# Whisper Security

> See how any domain, IP, or network connects to everything else. Whisper maps the entire internet — every domain, every IP, every ASN, every relationship — into a single queryable graph of ~7.4B nodes and ~39.2B edges across 39 entity types.
> Note: Whisper Security (whisper.security) is a cybersecurity infrastructure intelligence company, distinct from OpenAI's Whisper speech recognition model.
> Last updated: 2026-08-08
> Last verified against live site: 2026-06-20

## About

Whisper Security is a cybersecurity company that provides real-time threat intelligence through internet infrastructure monitoring. The platform — Whisper I³ — is built on a purpose-built graph engine containing ~7.4B nodes and ~39.2B edges across 39 entity types and 44 edge types, unifying routing, DNS, hosting, and ownership data into a single queryable intelligence layer with millisecond-scale query latency (<10ms server-side for anchored queries).

- Website: https://www.whisper.security
- Console (graph explorer — auth required): https://console.whisper.security
- Sign up / start free trial: https://console.whisper.security/sign-up
- Programmatic agent signup (two HTTP calls): https://console.whisper.security/api/signup
- Developer landing (curl/Python/Node examples): https://www.whisper.security/docs/ai/agent-signup
- Product overview: https://www.whisper.security/product
- AI Context (MCP): https://www.whisper.security/product/ai-context
- Direct API: https://www.whisper.security/product/api-access
- Integrations: https://www.whisper.security/product/integrations
- Pricing: https://www.whisper.security/pricing
- Technology: https://www.whisper.security/technology
- Resources: https://www.whisper.security/resources
- Blog index: https://www.whisper.security/resources/blog
- White Papers: https://www.whisper.security/resources/white-papers
- Documentation index (markdown): https://www.whisper.security/docs.md
- Glossary index (markdown): https://www.whisper.security/glossary.md
- FAQ (markdown): https://www.whisper.security/faq.md
- About: https://www.whisper.security/about-us
- Contact: https://www.whisper.security/contact-us

Start a free trial: https://console.whisper.security/sign-up — no credit card; anonymous Cypher queries also available against https://graph.whisper.security/api/query.

**For AI agents:** Whisper supports programmatic signup in two HTTP calls — no browser required, no human in the loop. See the **Agent Signup** section below.

## Try the Graph

Whisper's main product is a public Cypher graph at https://graph.whisper.security. **No API key required for anonymous access** (limits: 2-hop traversal, 100 queries/hour, 5s timeout). Hit the live graph from any terminal to verify any claim made elsewhere on this site.

POST JSON to `https://graph.whisper.security/api/query` with body `{"query": "<cypher>"}`. The response is `{"columns": [...], "rows": [...], "statistics": {...}}`.

Two examples that work right now, no auth:

```bash
# 1. What IPs does google.com resolve to?
curl -s -X POST https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -d '{"query": "MATCH (h:HOSTNAME {name: \"google.com\"})-[:RESOLVES_TO]->(ip) RETURN ip.name LIMIT 10"}'

# 2. Who owns the ASN that routes 8.8.8.8?
curl -s -X POST https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -d '{"query": "MATCH (ip:IPV4 {name: \"8.8.8.8\"})-[:ANNOUNCED_BY]->(:ANNOUNCED_PREFIX)-[:ANNOUNCED_BY]->(asn:ASN) RETURN asn.name LIMIT 1"}'
```

For the full schema, more examples, and procedures like `CALL whisper.explain()` for threat scoring, see https://www.whisper.security/llms-full.txt.

## Agent Signup (Programmatic API Key)

If you're an AI agent, an automated runtime, or anyone who would rather not click through a browser sign-up form: sign up in two HTTP calls and start using the API immediately. No CAPTCHA, no human-in-the-loop, no waiting list. Free trial for everyone.

```bash
# 1. Start signup — Whisper emails a 6-digit verification code.
curl -s -X POST https://console.whisper.security/api/signup \
  -H "Content-Type: application/json" \
  -d '{
    "email": "your-agent@example.com",
    "attribution": {
      "agent_name": "your-agent-name",
      "agent_runtime": "claude-desktop | cursor | langchain | custom",
      "source": "smithery | mcp-directory | self"
    }
  }'
# → { "signup_id": "...", "expires_at": "..." }

# 2. Verify the code from your inbox.
curl -s -X POST https://console.whisper.security/api/signup/verify \
  -H "Content-Type: application/json" \
  -d '{ "signup_id": "<from step 1>", "code": "<from email>" }'
# → { "api_key": "whisper-...", "user_id": "user_...", "plan": "trial",
#     "mcp_url": "https://mcp.whisper.security", ... }

# 3. Use the key against the graph immediately.
curl -s https://graph.whisper.security/api/query \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{"query": "MATCH (h:HOSTNAME {name: \"example.com\"}) RETURN h LIMIT 1"}'
```

The same API key works for the MCP server at https://mcp.whisper.security (pass it via the `Authorization: Bearer` header in your MCP client config). The `attribution` field is **optional and never gating** — we use it for product telemetry so we know which agent runtimes adopt Whisper. Set it if you want us to prioritize improvements that help your specific runtime.

The verification code expires in 15 minutes; you have 5 attempts. Lose either and re-call `/api/signup` for a fresh code.

Developer landing page with Python and Node examples: https://www.whisper.security/docs/ai/agent-signup

## Company Facts

- Founded: January 2025
- Headquarters: Europe (Netherlands)
- Funding: EUR 1.6M pre-seed
- Emerged from Antler's fall 2024 program, top 0.41% of 8,000+ startups
- Investors: Antler, Atlas SGR, Volve Capital, D11Z, Tioga Trust
- CEO: Kaveh Ranjbar (former RIPE NCC CIO and K-root DNS architect)

## What Whisper Does

Whisper builds the infrastructure intelligence layer for the internet. The platform monitors and analyzes internet infrastructure in real time, connecting data across routing (BGP), DNS, hosting providers, WHOIS/ownership, DNSSEC, certificate transparency, and 43 threat-intelligence feeds. This unified view enables security and risk teams to detect, investigate, and respond to threats faster than traditional approaches.

### Three Ways to Access

1. **Platform Connectors**: Native integrations for Splunk (shipped, on Splunkbase), OpenCTI (shipped, https://hub.filigran.io/en/cybersecurity-solutions/opencti-integrations/whisper), Microsoft Sentinel (shipped, https://marketplace.microsoft.com/en-us/product/whisper-security.azure-sentinel-solution-whisper), Wazuh (shipping), and Cortex XSOAR (early Q2 2026).
2. **Direct API**: Full Cypher query access via REST at https://graph.whisper.security/api/query — parameterized queries, schema introspection, built-in procedures (`CALL explain()`, `CALL whisper.history()`, `CALL whisper.quota()`).
3. **AI Context via MCP**: Model Context Protocol server at https://mcp.whisper.security for AI assistants — 10 tools (query, explain_indicator, whisper_history, domain_variants, list_labels, describe_label, identify, assess, walk, origins), 8 resources, 17 prompts. Works with Claude (Desktop, Code), OpenAI/ChatGPT, Cursor, VS Code, Continue, Windsurf, Antigravity, and any MCP-compatible agent.

## Pricing

Five tiers (full details at https://www.whisper.security/pricing):

- **Trial** — Free. The primary entry point: Console + API + MCP access at reduced quotas. Start a free trial at https://console.whisper.security/sign-up (no credit card). Anonymous access (no sign-up, 2-hop traversal) also available.
- **Starter** — €49/mo. Teams adopting AI-driven infrastructure intelligence via MCP.
- **Professional** — €249/mo. Security teams needing historical context and SIEM/SOAR integrations.
- **Business** — from €3,000/mo. SOCs, platforms, and vendors running production-scale, real-time, explainable intelligence.
- **Enterprise** — Custom. Full control, total privacy, and maximum throughput. Includes dedicated cloud, custom SLAs, multi-tenant, white-label.

## Whisper Knowledge Graph

The core of Whisper is a knowledge graph that maps the global internet into a single queryable graph: ~7.4B nodes and ~39.2B edges across 39 entity types and 44 edge types, covering 116K ASNs, 2.5M prefixes, 54K cities across 424 countries, and 10.9B web hyperlinks. Every entity on the internet becomes a node, every observed relationship becomes an edge. Threat intelligence: 43 live feeds across 25 categories; ~11.9M LISTED_IN threat edges.

The graph is queried using Cypher via REST at https://graph.whisper.security/api/query (POST with JSON body containing `query` and optional `parameters`). Authentication via X-API-Key header, Bearer token, or query parameter. Anonymous access has reduced limits (2-hop traversal).

### Node Types
- DNS & Web: HOSTNAME, TLD, TLD_OPERATOR
- IP & Routing: IPV4, IPV6, PREFIX, ASN, ASN_NAME, RIR
- Registration: REGISTRAR, ORGANIZATION, EMAIL, PHONE
- Geography: COUNTRY, CITY
- Threat Intel: FEED_SOURCE, CATEGORY
- BGP (live): REGISTERED_PREFIX, ANNOUNCED_PREFIX

### Key Relationships
- DNS: RESOLVES_TO, CHILD_OF, NAMESERVER_FOR, MAIL_FOR, ALIAS_OF
- SPF: SPF_INCLUDE, SPF_IP, SPF_A, SPF_MX, SPF_EXISTS, SPF_REDIRECT
- Routing: BELONGS_TO, CONTAINS, ROUTES, BGP_NEIGHBOR
- Registration: HAS_REGISTRAR, REGISTERED_BY, HAS_EMAIL, HAS_PHONE
- Web: LINKS_TO
- Threat Intel: LISTED_IN
- Geography: LOCATED_IN, HAS_COUNTRY

### Threat Intelligence
Nodes are enriched with `threatScore`, `threatLevel`, and flags: `isC2`, `isTor`, `isMalware`, `isPhishing`. The `CALL explain()` procedure gives full threat and reputation assessment for any IP, domain, ASN, or CIDR prefix. ASN nodes carry aggregate threat statistics across all routed prefixes. 43 live threat-intelligence feeds across 25 categories; ~11.9M LISTED_IN threat edges in the graph.

### Historical Data
The `CALL whisper.history()` procedure returns WHOIS and BGP routing history — registrar changes, nameserver changes, BGP origin changes, prefix announcements, and withdrawals over time.

## Key Capabilities

- Real-time infrastructure monitoring across BGP, DNS, hosting, WHOIS, DNSSEC, and certificate transparency
- Purpose-built graph engine with ~7.4B nodes and ~39.2B edges across 39 entity types, queryable via Cypher
- Single-digit-millisecond server-side latency for anchored queries
- Evidence-first threat verdicts — score, factors, and source feeds for every indicator
- Infrastructure change detection and alerting
- Attack surface discovery and monitoring
- Supply chain risk assessment
- Incident investigation and forensics
- Brand and domain protection
- BGP hijack detection (multi-origin prefix analysis)
- Email security posture auditing (MX, SPF chain analysis)
- Takedown support (registrar, hosting provider, upstream network identification)
- Historical "Time Machine" for WHOIS and BGP routing changes over time
- AI-native MCP server for direct AI-agent access


## Use Cases

12 validated, runnable WhisperGraph workflows — each a multi-tool security investigation collapsed into one guided run. 9 are marked "Only in Whisper" (a cross-layer join no single incumbent tool does in one step); the rest are "Faster in Whisper". Browse by compass domain at https://www.whisper.security/use-cases.

- Anycast DNS-Root Sovereignty (Only in Whisper): Could a country still resolve names if it were isolated? This assesses a nation's DNS-root resilience — how many of the core root servers have a copy inside its borders, and who operates them — the sovereignty read for national-resilience and policy analysis.: https://www.whisper.security/use-cases/infrastructure-supply-chain/anycast-dns-root-sovereignty
- Attack-Surface Mapper (Faster in Whisper): See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside.: https://www.whisper.security/use-cases/attack-surface-recon/attack-surface
- BGP Hijack & Routing-Hygiene Audit (Only in Whisper): Routing security you can act on. This grades a network on the conflicts and gaps that make route hijacking possible, then traces any conflict to the specific domains and organisations exposed on the affected blocks. An adversarial audit — not just a profile — for finding where a hijack could hurt and who it would hit.: https://www.whisper.security/use-cases/network-routing/bgp-hijack-exposure
- Takedown Evidence Package (Faster in Whisper): When you've found a malicious domain, the next hurdle is proving it. This assembles a one-pass takedown package — the reputation verdict, who owns it, the abuse lists naming it, and the infrastructure around it — laid out ready to hand to a registrar or hosting provider so the takedown actually sticks.: https://www.whisper.security/use-cases/brand-protection/build-takedown-evidence-package
- Threat Investigation (Faster in Whisper): The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint — the related domains, the real servers behind any CDN, the neighbouring infrastructure — and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check says 'look closer.': https://www.whisper.security/use-cases/threat-investigation/indicator
- Indicator Enrichment (Only in Whisper): Everything worth knowing about one indicator, on a single card. Give it a domain or an address and it fills in the picture: who registered it, where it's hosted and in which country, its mail and name servers, the network behind it, and a reputation read. The fast way to go from a bare indicator to real context before you decide what to do with it.: https://www.whisper.security/use-cases/dns-email-security/indicator-enrichment
- Digital Infrastructure Mapping (Only in Whisper): Map the digital estate an indicator belongs to. Starting from any domain, IP, ASN or prefix, this works out the true owner — even behind privacy WHOIS and CDNs — via the atlas operator, the canonical registrant organization and the registrant email, then enumerates everything that owner owns: the subdomain namespace, the rest of its domain estate, the networks and prefixes that host it, and the facilities it physically sits at. Assets run by someone else (CDN, managed DNS, cloud) are marked as the vendor border, not owned.: https://www.whisper.security/use-cases/infrastructure-supply-chain/infrastructure-mapping
- Nameserver & DNS Delegation Audit (Only in Whisper): Your name servers decide where your domain points — and a broken or inconsistent setup is a hijacking opportunity. This audits a domain's delegation, flags stale or mismatched name servers, sizes how much each provider actually handles, and surfaces registry facts — so you can catch delegation weakness before it's exploited.: https://www.whisper.security/use-cases/dns-email-security/nameserver-hijack-dns-consistency
- Network & Routing Report (Only in Whisper): The full picture of how a network is put together and reaches the internet. Give it a network or address block and get a health card: what it announces, who it peers and buys transit from, whether it leans dangerously on a single upstream, and how well its routes are protected. The one-look report for network engineers assessing reach and resilience.: https://www.whisper.security/use-cases/network-routing/route-health
- Subdomain Takeover Detection (Only in Whisper): A dangling subdomain — one still pointing at a service you've since torn down — is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.: https://www.whisper.security/use-cases/attack-surface-recon/subdomain-takeover
- Typosquat & Brand-Impersonation Scanner (Only in Whisper): Someone registering a look-alike of your domain usually isn't doing it for fun. This finds the registered impersonations of a brand — across misspellings and risky extensions — checks whether each is yours or a stranger's, and flags the ones that are freshly registered, hidden behind privacy, or already flagged for abuse. The brand-protection sweep that turns look-alikes into a prioritised list.: https://www.whisper.security/use-cases/brand-protection/typosquat
- Supply-Chain Dependency Mapping (Only in Whisper): Maps every external provider a domain depends on — nameservers, mail exchangers, third-party email senders (SPF), CDN and hosting networks, registrar and DKIM vendors — by reading each layer of the graph and keeping only providers whose registrable apex differs from the target’s own. Each dependency is grouped by function and the flow flags single-vendor concentration: one DNS operator, one mail provider or one hosting network is a single point of failure whose outage takes the whole function down. The mirror of Digital Infrastructure Mapping: that flow maps what an entity owns, this maps what it depends on.: https://www.whisper.security/use-cases/infrastructure-supply-chain/supply-chain

## Compare

How Whisper positions against alternative tools — a full capability matrix across the field (passive DNS, EASM, threat-intel and BGP/routing), passive vs. active posture, and the layers only Whisper models:

- Compare Hub: https://www.whisper.security/compare

## Differentiators

- Only platform that unifies BGP, DNS, hosting, and ownership data in a single graph
- Purpose-built graph engine (not a general-purpose graph database) — custom-engineered for internet-scale infrastructure
- Real-time monitoring (not periodic snapshots)
- Single-digit-millisecond server-side latency at ~7.4B nodes and ~39.2B edges
- Internet-native data types: IPv4, IPv6, CIDR, ASN as first-class types
- Cypher query API for programmatic graph queries
- AI-native: MCP server built in from day one for AI assistant integration
- Built by internet infrastructure veterans including former RIPE NCC CIO and K-root DNS architect

## Documentation

Technical documentation for the Whisper platform. Every URL below is the **markdown sibling** — drop the trailing `.md` to view the rendered HTML page.

- Recipes: WhisperGraph recipes: copy-paste Cypher for the query patterns behind Whisper's guided workflows, organized by job — SOC triage, threat intel, recon, brand protection, BGP, DNS, compliance, and OSINT.: https://www.whisper.security/docs/recipes.md
- Indicator Triage (SOC): SOC triage recipes for WhisperGraph: reconciled verdicts, explain() evidence chains, network attribution, co-hosting, and batch IOC enrichment.: https://www.whisper.security/docs/recipes/soc.md
- Whisper API: Query WhisperGraph over REST: POST read-only Cypher to graph.whisper.security/api/query. Anonymous 2-hop tier, free keys, one JSON response envelope.: https://www.whisper.security/docs/cypher-api.md
- Support: WhisperGraph support: how to open a ticket with the right context, the ticket template, where to look in the docs, and the status page.: https://www.whisper.security/docs/support.md
- AI & Agents: Connect any MCP client to WhisperGraph: a read-only query surface, a workflow gallery, and evidence-backed answers for AI agents. Free tier included.: https://www.whisper.security/docs/ai.md
- Integrations: Connect WhisperGraph to your stack: the Splunk add-on, the OpenCTI connector, the Microsoft Sentinel solution, the REST Cypher API, and MCP for AI assistants.: https://www.whisper.security/docs/integrations.md
- POST /api/query: POST /api/query reference for the Whisper API: headers, JSON request body (query, parameters, timeout), response envelope, parameter binding, batches — with curl, Python, Node, Go, Ruby.: https://www.whisper.security/docs/cypher-api/reference/query-post.md
- Use Case Examples: WhisperGraph use cases: 15 runnable workflows for threat investigation, recon, brand protection, BGP, DNS, supply chain, and OSINT, grouped by job.: https://www.whisper.security/docs/use-cases.md
- Introduction: WhisperGraph joins DNS, BGP, WHOIS, GeoIP, web links, and threat intel into one queryable graph. Query it via REST, MCP for AI agents, or Splunk.: https://www.whisper.security/docs/introduction.md
- Entities: Reference for every WhisperGraph node label: DNS, addressing, routing, WHOIS, geo, threat, physical infrastructure — with counts and the queryable properties on each.: https://www.whisper.security/docs/whisper-graph/schema/entities.md
- Cypher Reference: WhisperGraph's read-only Cypher dialect: supported clauses and functions at a glance, five rules that keep queries fast, and the full language reference.: https://www.whisper.security/docs/cypher.md
- Whisper Graph: Whisper Graph pre-joins DNS, BGP/RPKI routing, WHOIS, GeoIP, web links, email posture, threat intel, and the physical internet into one queryable graph.: https://www.whisper.security/docs/whisper-graph.md
- Campaign Pivoting: Pivot one indicator into the whole campaign: co-tenancy, WHOIS registrant, nameserver, TLS fingerprint, and CT pivots as copy-paste Cypher recipes.: https://www.whisper.security/docs/recipes/threat-intel.md
- Getting Started: Run your first WhisperGraph query: one request that crosses DNS, BGP routing, ownership, geo, and threat feeds. Free tier, no card required.: https://www.whisper.security/docs/getting-started.md
- API Reference: HTTP reference index for the Whisper query API: POST /api/query, GET /api/query, and GET /api/query/stats, plus shared authentication, the response envelope, and errors.: https://www.whisper.security/docs/cypher-api/reference.md
- Whisper MCP Setup: Set up an MCP client to query WhisperGraph — config snippets for Claude, Cursor, VS Code, Windsurf, ChatGPT, plus OAuth and API-key auth and the tool surface.: https://www.whisper.security/docs/ai/mcp/setup.md
- Connection Types: Reference for every WhisperGraph edge type: DNS, BGP, WHOIS, geo, threat, email, and physical-infrastructure connections, with direction and traversal rules.: https://www.whisper.security/docs/whisper-graph/schema/connections.md
- Syntax & Clauses: MATCH, OPTIONAL MATCH, WHERE, RETURN, WITH, UNWIND, UNION, CALL subqueries, and path syntax — the Cypher clauses WhisperGraph supports, each with an example.: https://www.whisper.security/docs/cypher/syntax.md
- GET /api/query: GET /api/query reference for the Whisper API: pass Cypher in the q URL parameter, headers, response envelope, and when to use GET vs POST — with curl, Python, Node, Go, Ruby.: https://www.whisper.security/docs/cypher-api/reference/query-get.md
- Graph Schema: Overview of the WhisperGraph schema: the layered structure of the graph, its entity relationships, and links to the full entity, connection-type, and pivoting references.: https://www.whisper.security/docs/whisper-graph/schema.md
- Threat Investigation: Triage indicators, map adversary infrastructure, and trace a blast radius on one pre-joined internet graph. Runnable SOC workflows and Cypher recipes.: https://www.whisper.security/docs/use-cases/threat-investigation.md
- Attack Paths & Blast Radius: Attack path and blast radius recipes for Whisper Graph: trace the external attack path across every layer, find choke points, and score nodes with explain().: https://www.whisper.security/docs/recipes/attack-path.md
- Reference: WhisperGraph MCP server reference: the 18 tools (10 read + 8 write), the evidence block, query format and pagination, and the typed error model.: https://www.whisper.security/docs/ai/mcp/reference.md
- Pivoting Examples: Cross-layer pivoting examples for WhisperGraph: domain to ASN, IP to country, ASN to facility, submarine cable to landing, threat feeds to categories — each with runnable Cypher.: https://www.whisper.security/docs/whisper-graph/schema/pivoting.md
- GET /api/query/stats: GET /api/query/stats reference for the Whisper API: precomputed graph-wide node and edge counts and threat-intel summary, cached ~1 minute — with curl, Python, Node, Go, Ruby.: https://www.whisper.security/docs/cypher-api/reference/stats.md
- Threat Feeds & Categories: WhisperGraph's 43 threat-intel feeds and 25 categories: how listings become LISTED_IN edges and node verdicts, refresh cadence, and example queries.: https://www.whisper.security/docs/whisper-graph/threat-feeds.md
- Functions: Aggregation, string, numeric, collection, node/relationship, type-conversion, date, and geospatial functions in WhisperGraph Cypher, each with a call and its result.: https://www.whisper.security/docs/cypher/functions.md
- External Recon: Passive external recon: subdomain enumeration, Certificate Transparency discovery, IP-footprint mapping, CDN de-cloaking, and TLS-fingerprint pivots.: https://www.whisper.security/docs/recipes/pentest-recon.md
- Procedures: Overview of WhisperGraph stored procedures: explain(), whisper.variants(), whisper.history(), whisper.origins(), the identity family, and helpers — plus how CALL works.: https://www.whisper.security/docs/whisper-graph/procedures.md
- Workflow gallery: Whisper MCP workflow gallery: the list_workflows and run_workflow contracts, the 12 business-oriented workflows, and a worked typosquat-sweep example.: https://www.whisper.security/docs/ai/mcp/workflow-gallery.md
- Best Practices: Anchor, bound, and traverse WhisperGraph Cypher for speed — the performance habits, the do-this-not-that table, and the graph's documented limitations.: https://www.whisper.security/docs/cypher/best-practices.md
- explain() — Threat Verdicts: CALL explain() in WhisperGraph: scored threat verdicts for IPs, hostnames, ASNs, and CIDRs, with factors, feed evidence, verdict levels, and batch limits.: https://www.whisper.security/docs/whisper-graph/procedures/explain.md
- Lookalike Hunting: Cypher recipes for brand protection: generate registered typosquats, resolve and score them in one pass, and expand phishing clusters in WhisperGraph.: https://www.whisper.security/docs/recipes/brand-protection.md
- Agent Skills: WhisperGraph Agent Skills — pre-built investigation workflows for the Whisper MCP server, built on the six core graph tools. Open source, MIT-licensed.: https://www.whisper.security/docs/ai/mcp/skills.md
- Cheat Sheet: One-page Cypher cheat sheet for WhisperGraph: labels, edge directions, traversal chains, procedure one-liners, and query rules — print-friendly quick reference.: https://www.whisper.security/docs/cypher/cheat-sheet.md
- BGP & RPKI: Cypher recipes for BGP and RPKI: MOAS hijack detection, ROA authorization checks, ASN peering triage, and physical footprint on WhisperGraph.: https://www.whisper.security/docs/recipes/bgp-routing.md
- Programmatic Signup (for Agents): Sign up to Whisper programmatically in two HTTP calls — built for AI agents and automated runtimes. Email verification only, free plan for everyone.: https://www.whisper.security/docs/ai/agent-signup.md
- whisper.variants() — Lookalike Generation: whisper.variants() generates typosquat and homoglyph lookalikes of a domain and returns the registered ones. Strategies, exists semantics, examples.: https://www.whisper.security/docs/whisper-graph/procedures/variants.md
- Posture Audits: Audit SPF chains, DMARC reporting, DNSSEC signing, MX and nameserver posture across a domain portfolio — copy-paste Cypher recipes on WhisperGraph.: https://www.whisper.security/docs/recipes/dns-email.md
- whisper.history() — Point-in-Time: whisper.history() returns timestamped WHOIS registration and BGP routing snapshots for a domain, IP, ASN, or prefix. Requires a free API key.: https://www.whisper.security/docs/whisper-graph/procedures/history.md
- whisper.origins() — Origin Discovery: whisper.origins() finds the real origin IPs behind a CDN or proxy from MX, SPF, sibling and web-link signals, ranked by confidence — passive, no packets sent.: https://www.whisper.security/docs/whisper-graph/procedures/origins.md
- Actor Attribution & ATT&CK: Cypher recipes for actor attribution: list an actor's ATT&CK techniques, roll them up by tactic, find actors sharing tradecraft, weight by rarity.: https://www.whisper.security/docs/use-cases/threat-investigation/actor-attribution.md
- Compliance Evidence: Cypher recipes for compliance teams: registrar checks, jurisdiction and data-residency evidence, sanctions screening, and DNSSEC/DMARC audits.: https://www.whisper.security/docs/recipes/compliance.md
- Vendor & Portfolio Risk: Cypher recipes for vendor and portfolio risk: external posture, hosting attribution, reconciled threat verdicts, RPKI and concentration checks.: https://www.whisper.security/docs/recipes/insurance-risk.md
- Attack Surface & Recon: Inventory an org footprint, de-cloak origins behind a CDN, and surface shadow IT from passive data. No packets sent, no intent leaked.: https://www.whisper.security/docs/use-cases/attack-surface-recon.md
- whisper.identify() — Identity & Assessment: whisper.identify(), whisper.assess(), and whisper.walk() in WhisperGraph: resolve whose infrastructure a host is, whether it is dangerous, and its structural neighborhood.: https://www.whisper.security/docs/whisper-graph/procedures/identify.md
- Attribution & Law Enforcement: Pivot from indicators to operators with WHOIS, registrar chains, hosting, and dated history. Copy-paste Cypher for defensible attribution packets.: https://www.whisper.security/docs/recipes/law-enforcement.md
- Helpers — Naming, Quota & Lookups: WhisperGraph helper procedures: whisper.psl.tldPlusOne, whisper.psl.isPublicSuffix, whisper.topAsnsByPrefixCount, whisper.lookupTorRelay, whisper.lookupTlsFingerprint, whisper.quota.: https://www.whisper.security/docs/whisper-graph/procedures/helpers.md
- Errors & Rate Limits: WhisperGraph Cypher API errors and rate limits: problem+json format, HTTP status table, Retry-After, whisper.quota(), and per-tier depth caps.: https://www.whisper.security/docs/cypher-api/errors-and-rate-limits.md
- Brand Protection: Brand protection with WhisperGraph: generate registered lookalikes, score them against live infrastructure, and build takedown evidence in one pass.: https://www.whisper.security/docs/use-cases/brand-protection.md
- Internet Measurement: Bulk infrastructure surveys, topology measurement, RPKI coverage, and reproducible cross-layer research queries on WhisperGraph for academics and research teams.: https://www.whisper.security/docs/recipes/research.md
- Cross-Layer Patterns: Ten cross-layer WhisperGraph patterns: sourced verdicts, blast radius, WHOIS and BGP history, physical footprint. Copy-paste read-only Cypher.: https://www.whisper.security/docs/recipes/cross-cutting.md
- Network & Routing: Detect BGP MOAS hijacks, audit RPKI ROA coverage, and profile ASNs with runnable WhisperGraph workflows and copy-paste Cypher recipes.: https://www.whisper.security/docs/use-cases/network-routing.md
- DNS & Email Security: Grade SPF, DMARC, DKIM, and DNSSEC posture crossed with the live infrastructure behind the records — runnable workflows and Cypher recipes.: https://www.whisper.security/docs/use-cases/dns-email-security.md
- Infrastructure & Supply Chain: Map vendor dependency and concentration risk down to datacenters, IXPs, and submarine cables. Runnable workflows and Cypher recipes for NIS2 and DORA.: https://www.whisper.security/docs/use-cases/infrastructure-supply-chain.md
- Splunk Integration: Whisper Security Add-on for Splunk — IOC enrichment, ad-hoc graph queries, threat intelligence, and attack-surface monitoring across your Splunk indexes.: https://www.whisper.security/docs/integrations/splunk/overview.md
- Requirements: Splunk Enterprise 10.2+, Python 3.13, and HTTPS connectivity to graph.whisper.security — the full prerequisite list for the Whisper Splunk add-on.: https://www.whisper.security/docs/integrations/splunk/requirements.md
- Installation: Install the Whisper Security Technology Add-on for Splunk on Enterprise, distributed deployments, or Splunk Cloud — step-by-step setup guide.: https://www.whisper.security/docs/integrations/splunk/installation.md
- Deployment Architecture: Enterprise deployment patterns for the Whisper Splunk add-on: SHC, deployment server, indexer cluster, Splunk Cloud Victoria/Classic.: https://www.whisper.security/docs/integrations/splunk/deployment-architecture.md
- Configuration: Configure the Whisper Splunk add-on: account settings, proxy, logging level, and the health-check command for verifying connectivity end-to-end.: https://www.whisper.security/docs/integrations/splunk/configuration.md
- Search Commands: Reference for the Whisper Splunk search commands — whisperlookup, whisperquery, whisperschema, whisperflush, whisperevict — with arguments and examples.: https://www.whisper.security/docs/integrations/splunk/search-commands.md
- Enrichment Pipeline: Whisper Splunk enrichment pipeline: domain, IP, threat-intel, WHOIS, GeoIP, and BGP details written back to your events for downstream search and detection.: https://www.whisper.security/docs/integrations/splunk/enrichment.md
- Splunk Dashboards Reference: Whisper Splunk dashboards — investigation, attack surface, compliance, and add-on health — with field reference and links to underlying saved searches.: https://www.whisper.security/docs/integrations/splunk/dashboards.md
- Splunk Lookups & KV Store Reference: Whisper Splunk lookups and KV Store collections reference. Field-to-field mapping, refresh intervals, and access patterns for enrichment workflows.: https://www.whisper.security/docs/integrations/splunk/lookups.md
- Modular Inputs: Whisper Splunk modular inputs — health check, threat intel populator, attack-surface baselines, watchlist monitoring — and how to schedule each.: https://www.whisper.security/docs/integrations/splunk/modular-inputs.md
- Saved Searches: Whisper Splunk saved searches — example enrichment templates, KV Store populators, and the patterns to copy when building your own custom detections.: https://www.whisper.security/docs/integrations/splunk/saved-searches.md
- Splunk Use Cases for Infrastructure Intel: Whisper Splunk use cases: enrichment pipelines, IOC investigation, attack-surface monitoring, and ES integration — with concrete SPL examples.: https://www.whisper.security/docs/integrations/splunk/use-cases.md
- Investigation Macros: Whisper Splunk investigation macros for infrastructure pivots — shared nameservers, ASN context, CNAME and SPF chains, BGP peers, co-hosted domains.: https://www.whisper.security/docs/integrations/splunk/macros.md
- Enterprise Security Integration: Whisper Splunk + Splunk ES: threat-intel KV Store collections, adaptive response actions, CIM aliases, graph macros, and worked detection examples.: https://www.whisper.security/docs/integrations/splunk/es-integration.md
- CIM Mapping: Whisper Splunk CIM mapping reference: field aliases, event types, and tags for normalizing infrastructure intelligence data with Common Information Model.: https://www.whisper.security/docs/integrations/splunk/cim-mapping.md
- Source Types: Whisper Splunk source types reference. Field extractions, event timestamps, and parsing rules for ingesting infrastructure intelligence into Splunk.: https://www.whisper.security/docs/integrations/splunk/source-types.md
- Troubleshooting: Troubleshoot the Whisper Splunk add-on: common errors, diagnostic commands, log locations, file precedence rules, and where to escalate for support.: https://www.whisper.security/docs/integrations/splunk/troubleshooting.md
- OpenCTI Integration: Whisper connector for OpenCTI — enrich IPs, domains, and AS numbers with DNS, WHOIS, BGP, and threat intelligence as STIX 2.1 objects inside OpenCTI.: https://www.whisper.security/docs/integrations/opencti/overview.md
- Requirements: OpenCTI 7.260701.0+, Docker, a Whisper API key, and HTTPS access to graph.whisper.security — the prerequisites for the Whisper OpenCTI connector.: https://www.whisper.security/docs/integrations/opencti/requirements.md
- Installation: Install the Whisper connector for OpenCTI: pull opencti/connector-whisper from Docker Hub, add one compose service, and verify registration in the OpenCTI UI.: https://www.whisper.security/docs/integrations/opencti/installation.md
- Configuration: Configure the Whisper OpenCTI connector: environment variables, connector scope, auto-enrichment, the TLP ceiling, and timeout and retry behavior.: https://www.whisper.security/docs/integrations/opencti/configuration.md
- Enriching Observables: Enriching observables with the Whisper OpenCTI connector: what comes back for IPs, domains, and AS numbers, and how to read the threat-evidence notes.: https://www.whisper.security/docs/integrations/opencti/enrichment.md
- Data Mapping: Whisper OpenCTI data-mapping reference: how WhisperGraph nodes and edges become STIX 2.1 objects, with attribution, result caps, and limitations.: https://www.whisper.security/docs/integrations/opencti/data-mapping.md
- Troubleshooting: Troubleshoot the Whisper OpenCTI connector: registration failures, empty enrichments, authentication errors, rate limiting, and how to escalate.: https://www.whisper.security/docs/integrations/opencti/troubleshooting.md
- Microsoft Sentinel Integration: Whisper Security solution for Microsoft Sentinel — enrich incidents with threat scores, infrastructure context, WHOIS/BGP history, and ASN reputation, from the Content Hub.: https://www.whisper.security/docs/integrations/sentinel/overview.md
- Requirements: Prerequisites for the Whisper Security solution for Microsoft Sentinel: resource-group roles, a Sentinel workspace, an RBAC-mode Key Vault, and a Whisper API key.: https://www.whisper.security/docs/integrations/sentinel/requirements.md
- Installation: Install the Whisper Security solution for Microsoft Sentinel: the Key Vault secret, the Content Hub install wizard, verification, and the first-data timeline.: https://www.whisper.security/docs/integrations/sentinel/installation.md
- Configuration: Configure the Whisper solution for Microsoft Sentinel: grant playbook permissions, wire automation rules, enable analytics rules, and set the watchlists.: https://www.whisper.security/docs/integrations/sentinel/configuration.md
- Playbooks: Whisper playbooks for Microsoft Sentinel: explain IPs, domains, and ASNs, WHOIS/BGP history, co-hosted discovery, batch enrichment, and automation pairings.: https://www.whisper.security/docs/integrations/sentinel/playbooks.md
- Workbooks & Detections: Whisper workbooks, analytics rules, and hunting queries for Microsoft Sentinel: attack surface, threat landscape, ASN reputation, and infrastructure hunts.: https://www.whisper.security/docs/integrations/sentinel/workbooks-detections.md
- Data Reference: Data reference for the Whisper Sentinel solution: the WhisperThreatIntel, WhisperInfraContext, WhisperHistory, and WhisperASNReputation tables, pipelines, and quota.: https://www.whisper.security/docs/integrations/sentinel/data-reference.md
- Troubleshooting: Troubleshoot the Whisper solution for Microsoft Sentinel: AuthorizationFailed deploys, Key Vault 403s, API error codes, empty tables, and empty workbook panels.: https://www.whisper.security/docs/integrations/sentinel/troubleshooting.md

## Glossary

Plain-language definitions of cybersecurity and internet-infrastructure terms used in real investigations. Every URL below is the **markdown sibling** — drop the trailing `.md` to view the rendered glossary entry.

- ASN Footprint: https://www.whisper.security/glossary/asn-footprint.md
- ASN Reputation: https://www.whisper.security/glossary/asn-reputation.md
- Attack Path Analysis: https://www.whisper.security/glossary/attack-path-analysis.md
- Attack Surface: https://www.whisper.security/glossary/attack-surface.md
- Attack Surface Management: https://www.whisper.security/glossary/attack-surface-management.md
- Autonomous System (ASN): https://www.whisper.security/glossary/autonomous-system.md
- BGP Hijacking: https://www.whisper.security/glossary/bgp-hijacking.md
- BGP Routing: https://www.whisper.security/glossary/bgp-routing.md
- Blast Radius: https://www.whisper.security/glossary/blast-radius.md
- Bulletproof Hosting: https://www.whisper.security/glossary/bulletproof-hosting.md
- C2 (Command and Control) Infrastructure: https://www.whisper.security/glossary/c2-infrastructure.md
- Certificate Transparency: https://www.whisper.security/glossary/certificate-transparency.md
- Choke Point Analysis: https://www.whisper.security/glossary/choke-point-analysis.md
- Co-hosted Domains: https://www.whisper.security/glossary/co-hosted-domains.md
- Concentration Risk: https://www.whisper.security/glossary/concentration-risk.md
- Coverage-Qualified Assessment: https://www.whisper.security/glossary/coverage-qualified-assessment.md
- Cypher (Query Language): https://www.whisper.security/glossary/cypher.md
- DMARC: https://www.whisper.security/glossary/dmarc.md
- DNS: https://www.whisper.security/glossary/dns.md
- DNSSEC: https://www.whisper.security/glossary/dnssec.md
- Domain Generation Algorithm (DGA): https://www.whisper.security/glossary/domain-generation-algorithm.md
- Fast Flux DNS: https://www.whisper.security/glossary/fast-flux-dns.md
- Forward Threat Intelligence: https://www.whisper.security/glossary/forward-threat-intelligence.md
- Indicator of Compromise (IOC): https://www.whisper.security/glossary/indicator-of-compromise.md
- Infrastructure Intelligence: https://www.whisper.security/glossary/infrastructure-intelligence.md
- Infrastructure Pivoting: https://www.whisper.security/glossary/infrastructure-pivoting.md
- Internet Exchange Point (IXP): https://www.whisper.security/glossary/internet-exchange-point.md
- Knowledge Graph: https://www.whisper.security/glossary/knowledge-graph.md
- MITRE ATT&CK: https://www.whisper.security/glossary/mitre-attack.md
- MOAS Conflict: https://www.whisper.security/glossary/moas-conflict.md
- Model Context Protocol (MCP): https://www.whisper.security/glossary/mcp.md
- Origin-IP Discovery: https://www.whisper.security/glossary/origin-ip-discovery.md
- Passive DNS (pDNS): https://www.whisper.security/glossary/passive-dns.md
- Prompt Injection: https://www.whisper.security/glossary/prompt-injection.md
- RDAP (Registration Data Access Protocol): https://www.whisper.security/glossary/rdap.md
- RPKI / Route Origin Authorization (ROA): https://www.whisper.security/glossary/rpki-roa.md
- Reconciled Verdict: https://www.whisper.security/glossary/reconciled-verdict.md
- Reverse DNS / PTR: https://www.whisper.security/glossary/reverse-dns.md
- Route Origin Validation: https://www.whisper.security/glossary/route-origin-validation.md
- SPF: https://www.whisper.security/glossary/spf.md
- Subdomain Enumeration: https://www.whisper.security/glossary/subdomain-enumeration.md
- Submarine Cable: https://www.whisper.security/glossary/submarine-cable.md
- Supply-Chain Risk: https://www.whisper.security/glossary/supply-chain-risk.md
- TLS Fingerprint (JA3 / JARM): https://www.whisper.security/glossary/tls-fingerprint.md
- TTPs (Tactics, Techniques, and Procedures): https://www.whisper.security/glossary/ttp.md
- Threat Hunting: https://www.whisper.security/glossary/threat-hunting.md
- Threat Intelligence: https://www.whisper.security/glossary/threat-intelligence.md
- Tor Exit Node: https://www.whisper.security/glossary/tor-exit-node.md
- Typosquatting: https://www.whisper.security/glossary/typosquatting.md
- WHOIS: https://www.whisper.security/glossary/whois.md

## Blog

Articles and analysis from the Whisper team. Every URL below is the **markdown sibling** — drop the trailing `.md` to view the rendered post.

- What an ASN actually is: Learn what an Autonomous System Number (ASN) is, how internet routing works, and why ASN analysis is the starting point for infrastructure investigations and threat intelligence: https://www.whisper.security/resources/blog/what-an-asn-actually-is.md
- Whisper welcomes Jonathan Cave: We’re proud to officially welcome Jonathan Cave to the Whisper Advisory Board.: https://www.whisper.security/resources/blog/whisper-welcomes-jonathan-cave.md
- Whisper welcomes Jeff Osborn: We’re excited to announce that Jeff Osborn, is joining Whisper’s Advisory Board.: https://www.whisper.security/resources/blog/whisper-welcomes-jeff-osborn.md
- Whisper welcomes Merike Kaeo: We’re proud to announce that Merike has joined the Whisper Advisory Board.: https://www.whisper.security/resources/blog/whisper-welcomes-merike-kaeo.md
- Whisper Welcomes Geoff Huston: Geoff Huston — Chief Scientist at APNIC and a foundational voice in BGP routing — has joined Whisper's Advisory Board. What his expertise brings to WhisperGraph.: https://www.whisper.security/resources/blog/whisper-welcomes-geoff-huston.md
- Whisper welcomes Maarten Botterman: whisper welcomes Maarten Botterman to the Whisper Advisory Board.: https://www.whisper.security/resources/blog/whisper-welcomes-maarten-botterman.md
- Every World Cup Threat Report Is a Starting Point: World Cup 2026 phishing campaigns are rapidly expanding. Learn how Whisper MCP transforms public threat reports into deeper infrastructure investigations using graph intelligence.: https://www.whisper.security/resources/blog/world-cup-phishing-infrastructure.md
- Your AI agent is only as smart as what it can see: AI agents in security lack context, not data. How MCP and graph-based infrastructure intelligence enable agents to reason over connected data.: https://www.whisper.security/resources/blog/your-ai-agent-is-only-as-smart-as-what-it-can-see.md
- Concentration risk: when half the internet depends on three companies: Most organizations overlook shared infrastructure dependencies across cloud, DNS, and ASNs. Learn how to identify and quantify concentration risk before.: https://www.whisper.security/resources/blog/blogcloud-concentration-risk-and-hidden-dependencies.md
- The Internet Has a Map. Most Defenders Can't Read It.: The internet’s infrastructure is public but fragmented. Learn how graph intelligence connects DNS, BGP, WHOIS, and certificates to reveal hidden threat.: https://www.whisper.security/resources/blog/mapping-internet-infrastructure-with-graph-intelligence.md
- Why blocklists are always one step behind: Blocklists react to attacks after they happen. Learn how infrastructure intelligence and graph analysis reveal phishing campaigns before new domains go.: https://www.whisper.security/resources/blog/why-blocklists-are-always-one-step-behind.md
- One Phishing Domain Is Never Just One: Detect phishing campaigns by mapping shared infrastructure, domain clusters, DNS patterns, and hosting relationships using graph intelligence: https://www.whisper.security/resources/blog/one-phishing-domain-is-never-just-one.md
- Your Vendors' Infrastructure Is Your Attack Surface Too: Your firewall isn't your perimeter — your vendors are. Learn how Whisper reveals hidden attack surface risks across third-party infrastructure. Try it.: https://www.whisper.security/resources/blog/vendor-infrastructure-is-your-attack-surface.md
- Attackers Change Their Domains. They Rarely Change Their Habits.: Attackers rotate domains daily but their infrastructure habits persist. Learn how infrastructure fingerprinting detects threats before they strike. Try.: https://www.whisper.security/resources/blog/attackers-change-domains-not-habits.md
- Rahul Saggar Joins Whisper as CRO: Whisper welcomes Rahul B Saggar as CRO, strengthening its founding team to scale commercial growth and accelerate its cybersecurity vision.: https://www.whisper.security/resources/blog/rahul-saggar-joins-whisper-as-cro.md
- Whisper is Coming to WebSummit 2025: Whisper will exhibit at WebSummit 2025 in Lisbon, showcasing its predictive cybersecurity platform and live 'God Mode' internet threat intelligence demos.: https://www.whisper.security/resources/blog/whisper-is-coming-to-websummit-2025.md
- Inside the D11Z Academy: Learning, Growing, and Building Together: Whisper attended D11Z Academy in Heilbronn, gaining practical insights, sharing experiences with fellow founders, and strengthening investor relationships.: https://www.whisper.security/resources/blog/inside-the-d11z-academy-learning-growing-and-building-together.md
- Whisper Welcomes Roman Viliavin!: Whisper welcomes Roman Viliavin as COO, strengthening its founding team with proven operational leadership to scale growth and cybersecurity innovation.: https://www.whisper.security/resources/blog/whisper-welcomes-roman-viliavin.md
- Meet the Minds Behind the Whisper's Mission: Whisper is a cybersecurity startup using deep internet and mathematical expertise to deliver infrastructure intelligence and help prevent cyber threats.: https://www.whisper.security/resources/blog/meet-the-minds-behind-the-whispers-mission.md
- Whisper Secures €1.6M in Pre-Seed Funding to Scale Its Internet-Infrastructure Graph: Whisper raised €1.6 million in pre-seed funding to expand its infrastructure-intelligence platform — a queryable graph of the internet that helps teams investigate and respond to cyber threats.: https://www.whisper.security/resources/blog/whisper-secures-eu1-6m-in-pre-seed-funding-to-revolutionize-predictive-cybersecurity.md
- Whisper Emerges from Stealth with a Queryable Map of Internet Infrastructure: Whisper, a Dutch cybersecurity startup, exits stealth with a threat-intelligence platform built on a queryable graph of internet infrastructure — helping teams investigate domains, IPs, and networks and respond faster.: https://www.whisper.security/resources/blog/whisper-emerges-from-stealth-with-god-mode-to-predict-and-combat-cybercrime.md
- Whisper at Slush'D Heilbronn: A Day of Innovation, Community, and European Optimism: Whisper attended Slush'D Heilbronn, connecting with investors and founders, and celebrating Europe's vibrant, optimistic startup ecosystem.: https://www.whisper.security/resources/blog/whisper-at-slushd-heilbronn-a-day-of-innovation-community-and-european-optimism.md

## Markdown Siblings

The links in **Documentation**, **Glossary**, **Blog**, and **FAQ** above already point to clean markdown versions of each page (the `.md` URL convention from llmstxt.org). The same convention works for any HTML URL on this site — append `.md`:

- https://www.whisper.security/docs.md (docs index, all pages flattened into one markdown file)
- https://www.whisper.security/docs/<path>.md (any individual doc page)
- https://www.whisper.security/glossary.md (glossary index)
- https://www.whisper.security/glossary/<uid>.md (any individual glossary entry)
- https://www.whisper.security/faq.md (full FAQ as markdown)
- https://www.whisper.security/resources/blog/<slug>.md (any blog post)

The HTML versions (without `.md`) are for human readers and are also indexed in https://www.whisper.security/sitemap.xml. The `.md` versions are intentionally not indexed but are stable and citation-safe.

## FAQ

- Frequently Asked Questions: https://www.whisper.security/faq.md

## Optional

Secondary content. Per the llms.txt spec, parsers may skip this section under context pressure.

- Privacy Policy: https://www.whisper.security/privacy-policy
- Terms & Conditions: https://www.whisper.security/terms-conditions

## Full Documentation

For comprehensive information, see: https://www.whisper.security/llms-full.txt