Does ThreatQ cost vs self-hosted OpenCTI and MISP come out lower?
Software licensing drops away with MISP and OpenCTI Community Edition, but infrastructure, migration and staff time remain. MISP is licensed under AGPL-3.0 and OpenCTI Community Edition under Apache 2.0, so neither carries a per-seat or per-feed license fee. Whether the total comes out lower depends on which components you run. OpenCTI Enterprise Edition is licensed under a proprietary OpenCTI Enterprise Edition License, so if you need features such as audit logs, playbooks, organization-based segregation or SSO for OpenID, LDAP or SAML, that line item returns and should be quoted from Filigran. Before comparing against your ThreatQ renewal, confirm with your ThreatQuotient or Securonix contact exactly what the renewal covers: the platform, any on-premises or SaaS hosting, connectors, the SIEM integration bundle and support.
The self-hosted cost lines are the ones you must price yourself. OpenCTI's documented deployment needs the platform (at least 2 cores and 8 GB RAM), Elasticsearch or OpenSearch (2 cores, 8 GB RAM and 16 GB SSD in the documented sizing), Redis 7.1 or later, RabbitMQ 3.11 or later, and S3-compatible storage such as MinIO, plus Python workers and at least one platform node for every 3 workers. Those servers, backups, high availability and upgrades recur every year. MISP is lighter on components, built on PHP, MySQL or MariaDB and Redis, but it still needs a supported Ubuntu host and an upgrade path: MISP 2.4 is end of life, so new deployments belong on MISP 2.5. The cost drivers are data volume, the number of feeds you ingest, sharing partners and whether you need high availability.
The largest unbudgeted line is people. Someone must curate feeds, write or maintain connectors, tune correlation and keep detection exports working for your SIEM and EDR tools, and that work is ongoing, not a one-time migration task. When you request quotes from implementation partners, including DeployOpen, ask for a written scope that separates one-time build, migration, hardening and documentation from recurring upgrades, support and feed curation. Then set that against the staff hours you spend today running ThreatQ, which is the figure most likely to decide the comparison.
Which cost components change when you move from ThreatQ
This table compares each cost component of a ThreatQ deployment with the same component under self-hosted OpenCTI or MISP, and marks whether it is one-time or recurring. The ThreatQ side depends on your own contract, invoices and any Securonix terms, so confirm those figures with your vendor before comparing. The main takeaway is that open-source licensing removes one line item, while infrastructure, feed curation and internal skills remain and often decide the total.
| Cost component | ThreatQ side | Self-hosted OpenCTI or MISP side | One-time or recurring |
|---|---|---|---|
| Software license or subscription | Set by your ThreatQuotient or Securonix contract and invoices | No license fee for MISP (AGPL-3.0) or OpenCTI Community Edition (Apache 2.0) | Recurring for ThreatQ, none for open source |
| Securonix bundle | Depends on whether ThreatQ is bundled with Securonix SIEM terms | Not applicable, but any SIEM integration must be rebuilt against your own tooling | Recurring for ThreatQ, one-time to rebuild |
| Servers or SaaS fees | On-premises hardware or SaaS subscription, per your contract | Your own servers or cloud accounts for the platform and workers | Recurring |
| Storage | Included in your ThreatQ tier or deployment, confirm limits | Object storage such as MinIO for files, plus database disk sized to indicator volume | Recurring, grows with data volume |
| Search and message infrastructure | Handled inside the vendor product | OpenCTI needs Elasticsearch or OpenSearch, Redis and RabbitMQ; MISP uses MySQL or MariaDB, Redis and optionally PostgreSQL | Recurring operations, one-time setup |
| Implementation and migration | Vendor or partner services, per your statement of work | Deployment, data mapping to STIX 2 or MISP events, and repointing SIEM and EDR feeds | One-time |
| Connectors and feed curation | Feeds and integrations supplied in the product, confirm coverage | Connectors and feeds are maintained by your team, including the OpenCTI MISP and MITRE ATT&CK connectors | Recurring staff effort |
| Support, upgrades and internal skills | Vendor support tier from your contract | Community support, paid support options, LTS licensing for OpenCTI, and staff time to upgrade and patch | Recurring |
What moves the ThreatQ and OpenCTI or MISP comparison
Six drivers decide whether a self-hosted move costs less than staying on ThreatQ. Each one pushes the cost of the commercial side, the open-source side, or both, and most of them are set by your own environment rather than by any vendor's list.
User count and access model
ThreatQ licensing and any Securonix bundle are usually priced around seats or deployment scope, so the number of analysts, read-only consumers and automation accounts is the first thing to pin down. OpenCTI Community Edition has no per-seat fee, but every user still needs identity integration, onboarding and access reviews that you run. Ask ThreatQuotient or Securonix exactly what the current license meter counts, then list your own users by role.
Indicator and event volume
Volume drives storage, search and worker capacity on the open-source side. OpenCTI relies on Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage, so growth in indicators and relationships adds nodes and disk. MISP grows mainly in its database and attribute count. Measure your current daily ingest and retention period, then ask your ThreatQ vendor whether its pricing tier depends on indicator counts.
OpenCTI Enterprise Edition features
Audit logs, playbooks, organization-based segregation, full text indexing, AI insights and SSO for OpenID, LDAP, SAML, certificate and header authentication sit in the Enterprise Edition under a separate proprietary license. If your requirements include these, the OpenCTI side carries a subscription cost that Community Edition does not. Confirm with Filigran which features and support levels a quote includes, and whether your identity provider needs a supported method.
Availability and upgrade cadence
Higher availability means redundant platform nodes, replicated search and message queues, and a tested backup and restore path, all of which add hardware and operator hours. OpenCTI LTS releases need a specific license key and receive only critical and security fixes after stabilization, so running an LTS line has its own licensing and patch planning cost. MISP 2.4 is end of life with security fixes only, so budget for upgrades on the MISP side as well.
Connectors, feeds and integrations
Every feed, enrichment source and SIEM or EDR push you rely on in ThreatQ must be rebuilt or confirmed on the new side. OpenCTI ships connectors for MISP, TheHive and MITRE ATT&CK, while MISP supplies default feeds and exports for Suricata, Snort, Zeek and RPZ. Count your active feeds and custom integrations, and mark which ones have an existing connector and which need someone to write or maintain one.
Team skills and curation capacity
The largest recurring cost is often the people who curate feeds, tune scoring, write connectors and patch the stack. A team already fluent in PHP, Docker, Elasticsearch or STIX 2 spends less time on onboarding than one that is not. Estimate how many hours per week your analysts currently spend on feed management in ThreatQ, and decide whether that work moves to in-house staff or to a retained support partner.
How to build the cost model with your own numbers
This sequence turns a ThreatQ renewal conversation into a three-year cost model built from your own contract, feed inventory, hardware quotes and analyst time. The result is a side-by-side view of ThreatQ against self-hosted OpenCTI or MISP that your finance and security leaders can check line by line.
Inventory the current ThreatQ contract and estate
Gather the ThreatQ license terms, renewal date, included modules, any Securonix bundling language, and the deployment model (on premises or SaaS). Alongside it, list every feed, connector, export and push integration that ThreatQ feeds today, including the SIEM and EDR targets. Your finance team and the ThreatQ account owner should both confirm the contract line items, so the baseline is the price you actually pay. The step is done when every recurring line has an owner and a renewal date, and every integration has a named consumer.
Size the target platform from documented requirements
For OpenCTI, use the documented dependencies (Elasticsearch 8.0 or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later, and S3-compatible storage such as MinIO) and the sizing in the deployment overview, which lists platform, search and worker guidance, including at least one platform node for every 3 workers. For MISP, plan around the MISP 2.5 installer on Ubuntu 24.04 or the Docker, Ansible, Puppet or RPM options. Your architects should translate these into node counts for your own environments, including development, test and disaster recovery copies. The output is a bill of materials with cores, memory and storage per role.
Price servers, storage and licenses from your own vendors
Request quotes from your hardware, cloud and storage vendors for the bill of materials, and separate one-time purchase or setup costs from recurring hosting, support and backup costs. Note the OpenCTI cost detail: Community Edition is Apache 2.0, while Enterprise Edition features such as SSO options, audit logs and playbooks sit under a separate commercial license, so ask Filigran for a written quote if you need them. Confirm with your Linux and database vendors whether support contracts apply. The output is a priced infrastructure table with a note on each assumption.
Estimate migration and connector rebuild effort
Walk through the integration inventory from step one and classify each item as a straightforward export, a mapping exercise, or a connector that must be rebuilt. For OpenCTI, map ThreatQ objects and scores to STIX 2 objects and check which connectors exist for your sources. For MISP, check which feeds and exports you need and whether they are available as defaults. Ask your delivery partner or internal engineers to produce effort estimates for each class, based on your inventory, and record them as a written scope. The output is a migration effort register that is independent of vendor marketing claims.
Assign analyst hours to feed curation
Feed curation is often the largest recurring cost and is easy to undercount. List each feed, its review frequency, the analyst role that triages it, and the tuning work such as false-positive handling, taxonomy tagging and sharing decisions. Estimate hours from your own team's current workload, not from a generic figure, and state whether the work moves, stays or shrinks under the new platform. Include connector upkeep, upgrade testing and on-call support for the platform itself. The output is an analyst time table with hours per month and a named owner for each feed.
Run a three-year view with one-time and recurring totals
Build a three-year model with separate rows for one-time costs (migration, connector rebuilds, initial hardware, training) and recurring costs (ThreatQ licensing or any Securonix-related charges, hosting, storage growth, support contracts, analyst hours, and upgrade effort). Run it twice, once for staying on ThreatQ and once for each self-hosted option, and include a sensitivity line for feed volume growth and staff turnover. Ask finance to review the assumptions before anyone reads the totals. The model is complete when each figure traces back to a quote, an inventory line or a stated assumption.
Who curates feeds and maintains connectors after the move
The largest recurring cost after a move is usually people, not software. A commercial platform like ThreatQ typically arrives with a feed catalog and vendor-maintained integrations, while MISP and OpenCTI ship as open-source platforms without a curated commercial feed set in the same way. Your team has to decide which feeds to ingest, pay for the ones that matter, confirm each provider's license terms for self-hosted use, and assign someone to watch for feed format changes that silently break ingestion. Start by listing every feed and sharing community you currently receive through ThreatQ, along with the contract terms that govern redistribution inside your own infrastructure.
Both platforms give you a head start, but not a complete one. MISP includes default intelligence feeds, shareable taxonomies, warning lists and galaxies covering threat actors, malware, ransomware, tools and MITRE ATT&CK. The taxonomies and galaxy data are licensed under CC0 1.0 Universal or the 2-clause BSD license, separate from the AGPL-3.0 license of the software, so review that distinction with your legal team before you redistribute them. OpenCTI offers connectors for MISP, TheHive and MITRE ATT&CK. Each connector still needs an owner who configures credentials, sets import scopes, monitors worker health and applies upgrades, since OpenCTI connectors run as separate components that consume RabbitMQ messages.
Ask two questions before you budget. First, which of your current feeds have providers who permit self-hosted ingestion and sharing with partners, and which require a hosted or per-seat arrangement. Second, who in your team will own curation, meaning tuning scores or decay, retiring stale indicators and joining sharing communities, and who will own connector maintenance. Those roles are recurring costs. If a quote from an implementation partner excludes feed licensing and ongoing curation, ask for those items to be listed separately so the comparison with ThreatQ's licensing is like for like.
Questions buyers ask about the cost of self-hosting
Can we run the migration from ThreatQ without outside help?
Yes, if your team has the skills, but most teams need help with at least part of it. Running MISP is largely a matter of installing and maintaining a PHP, MySQL or MariaDB and Redis application, and the project recommends Ubuntu 24.04 with its provided installer for MISP 2.5. Running OpenCTI is heavier: it depends on Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage such as MinIO, plus Python workers and connectors. The harder work is usually not the install. It is mapping your ThreatQ feeds, scores and integrations to the target model and rebuilding them. Ask whether your staff have run these components before, and which parts you want a partner to plan, build or hand over with documentation.
How long does a ThreatQ migration to self-hosted OpenCTI or MISP take?
It depends on scope. The main drivers are how many feeds and integrations you run, how much history you need to keep, how many SIEM and EDR connections must be repointed, and how much of the data model needs mapping. A team moving a small set of indicators to MISP has a very different job from a team rebuilding enrichment playbooks and connectors for OpenCTI. Ask any partner to break the work into phases with written deliverables, and to state which assumptions the timeline depends on. Your own validation time, including testing with detection teams, should be part of that plan.
What does a self-hosted threat intelligence platform need from our team?
Expect ongoing work in four areas: platform operations, feed and connector maintenance, intelligence curation and integration upkeep. Platform operations covers patching, backups, monitoring and capacity planning for the database, search and message queue layers. Feed and connector maintenance means watching source changes and fixing broken imports or enrichments. Curation means someone decides what is shared, how events are tagged with taxonomies and galaxies, and how indicators age out. Integration upkeep covers the SIEM and EDR exports. Work out who owns each area today in ThreatQ, because those people will be needed in the new model.
Is MISP or OpenCTI cheaper to run?
Software licensing is not the main difference, since MISP is AGPL-3.0 and OpenCTI Community Edition is Apache 2.0. The difference is in infrastructure and operating effort. OpenCTI's documented sizing calls for a platform with at least 2 cores and 8 GB RAM, a search cluster with 2 cores, 8 GB RAM and 16 GB SSD, and at least one platform node for every 3 workers, before you count Redis, RabbitMQ and object storage. MISP runs on a smaller stack. Which is cheaper depends on whether you need OpenCTI's graph model and connectors, or MISP's sharing and export strengths. Ask a partner to cost both against your real feed volume and sharing needs.
How are upgrades paid for when we self-host OpenCTI or MISP?
Upgrades are a recurring cost. For OpenCTI, the Enterprise Edition is under a proprietary license, and LTS releases require a specific LTS license key to use. LTS releases occur every 6 months and each is supported for 1 year, with only critical bug and security fixes after a one-month stabilization. Plan for either regular upgrades or a support arrangement that covers LTS patches. For MISP, MISP 2.4 is end of life with security fixes only, and the project strongly advises against new 2.4 instances. Existing 2.4 installs need an upgrade to 2.5, which the project supports with an upgrade script for Ubuntu. Budget for that work as a planned project, not an emergency.
What should we ask a partner for in a fixed-scope quote?
Ask for a written scope that lists the platforms, number of feeds and connectors, integrations to SIEM and EDR tools, data to migrate, and the environments involved. Require deliverables and acceptance criteria for each phase, a description of what is handed over (runbooks, configuration, documentation), and the testing and validation steps. Confirm what is excluded, such as feed subscriptions, licenses and hardware, and who pays for them. Ask how ongoing support, upgrades and LTS patching are priced as a separate retainer. DeployOpen plans, implements, hardens and documents self-hosted platforms in your own infrastructure and works to a written scope agreed before work starts. It does not issue audit reports or certifications.
What hidden costs should we check before moving off ThreatQ?
The costs most often missed are not on the platform itself. Check what your ThreatQ licence and any Securonix bundle currently cover, so you know which features you must replace. Include the time for running parallel systems during cutover, retraining analysts on the new model, and rebuilding feed connections that ThreatQ handled for you. Also count the hardware or cloud capacity for search, queues and storage, and any paid feed or enrichment subscriptions you keep. Confirm these items with your vendor and your own environment, then carry them into the quote.
What a migration adds to the first-year total
The one-time migration work is the cost most likely to be underestimated in a first-year total, because it lands before any saving does. It has four parts: exporting indicators, adversaries and related objects from ThreatQ; mapping ThreatQ's data model and scores to STIX 2 objects for OpenCTI or to MISP events enriched with taxonomies and galaxies; rebuilding the feeds that currently populate ThreatQ as connectors or feed imports; and repointing SIEM and EDR integrations so detections keep receiving indicators. Each part has a labor component that someone on your team or a implementation partner must perform, and the mapping step usually takes the most analyst judgment, since ThreatQ scores and decay rules do not translate one to one. Ask your vendor which export formats and APIs your ThreatQ version supports, and have an analyst sample a few hundred objects to test the mapping before committing to a full run. Running both platforms in parallel is the second recurring question for the first year. You need ThreatQ until detections, analysts and sharing partners have moved, so the license or subscription term for ThreatQ, and any Securonix bundle, continues during the overlap. Whether that overlap adds cost depends on the buyer's contract terms: check the notice period, whether seats or data volume are billed by term, and whether an early exit or shortened term is available. On the self-hosted side, parallel running means paying for the OpenCTI or MISP servers and their dependencies while ThreatQ still runs, so the overlap period is worth pricing explicitly rather than assuming it is free. For the detailed steps, see the sibling pages Migrate from ThreatQ to OpenCTI and Migrate from ThreatQ to MISP, which cover the export and mapping work for each target. Before you size the first-year budget, ask for a written scope that lists each migration step, the people responsible for it, the parallel-run period you expect, and the acceptance tests that close the migration.
How DeployOpen scopes a fixed-price migration and what it hands over
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For a ThreatQ cost comparison against self-hosted OpenCTI or MISP, the work starts with a written scope that sets out which feeds, connectors and integrations are in play before any build begins.
How we scope
- Inventory ThreatQ feeds, indicator volumes, adversary objects and the SIEM and EDR integrations that consume them.
- Decide with you whether OpenCTI, MISP or both fit the teams that curate and share intelligence.
- Agree deliverables, timelines and what is excluded in writing, since most engagements are fixed-scope.
How we build
- Size the OpenCTI dependencies (Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage) or the MISP host to your environment.
- Map ThreatQ scores and feeds to MISP taxonomies, galaxies and events, or to STIX 2 objects and OpenCTI connectors.
- Test imports, exports and sharing controls against sample data before any production cutover.
How we hand over
- Document the deployment, connector configuration, backup routines and upgrade steps for your operators.
- Provide a cost-of-ownership worksheet that separates one-time migration work from recurring hosting and staffing.
- Walk your curation and engineering staff through feed ownership, connector maintenance and sharing rules.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Plan upgrades around OpenCTI LTS cycles or the MISP 2.5 line, with your change process in the loop.
- Ask any provider, including DeployOpen, to confirm the support scope and response terms in the written quote.
