# OpenCTI: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 32 judge labels across 1 category by 13 of 14 models. Page: https://www.gane.ai/index/it/vendors/opencti

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Threat intelligence platforms](https://www.gane.ai/index/it/security/threat-intelligence-platforms/index.md) | 14% | 2 | 3% | 32 |

## What the models said for it

- "The best threat intelligence platform for a company with a limited budget is OpenCTI, which is a free and open-source option." (Llama 4 Maverick, Threat intel)
- "Need to start immediately with zero cost | OpenCTI Community Edition (easier setup)" (Kimi K2, Threat intel)
- "combining free platforms like OpenCTI or AlienVault OTX with curated free threat feeds" (MiniMax M2.5, Threat intel)
- "Go with MISP or OpenCTI (or both — they integrate well together)." (DeepSeek V4 Flash, Threat intel)

## And against it

- "Use MISP or OpenCTI only if you have the technical capacity to maintain them" (Qwen 3.7 Flash, Threat intel)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-5.4 mini | 0 | 1 | 0 | 0 | 1 |
| Gemini 3.5 Flash | 2 | 1 | 0 | 0 | 3 |
| Perplexity Sonar | 0 | 1 | 0 | 0 | 1 |
| Grok 4.20 | 1 | 1 | 1 | 0 | 3 |
| Mistral Small | 1 | 1 | 0 | 0 | 2 |
| DeepSeek V4 Flash | 1 | 1 | 0 | 0 | 2 |
| Llama 4 Maverick | 1 | 1 | 0 | 0 | 2 |
| Qwen 3.7 Flash | 0 | 2 | 0 | 1 | 3 |
| Kimi K2 | 1 | 2 | 1 | 0 | 4 |
| GLM 4.7 FlashX | 0 | 3 | 0 | 0 | 3 |
| MiniMax M2.5 | 1 | 2 | 0 | 0 | 3 |
| GPT-6 Luna | 0 | 1 | 0 | 0 | 1 |
| Muse Glimmer 30B | 0 | 3 | 1 | 0 | 4 |

## Sources returned with these answers

The sites and pages cited by the answers that named OpenCTI, from 72 of the 79 answers that named it (only the models that return a source list).

### Domains cited

- reddit.com: 21
- b2breviews.com: 17
- github.com: 16
- softwareadvice.com: 16
- cipherssecurity.com: 15
- g2.com: 15
- ciopages.com: 14
- cyble.com: 14
- vectra.ai: 14
- flare.io: 13

### Pages cited

- https://b2breviews.com/threat-intelligence-platforms: 17
- https://cipherssecurity.com/best-threat-intelligence-platforms-2026: 15
- https://ciopages.com/buyer-guides/threat-intelligence-platform: 14
- https://cyble.com/knowledge-hub/top-best-threat-intelligence-platforms: 14
- https://vectra.ai/topics/threat-intelligence-tools: 14
- https://reddit.com/r/cybersecurity/comments/1mhl19y/whats_the_best_threat_intelligence_software_out: 13
- https://spotsaas.com/list/threat-intelligence-software/for-small-business: 12
- https://consilien.com/news/best-threat-intelligence-platforms-2026: 11

## What it publishes

Every page filigran.io exposes, read 2026-09-29: 10984 addresses. By kind, pages and the last 90 days:

- blog: 167 pages, 10 in the last 90 days, latest 2026-09-24
- case study: 10 pages, 0 in the last 90 days, latest undated
- webinar or virtual event: 6 pages, 1 in the last 90 days, latest 2026-07-21
- report or ebook: 11 pages, 4 in the last 90 days, latest 2026-08-25
- comparison: 5 pages, 0 in the last 90 days, latest 2026-04-27
- template or tool: 1 pages, 0 in the last 90 days, latest 2026-05-27
- glossary or explainer: 27 pages, 0 in the last 90 days, latest undated
- news or press: 29 pages, 5 in the last 90 days, latest 2026-09-29
- Recent: 2026-09-29 news or press: Newsroom https://filigran.io/newsroom
- Recent: 2026-09-29 news or press: News archive https://filigran.io/news-archive
- Recent: 2026-09-24 blog: Women in cyber threat intelligence no typical path https://filigran.io/blog/women-in-cyber-threat-intelligence-no-typical-path
- Recent: 2026-09-24 news or press: Filigrans women in cti guide challenges the typical route into cyber https://filigran.io/press-releases/filigrans-women-in-cti-guide-challenges-the-typical-route-into-cyber
- Recent: 2026-09-15 news or press: Filigran partners with sek https://filigran.io/press-releases/filigran-partners-with-sek
- Recent: 2026-09-11 blog: Opencti and google secops soar threat intel flows both ways https://filigran.io/blog/opencti-and-google-secops-soar-threat-intel-flows-both-ways

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.