Two products.One engine.

Whisper sells two products on one graph engine. Intelligence answers what is behind an address and what else it touches. Graph XDR gives every machine and agent a routable identity you can revoke.

47.2B
data points in the graph
<10ms
anchored query, server-side
134
intelligence feeds, joined in one graph

Measured

Look it up. Or lock it down.

Both products run on WhisperGraph, the engine and the data underneath. One graph, two ways to put it to work.

  • Whisper Intelligence

    Ask about any host, address, network or certificate. The evidence comes back with the answer.

    See Whisper Intelligence

  • Whisper Graph XDR

    Give every machine and agent its own routable address. Set policy at its egress, and cut it off from outside the host.

    See Whisper Graph XDR

Which one do you need?

Whisper IntelligenceWhisper Graph XDR
The question
What is behind this address, and what else does it touch?What may this machine or agent reach, and how do I cut it off?
It starts from
An alert with an address and nothing else.Every machine, container and AI agent you run.
You get back
The network, the owner, the certificate and the feeds, with the reasoning attached.A routable IPv6 address per identity on AS219419, policy at its egress, and a kill that runs off the host.
Where you use it
The console, the API, an MCP client or your SIEM.The console, the CLI and a sensor on each host.
Start free
Community: a free key, for good.Five identities and one seat, for good.

Most teams start with one and add the other. Nothing forces the order, and nothing gets replaced on the way.

Every layer joined to the next.

Whisper is one account, one key and three tiers. WhisperGraph is the engine and the data. Whisper Intelligence and Whisper Graph XDR are the two products built on it.

Naming

DNS zones, hostnames, nameservers, DNSSEC, certificate transparency, newly observed domains

Addressing

IPv4 and IPv6, CIDR blocks, geolocation to city

Network

Autonomous systems, prefixes, live BGP, peering, RPKI validation, routing registries

Ownership

Organisations, WHOIS and RDAP registrants, registrars, regional registries

Email

Mail routing and sender authentication: MX, SPF and its includes, DKIM, DMARC reporting

Certificates

Issuers, subjects, every name a certificate covers, reuse across hosts

Threat

Intelligence feeds, threat actors, MITRE ATT&CK, Tor relays, TLS fingerprints, known-good allowlists

Physical

Submarine cables and landings, facilities, internet exchanges, cloud regions

A link resolves to a host, the host to an address, the address to the network that announces it, and that network to the building it sits in. One anchored traversal.

Every arrow is a hop you can take.

The entity types and the named edges between them, grouped by layer. One query crosses as many of them as the question needs.

  • DNS · Web
  • Mail · SPF
  • WHOIS
  • Routing · RPKI
  • GeoIP
  • Threat intel
  • Physical
DNS · WebMail · SPFWHOISThreat intelGeoIPRouting · RPKIPhysical infrastructureCHILD_OFNAMESERVER_FORCHILD_OFMAIL_FORSPF_INCLUDEREGISTERED_BYHAS_REGISTRARHAS_EMAILRESOLVES_TOLISTED_INBELONGS_TOANNOUNCED_BYLOCATED_INLISTED_INHAS_COUNTRYROUTESHAS_NAMEBGP_NEIGHBORAUTHORIZES_ORIGINAUTHORIZES_PREFIXAS_PRESENT_ATIX_MEMBERIX_HOSTED_ATLANDING_NEARCABLE_LANDS_ATBELONGS_TONAMESERVERSUBDOMAINTLDHOSTNAMEMAIL_SERVERSPF_SENDERORGANIZATIONREGISTRAREMAILFEED_SOURCECATEGORYCITYCOUNTRYIPV4 · IPV6PREFIXANNOUNCED_PREFIXROAASNASN_NAMEASN (peer)INTERNET_EXCHANGEFACILITYCABLE_LANDINGSUBMARINE_CABLE
The highlighted trail is one query: hostname, address, prefix, network, building. Five layers, one graph.

Investigate. Then build. Then control.

Three jobs on one graph. Take them in any order.

  1. Investigate

    Whisper Intelligence tells you what an address is, who owns it and what else it touches.

    See Whisper Intelligence

  2. Build

    Put the same graph behind your own product, through the engine's API.

    Put the graph in your product

  3. Control

    Whisper Graph XDR turns what the graph knows into policy for your machines and agents, with a kill switch that works from off the host.

    See Whisper Graph XDR

No new tab for anyone to remember.

Answers land in the SIEM, the case tool or the agent your team already works in.

Splunk, Microsoft Sentinel, OpenCTI, Wazuh, n8n, MCP, MISP

Your data does not have to leave.

Cloud

Fastest to value. Hosted in the EU by default.

On premise

The full engine inside your perimeter, on one server rather than a cluster you have to run.

Air gapped

Signed graph delivery for networks with no egress at all.

EU sovereign

A European operator and European hosting, with no US cloud provider in the data path.

Whisper is a Dutch company running its own RIPE-allocated autonomous system.

Where to next.

  • Investigate a suspicious address

    A worked example: verdict, owner and everything connected, in one pass.

  • Map who owns an address

    Trace one indicator to its real owner and the rest of what they run.

  • Pricing

    Community is free forever. Paid plans add history, integrations and enforcement.

  • Compare

    Where Whisper sits beside the passive-DNS, EASM and endpoint tools you already run.

Bring the host nobody could identify.

Start with a free key, or walk us through it on a call.