Glossary
What Is Choke Point Analysis?
Choke point analysis finds the single node that, when removed, severs the largest number of attack paths. In Whisper's external graph, a choke point is a shared-infrastructure node — a common IP, prefix, ASN, registrant, or data center — that ties an attacker's assets together.
What a choke point is
In attack path analysis, a choke point is a node that many attack paths pass through. Remediating one choke point neutralises more risk than fixing dozens of endpoints individually, which is why exposure-management frameworks prioritise choke points over raw vulnerability counts.
Inside an organisation, a choke point might be a service account every privilege-escalation path runs through. Across the open internet, the equivalent is a shared piece of infrastructure that multiple malicious assets depend on.
Choke points on the external graph
Whisper models external choke points as shared nodes in the graph. A cluster of phishing domains might all resolve to one IP; a campaign's domains might all sit on one announced prefix or be routed by one bulletproof ASN; a set of lookalikes might share a registrant email or a nameserver. That shared node is the choke point — block, sinkhole, or report it and the whole cluster degrades at once.
Because Whisper pre-joins DNS, routing, ownership, and physical layers, choke points that span layers become visible in a single query. A shared /24 or upstream ASN that flat DNS tools never see is one traversal away, and the same query returns the threat verdict on the shared node so you can confirm the choke point is worth severing.
Why cross-layer matters
A choke point is only as good as the layers you can see. DNS-only tools find shared nameservers but miss shared routing; routing monitors find shared prefixes but miss shared registrants and web links. Whisper joins all of them, so the analysis isn't confined to one layer.
That makes it possible to ask a question internal-only and single-layer tools can't: across web, DNS, routing, and physical infrastructure, which single node carries the most of this attacker's paths? The answer is the choke point — and on Whisper it's a query result, not a manual correlation exercise.
See it in practice
Run it live in these use cases: Trace the external attack path.