Whisper Intelligence
A list tells you it is bad.
A graph tells you why.
Whisper Intelligence sits under whichever feed you already buy and answers what a list cannot: who owns this, what else do they own, where is it routed, what changed recently, and what else goes dark when you block it.
Lists have no edges.
Every intelligence vendor sells the same shape of thing: indicators with a number beside each. The number tells you what somebody else already found.
It cannot tell you about the domain the same registrant bought yesterday, the seventeen thousand names sharing the address, the certificate reused across the campaign, or the network routing all of it that has two peers and a Seychelles registration.
That is not a gap in the data. It is a gap in the shape of it.
Six questions, answered in one query each.
Who owns this, really
Ownership, network, geography, email posture, certificate history and threat context, with the evidence that produced the verdict.
Who runs the host
Attribution that survives a CDN. The organisation behind the host, not the proxy in front of it.
What else do they run
One seed expands to the estate: shared certificates, co-hosting, registrant, nameserver, network.
What changed
WHOIS and BGP history. A prefix that changed origin five times in fifteen months, or a domain registered fifty days before it was used.
Tell me when it changes
Subscribe to an indicator or a pattern, get a webhook when its label, routing or freshness moves.
Am I actually exposed
Package inventory mapped to CVEs, so the question is which of your hosts are affected rather than which CVEs exist.
Thirty five procedures in total, reachable from Cypher, REST or MCP. All read only.
We will show you the arithmetic.
A score you cannot audit is a score you cannot defend to a regulator, a customer or a board. Every verdict returns its sources, their weights, and how network containment, neighbourhood density and recency moved the number.
Network reputation works the same way. Threat density, topology, historical behaviour and prefix age, each weighted and shown. Scored from what a network does, not from whether anyone has blocklisted it yet.
