WhisperGraph
WhisperGraph:we built the engine ourselves.
WhisperGraph holds 7.5 billion nodes and 39.7 billion edges of internet infrastructure as one connected object, measured 2026-09-20. About half of it is computed at query time rather than stored. You query it in Cypher, over one endpoint.
Why not a normal graph database.
WhisperGraph is the engine and the data under Whisper Intelligence and Whisper Graph XDR. One asks it questions. The other turns its answers into enforcement.
We tried the off-the-shelf route first. A general-purpose graph database stores a generic node with a bag of properties, and pays for that on every hop. At internet scale the useful answers sit four and five hops out, and that cost is the gap between a query and a coffee break.
So the engine models internet objects natively. A prefix knows it is a prefix. A network knows what it announces. A certificate knows every name it covers. The traversal never has to ask what it is holding.
One connected graph, joined layer to layer.
Naming and DNS, addressing, routing, ownership, email posture, threat intelligence and the physical network. Each layer is joined to the next, so a question can cross them without a second tool.
The census, and the call behind it.
Every figure on this page comes from one endpoint, read from the live graph and stamped with the date it answered.
curl -s -A "whisper-client/1.0" https://graph.whisper.security/api/query/statsHalf the graph is built as you ask.
Part of the graph sits on disk. The rest is built while the query runs, from live BGP, DNS and certificate data. A query cannot tell which half it is walking, and the answer does not change.
Single-digit milliseconds, server-side.
For an anchored query: one that starts from a name, an address or a network you already know.
- Compressed sparse row adjacency
A node's neighbours sit side by side in memory, so a hop is a sequential read rather than a pointer chase.
- Off-heap memory, managed directly
No garbage collection on the query path at all.
- Delta and variable-length edge encoding
The graph fits in memory that would otherwise hold a fraction of it.
- A separate overlay for writes
Ingest never blocks a read. The overlay merges in periodically.
- A prefix index and an address trie
Text search and CIDR containment are built in from the start.
Depth stays cheap because the graph is pre-joined. A cross-layer step that would be a deep scan elsewhere is already one indexed edge.
Every arrow is a hop you can take.
The entity types and the named edges between them, grouped by layer. This is the schema every query on this page walks.
- DNS · Web
- Mail · SPF
- WHOIS
- Routing · RPKI
- GeoIP
- Threat intel
- Physical
We run the network we describe.
- The engine
Built from scratch for this data, with the internet objects modelled natively from the first line.
- The network
Whisper operates its own autonomous system, AS219419, with RPKI-signed route announcements you can check without asking us.
Verified
Put the graph inside your own product.
WhisperGraph can also sit inside your product. Your product sends the query, the engine returns the answer, and your brand is the one on the screen. Start with the embed guide.
Co-hosting in one statement.
Every other hostname that shares an address with the one you start from.
MATCH (h:HOSTNAME {name:"example.com"})
-[:RESOLVES_TO]->(ip:IPV4)
<-[:RESOLVES_TO]-(other:HOSTNAME)
WHERE other.name <> h.name
RETURN ip.name AS shared_ip,
collect(other.name)[0..20] AS co_hostedWhere to next.
Embed
Put the same graph behind your own product, through the engine's API.
Integrations
Splunk, Sentinel, OpenCTI, SOAR, MDM and any MCP client.
Trace a BGP hijack
Grade a network’s routing security and trace MOAS conflicts, checked against RPKI.
Turn an address into a context card
Owner, hosting, mail and reputation at a glance.
Pricing
Community is free forever. Paid plans add history, integrations and enforcement.
Compare
Where Whisper sits beside the passive-DNS, EASM and endpoint tools you already run.