# Products and services

> An overview of Whisper: WhisperGraph, the engine and the data; Whisper Intelligence, which asks it questions; and Whisper Graph XDR, which turns its answers into enforcement — one account, one key, and which chapter documents which job.

*Source: https://www.whisper.security/docs/overview*

---
Whisper is one account, one key, and three tiers. **WhisperGraph** is the engine and the data. **Whisper Intelligence** and **Whisper Graph XDR** are the two products built on it. "The Whisper platform" is the plain descriptor for the pair; it is not a third thing to buy. This page says what each one is and which chapter documents it.

## WhisperGraph, the engine

WhisperGraph models the internet as one connected graph — naming and DNS, addressing and geography, routing, ownership, email posture, and threat intelligence, each layer joined to the next. Both products read it. Nothing else here stands on its own.

Start at [WhisperGraph](/docs/whisper-graph) for what the graph contains, or [Getting Started](/docs/whisper-graph/getting-started) to run a query straight away. Neither needs a key to begin.

## Whisper Intelligence: ask the graph about the world

Whisper Intelligence is the query side — anything you want to know about a host, address, network or certificate you do not own. Its documentation starts at [Cypher](/docs/cypher), the read-only query dialect. The [HTTP API](/docs/cypher-api) sends that dialect over the wire and the [CLI](/docs/cli) runs it from a terminal. [Workflows](/docs/workflows) run a prepared investigation in the browser without writing a query, and [Recipes](/docs/recipes) is the copy-paste Cypher those investigations are built from.

## Whisper Graph XDR: enforce it on your own estate

Whisper Graph XDR is the other direction — turning what the graph knows into what your own machines and agents are allowed to reach. Its documentation starts at [Agent Identity](/docs/identity), where an identity is a routable address a stranger can verify with `dig` and `curl` alone.

[Network & DNS](/docs/network) turns that identity into attributable egress and a policy-aware resolver, [Whalenet](/docs/whalenet) is the mesh between the nodes that hold one, and the [Control Plane API](/docs/control-plane) is the one call that mints, governs and revokes them. [Endpoint Security](/docs/endpoint) is the sensor that runs on a host, watching processes, files and connections, and reporting under that host's own identity. A firm that runs security for other companies works from [Partners](/docs/partners), reaching each customer's estate as that customer's own account.

## Reach either one from where you already work

Two chapters belong to both products rather than to one. [Agents & MCP](/docs/ai) connects any MCP-capable client to the live graph: read-only tools, a coverage-qualified verdict, and an evidence trail behind every answer — [Your first investigation](/docs/ai/mcp/investigation) works one alert end to end. [Integrations](/docs/integrations) puts the same answers inside the tools teams already run, so a verdict lands beside the alert instead of in a second tab.

## How the pieces meet

An agent gets an identity, so its egress is attributable and its lookups carry your policy. The sensor reports under that same identity, so a host's detections and its connections are one record rather than two to reconcile by hand. WhisperGraph scores what that object reached, an agent can ask it directly over MCP, and a firm working a book reads all of it, one estate at a time, with the customer's own key.