Does self-hosting Cyware Intel Exchange cost less?
Self-hosting usually removes the hub subscription, but it adds infrastructure, implementation and staffing, so the answer depends on how many member organizations connect, how much intelligence moves through the hub and what skills your team already has. Start the review by listing every cost line you pay today: the hub subscription, any fees tied to connected member instances, storage and support. Then list what you would carry yourself: servers or cloud accounts, backups, upgrades, an implementation partner if you need one, and the analysts who run the platform. Software licensing is rarely the largest line in a self-hosted case.
The software terms differ, and they matter for budgeting. MISP is licensed under AGPL-3.0, so its code carries no per-seat or per-instance license fee. For OpenCTI, the Community Edition is licensed under Apache 2.0, while the Enterprise Edition uses its own license and adds features such as audit logs, playbooks, organization-based segregation and SSO options. Ask whether your requirements need Enterprise features, and if so, request that license cost in writing. OpenCTI also has real infrastructure needs. Its documented sizing gives the platform at least 2 cores and 8 GB RAM, Elasticsearch or OpenSearch 2 cores, 8 GB RAM and 16 GB SSD, and at least one platform node for every 3 workers, on top of Redis, RabbitMQ and MinIO. Those components recur every month and must be sized for your data volume.
When you request quotes from an implementation partner or your internal team, ask for each component separately: one-time design, migration and integration work; recurring hosting, monitoring, backup and upgrade effort; and member onboarding support. Confirm which MISP version and installer path the quote assumes, since MISP's download page recommends MISP 2.5 for new deployments. Test the staffing assumption with an illustrative workload before you sign, because the main cost driver is usually the people who run the sharing platform, not the software.
Which cost components change when you self-host
This table sets Cyware Intel Exchange subscription terms against the no-license-fee cost of self-hosted MISP and OpenCTI, component by component. Read each row as who gets paid, whether the cost is one-time or recurring, and what you must confirm in a written quote. The main takeaway is that licence fees are only one line; staffing, infrastructure and upgrades recur on both sides.
| Cost component | Cyware Intel Exchange (confirm with Cyware) | Self-hosted MISP and OpenCTI |
|---|---|---|
| Hub or platform licence | Recurring subscription for the hub; confirm term, user tiers and renewal uplift in writing | MISP is AGPL-3.0 with no licence fee. OpenCTI Community Edition is Apache 2.0. Recurring cost is zero for licence |
| Member instance licensing | Confirm whether each connected member instance or community member is charged separately, and for how long | No per-member licence. Each MISP or OpenCTI instance you host adds infrastructure and support load, not a fee |
| Server infrastructure | Largely absorbed by the vendor for SaaS; confirm hosting, data residency and any on-premises variant costs | Recurring: compute, storage and backups in your cloud or data centre. OpenCTI needs Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage |
| Implementation and installation | Usually bundled into onboarding; confirm what professional services are extra | One-time: installation on Ubuntu 24.04 via the MISP installer or other supported methods, plus hardening and integration. OpenCTI adds connector setup |
| Data migration | Export of intelligence from the hub is a vendor or internal task; confirm export formats and any fees | One-time: converting exports to MISP or STIX 2.1 bundles, rebuilding sharing groups and feeds, and validating imports |
| Enterprise features and licence keys | Included in subscription tiers; confirm feature parity | Optional. OpenCTI Enterprise Edition requires a paid licence, and OpenCTI LTS releases require a specific LTS license key. Confirm both with Filigran |
| Upgrades and patching | Included with subscription; confirm upgrade windows and member impact | Recurring: MISP 2.4 is end of life, so plan the move to 2.5. OpenCTI non-LTS releases ship often; LTS releases need a planned upgrade cycle |
| Internal staff and support | Vendor support is part of the subscription; confirm response terms and escalation | Recurring: people to run the server, manage member onboarding and keep sharing trust. Commercial support is optional through a retainer |
What moves the cost comparison up or down
Self-hosted MISP and OpenCTI costs are shaped by how many organizations sync, how much data flows, which features you need, and who runs the platform. Each driver below changes the infrastructure and staffing you carry, so check them against your own sharing model before comparing any subscription quote.
Member organizations and sync topology
Every member instance you connect adds sync traffic, onboarding work and a trust relationship you must maintain. In MISP, sync between instances is a core feature, so the number of partners, the number of hubs and whether members run their own servers all change your footprint. Cyware charges for the hub and any connected member instances, so ask the vendor to price each member separately and compare that with the MISP servers you would host. Confirm which members will run their own MISP and which will connect to yours.
Daily indicator volume
Indicator volume drives storage, search load and worker capacity more than user count does. For OpenCTI, the Elasticsearch or OpenSearch node is the component that grows with data, and its documented minimum is 2 cores, 8 GB RAM and 16 GB SSD. Ask Cyware how its quote scales with ingested indicators, and load-test your expected feed volume before sizing any self-hosted cluster. An illustrative feed of a few hundred thousand indicators a day will need far more disk than a feed of a few thousand.
Enterprise features and identity options
OpenCTI Community Edition is Apache 2.0, but audit logs, playbooks, organization-based segregation and several SSO methods sit in the Enterprise Edition under a proprietary license. If you need SAML, LDAP or certificate authentication with audit trails, budget for that license in OpenCTI, and compare it with Cyware's included features. MISP handles OIDC through a plugin, so confirm which identity provider you use and whether its plugin meets your audit requirements before you commit.
Availability and backup requirements
A sharing hub that members depend on needs redundancy, tested backups and a defined recovery time. OpenCTI runs several services (platform, workers, RabbitMQ, Redis, search and S3-compatible storage), so high availability multiplies the nodes you pay for and operate. MISP is simpler to run as a single server but still needs database backups and a standby plan. Ask Cyware what uptime and recovery commitments its subscription includes, and write your own targets before you size the hardware.
Required sharing formats
The formats your partners consume determine how much conversion and testing you own. MISP exports MISP JSON, STIX 1 and 2, OpenIOC, CSV and NIDS rules for Suricata, Snort and Zeek, which covers most sharing communities. OpenCTI is built on the STIX 2 standard and reaches other formats through connectors. If a member needs STIX 1 or OpenIOC, plan the conversion work and its testing. List every format your members use today and confirm which ones Cyware exports natively.
Existing team skills and install paths
Staff who already know PHP and MySQL or MariaDB can run MISP with the Ubuntu 24.04 installer, Docker images, RPM packages, Ansible or Puppet. Teams that know Elasticsearch, Kubernetes and message queues will find OpenCTI's stack familiar, but it has more moving parts to patch and monitor. Skill gaps cost money through slower onboarding, contractor time or turnover risk. Count the people who can carry the platform after launch, and ask Cyware who supports you when your own team is not available.
How to build the comparison with your own numbers
This sequence turns the Cyware cost question into a side-by-side model built from your own contracts, instance inventory, traffic and staff time, so both options are priced over the same period.
Gather your current Cyware contracts and invoices
Collect the Intel Exchange order form, the current invoices and every member or partner agreement that refers to fees, seats or connected instances. Finance or procurement usually holds these, and the platform owner should check that nothing is missing. Ask Cyware in writing for the terms that govern any member-instance fees, including how they are billed, how they change at renewal and what happens if a member leaves. Confirm which features sit in which subscription tier, because a feature you rely on may belong to a higher tier. The output is a single register of recurring charges, renewal dates and notice terms.
List every connected instance and member
Build an inventory of each hub connection, member instance, feed and sharing relationship that Intel Exchange currently serves. For each one, record who operates it, which data flows in and out, which formats they use (for example STIX, the MISP format or CSV), and which integrations depend on it, such as SIEM, SOAR or TAXII consumers. This list tells you how many sharing endpoints a MISP or OpenCTI deployment would need to replace or re-establish. The check that closes this step is a signed-off inventory that the community or SOC owners have reviewed.
Measure indicator volume and sharing traffic
Pull counts from your own logs and platform reports for a representative period: indicators ingested per feed, indicators shared outbound, sync or API calls per day and the size of the largest bundles or events. Note peaks as well as averages, since they drive sizing for storage and search. Where the vendor reports usage, ask for the same figures so your numbers can be checked against theirs. The output is a volume baseline with the assumptions written next to each figure, which you will reuse when you size the self-hosted stack.
Price the self-hosted infrastructure
Price the servers, storage, backup and network capacity in your own cloud account or data center for each option you are evaluating. OpenCTI's documented sizing lists minimum cores and memory for the platform and for Elasticsearch or OpenSearch, and it requires Redis, RabbitMQ and S3-compatible storage, so include each of these components. MISP is typically run on a single Ubuntu 24.04 host with MySQL or MariaDB and Redis, though larger communities often split roles across hosts. Use your own unit prices from your cloud or facilities team, and record one-time setup costs separately from the recurring monthly or annual costs. The output is a per-component infrastructure table for each platform.
Request written migration and implementation quotes
Ask each candidate services provider, including DeployOpen if it fits your scope, for a written quote based on the same scope statement. The scope should name the data to migrate, the sharing groups and member onboarding to rebuild, the connectors or feeds to recreate, the integrations to re-point, testing and cutover support, and the documentation you need to keep. Ask for the deliverables, assumptions and exclusions in writing, along with how change requests are priced. The output is a comparable set of one-time quotes that cover the same work, so the figures can be set against each other.
Assign monthly staff hours for run and support
Estimate the recurring staff effort for each option, in hours per month, split into upgrades, monitoring, backup checks, member onboarding and user support. For MISP, consider the upgrade path between releases and any changes to sharing groups or sync partners. For OpenCTI, include the LTS license key process, the patch cadence for LTS hotfixes and the management of connectors and workers. Ask staff who already run similar platforms to validate the hours, and record who is accountable for each task. The output is a monthly effort table that you can convert to cost with your own internal rates.
Compare one-time and annual totals over one period
Place every figure on the same time horizon, for example a three-year view, and separate one-time costs (migration, implementation, initial hardware, training) from recurring costs (subscriptions, member-instance fees, infrastructure, support retainers and staff time). Model the current Cyware path and each alternative with the same volume and member assumptions, then run a sensitivity check on the drivers you know are variable, such as member count or indicator growth. Record the assumptions beside the totals so that finance and the platform team can challenge them. The closing check is a single comparison sheet that procurement and the security leadership have reviewed.
Where MISP and OpenCTI cost differently to run
MISP is a sharing-first platform, so its largest running cost is usually the sharing relationship itself. Each MISP instance is a node in a trust network. Synchronization between instances, distribution levels and sharing groups all have to be configured, monitored and kept working as members join, leave or change their connections. Those tasks fall to whoever runs the server, and they recur every month. Ask any vendor or community you are considering what they expect the hub to carry, and ask how many member instances they plan to synchronize with. Both answers drive staffing more than licence fees do. MISP itself is AGPL-3.0 licensed, and its taxonomies and galaxies carry separate CC0 1.0 or BSD-2-Clause terms, so confirm the licence on each data bundle you intend to redistribute.
OpenCTI is an analysis platform with a heavier infrastructure footprint. Its documented dependencies are Elasticsearch 8.0 or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later and S3-compatible storage such as MinIO. Its worker model means the platform, Python workers and connectors each scale separately, and the sizing guidance recommends at least one platform node for every three workers. Cost therefore sits in more components, each with its own patching and capacity planning. MISP's installation path is simpler by comparison: MISP 2.5 is recommended on Ubuntu 24.04 with the provided installer, and MISP 2.4 is end of life, so any new deployment should target 2.5. Plan the upgrade path for any existing 2.4 instance now, since the project advises against installing new 2.4 instances.
Cost profile by deployment option
A single MISP instance suits a small community or an internal sharing group that needs to collect, store and distribute indicators without running a federation. The software itself carries no license fee, since MISP is licensed under AGPL-3.0. The costs sit in the server, the operating system, the database, the staff time to patch and back it up, and the work of onboarding and reviewing feeds. MISP 2.5 is the recommended version for new deployments, and the project's download page recommends Ubuntu 24.04 with the provided installer.
- Infrastructure: One virtual machine or a small set of machines, sized for the event volume and feed count you expect. This is usually a one-time build plus a recurring hosting line.
- Operations: Patching the operating system and MISP, rotating credentials, checking feed synchronization and restoring from backup. This is the largest recurring item and often falls to a single engineer.
- Upgrades: Moving between MISP releases is a planned task. Confirm the upgrade path on the project's release page before you commit to a version.
- Feeds and content: Default feeds, taxonomies and galaxies are shipped with MISP, but tuning them to your sector takes analyst time.
Confirm with your team who owns the server after go-live, and ask any implementation partner to price patching and backup as a retainer separate from the build.
A MISP hub connects several member instances through synchronization, with distribution levels and sharing groups controlling what each member sees. The hub is the most cost-sensitive option because its value depends on members staying connected. Each member instance adds its own infrastructure, upgrades and support obligations, and the hub operator carries the governance work of trust, onboarding and access decisions. The MISP features page describes automatic synchronization between instances and granular sharing controls, which reduces manual exchange but adds configuration to maintain.
- Hub infrastructure: A central instance with higher availability expectations, since members rely on it for sync.
- Member instances: Each member may run its own MISP server or connect a lighter client. Ask which model your members will use, because it changes who pays for hosting.
- Governance: Sharing agreements, sharing group membership and reviews of who can publish. These are staff hours that recur as membership grows.
- Member support: Helping members with sync errors, certificates and version drift. This is the cost most often missed in a comparison with a hosted subscription.
Ask what Cyware charges for connected member instances today and whether member-side licensing is per organization or per seat, so the comparison matches your membership model.
An OpenCTI node is typically used by analysts who need a knowledge graph of STIX 2 objects, relationships and connectors to MITRE ATT&CK, MISP and TheHive. The Community Edition is licensed under Apache 2.0, so the license cost is zero, but the stack is heavier than a single MISP server. The platform depends on Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage such as MinIO, and it runs Python workers. The deployment overview lists minimum sizing for each component, and the platform needs at least one platform node for every three workers.
- Dependent services: Five or more services to install, patch and monitor, each with its own upgrade path.
- Release cadence: Non-LTS releases ship from daily to weekly. LTS releases follow a 6-month cycle with one year of support each, and LTS use requires a license key from the vendor.
- Enterprise features: Audit logs, playbooks, organization-based segregation and SSO options sit in the Enterprise Edition under a separate license. Confirm whether you need them before you budget.
- Analyst time: Connector setup and data modeling are ongoing work that scales with the number of sources.
Confirm which edition and release channel you will run, and ask any quote to separate the infrastructure from the analyst time.
A combined setup uses MISP for sharing with the community and OpenCTI for analysis inside the SOC. This doubles the number of platforms you operate, but it can separate the cost of sharing from the cost of analysis. Each platform keeps its own infrastructure, upgrades and backups, while a connector or an export step moves intelligence between them. This model is common where a sharing hub must stay simple and analysts need a richer graph, though the integration itself is ongoing work.
- Two stacks: Separate infrastructure, monitoring and patching for MISP and OpenCTI, with the staff time that comes with both.
- Integration: The OpenCTI connector for MISP and any export or sync jobs need testing after each upgrade of either platform.
- Skills: Your team needs experience with PHP and MySQL or PostgreSQL for MISP, and with containers, Elasticsearch or OpenSearch and RabbitMQ for OpenCTI.
- Data flow rules: Define which intelligence is published to members and which stays internal, so sharing controls are enforced in one place.
Ask for a written split of effort between the MISP and OpenCTI workstreams, since the combined cost is the sum of two operating models rather than a single line item.
What migration and member support add to the total
Migration is a one-time cost, and it is usually the largest single line in the first year of a move away from Cyware Intel Exchange. The work covers exporting intelligence in STIX or MISP format, importing events and attributes into MISP or OpenCTI, rebuilding sharing groups and distribution levels, and re-creating each feed as a MISP feed or an OpenCTI connector. Whoever performs this work is paid for hours spent on data mapping, validation and cutover planning, so ask any implementation partner for a written breakdown by these tasks. Also ask how member integrations will be carried across, because a member's SIEM or ticketing hook that calls the old hub will break at cutover unless someone maps its endpoints and credentials to the new platform in advance.
Member support is a recurring cost that continues after the migration ends. Once a sharing community runs on MISP, your team or your provider will handle onboarding requests for new organizations, troubleshoot synchronization between instances when an event fails to replicate, and coordinate version upgrades so that every server in the community stays compatible. The volume of these requests depends on how many member organizations you host and how many run their own MISP servers, so count both before you budget. The MISP support page lists the community channels available to operators. Confirm in writing whether any paid support terms apply, what response expectations they set, and who is responsible for each class of incident before you sign anything.
Questions buyers ask before comparing costs
How much does a Cyware Intel Exchange subscription cost?
No Cyware price is supplied on this page, so you need to obtain the figure from Cyware in writing. Ask for the fee for the hub itself, then for each connected member instance or community seat that your model requires, and confirm what changes at renewal. Check whether the quote covers support tiers, additional data feeds, automation features and any hosting or dedicated deployment option. Those line items decide how much of the total is recurring, so compare the written quote against the components listed on this page rather than a headline number.
Can a small team run MISP on its own?
A small team can run MISP alone if it has someone comfortable with Linux, PHP-based web applications, database administration and regular upgrades. MISP 2.5 is the recommended version for new deployments, and the project recommends Ubuntu 24.04 with its provided installer, which lowers the initial build effort. Ongoing work includes applying MISP releases, managing the database and Redis, handling sync partners and keeping feeds and taxonomies current. Sharing communities also need someone to onboard members, review sharing groups and answer trust questions. If that work falls to one person, plan for cover during absence and treat upgrades as scheduled work.
What staffing does a self-hosted OpenCTI deployment need?
OpenCTI needs more platform components than MISP, so staffing depends on how many of them you run. The documented dependencies include Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage such as MinIO, along with the platform itself and Python workers. The deployment documentation recommends at least one platform node for every 3 workers, so worker count is a sizing driver. Plan for engineers who can operate search clusters, message queues and container platforms, plus analysts who manage connectors for imports and enrichment. Confirm the sizing for your data volume with Filigran's documentation before you commit to headcount.
How long does a migration from Cyware Intel Exchange take?
No migration duration is supplied on this page, so treat any timeline as something to agree in writing. The main drivers are the number of intelligence sources and feeds, the volume of historical data you need to keep, how many member organizations must move without breaking their integrations, and whether sharing groups and distribution levels must be rebuilt by hand. Playbooks that push intelligence to detection tools add testing time. Teams that run a parallel period with both platforms usually need more elapsed time than teams that cut over at once. Ask any provider for a plan that lists each of these drivers and the acceptance tests for each stage.
Should we hire outside help or migrate in-house?
The decision depends on how much platform and sharing experience your team already has and how many moving parts the migration includes. In-house work suits teams that already run Linux services, can take on sharing governance and can absorb a learning period. Outside help is worth pricing when you need a fixed scope for export, import, connector build-out, hardening and documentation, or when staff are already committed to operations. DeployOpen plans, implements, integrates, hardens, backs up and documents self-hosted platforms inside your own infrastructure, and most engagements are fixed-scope with deliverables and timelines agreed in writing before work starts. Ask any provider to split the quote into planning, build, migration, handover and ongoing support so you can see which parts you could keep in-house.
Do we need OpenCTI Enterprise Edition features?
Enterprise Edition is needed only if your requirements match features that the Community Edition does not cover. Filigran's documentation lists audit logs, playbooks, organization-based segregation, full text indexing, AI insights and SSO configuration for OpenID, LDAP, SAML, certificate and header authentication as Enterprise features. Community Edition is licensed under Apache 2.0, while Enterprise Edition uses a separate proprietary license. Check whether your community needs organization-level segregation, audit evidence or central SSO before you budget, and confirm the current feature split and license terms with Filigran. Also note that LTS releases require a specific LTS license key, so include that in the cost review.
Which MISP and OpenCTI costs recur after go-live?
Most recurring cost for either platform is staff time, infrastructure and support rather than software fees. The MISP software is licensed under AGPL-3.0, and OpenCTI Community Edition under Apache 2.0, so no licence fee recurs for those editions. Recurring items include virtual machines or cloud resources, storage, backups, monitoring, the time spent applying upgrades (MISP 2.4 is end of life, and OpenCTI LTS lines receive only critical and security fixes after stabilization), and any paid support or retainer you choose. Ask any vendor or provider to separate one-time build costs from these recurring items so you can compare the two sides on the same basis.
When self-hosting is the lower-cost choice
Self-hosting tends to be the lower-cost choice when the sharing community is large enough to justify a dedicated platform team, and when the organization already runs servers, backups and identity services that MISP or OpenCTI can use. In that situation the recurring cost is mostly staff time and infrastructure, and both scale with the community more slowly than a per-seat or per-member subscription. MISP is licensed under AGPL-3.0 with no license fee, and OpenCTI Community Edition is Apache 2.0, so the software line item is zero in both cases. Before you rely on that comparison, ask Cyware for its written pricing basis for the hub and for each connected member instance, and check whether the features your community needs sit in a paid tier, since OpenCTI Enterprise Edition features such as audit logs, SSO and organization-based segregation fall under a separate proprietary license.
Self-hosting is less likely to win when the member base is small, no one on the team can own upgrades and synchronization, or the organization requires vendor-managed uptime with a contractual SLA. A small community may spend more on staff time per member than it would on a subscription, because MISP's synchronization, sharing groups and upgrades still need a named owner. Likewise, if your governance requires a vendor to carry availability obligations, a self-hosted platform shifts that responsibility to your own operations or to a support partner. Confirm with Cyware what its service commitments cover, and confirm which of those obligations your own board or regulator expects you to keep.
Recommend a written scope and quote before committing. Ask the implementer to list the components in scope (hosting, MISP or OpenCTI deployment, connectors, sharing group design, member onboarding, backups, upgrades and monitoring), the one-time and recurring items for each, and the assumptions behind the member count and feed volume. Ask Cyware for its renewal terms and any charges tied to member instances. Compare both quotes on a three-year view of total ownership, and record who will run each recurring task. DeployOpen plans and implements these platforms on a fixed-scope basis, with the scope, deliverables and timeline agreed in writing before work starts.
How DeployOpen scopes a fixed-price implementation
DeployOpen plans and builds self-hosted MISP or OpenCTI inside your own infrastructure, so the cost of the sharing platform is set by a written scope rather than a subscription tier. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
How we scope
- We map your current Cyware hub, member instances, feeds and playbooks into a written inventory before any quote is issued.
- The written scope states which sharing groups, distribution levels and member connections are moved, and which stay with the existing platform.
- We agree which parts of the cost are one-time build work and which are ongoing support, so you can compare quotes on equal terms.
How we build
- We deploy MISP or OpenCTI in your cloud accounts, data center or air-gapped network, with the dependencies your chosen platform requires.
- Sharing rules, synchronization between instances and authentication are configured and tested against the scope before cutover.
- Feed ingestion, exports and integrations with your detection tools are rebuilt and checked against the outputs they replace.
How we hand over
- You receive documentation of the deployment, sharing configuration, backup procedures and upgrade steps written for your own staff.
- Your team runs a handover session covering daily operation, member onboarding and how to review sync and feed health.
- Compliance evidence and control records are prepared for your assessors, though independent auditors issue any audit report or certification.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the implementation.
- Upgrades follow the release life cycle of your chosen platform, and we confirm the current version and support status before each change.
- Ask any provider to state in writing which member, sync and upgrade tasks are included in the retainer and which are billed separately.
