Does self-hosting ThreatConnect's replacement cost less?
Neither MISP nor OpenCTI Community Edition carries a software license fee, so the cost comparison against ThreatConnect turns on what you pay to run the platform yourself. MISP is licensed under AGPL-3.0 and OpenCTI Community Edition under Apache 2.0, so the recurring line items are infrastructure, the automation that replaces ThreatConnect playbooks, analyst time for integration and tuning, and support, whether that is in-house staff or a paid partner. Your renewal pressure is real, but the fair comparison is your total run cost against the ThreatConnect subscription quote you hold. The ThreatConnect price is not something this page can state. Ask Dataminr or your reseller for the quote in writing, with the deployment model (public cloud, dedicated cloud or on premises) and the modules and data volumes it covers.
On the self-hosted side, the infrastructure figures are the most concrete ones available. OpenCTI's documented sizing calls for a platform node with 2 cores and at least 8 GB RAM, an Elasticsearch or OpenSearch node with 2 cores, 8 GB RAM and 16 GB SSD, and at least one platform node for every 3 workers. It also depends on Elasticsearch 8.0 or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later and S3-compatible storage such as MinIO. Those are minimums from the vendor's documentation, not a capacity plan. Storage growth, indicator volume, replicas, backups and high availability are not covered, so size them with your own feed volumes. MISP is lighter to start, since its installer targets Ubuntu 24.04 and it also ships Docker images, Ansible roles and Puppet modules, but you still need to budget for patching and backups.
Two cost items sit outside the free software and must be priced separately. OpenCTI Enterprise Edition is under the proprietary OpenCTI Enterprise Edition License, and features such as audit logs, playbooks, organization-based segregation and SSO are part of it. OpenCTI LTS releases also require a specific LTS license key. Ask Filigran for the Enterprise and LTS terms in writing before you compare totals. Where the figures stop: this page does not supply the cost of staff time, cloud or hardware prices, or ThreatConnect pricing. Build the model from your own environment, then ask each vendor for a quote that lists the components, the one-time and recurring costs, and what each one depends on.
Which cost components change when you self-host
This table sets each ThreatConnect cost component against the matching cost on a self-hosted OpenCTI or MISP deployment, and marks whether it is one-time or recurring. Read it as a checklist for building a like-for-like quote, since most of the total shifts from the vendor invoice to servers, connector upkeep and staff time. Ask ThreatConnect for every line it bundles into the subscription before comparing.
| Cost component | ThreatConnect subscription | Self-hosted OpenCTI or MISP | One-time or recurring |
|---|---|---|---|
| Platform licence or subscription | Annual subscription, scope set by contract and deployment model | No licence fee for MISP (AGPL-3.0) or OpenCTI Community Edition; Enterprise features need a separate Filigran agreement | Recurring (ThreatConnect); recurring only if OpenCTI Enterprise is chosen |
| Hosting and servers | Included in public or dedicated cloud; on premises needs your own hardware | Your compute, storage and network for MISP, or OpenCTI with Elasticsearch or OpenSearch, Redis, RabbitMQ and MinIO | Recurring for cloud or power; one-time for hardware purchase |
| Installation and hardening | Vendor onboarding, usually covered by the subscription | Build, configuration, TLS, authentication and sizing, by your team or a partner under a written scope | One-time |
| Connectors and integrations | Vendor-maintained integrations, scope depends on the contract | Maintain OpenCTI connectors such as MISP and MITRE ATT&CK, and MISP feeds and export formats for your SIEM or blocking tools | Recurring, driven by how many tools you connect |
| Playbook and automation replacement | Built-in playbooks as part of the platform | OpenCTI playbooks in Enterprise Edition, or a separate automation tool you operate | One-time build, recurring upkeep |
| Analyst time | Existing analyst workflow and vendor training | Time to learn new tooling, write sharing rules and tune correlation and taxonomies | Recurring, highest-variance line |
| Upgrades and patching | Handled by the vendor; on premises may still need your window | OpenCTI LTS line needs a license key and a supported version path; MISP 2.4 is end of life, so plan upgrades | Recurring |
| Support | Vendor support included in the subscription tier | Community channels, or a paid support or retainer agreement you scope in writing | Recurring if you buy support |
What OpenCTI and MISP need in servers and storage
The server footprint for self-hosted OpenCTI is the largest infrastructure line in this comparison, and it is set by a stack of dependencies rather than by the platform alone. The documented sizing gives the OpenCTI platform (the UI and GraphQL API) 2 cores and at least 8 GB RAM, and Elasticsearch or OpenSearch 2 cores, 8 GB RAM and 16 GB SSD. The deployment overview also recommends at least one platform node for every 3 workers. Around those components you need Elasticsearch 8.0 or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later, and S3-compatible object storage such as MinIO. Each of these is a service your team patches, backs up and monitors, so the server count is only part of the operating cost. Ask your architect to map every dependency to a host, a backup job and an owner before you compare totals.
MISP has a smaller and more familiar stack. It is built on PHP with CakePHP, uses MySQL or MariaDB and Redis, and is commonly installed with the project's own installer on Ubuntu 24.04. MISP 2.5.47, released on September 17, 2026, introduced a new database migration system with PostgreSQL support, so teams that already standardize on PostgreSQL can now consider it as the database. Confirm with the MISP project which database engine and version your target release supports before you commit to a design, and plan the database choice as a one-time decision because switching later adds migration work. Storage for MISP is driven mainly by the number of events, attributes and attachments you keep, along with the sync traffic you accept from partner instances.
Neither platform publishes a sizing that fits your data, so treat the figures above as minimums for a lab. Indicator volume, retention period, enrichment rate, number of concurrent analysts and the connectors you run all change CPU, memory and disk needs. Build a test environment that loads a representative sample of your feeds, measure queue depth in RabbitMQ and index growth in Elasticsearch or OpenSearch over several days, and extrapolate from those measurements to your production volume. The results of that test are the input your infrastructure quote should be built on, and they also tell you whether the hosting cost sits in your existing virtualization estate or needs new capacity.
What moves the cost comparison most
A self-hosted OpenCTI or MISP deployment has no subscription line, so the total cost depends on how the platform is sized and who runs it. The six drivers below show which inputs move the comparison most, and which direction each one pushes cost.
User count and access model
Every analyst, responder and partner account adds to the authentication, support and training workload, even when the software itself is free. OpenCTI Enterprise Edition adds organization-based segregation and SSO options, which matter once more than one team shares a platform. Ask ThreatConnect for the seat count and tier you pay for today, then map the same people to roles in OpenCTI or MISP before you size anything.
Indicator and event volume
Volume drives storage, index size and worker capacity more than any other technical input. OpenCTI runs on Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage, so more indicators mean larger indexes and more queue throughput. Pull a twelve-month count of indicators, groups and feed items from your ThreatConnect owners and use it as the basis for every storage and compute estimate.
OpenCTI edition choice
The Community Edition is Apache 2.0 licensed, while Enterprise adds features such as audit logs, playbooks, full text indexing and SSO integrations under a separate license. Playbooks and SSO are the features teams most often need from the paid tier, so the edition decision changes both license cost and the amount of custom automation you build. Confirm with Filigran which features your requirements depend on before you choose.
Availability and backup targets
A single MISP or OpenCTI node costs less to run, but a platform that feeds SIEM blocking or incident response needs redundancy, tested restores and patch windows. High availability adds database replicas, load balancing and a second site for backups, each of which needs hardware or cloud spend and staff time. Set a recovery time and recovery point target with the business owners before comparing platform costs with ThreatConnect's hosting tier.
Sharing with external communities
MISP's distribution levels, sharing groups and synchronization let you run feeds and exchange data with trusted communities without a per-community fee. The cost shifts to onboarding partners, reviewing sync rules and maintaining connections, which takes ongoing coordination effort. If you rely on ThreatConnect communities or ISAC-style sharing today, list each community, its data format and its sync frequency before you estimate this effort.
In-house skills and upgrade cadence
Self-hosting moves the cost of upgrades, connector maintenance and incident handling from the vendor to your team. OpenCTI publishes regular releases and LTS lines with a one-year support window, and MISP 2.4 is end of life, so your staff must plan upgrades on a fixed rhythm. Count the people who can run Linux, containers, Elasticsearch or OpenSearch and PHP, and decide whether the gap will be closed by hiring, training or a fixed-scope implementation partner.
How to build the comparison with your own numbers
This sequence turns a ThreatConnect renewal into a like-for-like, three-year comparison against self-hosted OpenCTI or MISP, built from your own invoice, playbooks, sizing and staff time. The result is a cost model you can defend in a procurement or board discussion.
Collect the current ThreatConnect invoice
Gather the current order form, invoice and renewal terms from your ThreatConnect account team, and list every licensed module, user seat, data volume allowance, community or feed entitlement and support tier. Note the deployment model you currently run (public cloud, dedicated cloud or on premises) because it changes which costs you carry yourself. Ask your account contact to confirm in writing whether any of these items change after the Dataminr acquisition, since a renewal may be re-papered. The step is complete when every line on the invoice maps to a named entitlement in a single spreadsheet.
Inventory playbooks and integrations
Work with the analysts and automation owners to list each ThreatConnect playbook, scheduled job, feed import, export and integration with a SIEM, EDR, firewall or ticketing system. For each item, record the trigger, the systems it touches, how often it runs and who maintains it. This list shows which functions must move to OpenCTI or MISP connectors, which need a separate automation tool, and which can be retired. The step is complete when every integration has an owner and a target: connector, export, or separate tool.
Size the target stack
Using the sizing in the OpenCTI deployment documentation, translate your data volume and worker count into platform, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage requirements, including at least one platform node for every three workers. Add a MISP sizing based on your event volume, sharing partners and the chosen install method, and confirm the supported Ubuntu and database choices with the MISP download page. Plan separate environments for test and production, and account for backups and disaster recovery. The step is complete when you have a bill of materials for compute, storage and network in your own infrastructure.
Price the infrastructure and software components
Cost each line of the bill of materials at your own infrastructure rates, covering virtual machines or hardware, storage, backup, monitoring, load balancing and network egress if your feeds cross a boundary. Software licenses for OpenCTI Community Edition and MISP are zero, but the Enterprise Edition license, if you need audit logs, playbooks or SSO features not in the community build, is a separate quoted item from Filigran. Record which costs are one-time (hardware, initial build, migration) and which recur (hosting, storage growth, licenses, certificates). The step is complete when each cost has a unit, a source and a recurrence flag.
Estimate staff time for operations
Ask the platform, security engineering and analyst leads to estimate hours for installation, configuration, OpenCTI LTS or MISP upgrades, connector maintenance, dependency patching and on-call support. Include the OpenCTI release cadence, which has regular releases from daily to weekly and LTS releases every six months, and the MISP upgrade path from 2.4 to 2.5. Cost these hours at your loaded internal rates, and separate build effort from steady-state effort. If you plan to use a partner, request a fixed-scope written proposal instead of an estimate. The step is complete when staff hours are recorded per activity with a recurring annual figure.
Request matching ThreatConnect and Dataminr quotes
Send the same scope to ThreatConnect and, where relevant, Dataminr for Cyber Defense, and ask for written quotes covering identical users, data volume, modules, playbook or automation capacity, support level, term length and deployment model. Ask each vendor to state which items are included, which are optional add-ons, what happens to price at renewal, and what data export and exit assistance is included. Keep the scope identical so the comparison reflects the products rather than negotiating leverage. The step is complete when both quotes are on file and every line in your model maps to a line in each quote.
Model three years with one-time and recurring costs
Build a three-year view with one-time costs (build, migration, initial training, hardware if purchased) in year one and recurring costs (hosting, storage growth, staff operations, support contracts, subscriptions) spread across each year. Add a sensitivity row for data volume growth and staff turnover, and show the ThreatConnect subscription and any Dataminr-related changes as their own line. Label any hypothetical scenario as illustrative. The step is complete when a single model shows total cost by year for each option, with every assumption tied to a source document.
Review assumptions with the decision owners
Present the model to the CISO, CIO, platform lead and procurement, and walk through the three largest cost drivers and the open questions still awaiting vendor written confirmation. Record which assumptions are confirmed, which are estimates and who owns each open item. Decide whether the comparison supports a migration, a hybrid approach or renewal on the current terms. The step is complete when the decision owners have signed off the assumptions list and the next action has a named owner.
What replaces ThreatConnect playbooks and their cost
The main cost question for playbooks is whether the automation work disappears or moves to your own team. OpenCTI Enterprise Edition includes playbooks, so an organization that licenses it can keep enrichment and routing steps inside the platform. The Community Edition, licensed under Apache 2.0, does not give you that feature set, so teams on it usually build the equivalent in a separate automation tool or in scripts that call the GraphQL API and the connectors. Before you compare prices, confirm with Filigran which Enterprise features your intended deployment needs and whether they are licensed per deployment, and list every ThreatConnect playbook your team actually runs today so you can see which ones have an OpenCTI equivalent and which do not.
Replacement automation is a recurring cost, not a one-time one. Someone must write, test, document and update each workflow every time the OpenCTI schema, connector versions or your SIEM and blocking integrations change, and OpenCTI's own release cadence means those changes arrive regularly. Your options are internal engineers, a partner under a fixed-scope build followed by a support retainer, or a mix of both. Ask any partner for a written list of the workflows in scope, the test evidence for each, who owns failures after handover and what happens when a connector is upgraded. These answers determine most of the long-term cost, far more than the initial build.
MISP automation is handled differently. Its REST API, described in OpenAPI, and the PyMISP library let you script sync jobs, enrichment lookups and exports, but MISP does not ship a visual playbook builder, so you should plan for code ownership either way. Budget for the engineers who will maintain scripts against the API, for test instances where changes can be validated before production, and for the time to keep those scripts aligned with each MISP release. Whichever platform you choose, the cost of ThreatConnect playbooks is replaced by an ongoing engineering commitment, and that commitment should be sized before the subscription is cancelled.
Questions buyers ask before comparing costs
How much effort does self-hosting OpenCTI or MISP take, and can our team do it alone?
Yes, a capable platform team can run either platform alone, but the effort is real and recurring. Both are multi-component systems. OpenCTI needs Elasticsearch or OpenSearch, Redis, RabbitMQ, S3-compatible storage such as MinIO, the platform itself and Python workers for connectors. MISP is built on PHP with CakePHP, MySQL or MariaDB and Redis, and offers an installer for Ubuntu 24.04 plus Docker, Ansible and Puppet options. Ask yourself whether your team already runs stateful services like these, can own patching and backups, and has someone accountable for intelligence content and sharing rules. If the answer to any of these is no, budget for outside help during the first build and for a retainer afterward.
How long does a migration from ThreatConnect take?
The main drivers are the volume and shape of your data, not a fixed duration. Migration time grows with the number of indicators, groups, cases and associations to move, how many owners and sharing communities you must keep separate, and how many SIEM, blocking and enrichment integrations depend on ThreatConnect. Playbooks that must be rebuilt in OpenCTI or a separate automation tool add effort that is easy to underestimate. Also count the parallel running period, when both systems feed the same consumers. Ask any provider to break the timeline into data export, mapping, integration rewiring and validation, and to name what is out of scope.
What does the work need from our side?
Your side supplies decisions and access. Expect to provide export permissions for every ThreatConnect owner you intend to move, a clear list of sharing communities and their rules, and named owners for the integrations that consume indicators. You will also need infrastructure accounts or data center capacity for the servers, storage and network paths, plus a decision on identity integration, such as OpenID, LDAP or SAML for OpenCTI, or the OidcAuth plugin for MISP. Analysts must review how ThreatConnect tags and owners map to OpenCTI organizations and markings or MISP distribution levels, because that mapping encodes your sharing policy.
Is MISP or OpenCTI cheaper to run?
Neither is automatically cheaper. MISP has a lighter default footprint for indicator sharing and is licensed under AGPL-3.0, so its software cost is zero. OpenCTI Community Edition is Apache 2.0, but its documented dependencies (Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage) and its sizing, which calls for at least one platform node for every 3 workers, mean more infrastructure to pay for and operate. Enterprise features such as audit logs, playbooks, organization-based segregation and SSO are covered by the separate OpenCTI Enterprise Edition License, so check that cost before you decide. Pick by the workflow you need, then compare infrastructure and staff time for that choice.
How does the upgrade cadence affect staffing?
Upgrade cadence sets a recurring staffing load that continues after go-live. OpenCTI non-LTS releases ship from daily to weekly, while LTS releases appear every 6 months, each supported for 1 year, and LTS builds require a specific license key. After a one-month stabilization, LTS receives only critical bug and security fixes, so feature upgrades need planned testing. MISP 2.4 is end of life with security fixes only, and the project recommends 2.5 for new deployments, so your team must schedule upgrades rather than defer them. Staff for test environments, change windows and rollback plans, and ask who covers these tasks when your engineers are on leave.
What should we ask for in a fixed-scope quote?
Ask for a written scope that lists each deliverable and what is excluded. A useful quote separates one-time work (architecture, installation, data migration, integration rewiring, playbook rebuilds, hardening, documentation and training) from recurring work (upgrades, backups, monitoring, support and continuous testing). DeployOpen works to fixed scope, with deliverables and timelines agreed in writing before work starts, and offers ongoing support and upgrades as retainers. Request the assumptions behind any data volume, number of integrations and owners, plus the acceptance criteria for each phase. DeployOpen does not publish a price list, so a quote follows from that written scope.
Will self-hosting help with data residency or sharing controls?
Self-hosting keeps indicators, sightings and sharing configuration inside infrastructure you control, which is often what residency rules require. MISP supports distribution levels and custom sharing groups down to individual attributes, plus synchronization with trusted instances, so you decide exactly what leaves your environment. OpenCTI offers organization-based segregation in its Enterprise Edition. Confirm with your compliance lead which controls your regulator expects, and document how each one is configured. DeployOpen prepares systems, controls and evidence for compliance assessments, but independent auditors and certification bodies issue any audit report or certification.
Does ThreatConnect's Dataminr acquisition change the cost comparison?
It changes the risk side of the comparison more than the arithmetic. Dataminr announced on October 21, 2025 that it had signed a definitive agreement to acquire ThreatConnect, and ThreatConnect is now presented as part of Dataminr for Cyber Defense. Ask your ThreatConnect account team in writing about pricing terms, product roadmap, deployment options and data handling after the change, and record the answers in your renewal file. A self-hosted platform keeps that dependency under your control, but it still needs the operating budget described above.
How the Dataminr deal affects renewal planning
Dataminr announced on October 21, 2025 that it had signed a definitive agreement to acquire ThreatConnect, and ThreatConnect is now presented as part of Dataminr for Cyber Defense on Dataminr's site. For a renewal, the practical point is that the vendor relationship, the account team and the contract counterparty may change while your current terms remain in force. Before you sign anything, ask your ThreatConnect account contact in writing which legal entity will be party to the renewal, whether the offer will be issued by ThreatConnect or Dataminr, and how the transition affects your support contacts and escalation path.
Ask for written commitments on three points: pricing, deployment options and data export. On pricing, request the renewal rate, the uplift cap for each remaining year, the unit basis for charges (for example, users, data volume or modules) and any fee that applies if you move between public cloud, dedicated cloud or on-premises deployment. On deployment, confirm in the contract which option you are buying and whether a move to another option requires a new agreement. On data export, get the export formats, the API access level and any limits on bulk export written into the order form, so that an exit does not depend on goodwill. Do not assume future pricing or product packaging will match today's, and treat any verbal assurance as unconfirmed until it appears in the signed document.
Use the renewal as a decision point rather than a formality. Set a date for exporting a full copy of your indicators, groups and associated metadata, and test that the export can be loaded into a pilot OpenCTI or MISP instance before the notice period closes. Keep the migration cost estimate separate from the subscription comparison so that the renewal term is weighed against a realistic exit path. Confirm the notice period and any auto-renewal clause with your legal and procurement teams now, because these dates control your leverage.
How DeployOpen scopes a fixed-price implementation
DeployOpen plans, implements and hands over self-hosted OpenCTI or MISP inside your own cloud accounts, data centers or air-gapped networks. For a ThreatConnect cost comparison, we start by writing down which components, connectors and automation replacements are in scope, so the cost model you compare against ThreatConnect is based on an agreed design.
How we scope
- Inventory your current ThreatConnect subscription scope, owners, integrations and playbooks before any cost model is drafted.
- Agree in writing which platform (OpenCTI, MISP or both) and which deployment target each option will be costed against.
- Define the connector list, automation replacements and analyst workflows that the written scope will cover and exclude.
How we build
- Size the servers, storage and supporting services for OpenCTI or MISP against the documented requirements of the chosen version.
- Build a parallel cost model that separates infrastructure, connector operation, automation tooling and analyst time.
- Test sharing, feeds, authentication and integrations in a non-production environment before any cutover decision.
How we hand over
- Deliver the architecture, sizing assumptions, cost worksheet and runbooks as documentation your team keeps.
- Walk your platform, security and analyst staff through administration, upgrades and backup procedures during handover.
- Document each cost line with its owner, its recurring or one-time nature and the assumption behind it.
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- Ask any quote to state which items are one-time, which recur and which depend on your own staffing decisions.
