Filigran promotes attack-chain testing for exposure validation

Filigran is positioning Attack Chaining in its OpenAEV platform as a way to test multi-stage intrusions rather than individual security techniques. The company says the capability automates end-to-end attack paths, using the result of one action to determine the next, and can run simulations in minutes rather than the weeks associated with some manual red-team exercises.

The argument addresses a gap in conventional breach-and-attack simulation programmes. A security team may test whether an EDR agent detects a payload, a phishing exercise produces clicks, or a SIEM rule fires for a specific technique. Those tests can validate a control, but they do not necessarily show whether an attacker can combine several steps—from initial access and credential abuse to lateral movement, data staging and exfiltration.

Why isolated validation can miss an intrusion path

Filigran cites its State of Threat Management report, in which 93% of security leaders said their organisation had suffered a business-impacting cyberattack in the previous 12 months. The report also found that 88% believed AI was accelerating attackers after they gained access, while 84% identified siloed tools and disconnected testing as a principal reason exposures remain unnoticed until exploitation.

The company points to the 2025 breach of France's tax authority, DGFiP, as an example of how a coordinated sequence can turn individually survivable weaknesses into a significant incident. The source describes a path involving initial access, credential abuse, lateral movement and exfiltration, rather than a single unusual technique.

This distinction matters because a control can work when assessed alone while the overall route still remains viable. A missed detection, an unaddressed permission problem or a usable credential can become the link that enables the next stage. The relevant resilience question is therefore whether the sequence is interrupted, not simply whether a catalogue of separate techniques has been checked.

Conditional paths and explicit guardrails

OpenAEV Attack Chaining is presented as an engine for reusable, conditional attack logic. Teams can combine TTPs, payloads, custom actions and library content, then specify what should happen if a credential is valid or a control blocks a step. Findings such as credentials, IP addresses, tokens and files are retained as structured outputs that can feed subsequent actions.

Filigran says paths render on an interactive graph as they unfold, allowing teams to inspect every hop, pivot and finding. The stated purpose is to identify chokepoints: a single remediation point that would collapse activity downstream, instead of generating an undifferentiated list of findings.

The platform also applies defined limits for in-scope assets, permitted actions and escalation depth. Social-engineering stages, including phishing emails, SMS lures and fake landing pages, can supply a click, reply or submitted credential to later steps in the same chain.

Operator-led and autonomous modes

In operator-led mode, a human builds the conditional logic and controls execution. Filigran also offers Autonomous Attack Chaining through XTM One, where an operator supplies an objective and scope and an AI orchestrator plans, executes and adapts the path. The orchestrator can use specialist agents for payload creation, code generation, reconnaissance and exploitation, and may generate phishing emails or landing pages when social engineering is part of the objective.

Both modes use the same conditional engine and scope controls, with outcomes feeding a unified exposure score. For businesses, the practical implication is to complement isolated control checks with controlled, repeatable tests of realistic multi-stage paths, then prioritise the chokepoints that prevent an intrusion from progressing.