Recorded Future cost vs self-hosted OpenCTI and MISP: where the savings actually come from
The saving depends on what your Recorded Future subscription actually buys. If a renewal or pricing change has pushed the cost up, the first question is whether you are paying for the platform (portal, search, alerting, API access and integrations), for intelligence collection (proprietary research, analyst reporting and curated risk data), or for both bundled together. Platform costs can move to self-hosted software. Collection costs usually cannot, because neither OpenCTI nor MISP gathers proprietary intelligence of its own. Pull the order form, the module list and the API and feed entitlements from your own contract and map each line to one of those two groups. Recorded Future's price cannot be estimated from the facts available here, so do not benchmark against any figure from outside your agreement.
The licenses are not the cost. *OpenCTI Community Edition* is licensed under Apache 2.0 and *MISP* under AGPL-3.0, so neither carries a license fee for the core software. Running either platform is a different matter. OpenCTI needs an Elasticsearch or OpenSearch cluster, Redis, RabbitMQ, S3-compatible storage such as MinIO, platform nodes and worker capacity, and its LTS releases require a specific license key, which makes Enterprise Edition features and LTS support separate line items to price. MISP runs on Ubuntu with MySQL or MariaDB and Redis, with PostgreSQL support arriving in the 2.5 line. Ask each vendor or partner to quote hosting, backup, high availability, upgrades and the Enterprise license, if you need it, as separate lines, and check whether the quote includes staff time for patching and connector maintenance.
The costs that recur most often surprise buyers. Connector upkeep, feed ingestion and fixing broken imports after upgrades take analyst and engineer hours every month, and that time is the largest unpriced item in most comparisons. Open feeds such as default MISP feeds need someone to decide which ones to keep, tune false positives and retire stale indicators. Before you commit to a cutover, record how many hours your team spends on Recorded Future work today, confirm which commercial feeds you will keep for coverage gaps, and ask any implementation partner for a written scope that lists who maintains each connector and feed after go-live.
Which cost components change when you self-host
This table compares each cost component of a Recorded Future subscription with the components of running self-hosted OpenCTI or MISP. Read the one-time and recurring labels first, then check the supporting facts before estimating your own totals, since no price figures are given here. The main takeaway is that the subscription fee is replaced by infrastructure, people and feed costs that you control and must budget for.
| Cost component | Recorded Future | Self-hosted OpenCTI or MISP |
|---|---|---|
| Platform licence or subscription | Recurring subscription covering the intelligence service and its modules. Ask the vendor which modules are bundled and which are priced separately. | Software licence is free: OpenCTI Community Edition is Apache 2.0 and MISP is AGPL-3.0. OpenCTI Enterprise Edition carries its own licence, so check whether you need it for SSO, audit logs or playbooks. Recurring if you buy Enterprise support or LTS keys. |
| Compute and storage infrastructure | None on your side. Hosting is handled by the vendor. | Recurring. OpenCTI documents at least 2 cores and 8 GB RAM for the platform, 2 cores, 8 GB RAM and 16 GB SSD for Elasticsearch or OpenSearch, and recommends one platform node for every 3 workers. MISP sizing depends on event volume and is set in your own environment. |
| Search, cache, queue and object storage | None on your side. | Recurring to run. OpenCTI needs Elasticsearch 8.0 or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later and S3-compatible storage such as MinIO. MISP uses MySQL or MariaDB and Redis, with PostgreSQL support in 2.5.47 under its new migration system. |
| Connector upkeep | Enrichment and Recorded Future connectors are supplied with the service. Confirm what access the subscription grants. | Recurring engineering time. OpenCTI runs import, enrichment, export and stream connectors as separate services, and each needs monitoring and version alignment after upgrades. MISP feeds and sync partners need the same attention. |
| Analyst curation of open feeds | Largely reduced, since the vendor collects and scores much of the data. Some analyst review remains. | Recurring and usually the largest internal cost. Teams select, deduplicate, score and expire open feeds. MISP ships default feeds and galaxies, and OpenCTI connects to MITRE ATT&CK, but both need someone to decide what is trusted and what is retired. |
| Commercial feeds kept alongside | Included in the subscription or sold separately. Confirm with the vendor. | Optional recurring fee per feed. Many teams keep one or two commercial feeds and run the platform themselves, so the saving depends on how much of the subscription you replace. |
| Implementation and migration | None beyond onboarding into the vendor portal and API tokens. | One-time. Covers installation (MISP 2.5 is recommended on Ubuntu 24.04 with its installer), platform setup, SSO, sharing group design and data import. Ask for a fixed-scope written plan that names each deliverable. |
| Upgrades and patching | Handled by the vendor as part of the service. | Recurring. OpenCTI non-LTS releases ship from daily to weekly, while LTS releases come every 6 months and are supported for 1 year, with LTS builds requiring a specific license key. MISP 2.4 is end of life, so upgrades to 2.5 are needed for supported security fixes. |
| Support and internal skills | Vendor support is included in the contract. Confirm response terms in writing. | Recurring. You need staff or a retained partner who can run containers, databases, message queues and the MISP or OpenCTI APIs. Community support is available, while paid support depends on the chosen vendor or partner. |
What moves the comparison up or down
The cost gap between Recorded Future and a self-hosted OpenCTI or MISP stack is set by who uses the platform, how much data it holds, and which commercial feeds stay in place. Edition choice, availability targets and in-house skills then decide how much of the infrastructure and staff time is needed to run it.
Analyst and consumer count
Recorded Future is licensed around the people who use it, so seat or user counts in the current quote drive most of the subscription. OpenCTI and MISP carry no per-user license fee, but more analysts and downstream consumers mean more accounts, more SSO configuration, more reporting work and more load on the search and database tiers. Ask the vendor how seats, API use and consumers are counted, then model the self-hosted side against the same headcount.
Indicator volume and retention
Indicator counts and how long they are kept determine the storage and search footprint. OpenCTI relies on Elasticsearch or OpenSearch, MinIO and RabbitMQ, while MISP stores events in its database, so both grow with volume. Decide retention per data type before sizing, because keeping expired indicators for correlation costs more than keeping only active ones.
Commercial feeds kept alongside
Keeping any Recorded Future feed is the single biggest line that stays in the budget. Open feeds in MISP and OpenCTI reduce subscription spend only if the team accepts their coverage gaps. Price each commercial feed or risk list separately, since a feed kept for collection value may justify the platform cost on its own. Confirm which feeds are licensed for use inside a self-hosted platform and whether the license permits sharing outside the organization.
OpenCTI edition choice
The Community Edition is Apache 2.0 licensed and covers the core knowledge platform. Enterprise features such as audit logs, playbooks, organization-based segregation, full text indexing and SSO for OpenID, LDAP, SAML, certificate and header authentication fall under the separate Enterprise Edition License. If your auditors or identity team need these controls, request an Enterprise quote as a line item and do not assume the Community Edition covers them.
Availability and release cadence
Continuous intelligence feeds are only useful when the platform is up, so availability targets add redundancy to every component. OpenCTI LTS releases are supported for one year and receive only critical bug and security fixes after a one-month stabilization, so staying on a supported line requires a planned upgrade cycle. Define the outage tolerance and the upgrade window in writing before pricing high availability.
In-house skills for the stack
The cost of running either platform depends on who can operate it. OpenCTI needs people comfortable with search clusters, Redis, RabbitMQ, object storage and STIX 2 data modeling, while MISP needs PostgreSQL or MySQL administration, PHP application support and sync configuration between instances. Skills you lack are paid for either through an implementation partner, a retainer or new hires, so record which gaps exist before comparing totals.
What the OpenCTI stack asks of your infrastructure
Running OpenCTI means running a small stack, and the search layer and message queue are the parts that drive hardware and staffing cost. The documented dependencies are Elasticsearch 8.0 or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later, and S3-compatible object storage such as MinIO. The OpenCTI deployment overview gives baseline sizing of 2 cores and at least 8 GB RAM for the platform, 2 cores, 8 GB RAM and 16 GB SSD for Elasticsearch or OpenSearch, and at least one platform node for every 3 workers. Treat these as floors. Your own indicator volume, enrichment connector count and retention period determine the real numbers, so ask your team to size the search and worker tiers against a sample of your actual feed volume before ordering hardware or cloud instances.
MISP has a smaller footprint but its own dependencies. It is built on PHP with CakePHP, uses MySQL or MariaDB, and uses Redis. Since MISP 2.5.47, PostgreSQL is supported through a new database migration system, which matters if your organization standardizes on PostgreSQL and wants to avoid a second database engine. The recommended path for MISP 2.5 is Ubuntu 24.04 with the project's installer, with Docker images, RPM packages, an Ansible role and a Puppet module as alternatives listed on the MISP download page. Choose the database and install method before build, because switching later adds migration work. Confirm the supported database and PHP versions for your target MISP release with the project before you commit to an image or configuration.
How to build the comparison with your own numbers
This sequence turns the cost components on this page into a comparison your finance and security leads can check line by line. It ends with three- and five-year totals that show the difference with and without commercial feeds kept.
Pull the current Recorded Future contract
Ask your procurement or security lead to retrieve the current Recorded Future order form, renewal terms and the list of licensed modules, feeds and API access. Confirm the term length, the renewal date, any notice period, and whether the price includes services or only platform access. Record which modules are licensed for each team. The step is done when every recurring line in the contract is written in a single sheet with its end date, and nothing is left as a verbal assumption.
List every integration the subscription feeds
Inventory each SIEM, firewall, EDR, ticketing system, SOAR playbook and internal report that consumes Recorded Future data today, including API calls, risk list downloads and TAXII pulls. Name the owner of each integration and note whether it would need to be rebuilt against MISP or OpenCTI. Include the people who read the reports, since their workflow is part of what you replace. The step is done when you have a list of consumers and a rough rebuild or retain decision for each one.
Price your own infrastructure at your rates
Using your cloud or data center rates, price the compute, memory, SSD storage, backups, networking and any load balancing for a MISP instance and, if you plan it, an OpenCTI deployment. For OpenCTI, include the platform nodes, workers, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage. Separate non-production environments and keep the sizing aligned with the documented minimums and with your expected volume. The step is done when you have a monthly and annual infrastructure figure per environment, sourced from your own rate card.
Estimate analyst hours for open feed curation
Ask the analysts who will run the platform to estimate weekly hours for reviewing community and default feeds, tuning taxonomies and galaxies, handling false positives, and managing sharing groups and synchronization. Split the estimate between one-time setup work and recurring curation. Label the figure as your team's estimate, since it depends on the feeds you choose and the volume of your sector. The step is done when the hours are recorded per role and converted to annual cost using your internal loaded rates.
Add connector and upgrade effort
Budget the work to maintain connectors, such as the MISP, TheHive and MITRE ATT&CK connectors in OpenCTI, and to apply upgrades. For OpenCTI, factor in the release model: non-LTS releases ship frequently, while LTS releases require a specific license key and receive only critical and security fixes after stabilization. For MISP, factor in moving between major versions. Ask your platform partner or internal team to confirm the effort per upgrade cycle. The step is done when recurring maintenance hours and any license costs for LTS use are on the sheet.
Get implementation and migration as a fixed quote
Request a written, fixed-scope quote from your implementation partner covering deployment, integration, hardening, backup configuration, data migration and the cutover plan. Ask for the deliverables, the assumptions behind them, and what is excluded. DeployOpen agrees scope, deliverables and timelines in writing before work starts, and most engagements follow that model. The step is done when the one-time implementation cost is a single line item with a defined scope, and any ongoing support or retainer is listed separately.
Compare three- and five-year totals with and without feeds
Build two scenarios over three and five years. The first replaces Recorded Future entirely with self-hosted platforms and open feeds. The second keeps selected commercial feeds alongside MISP or OpenCTI. For each scenario, total the one-time costs and the recurring subscription, infrastructure, analyst and maintenance lines, then show the gap against the current contract. Flag what the cheaper scenario gives up, such as proprietary collection and analyst reporting. The step is done when both totals and their stated gaps are reviewed by security, finance and procurement together.
Which feeds you keep changes the bill
This option drops the Recorded Future subscription entirely and runs the platform on community and open feeds. The saving is the subscription fee itself, offset by the infrastructure to run the platform and the analyst hours needed to curate open sources. Costs recur through hosting, staff time and connector maintenance, while setup is largely one-time.
- Saved: the full subscription, plus any per-seat or API access charges tied to the portal.
- Given up: Recorded Future's own collection, proprietary risk scoring and analyst-written reporting. MISP brings community feeds and default intelligence feeds rather than that collection.
- Enrichment depth: expect thinner context on indicators than a commercial feed provides, so plan for more manual pivoting.
- Recurring cost: servers or cloud capacity, backups, upgrades and the time to review feed quality each cycle.
- Confirm: the exact cost of your current subscription and any contractual exit terms with Recorded Future before you commit.
Ask your team to inventory which Recorded Future outputs they actually consume, because that list determines whether this option is viable.
This option keeps a reduced commercial feed and places it inside self-hosted OpenCTI, which holds the knowledge graph, relationships and reporting. The bill shifts from a full platform subscription toward a narrower feed or enrichment agreement, plus the infrastructure OpenCTI requires. OpenCTI Community Edition is Apache 2.0, while Enterprise Edition adds audit logs, playbooks and SSO under a separate license, so check which edition your controls depend on.
- Saved: the platform and portal portion of the subscription, if the vendor agrees to a feed-only scope.
- Given up: the Recorded Future interface, its analyst workflow and some proprietary enrichment depth that does not transfer through connectors.
- Infrastructure: OpenCTI depends on Elasticsearch or OpenSearch, Redis, RabbitMQ and MinIO, with worker and connector capacity added as feed volume grows.
- Edition cost: Enterprise features such as SSO and audit logging carry their own license terms, so price them in as a recurring item.
- Confirm: with the vendor, whether a feed-only or connector-based license exists, and the price for that scope.
Before you negotiate, ask for the scope in writing so you can compare the remaining fee against the platform costs on this page.
This option runs self-hosted MISP as the store and sharing layer and keeps one commercial feed alongside it, typically for the collection your team cannot source elsewhere. MISP is AGPL-3.0 licensed, so the software carries no license fee, and its community synchronization and sharing groups reduce what you need to buy for distribution. The remaining cost is the feed itself, the server and the staff who maintain MISP.
- Saved: the platform subscription and any seat-based charges, leaving only the feed fee.
- Given up: proprietary collection and analyst reporting that the commercial feed does not cover, and the single-vendor enrichment path.
- Feed ingestion: MISP supports STIX and other formats, so confirm the feed delivers in a format your import process accepts.
- Recurring cost: the feed fee, MISP server operations, upgrades and the sync configuration with partner communities.
- Confirm: the remaining feed price, its usage terms for sharing outside your organization, and whether the vendor permits redistribution through MISP sharing groups.
The feed contract often sets the true floor of this option, so review its redistribution clauses before you assume the saving.
Questions buyers ask before comparing costs
Is the saving real if we already run Elasticsearch or OpenSearch?
Partly. OpenCTI needs Elasticsearch 8.0 or OpenSearch 2.9 or later, along with Redis 7.1 or later, RabbitMQ 3.11 or later and S3-compatible storage such as MinIO. If your team already operates an Elasticsearch or OpenSearch cluster, the saving is mainly the license and subscription cost, while you still pay for added capacity and for the platform nodes, workers and connectors. The documented sizing starts at 2 cores and 8 GB RAM for the platform and 2 cores, 8 GB RAM and 16 GB SSD for the search tier, and recommends at least one platform node for every 3 workers. Confirm with your platform team whether the existing cluster can take the extra index volume and whether it is sized for production use. Ask any quote to show the new components separately from the shared ones.
How long does a migration take, and what drives the timeline?
No duration figure is supplied for this migration, so treat any number you hear as a question to ask rather than a fact. The main drivers are the number of feeds and connectors in use, how much history you need to carry over, how many sharing groups or communities must be reconnected, the state of your SIEM and firewall integrations, and how many analysts must be trained on the new workflow. Staged cutovers, where Recorded Future feeds keep running while MISP or OpenCTI takes over one use case at a time, usually take longer but reduce risk. Ask for a written plan with phases, exit criteria and dependencies before accepting a timeline.
How much work do our own engineers and analysts need to put in?
Expect the internal effort to cover platform ownership, data curation and integration. Platform engineers handle hosting, upgrades, backups and access control. Analysts decide which open feeds to trust, tune correlation and sharing rules, and review enrichment output. MISP's default feeds and galaxies reduce starting work, but someone still has to decide which feeds stay enabled and how false positives are handled. OpenCTI Enterprise Edition features such as SSO and audit logs may require configuration effort, and OpenCTI LTS releases require a specific license key. Ask your implementation partner to list every role, the hours each role is expected to give, and which tasks transfer to your team at handover.
Can our analysts run the platform without outside help?
Many teams can run day-to-day operations in house, especially where a team already operates Linux servers, containers and a search cluster. Outside help is most useful for the initial build, hardening, connector setup, backup design and upgrade planning. MISP 2.5 is recommended on Ubuntu 24.04 with the provided installer, and Docker images, Ansible roles and Puppet modules are listed as other install options, which gives your team a choice of tooling. OpenCTI deployments have more moving parts, including workers, RabbitMQ and Redis. Whether your staff can take this on depends on their current skills, so ask a partner to assess that gap in writing before deciding.
Which Recorded Future data cannot be replaced by open source?
The main gap is Recorded Future's own collection and analyst reporting. MISP and OpenCTI store, correlate and share intelligence, and both can ingest feeds, but they do not produce the proprietary collection, finished analyst reports or the risk scoring that come from Recorded Future's research team. Open feeds, community sharing and default MISP feeds cover parts of this need, but coverage and freshness will differ. Connector-based access to Recorded Future data, if you keep a subscription, depends on the entitlements in your contract. Before you cut back, list the risk lists, report types and API uses your teams depend on, and confirm with Recorded Future which of them your current license includes.
How do we get a quote from a fixed written scope?
Start by writing down the scope in terms of platform, feeds, integrations and deliverables. DeployOpen works from a written scope, agreed before work starts, and does not publish a price list, so a quote follows from that document. A useful scope names the platform (MISP, OpenCTI or both), the hosting environment, the connectors and SIEM or firewall integrations, the sharing relationships, the handover items and the documentation you expect. It should also state what is out of scope, such as proprietary collection or analyst reporting. Ask for the quote to split one-time implementation effort from recurring support and upgrades, so you can compare it with your current subscription.
What recurs after go-live, and what is one-time?
One-time costs include the initial build, hardening, data migration, connector setup and staff training. Recurring costs include infrastructure, backups, monitoring, operating system and application upgrades, and any commercial feeds or licenses you keep. OpenCTI has a non-LTS release cadence from daily to weekly, and LTS releases arrive every 6 months with one year of support each, so a planned upgrade window is a recurring task. MISP 2.5 is the recommended line, and MISP 2.4 is end of life with security fixes only. Ask a quote to show recurring support and upgrade effort as a separate line, so you can see what continues after the first year.
What the saving does not cover
Moving the platform layer to self-hosted OpenCTI or MISP does not replace the collection that Recorded Future performs. MISP brings community and default feeds, not a vendor's own collection. Its galaxies, taxonomies and default feeds are useful, but they are assembled by others and their coverage, timeliness and depth of context will differ from Recorded Future's research staff and sensor network. OpenCTI is a knowledge platform: it stores, correlates and visualizes STIX 2 objects and connects to sources, but it does not gather intelligence on its own. Before you decide, list every Recorded Future data product your team uses today, such as risk lists, alerting, or investigation content, and map each one to a named replacement or to an accepted gap.
Several items leave with the subscription and need explicit confirmation against your current contract. These typically include proprietary research and analyst reports, access to the Recorded Future portal and its investigation tooling, and any analyst-driven briefings or customized intelligence requests. Vendor support terms also need checking: confirm the response times, escalation paths and any service levels written into your agreement, because a self-hosted platform shifts that responsibility to your own team or to a support partner. Ask Recorded Future what data export rights you hold on termination and whether the license covers the use of exported indicators in a self-hosted system, including any sharing with partners.
Treat the gap list as an input to the business case, not a footnote. Ask your procurement and legal teams to confirm three points in writing: which intelligence sources are included in the current subscription, what happens to exported data at the end of the term, and whether any commercial feed you keep will be licensed for use inside OpenCTI or MISP. Only after those answers are known can you compare the subscription saving against the analyst hours and any retained feed costs that remain.
How DeployOpen scopes a fixed-price implementation
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For a Recorded Future cost comparison against OpenCTI or MISP, we agree the scope in writing first so the cost components you compare are the ones you actually run.
How we scope
- We confirm which Recorded Future products, feeds and API access you hold today before estimating platform work.
- We list the hosting, connector, feed and analyst components so each cost line in your comparison has a named owner.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work starts.
- We identify which open feeds and any commercial feeds you keep, so the scope reflects what you will still pay for.
How we build
- We deploy the chosen platform in your cloud account, data center or air-gapped network, using your sizing and sharing requirements.
- We configure connectors for the feeds in scope and document the update cadence each one needs to run.
- We test ingestion, sharing groups, authentication and backups against the written acceptance criteria before go-live.
- We harden the deployment and record the configuration so the running cost matches the design.
How we hand over
- You receive architecture, configuration, runbook and data flow documentation for the platform and its connectors.
- We walk your operators through daily feed checks, connector failures and user access changes.
- We prepare the evidence your internal reviewers or external auditors may ask for, without issuing any audit report or certification.
- Handover covers the open items, upgrade path and the decisions still owned by your team, such as analyst staffing.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- A retainer can cover platform upgrades that follow the OpenCTI or MISP release schedule you choose to run.
- Ask any quote to separate one-time implementation work from recurring retainer and infrastructure costs.
- We confirm the support scope in writing so your team knows what is covered and what remains internal.
