Paris-based Filigran, which develops open-source threat intelligence tools, raised a $58M Series C led by French VC Eurazeo and reports 6K+ users
Daphné Leprince-Ringuet / Sifted :
Context & Ripple Effects
Filigran’s Series C follows its $35M Series B for OpenCTI less than a year earlier, extending the financing arc for a Paris-based supplier of open-source threat-intelligence tooling. Its reported base of more than 6,000 users makes this more than an early-stage funding signal.
The round also lands in an active French cyber-software field: Sekoia’s earlier funding for real-time attack detection shows capital reaching different layers of security operations, from intelligence collection to detection.
First-order effects
- Filigran gains $58M in new financing, led by Eurazeo, to support the next stage of its threat-intelligence platform development and commercialization.
- The company’s 6,000-plus reported users become a stronger proof point for customers and partners evaluating an open-source intelligence workflow.
Second-order effects
- Threat-intelligence and detection vendors will face a better-capitalized Filigran in enterprise and public-sector evaluations, increasing the value of integration, deployment support, and differentiated workflows.
- A larger funded user base can make Filigran’s tooling more consequential to adjacent security teams that rely on shared intelligence context, even where they use separate detection or awareness products.
Third-order effects
- If later-stage funding continues to concentrate around widely adopted open-source security platforms, the market may increasingly reward vendors that pair community distribution with commercial support and enterprise-ready operations.
- The pattern points toward threat intelligence becoming a shared layer in security stacks rather than a standalone specialist product, though the durability of that shift depends on whether adoption converts into sustained paid deployments.
The trend: Cybersecurity investment is moving toward platforms that turn broadly shared intelligence into operational infrastructure for multiple security tools and teams.