, with community support. Enterprise pricing is quote-based, and its SaaS trial lasts 30 days. Components are offered as Docker images or manual installation packages, with Kubernetes recommended for production deployments.

OpenAEV brings attack simulation, scoring, and tabletop exercises into one platform. Community Edition is free for core on-premise use; Enterprise adds listed deployment and governance options at quote-based pricing.

OpenAEV is aimed at cybersecurity and crisis management teams that need attack simulations, exposure tracking, or structured readiness exercises. Organizations evaluating Enterprise can use its 30-day SaaS trial.

Overview

OpenAEV brings breach-and-attack simulation together with crisis exercises and exposure tracking. It is best suited to cybersecurity and crisis management teams that want to assess both technical defenses and organizational response. Its broad scope is a strength, but getting the most from it calls for an organization prepared to manage a substantial security program.

Filigran, the Paris-based developer founded in 2022, lists SOC 2 Type 2, ISO 27001:2022, and GDPR trust items. OpenAEV spans cloud, on-premise, and multi-tenant deployments, with Enterprise options for air-gapped and bring-your-own-cloud environments.

Key features

Threat-led simulations and attack paths

Simulations draw on cyber threat intelligence and map scenarios to MITRE ATT&CK and ATLAS. Teams can build custom scenarios, enrich indicators, and use STIX/TAXII support. Attack Chaining connects actions into paths based on findings; orchestration can be manual or autonomous with dedicated agents. Continuous scheduling, workflow automation, case management, and reporting support recurring validation rather than isolated tests.

The attack surfaces cover endpoints, asset groups, people, teams, and network hosts, alongside email, phishing landing pages, SMS, phone-based social engineering, and media pressure. That breadth helps teams exercise technical controls and human-facing risks in the same program, but may be more than organizations seeking a narrow technical test need.

Exercises, scoring, and integrations

Structured tabletop exercises assess readiness across escalation, coordination, communication, and response. Adversarial Exposure Scoring tracks posture over time and maps coverage to MITRE ATT&CK and domain-based controls, giving teams a way to connect exercise results with ongoing exposure measurement.

OpenAEV has more than 30 integrations, including connections for OpenCTI, threat feeds, EDR/XDR, SIEM, and SOC playbooks. Community Edition includes OpenCTI security coverage integration, prepackaged scenarios, Threat Arsenal, atomic testing, scoring, CVE findings, alert fetching, tabletop exercises, and RBAC. Enterprise adds advanced integrations and AI features, plus governance options such as SSO, full audit logging, data segregation, and advanced role-based access controls.

Pricing

Community Edition: free, billed Free forever. This on-premise plan covers core attack simulation and tabletop exercises with community support. It is the clear fit for teams able to operate their own deployment and accept community support; it gives up Enterprise’s advanced integrations, AI features, and vendor support with SLAs.

Enterprise Edition: custom pricing, based on number of instances, instance size, and support services. It is available as SaaS or on-premise and includes advanced integrations, AI features, and vendor support with SLAs. A 30-day SaaS trial lets teams explore the Enterprise platform. Enterprise is the better fit when deployment flexibility, governance, and vendor-backed support justify a quote-based purchase.

Filigran offers standard 8×5 and premium 24×7 support options for Enterprise, along with a customer support portal and dedicated Customer Success Manager. No seat or usage caps are part of the plan terms stated here, so the main published cost distinction is free on-premise core use versus a quote based on deployment scale and support.

Platforms

OpenAEV supports API, Linux, self-hosted, and web environments. Components are available as Docker images and manual installation packages, while Kubernetes is recommended for production deployments. The combination of cloud, on-premise, and multi-tenant deployment options suits organizations with varied infrastructure needs; Enterprise also lists air-gapped and bring-your-own-cloud options. Deployment choice does not remove the operational work involved in running a broad simulation and exercise program.

Who it's for

OpenAEV is aimed at cybersecurity and crisis management teams that need to link threat-informed testing with tabletop response exercises and exposure scoring. Community Edition makes sense for technically capable teams seeking core on-premise use without a license charge. Enterprise is more appropriate for organizations that need SaaS or specialized deployment choices, stronger governance, advanced integrations, or vendor support. Filigran says Enterprise serves governments, financial institutions, and enterprises.

Pros and cons

• Pros: Threat-led scenarios map to MITRE ATT&CK and ATLAS, while scoring tracks coverage over time, connecting simulation with posture review.
• Pros: Technical attack surfaces and human-response exercises sit in one platform, including structured tabletop work and social-engineering channels.
• Pros: Community Edition provides core on-premise simulation and tabletop exercises free forever, with a substantial set of community features.
• Cons: Community Edition is on-premise and includes community support, so organizations needing SaaS, advanced governance, or vendor SLAs must consider Enterprise.
• Cons: Enterprise pricing depends on instances, instance size, and support services, making it harder to budget without a quote.
• Cons: Its wide attack-surface and exercise coverage may be unnecessary for teams looking only for a focused, lightweight simulation tool.

Alternatives

For a wider comparison, browse Breach and Attack Simulation Software or Threat Intelligence Platforms.

• Atomic Red Team is a free, community-developed option for tests that run in five minutes or less with minimal setup; choose it for compact tests rather than OpenAEV’s broader exercise and scoring scope.
• Infection Monkey is a free, open-source breach-and-attack simulation tool for teams looking for that more focused category of tool.
• MITRE Caldera is a free, Apache License 2.0 open-source cybersecurity framework for teams seeking a framework rather than OpenAEV’s combined simulation, tabletop, and scoring platform.
• Keysight Eggplant Test is a paid enterprise option with quote-based pricing and a free trial; consider it when its broader Android, iOS, macOS, and Windows platform coverage is a priority.
• BlackNoise BAS is a paid, self-hosted and web-based alternative.
• Cymulate Platform offers a free trial and subscription pricing tailored to the organization, with price depending on package, assets, and scenarios.
• PurpleSharp is a free option for self-hosted Windows use.
• Pentera Platform is a paid alternative with personalized demo and commercial details available by contacting Pentera.

Verdict

Choose OpenAEV if your team wants one platform for threat-led attack simulations, crisis exercises, and exposure scoring, especially when free on-premise core use is enough to get started. Its central advantage is joining technical validation with human-response readiness. Look elsewhere if you need only a narrow simulation tool or cannot justify Enterprise’s custom pricing for cloud deployment, advanced governance, or vendor-backed support.