# What's inside the graph, and how it stays fast.

> WhisperGraph is Whisper's own graph engine, and every layer is joined to the next. Query it directly over one endpoint, or let Whisper Intelligence and Whisper Graph XDR query it for you. It is one graph of 7.5B nodes and 39.8B edges.

*Source: https://www.whisper.security/products/engine*
*Last updated: 2026-10-04*

---

- [Run a query, no key](https://www.whisper.security/docs/whisper-graph/getting-started)
- [Read the schema](https://www.whisper.security/docs/whisper-graph/schema)

## Fast, even at full scale.

Every figure here comes from the graph itself. Anchored queries return in single-digit milliseconds, server-side.

- **7.5B** Nodes (hostnames, addresses, networks, owners, facilities and feed listings)
- **39.8B** Edges (the relationships that join every layer to the next)
- **134** intelligence feeds (112 threat feeds, 22 VPN, proxy, Tor, ad-tracking, reputation and popularity lists)
- **<10ms** anchored queries, server-side

*Measured 2026-10-22*

## Every kind of data, and how it changes.

The ledger below names each layer’s data and how it stays current. The table beneath it breaks the same answer down by freshness class.

A ledger of the layers WhisperGraph joins: naming and DNS, addressing and geography, network and routing, ownership and registration, email security, certificates and TLS, threat intelligence, threat actors and ATT&CK, phishing-kit paths, physical infrastructure, and company and technology. Each row names its data and how it stays current: live, regular, snapshot or reference.

## How each kind of data stays current.

| How it stays current | What that means |
| --- | --- |
| Live | New data reaches the graph through the day, as its sources publish updates. (DNS resolutions · Routing table · Route-origin records · Threat listings) |
| Regular | Refreshed on a recurring cycle as its sources publish changes. (Ownership & registration · Email security · Certificates & TLS · Phishing-kit paths) |
| Snapshot | Taken from periodic snapshots. (Addressing & geography · Company & technology, for accounts with company-data access) |
| Reference | These are curated records that change rarely. (Physical infrastructure · Threat actors & ATT&CK) |

## No data is never clean.

Every verdict says which of four things it found, with the evidence behind it.

- **Listed, with evidence**: Each feed that lists it, with its weight and when it last saw it.
- **Known clean**: Seen in the graph, with no malicious evidence against it.
- **Ambiguous**: The signals disagree. Escalate it to a person, and do not automate the call.
- **No data**: The graph has nothing on it yet. That is not the same as clean.

## Four ways to reach the graph.

Pick the one that fits how your team already works.

- **[Console](https://console.whisper.security)**: Ask a question in the browser and see the evidence, with nothing to install.
- **[Query API](https://www.whisper.security/docs/whisper-graph/getting-started)**: Ask in Cypher, the open graph query language, over one HTTPS endpoint, from any language.
- **[MCP server for AI agents](https://www.whisper.security/docs/ai/mcp/setup)**: Connect once and an agent walks the graph itself. Every tool it offers is read-only.
- **[SIEM and TIP integrations](https://www.whisper.security/products/integrations)**: Splunk, Sentinel, OpenCTI, MISP and Wazuh, each with its own connector.

[Put it inside your product](https://www.whisper.security/products/engine/embed)

## We run the network we describe.

Whisper operates its own autonomous system, AS219419, with RPKI-signed routes you can check yourself. The same address space gives every Graph XDR identity its public address.

## Three ways the graph reaches you.

1. **[Graph XDR](https://www.whisper.security/products/graph-xdr)**: Decides what your machines and agents may reach, and logs who is on the other end.
2. **[Intelligence](https://www.whisper.security/products/intelligence)**: Answers who is behind an address, with the evidence.
3. **[Inside your product](https://www.whisper.security/products/engine/embed)**: The same endpoint, behind your own product.

[Put it inside a security product](https://www.whisper.security/solutions/security-vendors)

## Run a query against it.

The query API's keyless tier answers without an account. Examples and the MCP server take a free key.

- [Get a free key](https://console.whisper.security/sign-up?redirect_url=https%3A%2F%2Fwww.whisper.security%2Fproducts%2Fengine)
- [Read the schema](https://www.whisper.security/docs/whisper-graph/schema)