Recorded Future vs OpenCTI: which to choose

Recorded Future or OpenCTI: which fits your threat intelligence team?

The decision turns on whether your team needs a content source, a platform, or both. Recorded Future sells analyst-grade collection, research and reporting, delivered through its own portal and API. OpenCTI is a self-hosted knowledge platform that stores, correlates and visualizes intelligence in a STIX 2 graph inside your own infrastructure. They are not interchangeable, so a renewal notice, a data residency rule or lock-in concern should first prompt you to separate what you pay for: the research or the place where it lives. Recorded Future fits teams that want vendor-produced collection and reporting and have little appetite to run a platform. Its Mastercard ownership, completed on December 20, 2024, is a change of corporate parent, so confirm with your account team whether terms, data handling or product roadmap have shifted for your contract.

Self-hosted OpenCTI fits when intelligence data must stay within your cloud accounts, data center or air-gapped network, when your team wants to own its knowledge graph and history, or when you already hold feeds you want to ingest and link. Running it means operating Elasticsearch or OpenSearch, Redis, RabbitMQ, MinIO, platform nodes and workers, and keeping connectors and the LTS license key current. Check the OpenCTI product life cycle documentation and the Enterprise Edition scope against the controls you need, such as SSO, audit logs and organization segregation, because some of these sit in the proprietary Enterprise Edition. Reading the OpenCTI deployment overview before you size hardware will show the operational footprint you are taking on.

Many teams end up with both: a commercial feed supplies collection and analyst reporting, and OpenCTI holds it alongside open sources and internal data. Write down which problem you are solving. If it is supply of finished intelligence, keep the content source and evaluate whether a platform change is needed at all. If it is custody, sharing and correlation under your own control, a platform decision comes first and the feed question can follow. Ask your team which data they cannot send to a third party and which analysts would need to change their daily workflow, then price both paths from a written scope.

Which option fits which scenario

This table matches common buyer situations to the option that fits better, and names the condition that makes each choice correct. Read each row against your own constraints: a row only applies when its condition is true for your organization.

Scenario	Better fit	Condition that makes it so
Renewal with a price change	OpenCTI with a reduced commercial feed, or OpenCTI with open feeds only	The renewal quote raises cost for the same entitlements, and your team can name which Recorded Future data it actually queries each week. Confirm the feed scope you can drop before the notice date.
Data residency mandate	Self-hosted OpenCTI or MISP	Regulation or contract requires indicators, case notes and sharing records to stay in your own cloud accounts or data centers. Confirm whether the commercial feed still sends queries or pulls data to a vendor-hosted service.
Air-gapped or OT network	MISP, with scheduled manual transfer	The network has no internet path, so enrichment must come from exported files crossing the gap. OpenCTI can also run offline, but its connector set and dependencies must be staged in advance. Confirm the transfer process and approval path with your security authority.
Small team without platform engineers	Recorded Future, or MISP on a managed installer	The team cannot staff the upkeep of Elasticsearch or OpenSearch, Redis, RabbitMQ and object storage that OpenCTI needs. MISP has a simpler single-application footprint, but someone still owns patching and sync.
Team that needs its own analyst reporting	Recorded Future for collection, OpenCTI for internal reports	Analysts require vendor-produced finished intelligence and proprietary collection. OpenCTI stores and links your own reports and objects, but it does not produce the collection that feeds them.
Team with existing open feeds and a sharing community	MISP, possibly with OpenCTI alongside	You already consume open or community feeds and exchange indicators with peers or an ISAC. MISP synchronization and sharing groups fit this pattern, and Recorded Future can be kept only if a specific gap remains.
Need for a graph of relationships across intelligence objects	OpenCTI	Analysts must traverse actors, campaigns, malware and indicators as a knowledge graph. OpenCTI is built on STIX 2 with a GraphQL API for this, and MISP's correlation focuses more on attribute matches.
Enterprise governance, audit and segregation needs	OpenCTI Enterprise Edition or Recorded Future, after checking licensing	Auditors expect audit logs, organization-based segregation and SSO for every user. Several of these sit in OpenCTI Enterprise Edition under its separate license. Confirm the feature set against your control requirements.

What Recorded Future and OpenCTI each actually are

Recorded Future is a commercial intelligence service, and OpenCTI is a knowledge platform. Recorded Future is owned by Mastercard, and the acquisition closed on December 20, 2024, after being announced on September 11, 2024. Its value comes from its own collection and analyst content, which the vendor gathers, processes and delivers through its portal and APIs. You pay a subscription for that content and for the access to it. Before you compare anything, confirm with the vendor which modules, data sets and API entitlements your current contract includes, because those define what you are actually buying.

OpenCTI is designed and developed by Filigran. It stores, correlates and visualizes intelligence structured on the STIX 2 standard, and it gives you a web application and a GraphQL API to work with that data. It holds no collection of its own. Its contents come from the sources you connect, such as feeds, MISP, TheHive or the MITRE ATT&CK connector, and from the analysts who write into it. Its Community Edition is licensed under Apache 2.0, and its Enterprise Edition adds features such as audit logs, playbooks and SSO options under a separate license. Confirm which edition your team needs before you budget for it.

Because one sells content and the other organizes content, the two are not like-for-like products. The useful question is not which one is better but what your team needs to buy: collected intelligence, a platform to hold and share your own intelligence, or both. Map your current Recorded Future usage to those three categories. Where the work is mostly reading vendor reports and pulling indicators, you will still need a source of collection. Where the work is storing, correlating and sharing indicators across teams, an open platform can take over that role while you decide what content to keep.

How Recorded Future and OpenCTI compare on each capability

This table compares Recorded Future and OpenCTI across nine capabilities, from collection and reporting to APIs, integrations and partner sharing. Read the Recorded Future column as what the subscription provides, and confirm the specifics in your contract. The main takeaway is that OpenCTI organizes, searches and shares intelligence but does not collect it, so the two are often used together.

Capability	Recorded Future	OpenCTI
Intelligence collection	Vendor-run collection under the subscription. Confirm sources and coverage in your contract.	No proprietary collection. Ingests data from feeds, MISP, TheHive and other connectors you configure.
Analyst reporting	Vendor analyst reports and intelligence products. Confirm which report types your subscription includes.	Lets your team author and manage reports linked to STIX objects. Content is written in-house.
Search and graph	Search across the vendor's intelligence portal. Confirm the query and export limits in your plan.	Full text indexing on Elasticsearch or OpenSearch, with a graph of relationships between STIX objects.
STIX 2 data model	Exports risk lists and collections in STIX. Confirm the STIX versions and fields delivered.	Data is structured on the STIX 2 standard, so objects and relationships stay portable.
API access	Vendor API with token-based access. Confirm rate limits and endpoints covered by your license.	GraphQL API for the platform, plus connector interfaces for import and export.
SIEM and SOAR integration	Integrations depend on the vendor's supported products and your subscription. Confirm with the vendor.	Connectors and export paths you deploy yourself. Playbooks are an Enterprise Edition feature.
Enrichment	Enrichment of indicators from the vendor's own intelligence. Confirm what is included in your plan.	Enrichment through connectors you choose, including MITRE ATT&CK mapping. Feed choice remains yours.
Sharing with partners	Sharing is governed by the vendor's platform and terms. Confirm partner access rights in writing.	Organization-based segregation and sharing controls in Enterprise Edition. Confirm model against your needs.
Access control and audit	Role and access settings are set by the vendor's platform. Request the audit log options in writing.	Audit logs and SSO through OpenID, LDAP, SAML, certificate or header authentication in Enterprise Edition.

Where the two overlap in search, graph, enrichment and reporting

Recorded Future and OpenCTI both help teams search, connect and report on intelligence, but they start from different places: one sells collected and analyzed content, the other is a platform that organizes whatever data you bring. The four areas below show where each side is strong and the conditions under which OpenCTI's version is enough.

Search across indicators and reports

OpenCTI indexes STIX 2 objects through Elasticsearch or OpenSearch and exposes them through a GraphQL API, so analysts can query indicators, reports and threat actors from one place. Recorded Future's search covers a much larger body of collected and analyzed content. OpenCTI's search is enough when your own feeds, sharing partners and internal reports already hold the material you need. Check how much of your daily search depends on content you do not ingest yourself.

Relationship graph and pivoting

OpenCTI models relationships between actors, malware, campaigns and observables as a knowledge graph built on the STIX 2 standard, so analysts can pivot from an indicator to the actor and campaigns behind it. Recorded Future also links entities, but its graph draws on its own collection and entity coverage. Your graph is only as complete as the data you load, so confirm which relationships come from your sources and which come from the commercial feed before you rely on a pivot.

Enrichment and risk context

OpenCTI enriches observables through connectors, and a Recorded Future connector can push risk scores into it if you keep a subscription. The commercial service's advantage is the enrichment content itself: risk scoring, historical context and coverage of sources your team cannot collect directly. Open enrichment sources are enough when your alerting needs IP, domain and hash context that community and public feeds already provide. Ask the vendor which enrichment fields you would lose on cancellation.

Reporting and analyst narrative

OpenCTI can store, link and export reports as STIX objects, which suits teams that write their own intelligence products and distribute them internally. Recorded Future publishes finished analyst reporting and research that teams consume without producing it. OpenCTI's reporting is enough when your analysts already produce the narrative from primary sources. If you depend on vendor research for executive briefings, plan for analyst time or a separate reporting source.

Licensing and editions that change the decision

The OpenCTI Community Edition is licensed under Apache License 2.0, so the software itself carries no license fee. It suits teams with a platform engineering function that can run Elasticsearch or OpenSearch, Redis, RabbitMQ and MinIO, keep connectors current, and handle upgrades. Your costs sit in infrastructure, staff time and support you buy elsewhere, and they recur every year you run the platform. The Community Edition is a good fit when a single security team needs a shared knowledge graph and standard SSO is not a hard requirement.

Core capabilities: STIX 2 data model, GraphQL API, the web application, and connectors for MISP, TheHive and MITRE ATT&CK.
What is not included: the Enterprise-only features such as audit logs, playbooks, organization-based segregation and the SSO modes listed for the Enterprise Edition.
Who pays for what: you pay for servers, storage, backups and engineers. Filigran is not paid for the Community code.
Upgrade planning: non-LTS releases ship frequently, so plan a regular update cycle or an LTS track.

Confirm with Filigran which features ship in the Community Edition for your target release line before you design the access model.

Where the data lives and who controls the platform

Recorded Future keeps your query activity and intelligence consumption in its own cloud, while OpenCTI and MISP store everything in infrastructure you choose. The cards below cover what that shift changes for residency, identity, access, evidence and vendor dependency, and what your team still has to run.

Data location and residency

With a self-hosted OpenCTI or MISP, indicators, reports, sightings and analyst notes sit in your cloud account, data center or air-gapped network. That matters when a residency rule or sector regulator limits where threat data about your customers, partners or internal incidents may be processed. Check where the connectors send traffic, since enrichment connectors and feed pulls still reach external services. Map every outbound path before you call the data resident.

Hosting model and dependencies

OpenCTI runs as a platform, Python workers, connectors, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage such as MinIO. MISP runs on PHP, MySQL or MariaDB, and Redis, with a supported installer, Docker images and configuration management options. Your team owns sizing, failover, backups of each store and upgrades. Confirm which components your security operations group can operate after the project ends.

Identity integration

Recorded Future accounts are managed in its portal. OpenCTI Enterprise Edition supports SSO through OpenID, LDAP, SAML, certificate and header authentication, and MISP can authenticate through its OidcAuth plugin. Decide which identity provider is authoritative, how roles map to groups, and how leavers lose access to both the platform and its API tokens. Confirm which of these methods your chosen edition supports before design starts.

Audit logs and access control

Shared intelligence needs clear answers to who viewed, changed or exported a record. OpenCTI Enterprise Edition includes audit logs, organization-based segregation and playbooks, while MISP uses distribution levels and sharing groups that can be set down to individual attributes. Your team must define those rules, review them on a schedule and forward logs to your SIEM. Confirm how log retention and export work in the edition you select.

Compliance evidence

Assessors often ask for evidence that access is reviewed, changes are logged and backups restore. Self-hosting gives you those records directly, but it also makes them your responsibility. DeployOpen can prepare controls, configuration baselines and evidence collection for an assessment, but it does not issue audit reports, attestations or certifications. Independent auditors and certification bodies make those determinations.

Vendor dependency and upgrades

Recorded Future is a proprietary service whose collection and analyst output you cannot run yourself. OpenCTI has an open Community Edition under Apache 2.0, but Enterprise features and LTS releases depend on Filigran licensing. MISP is AGPL-3.0 with interlocked copyright. Review the OpenCTI life cycle, including its LTS license key requirement, and budget staff time for patching and upgrades. Note which parts of your intelligence would stop without a commercial feed.

What costs money on each side and what drives it

The Recorded Future invoice is one line, but it bundles several decisions. The subscription price depends on the modules, feeds and seats you buy, and on whether the API and any TAXII or risk list access are included. Before you compare anything, pull the order form and map each entitlement to a use: which analysts log in, which systems call the API, and which data feeds your SIEM or firewall. Ask the vendor to state in writing what happens to exported data and API access at renewal, because those terms drive the exit cost more than the list price does.

On the OpenCTI side, the costs are infrastructure, labor and upkeep. The documented minimums are at least 2 cores and 8 GB RAM for the platform, 2 cores, 8 GB RAM and 16 GB SSD for Elasticsearch or OpenSearch, and at least one platform node for every 3 workers. Redis, RabbitMQ and MinIO add their own footprint. Connector upkeep is recurring: each enrichment or import connector needs credentials, monitoring and version alignment. Analyst time to curate open feeds and tune scoring is often the largest recurring line, and it grows with the number of sources you add. If you keep a commercial feed, its license still applies on top of the infrastructure. Enterprise Edition features, such as SSO options and audit logs, carry their own license from Filigran, so confirm which edition your requirements need.

Separate one-time work from recurring work, and make the quote show both. One-time items include architecture, deployment, connector integration, data migration and hardening. Recurring items include OpenCTI upgrades, LTS license handling (LTS releases require a specific license key, and only critical and security fixes follow the one-month stabilization period), backup testing, monitoring and on-call coverage. Ask any implementation partner for a written scope that names each component, including Elasticsearch or OpenSearch, Redis, RabbitMQ, MinIO and each connector, along with the upgrade cadence and which OpenCTI release line it covers. Also ask who pays for the Enterprise Edition license and who owns the LTS key renewal.

What moving from Recorded Future to OpenCTI involves

The sequence turns Recorded Future from a platform you depend on into a feed that OpenCTI ingests, with your indicators, reports and consumers moved over in a controlled order. The output is a tested OpenCTI instance that your SIEM and SOAR tools read from, with a clear record of what was retired.

Inventory the Recorded Future data you use
Your analysts and the team that owns the subscription list which risk lists, alert types, reports, API queries and TAXII collections are actually consumed, and by which tools. Record the subscription entitlements and who holds API tokens. Done when every consumer has a named owner and every data type is marked as keep, replace or drop.
Confirm the target environment and dependencies
Your platform and infrastructure team decides where OpenCTI runs, then provisions its dependencies: Elasticsearch 8.0 or later or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later and S3-compatible storage such as MinIO. Confirm the documented sizing, and choose between a Community Edition and Enterprise Edition based on features you need such as SSO or audit logs. Done when the dependencies are reachable and the edition decision is signed off.
Deploy OpenCTI and set up access
Your engineers, or DeployOpen under a written scope if you engage us, install the platform, workers and connectors, then configure authentication against your identity provider. Pick the release line deliberately: regular releases ship often, while LTS releases need a specific license key and receive only critical and security fixes after stabilization. Done when a test user signs in through SSO and the workers consume RabbitMQ messages without backlog.
Map indicators and reports to the STIX 2 model
Your threat intelligence lead defines how Recorded Future fields map to OpenCTI objects such as indicators, observables, reports, threat actors, malware and relationships, using STIX 2 as the common model. Run a sample export through a staging instance and check that scores, dates, confidence and source names survive the import. Done when a documented mapping exists and a sample set reviews cleanly with the analysts who use it.
Connect the feeds that stay
Your platform engineers configure the connectors for each feed you keep, including any Recorded Future connector if the subscription continues, and any open feeds or MISP and MITRE ATT&CK connectors you add. Store API credentials in your secrets tooling, not in configuration files. Done when each connector reports successful runs and the expected volume of objects appears in the platform.
Run old and new workflows in parallel
Your SOC and intelligence team keep Recorded Future live while analysts run the same investigations and hunts in OpenCTI, and they log every case where results differ. Compare alert volumes, false positive rates and enrichment hits for an agreed review period. Done when the team has a written list of gaps and each gap is either fixed, accepted or assigned to a commercial source.
Cut over SIEM and SOAR consumers
Your SIEM and SOAR owners repoint each integration from Recorded Future to OpenCTI's GraphQL API or exported feeds, one consumer at a time, with a rollback path for each. Keep the old integration disabled but present until the last consumer is confirmed. Done when every production playbook pulls indicators from OpenCTI and no consumer still calls the Recorded Future API.
Record what does not move
Your intelligence lead documents what OpenCTI cannot replace, including Recorded Future's proprietary collection, analyst-written reporting and its risk scoring logic, along with any contract terms on data retention. Decide whether the subscription is reduced, kept or ended, and confirm the terms with the vendor in writing. Done when the decision record is approved and stored with the platform documentation. The export steps are covered on a separate page.

Questions buyers ask before choosing or hiring help

What does a move from Recorded Future to OpenCTI cost, and what drives the price?

The cost comes from four components: the infrastructure you run, the people who operate and tune the platform, the feeds you keep or add, and any implementation work you buy. Infrastructure and staff time recur every year, while migration, connector setup and content mapping are mostly one-time. The main drivers are the number of feeds and connectors, the volume of indicators and reports you import, how many integrations (SIEM, firewall, SOAR, ticketing) you wire in, and whether you keep a Recorded Future subscription at all. OpenCTI Community Edition is Apache 2.0 licensed, while Enterprise Edition features such as SSO options, audit logs and playbooks are under a separate license, so ask vendors to quote both. Request a written scope listing feeds, connectors, integrations and data volumes before comparing numbers.

How long does a migration take, and what sets the timeline?

No duration is given here without a scoped plan, because the timeline depends on the work in front of you. The main variables are how many feeds and connectors need to be built or tested, how much historical data you move, how many downstream systems consume indicators, and how long your change approvals and security reviews take. Sequencing also matters: most teams stand up the platform, run it in parallel with the existing service for a period, and only then retire feeds. Fixed-scope engagements agree deliverables and timelines in writing before work starts, so ask for a phased plan with clear acceptance points.

Can our team run OpenCTI ourselves, and what skills does it need?

A team with container, Linux and database operations experience can run OpenCTI, but it has more moving parts than a hosted service. The documented dependencies include Elasticsearch 8.0 or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later, and S3-compatible storage such as MinIO. Operating it means sizing platform nodes and workers (the documentation recommends at least one platform node for every 3 workers), upgrading on the LTS or regular release cadence, and monitoring connectors. OpenCTI LTS releases require a specific LTS license key and receive only critical and security fixes after a one-month stabilization period, so plan for that in your upgrade process. Skills you need in-house include threat intelligence modeling in STIX 2, GraphQL familiarity and connector troubleshooting.

What does our organization need to provide during the work?

The work needs named owners on both sides, environment access and analyst time. Assign a platform owner who makes configuration decisions, a security owner for access and data handling, and an intelligence lead who decides which indicators, reports and relationships matter. You will need access to the target cloud account, data center or air-gapped network, credentials for any feeds or APIs you keep, and a place to test connectors before production. Analysts must curate imported content, retire stale indicators and agree on labeling rules, because a platform imports whatever it is given. Ask any implementation partner to list these dependencies in the written scope.

Can OpenCTI replace Recorded Future's own collection and analyst reporting?

No. OpenCTI is a knowledge platform that stores, structures, enriches and shares intelligence, and it does not collect data on the internet or produce proprietary research. Recorded Future's collection, its analyst reports and its risk scoring come from its own service, so when you cancel that subscription, that content stops unless you replace it with another source. OpenCTI can hold community feeds, your own incident data and any commercial feed you keep, and connectors can bring in data from MISP, TheHive and MITRE ATT&CK. Before you decide, list which Recorded Future outputs your team actually uses and confirm with the feed owner which of those have an open or alternative equivalent.

Can we keep a commercial feed running alongside OpenCTI?

Yes, and many teams do this. OpenCTI connectors can bring data from external sources into the platform, so a commercial feed can continue to flow in while your own team manages storage, relationships and sharing. Keeping a feed changes the subscription you need, since you may pay for data access rather than the full platform, and the license terms of that feed govern how the data may be stored and redistributed. Confirm with the vendor whether their API or export terms allow ingestion into a self-hosted platform, and check whether a Recorded Future connector or export fits your needs before you commit.

How DeployOpen helps you evaluate, implement or migrate

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For Recorded Future vs OpenCTI, we start by separating the parts of your intelligence work that OpenCTI can hold from the parts that depend on a commercial feed, so the decision rests on your sources, sharing needs and data residency rules.

How we scope

Inventory the Recorded Future products, feeds and API uses your team relies on today.
Define which intelligence sources OpenCTI will ingest, enrich, or keep out of the platform.
Agree a fixed-scope written document with deliverables and timelines before any work starts.

How we build

Deploy OpenCTI with its search, cache, queue and object storage dependencies in your environment.
Configure connectors for the feeds you keep, handling API tokens through your secrets process.
Test ingestion, deduplication, relationships and access segregation against your agreed scope.

How we hand over

Document architecture, connector configuration, sizing decisions and operating runbooks for your team.
Provide a backup and upgrade procedure covering the platform and its supporting services.
Walk your analysts and administrators through daily workflows, reporting and access management.

How we support

Run upgrades and hardening on your chosen OpenCTI release line as part of an ongoing retainer.
Maintain connector health checks and respond to changes in upstream feed formats or APIs.
Prepare system and control evidence for compliance assessments, leaving audit conclusions to independent auditors.

Recorded Future vs OpenCTI