Anomali cost vs self-hosted MISP and OpenCTI

Self-hosting costs more than the subscription when the people who run it are too few or too busy to keep feeds, connectors and sharing agreements current. The licence fee for MISP and OpenCTI is zero, but the staff time is not. Feed curation is the largest hidden item: someone must decide which open and commercial feeds to ingest, remove stale indicators, tune warning lists and galaxies, and check that sharing groups still match partner agreements. If that work falls to one analyst with other duties, the platform will drift even if the servers are healthy. Ask your team to estimate curation hours per week before comparing any quote with a ThreatStream renewal.

Several deployment choices move cost sharply. OpenCTI Enterprise Edition adds audit logs, playbooks, organization-based segregation, full text indexing, AI insights and SSO for OpenID, LDAP, SAML, certificate and header authentication, and it is licensed under the proprietary OpenCTI Enterprise Edition License, so you need a commercial agreement if you depend on those features. Air-gapped or sovereign deployments add the cost of moving feed updates across the gap, of offline patching and of keeping connectors current without internet access. High availability is the other driver: OpenCTI needs Elasticsearch 8.0 or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later and S3-compatible storage such as MinIO, and each of those clustered tiers needs its own redundancy, backup and monitoring.

The MISP project is co-funded by the European Union, but that funding does not give your organization a support obligation or an SLA. Community help through the MISP support channels is valuable, but a regulated operation still needs a named internal owner or a contracted partner for incident response, upgrades and security fixes. Confirm with your procurement team whether the support you need is covered by internal staff, a retainer or a fixed-scope engagement, and write that cost into the comparison from the start.

Threat intelligence vendors change hands, and the budget should expect it. Mastercard completed its acquisition of Recorded Future on December 20, 2024, after announcing the deal on September 11, 2024, and Dataminr announced on October 21, 2025 that it had signed a definitive agreement to acquire ThreatConnect. Neither change says anything about how any particular product will be priced, but both show that the owner, the roadmap and the commercial terms of a platform can shift during a multi-year contract. Anomali's ownership, product packaging and renewal terms are the points to confirm in your own file rather than assume will stay fixed.

Build that uncertainty into the cost model. Ask the vendor, in writing, for the renewal uplift cap, the notice period for price changes, the list of modules and feeds that are bundled versus priced separately, and what happens to premium feed entitlements if a feed is discontinued or repackaged. Then ask for an exit clause covering the export of indicators, STIX bundles, sharing agreements and audit history, with the format and timing of that export stated in the contract. An *exit plan* is a documented estimate of what it would take to leave, written before you need it, and it becomes a line in the comparison against self-hosted MISP and OpenCTI.

Self-hosted open source changes the risk profile rather than removing it. MISP is licensed under AGPL-3.0 and OpenCTI Community Edition under Apache 2.0, so the software you run does not depend on a single vendor's renewal decision. You still depend on the upstream projects, on Filigran's Enterprise Edition licensing if you need its features, and on whoever supports your deployment. Confirm the license terms that apply to each component in your stack, and keep a current copy of your configuration and data so a change in any one supplier does not become an outage.

Ask for a written fixed scope before any cost comparison is finalized, because the self-hosted figures only mean something once the components are named. The quote should list the servers and storage for each platform separately. For OpenCTI, that means the platform nodes, the Python workers (the documented guidance is at least one platform node for every 3 workers), Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage such as MinIO. For MISP, it means the application host, the database (MySQL or MariaDB, or PostgreSQL on MISP 2.5 where your team has confirmed it fits your standards), Redis and the backup target. Ask for each sizing assumption in writing, and confirm current minimums against the OpenCTI deployment overview and the MISP download page rather than relying on figures in a proposal.

Next, require an explicit connector list and curation estimate. Name every feed, MISP or OpenCTI connector, enrichment source and SIEM or firewall integration in scope, and state whether each one is built, configured, or only documented for your team to run. Ask how many analyst hours per week are assumed for feed triage, false-positive review and sharing decisions, and who owns that time after handover. On upgrades, request the handling for MISP release cadence and, for OpenCTI, the choice between regular releases and the LTS line. Confirm who holds the LTS license key, since LTS images require one, and whether the quote covers patching during the post-stabilization period when only critical and security fixes ship.

Finally, pin down support hours, response expectations, migration boundaries and exit terms. Ask which period is fixed-scope implementation and which period is an optional retainer, and what each includes. Require the migration boundary in writing: which ThreatStream exports, which indicators and feeds, which sharing partners and which integrations move, and which are the customer's responsibility. Ask for the handover documents, the admin credentials and infrastructure as code the customer keeps, and the conditions for ending a retainer. DeployOpen does not publish a price list, and a quote follows from the written scope, so the more precisely these items are defined, the more comparable the offers you receive will be.