# One graph. Two products built on it. > WhisperGraph holds the internet's infrastructure as one graph. Whisper Intelligence answers who is behind any address, and Whisper Graph XDR decides what your machines and agents may reach and cuts them off from outside the host. *Source: https://www.whisper.security/products* *Last updated: 2026-10-04* --- Graph XDR protects the fleet from the network in. Intelligence answers inside the tools your team already uses. One account opens both. - [Start free](https://console.whisper.security/sign-up?redirect_url=https%3A%2F%2Fwww.whisper.security%2Fproducts) - [Book a demo](https://meetings-eu1.hubspot.com/rsaggar) ## One graph of the internet, every layer joined. WhisperGraph joins routing, DNS, hosting, ownership, email, certificates, threat intelligence and physical infrastructure. Graph XDR uses it to decide what a connection may reach. Intelligence uses it to answer what an address is. - [How the graph works](https://www.whisper.security/products/engine) - **47.3B** objects in one graph - **134** intelligence feeds, joined - **<10ms** anchored queries, server-side *Read 2026-10-06* ## Which question do you need answered? Graph XDR controls where your machines and agents can connect. Intelligence explains any address they, or an attacker, touch. Start with either. - **[Whisper Graph XDR](https://www.whisper.security/products/graph-xdr) (Five identities free, for good)**: "What may this machine reach, and how do I cut it off?" - **[Whisper Intelligence](https://www.whisper.security/products/intelligence) (Free key, for good)**: "Who is behind this address, and what else do they run?" ## Rules and logs that know who is on the other end. An IP list only knows the address. Graph XDR checks each connection against the whole graph, so a log line names who is behind the destination and a rule can act on the owner, the network and the country behind it. - **Every connection, in context**: Each destination with its owner, network, country and risk, and the organisations that own the networks your fleet reaches. - **Who is looking at you**: Lookups of your identities grouped by the operator behind them. That reconnaissance never touches the host. - **Rules on what is behind it**: Owners, countries, bulletproof hosting, Tor exits, sanctions, new registrations and RPKI, at resolution and egress. - **Contain from outside**: Revoke an identity and it stops at our edge, even when the host is fully owned. - [See Graph XDR](https://www.whisper.security/products/graph-xdr) ## Start with one node. Expand the internet. Run a guided workflow on any indicator, or write your own query. Every answer arrives with the path that produced it. ![Whisper Intelligence explorer opened on 1.1.1.1: the address expanded one hop to its prefix, its network AS13335 and its feed listings, with a side panel showing the threat-intel reading and suggested next moves.](https://images.prismic.io/whisper/VQCrpUh2oCJjvope_products-v3-explorer-2x.png?auto=format,compress) Every answer is available in the console, the query API, MCP and the CLI, and inside Splunk, Microsoft Sentinel, Wazuh, OpenCTI, MISP or your own product. - [See Intelligence](https://www.whisper.security/products/intelligence) ## One sign-in. Two consoles that share what they see. - **From a connection to a dossier**: Open any destination your fleet reached and get Intelligence's full answer on it: owner, network, listings and history. - **The same graph**: Graph XDR rules and Intelligence answers both read WhisperGraph, so what a rule acts on is what a dossier shows. - **One account**: The same sign-in opens both consoles. Start with one product and add the other when you need it. ## Run Whisper for your clients, under your name. The partner portal puts every client's fleet in one queue. It contains threats off-host and hands each client proof they can check without trusting you or us. - **Shared exposure**: See which infrastructure more than one of your clients reached, and block it for all of them at once. - **Your brand, your margin**: Reports carry your firm's name and colours, with your logo shipping soon. Your wholesale rate is quoted in the portal. - **Your ticketing**: Cases open in ConnectWise, Autotask, HaloPSA or Syncro, and events export as OCSF. - [See the partner programme](https://www.whisper.security/solutions/mssp) ## More from Whisper - **[Industry editions](https://auto.whisper.online)**: Graph XDR for connected vehicles, energy, telecom, OT and five more industries. - **[Private mesh](https://www.whisper.security/products/graph-xdr)**: Whalenet connects your servers and agents to each other over their public identities, with rules that can check the graph. - **[Free, no account](https://chromewebstore.google.com/detail/whisper-guard/ipiabkcdkhokcanmnfihfhgbjaofpakn)**: Whisper Guard checks every site you open, free in Chrome. Check any Whisper identity with dig, query the graph's keyless tier, or try Lookalikes and isitsc.am. - **[Also free in Firefox](https://addons.mozilla.org/en-US/firefox/addon/whisper-guard/)**: The same checks, as a Firefox Add-on. ## We run the network we tell you about. Your enforcement point should belong to someone you can check. - **Our own network**: AS219419, allocated by RIPE, with exact-length RPKI routes you can check without asking us. - **Who built it**: Co-founder and CEO Kaveh Ranjbar was CIO of RIPE NCC and architect of K-root, one of the internet's thirteen DNS root servers. Advisers include Geoff Huston, Jeff Osborn, Maarten Botterman, Merike Kaeo and Jonathan Cave. - **Where it runs**: Our cloud, hosted in the EU by default. Or on premise on one server, air gapped with signed graph delivery, or EU sovereign with no US cloud in the data path. ## Or start from your role. - **[SOC and threat intel](https://www.whisper.security/solutions/soc)**: Find the alert that matters, and show the reasoning. - **[Security leaders](https://www.whisper.security/solutions/security-leaders)**: Answer "are we exposed?" with evidence. - **[Engineers and AI agents](https://www.whisper.security/solutions/engineering)**: A checkable identity for every agent and machine. - **[MSSPs and MSPs](https://www.whisper.security/solutions/mssp)**: Both products for your clients, under your name. ## Start with one agent and one alert. Graph XDR is free for five identities, for good, then €3.99 per endpoint per month, billed yearly. Intelligence starts with a free key. - [Start free](https://console.whisper.security/sign-up?redirect_url=https%3A%2F%2Fwww.whisper.security%2Fproducts) - [Book a demo](https://meetings-eu1.hubspot.com/rsaggar)