# What Is Cypher?

> Cypher is a declarative query language for graph databases. Originally developed at Neo4j and now standardized as openCypher (and ISO/IEC GQL), Cypher uses ASCII-art-like patterns — **(a)-[:KNOWS]->(b)** — to describe nodes, edges, and traversals. It reads like a sentence and maps directly to how analysts already think about graph problems.

*Source: https://www.whisper.security/glossary/cypher*
*Published: 2026-05-05*
*Last updated: 2026-05-05*

---

## A Cypher Query at a Glance

```
MATCH (h:HOSTNAME {name: "example.com"})-[:RESOLVES_TO]->(ip:IPV4)
        <-[:RESOLVES_TO]-(other:HOSTNAME)
WHERE other.name <> h.name
RETURN other.name, ip.name
ORDER BY other.firstSeen DESC
LIMIT 50
```

Read literally: find all hostnames that resolve to the same IP as **example.com**, exclude the original hostname, and return the 50 most recently observed.

## Why Cypher Beats SQL on Graph Problems

The same query in SQL would require a self-join on the resolutions table for every hop, with explicit join conditions and growing intermediate result sets. Cypher's pattern syntax compiles directly to graph traversal — no join planning, no cost surprises as the depth grows.

## Cypher and the AI Era

Every major LLM has been trained on enough Cypher to generate it fluently. Ask Claude or GPT-4 "give me Cypher to find domains that share a registrant with this domain" and the answer is correct on the first try most of the time. That is a structural advantage — proprietary query languages require fine-tuning or custom prompting just to be usable through an AI agent.

## Standardization Status

- **Cypher** — original Neo4j dialect.
- **openCypher** — open-source spec maintained by the openCypher project.
- **GQL (ISO/IEC 39075:2024)** — the first ISO graph query language standard, derived heavily from Cypher.

## Cypher in Whisper

[Whisper](https://www.whisper.security) implemented a full Cypher engine from scratch, tuned for the scale and shape of internet-infrastructure data. Analysts query directly via REST, SDKs, the Console, or — through [MCP](/glossary/mcp) — through any AI assistant. Read more on the [technology page](/products/engine).

## Related Terms

- [Knowledge Graph](https://www.whisper.security/glossary/knowledge-graph.md)
- [Mcp](https://www.whisper.security/glossary/mcp.md)
- [Infrastructure Intelligence](https://www.whisper.security/glossary/infrastructure-intelligence.md)