Overview

OpenAEV brings adversarial security exercises and crisis-readiness work into a single platform for cybersecurity and crisis management teams. It is a strong fit for organizations that want threat-informed simulations alongside a way to measure exposure and practice coordinated response.

Its broad exercise scope is the draw; choosing between the free on-premise Community Edition and custom-priced Enterprise Edition is the key practical decision.

Key features

Threat-led simulation and attack chaining

OpenAEV builds breach and attack simulations from cyber threat intelligence, with scenarios mapped to MITRE ATT&CK and ATLAS. Teams can create custom scenarios and connect actions into attack paths based on findings. Chains can be orchestrated manually or autonomously with dedicated agents, while continuous scheduling, indicator enrichment, STIX/TAXII support, reporting, workflow automation, and case management support repeatable exercises. This combination suits teams that want to turn threat intelligence into structured validation work, but it is a broader operational platform than a tool focused only on running individual tests.

Coverage spans endpoints, asset groups, people, teams, network hosts, email, phishing landing pages, SMS, phone-based social engineering, media pressure, and tabletop exercises. That range lets teams exercise both technical controls and human coordination. It is especially relevant where security and crisis response need to be evaluated together, rather than in separate tools.

Readiness and exposure tracking

Structured tabletop exercises assess readiness across escalation, coordination, communication, and response. Adversarial Exposure Scoring tracks posture over time and maps coverage to MITRE ATT&CK and domain-based controls. Together, these capabilities connect simulated activity with a continuing view of exposure and team readiness.

Integrations and deployment

OpenAEV has 30+ integrations, including connections to OpenCTI, threat feeds, EDR/XDR, SIEM, and SOC playbooks. It supports cloud, on-premise, and multi-tenant deployments, with or without an endpoint agent; Enterprise Edition also offers air-gapped and bring-your-own-cloud options. Components are available as Docker images and manual installation packages, with Kubernetes recommended for production. The deployment range is useful for varied infrastructure and security requirements, though the on-premise route puts more operational responsibility on the organization.

Pricing

OpenAEV uses a freemium model with a free plan and a 30-day Enterprise SaaS trial. Community Edition costs 0.00 USD per free, billed Free forever, and is on-premise. It includes core attack simulation and tabletop exercises with community support. Its included capabilities cover OpenCTI security coverage integration, prepackaged scenarios, Threat Arsenal, atomic testing, scoring, CVE findings, alert fetching, and RBAC. This is the clearest choice for teams that can operate an on-premise deployment and do not require enterprise governance or vendor support.

Enterprise Edition has custom pricing, based on the number of instances, instance size, and support services. It is available as SaaS or on-premise and adds advanced integrations, AI features, and vendor support with SLAs. Governance includes SSO, full audit logging, data segregation, and advanced role-based access controls. The SaaS trial lasts 30 days. Enterprise includes a customer support portal and dedicated Customer Success Manager, with standard 8×5 and premium 24×7 support options. This tier is better suited to organizations that need those controls, deployment choices, or support commitments; teams should weigh those needs against a quote-based price.

Platforms

OpenAEV supports API, Linux, self-hosted, and web environments. Its hybrid attack simulation and deployment model gives teams options across cloud and on-premise operations, while Community Edition is on-premise.

Who it's for

OpenAEV is best suited to cybersecurity and crisis management teams that need to validate defenses and rehearse coordinated response in the same program. Organizations with suitable infrastructure and community support expectations can start with Community Edition. Teams requiring enterprise governance, air-gapped or bring-your-own-cloud deployment, or vendor SLAs should evaluate Enterprise Edition and its custom pricing. Filigran says its Enterprise Edition serves governments, financial institutions, and enterprises; the company lists SOC 2 Type 2, ISO 27001:2022, and GDPR trust items.

Pros and cons

Pro: Technical simulations, human-focused exercises, and exposure scoring sit together, helping teams connect security validation with crisis readiness.
Pro: Community Edition is free forever and includes core simulation and tabletop capabilities, giving on-premise teams a substantive starting point.
Pro: More than 30 integrations and cloud, on-premise, and multi-tenant deployments provide room to fit different security stacks and operating models.
Con: Community Edition is on-premise and community-supported, so it is not the fit for teams that need SaaS or vendor SLAs.
Con: Enterprise Edition pricing is quote-based, making cost harder to assess without instance and support requirements.

Alternatives

For focused, free testing rather than OpenAEV’s combined simulation and crisis-exercise scope, Atomic Red Team offers community-developed tests that run in five minutes or less with minimal setup, on API, Linux, macOS, and Windows. Keysight Eggplant Test is an enterprise software option with custom quote pricing and a free trial, spanning mobile, desktop, web, API, and Linux environments.

Picus Security Platform is a paid alternative with a 14-day trial capped at one simulation agent, a ransomware-only threat library, and vendor-specific recommendations for one techno. Skyhawk Security BAS is another paid option with a free trial and API and web support. Infection Monkey is a free-plan alternative for web, Windows, and Linux, while BlackNoise BAS is paid and supports self-hosted and web environments.

Cymulate Platform uses organization-tailored subscriptions priced by package, assets, and scenarios, with a free trial. PurpleSharp is a free-plan option for Windows. For broader category browsing, see Breach and Attack Simulation Software and Threat Intelligence Platforms.

Verdict

OpenAEV is a compelling choice for security and crisis teams that want threat-led simulations, tabletop exercises, and exposure tracking under one roof. Its free forever Community Edition makes the platform approachable for teams prepared to run it on-premise; look elsewhere or budget for Enterprise if SaaS, enterprise governance, or vendor-backed SLAs are requirements.

	OpenAEV	Yeti
Free plan	Yes	No
Free trial	Yes	No
Paid from	Free	—
Open source	No	No
Platforms	api, Linux, self-hosted, Web	Web
Free plan	Yes	Yes
Indicator enrichment	Yes	Yes
STIX/TAXII support	Yes	—
Report management	Yes	—
Workflow automation	Yes	Yes
Case management	Yes	—
Deployment	hybrid	self-hosted

OpenAEV vs Yeti

OpenAEV

Yeti