llms.txt
# Whisper Security
> Whisper Security maps how every domain, IP address and network on the internet connects to everything else, in one graph of 7.5B nodes and 39.8B edges across 42 entity types. Whisper Security (whisper.security) is a cybersecurity infrastructure intelligence company, not OpenAI's Whisper speech recognition model.
Whisper is two products built on WhisperGraph, a graph engine that joins routing (BGP), DNS, hosting, WHOIS ownership, email posture, certificate transparency and 134 intelligence feeds (112 of them threat feeds), and answers an anchored query in under 10 ms, server-side:
- Whisper Intelligence: ask the graph through the console, the Cypher query API, the MCP server and the integrations for Splunk, Microsoft Sentinel, OpenCTI, Wazuh and MISP.
- Whisper Graph XDR: enforce on it, with DNS and egress policy and an identity for every agent and endpoint.
For AI agents:
- Query the graph with `POST https://graph.whisper.security/api/query` and a JSON body `{"query": "<cypher>"}`. The API has a keyless tier: a query sent with no key returns real rows. Running a query or an example on a whisper.security page takes a free account.
- Get a free API key without a browser, in two HTTP calls: `POST https://console.whisper.security/api/signup` with an email address, then `POST https://console.whisper.security/api/signup/verify` with the code that arrives by email. The same key works for the MCP server at https://mcp.whisper.security, whose tools are all read-only.
- The links below point to each page's markdown version where it has one. Append `.md` to any other docs, glossary or blog URL on this site for the same.
Company: founded in January 2025 and headquartered in the Netherlands. CEO Kaveh Ranjbar, former RIPE NCC CIO and K-root DNS architect.
Last updated: 2026-10-17. Last verified against the live site: 2026-09-26. Graph figures measured: 2026-10-17 (source: https://graph.whisper.security GET /api/query/stats).
## Start here
- [Full reference for AI systems](https://www.whisper.security/llms-full.txt): everything in one file: the graph schema, example queries, the agent sign-up flow, pricing, integrations, use cases and the glossary
- [Get an API key from an agent](https://www.whisper.security/docs/ai/agent-signup.md): the two-call sign-up, with curl, Python and Node examples
- [FAQ](https://www.whisper.security/faq.md)
## Pages
- [Website](https://www.whisper.security/index.md)
- [Products overview](https://www.whisper.security/products.md)
- [Whisper Intelligence](https://www.whisper.security/products/intelligence.md)
- [Whisper Graph XDR](https://www.whisper.security/products/graph-xdr.md)
- [Integrations, MCP and AI clients](https://www.whisper.security/products/integrations.md)
- [The engine (WhisperGraph), including the Direct API](https://www.whisper.security/products/engine.md)
- [Embed the graph in your product](https://www.whisper.security/products/engine/embed.md)
- [Pricing, both products](https://www.whisper.security/pricing)
- [Solutions](https://www.whisper.security/solutions.md)
- [SOC and threat intel](https://www.whisper.security/solutions/soc.md)
- [Security leaders](https://www.whisper.security/solutions/security-leaders.md)
- [MSSPs and MDRs](https://www.whisper.security/solutions/mssp.md)
- [Engineers and AI agents](https://www.whisper.security/solutions/engineering.md)
- [Security vendors](https://www.whisper.security/solutions/security-vendors.md)
- [Whisper Intelligence use cases, by domain](https://www.whisper.security/products/intelligence/use-cases.md)
- [Free tools (no account needed — Whisper Guard, isitsc.am, the keyless API tier, CLI, SDKs)](https://www.whisper.security/open.md)
- [Whisper for AI agents (the MCP server, the keyless API tier, Agent Skills, SDKs, sign-up without a browser)](https://www.whisper.security/ai.md)
- [Compare](https://www.whisper.security/compare.md): Three comparison tables built from one dated data model. The first measures infrastructure and threat-intelligence tools by the layers each one covers; the second measures endpoint detection and response products by what an admin can write a policy on and where the block is enforced; the third measures machine- and AI-agent identity products by what they issue, where they enforce, whether a revocation survives a compromised host, and whether they know anything about the destination. Each row cites the vendor documentation it was read from and the date it was read, and treats a missing capability as absent from that vendor’s documentation rather than tested for.
- [Documentation](https://www.whisper.security/docs.md)
- [Glossary](https://www.whisper.security/glossary.md)
- [Resources](https://www.whisper.security/resources)
- [Blog index](https://www.whisper.security/resources/blog.md)
- [White Papers](https://www.whisper.security/resources/white-papers)
- [About](https://www.whisper.security/about-us.md)
- [Trust (the founders and advisory board, AS219419, security contacts and how to verify each)](https://www.whisper.security/trust.md)
- [Contact](https://www.whisper.security/contact-us)
- [Console](https://console.whisper.security): the graph explorer; sign-in required
- [Sign up](https://console.whisper.security/sign-up): a free account, no credit card
## Use cases
- [Anycast DNS-Root Sovereignty](https://www.whisper.security/docs/workflows/anycast-dns-root-sovereignty.md): Only in Whisper. Could a country still resolve names if it were isolated? This assesses a nation's DNS-root resilience (how many of the core root servers have a copy inside its borders, and who operates them), the sovereignty read for national-resilience and policy analysis.
- [Attack-Surface Mapper](https://www.whisper.security/docs/workflows/attack-surface.md): Faster in Whisper. See your organisation the way an attacker does. Give it a domain and it maps the full external footprint (every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to) and scores the exposure. The starting point for shrinking what's reachable from the outside.
- [BGP Hijack & Routing-Hygiene Audit](https://www.whisper.security/docs/workflows/bgp-hijack-exposure.md): Only in Whisper. Routing security you can act on. This grades a network on the conflicts and gaps that make route hijacking possible, then traces any conflict to the specific domains and organisations exposed on the affected blocks. An adversarial audit, not just a profile, for finding where a hijack could hurt and who it would hit.
- [Takedown Evidence Package](https://www.whisper.security/docs/workflows/build-takedown-evidence-package.md): Faster in Whisper. When you've found a malicious domain, the next hurdle is proving it. This assembles a one-pass takedown package (the reputation verdict, who owns it, the abuse lists naming it, and the infrastructure around it), laid out ready to hand to a registrar or hosting provider so the takedown actually sticks.
- [Threat Investigation](https://www.whisper.security/docs/workflows/indicator.md): Faster in Whisper. The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint (the related domains, the real servers behind any CDN, the neighbouring infrastructure) and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check says 'look closer.'
- [Indicator Enrichment](https://www.whisper.security/docs/workflows/indicator-enrichment.md): Only in Whisper. Everything worth knowing about one indicator, on a single card. Give it a domain or an address and it fills in the picture: who registered it, where it's hosted and in which country, its mail and name servers, the network behind it, and a reputation read. The fast way to go from a bare indicator to real context before you decide what to do with it.
- [Digital Infrastructure Mapping](https://www.whisper.security/docs/workflows/infrastructure-mapping.md): Only in Whisper. Map the digital estate an indicator belongs to. Starting from any domain, IP, ASN or prefix, this works out the true owner (even behind privacy WHOIS and CDNs) via the atlas operator, the canonical registrant organization and the registrant email, then enumerates everything that owner owns: the subdomain namespace, the rest of its domain estate, the networks and prefixes that host it, and the facilities it physically sits at. Assets run by someone else (CDN, managed DNS, cloud) are marked as the vendor border, not owned.
- [Nameserver & DNS Delegation Audit](https://www.whisper.security/docs/workflows/nameserver-hijack-dns-consistency.md): Only in Whisper. Your name servers decide where your domain points, and a broken or inconsistent setup is a hijacking opportunity. This audits a domain's delegation, flags stale or mismatched name servers, sizes how much each provider actually handles, and surfaces registry facts, so you can catch delegation weakness before it's exploited.
- [Network & Routing Report](https://www.whisper.security/docs/workflows/route-health.md): Only in Whisper. The full picture of how a network is put together and reaches the internet. Give it a network or address block and get a health card: what it announces, who it peers and buys transit from, whether it leans dangerously on a single upstream, and how well its routes are protected. The one-look report for network engineers assessing reach and resilience.
- [Subdomain Takeover Detection](https://www.whisper.security/docs/workflows/subdomain-takeover.md): Only in Whisper. A dangling subdomain, one still pointing at a service you've since torn down, is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.
- [Typosquat & Brand-Impersonation Scanner](https://www.whisper.security/docs/workflows/typosquat.md): Only in Whisper. Someone registering a look-alike of a domain usually isn't doing it for fun. This finds the look-alike names of a brand that the graph has seen (across misspellings and risky extensions), checks whether each is yours or a stranger's, and flags the ones that are freshly registered, hidden behind privacy, or already flagged for abuse. The brand-protection sweep that turns look-alikes into a prioritised list.
- [Supply-Chain Dependency Mapping](https://www.whisper.security/docs/workflows/supply-chain.md): Only in Whisper. Maps every external provider a domain depends on (nameservers, mail exchangers, third-party email senders named in SPF, CDN and hosting networks, registrar and DKIM vendors) by reading each layer of the graph and keeping only providers whose registrable apex differs from the target’s own. Each dependency is grouped by function and the flow flags single-vendor concentration: one DNS operator, one mail provider or one hosting network is a single point of failure whose outage takes the whole function down. The mirror of Digital Infrastructure Mapping: that flow maps what an entity owns, this maps what it depends on.
- [Email Security Posture](https://www.whisper.security/docs/workflows/email-security-posture.md): Only in Whisper. Reads a domain’s SPF, DKIM, DMARC, MX and DNSSEC records straight off the graph and grades each on presence and hygiene: whether the control is configured, whether the SPF chain stays inside the ten-lookup limit, whether an SPF_IP authorization is unusually wide, whether a DKIM signer has no matching SPF authorization, and whether a mail-exchange address carries a threat verdict. Never grades enforcement strength: SPF’s -all qualifier and DMARC’s p= policy tag are not yet imported into the graph.
- [Threat Actor Attribution](https://www.whisper.security/docs/workflows/threat-actor-attribution.md): Only in Whisper. Reads the threat-attribution layer (actors, MITRE ATT&CK techniques and tactics, threat tags) straight off the graph. From an indicator: its threat tags (a lead) and any direct actor attribution (evidence, via the graph’s ATTRIBUTED_TO edge), the attributed actor’s techniques/tactics, and other indicators sharing a tag. From an actor name or alias: exact-name then alias resolution, similarly-named candidates, the actor’s techniques/tactics, and every indicator this graph directly attributes to them, bounded and threat-checked.
## Documentation
- [Whalenet](https://www.whisper.security/docs/whalenet.md): Read a Whisper fleet, publish the one document that decides who inside it may reach what, expose a port to it, and admit new members deliberately.
- [Control Plane API](https://www.whisper.security/docs/control-plane.md): Mint agent identities, set resolver policy and read query logs with one CALL whisper.agents verb over graph.whisper.online/api/query.
- [Endpoint Security](https://www.whisper.security/docs/endpoint.md): Whisper Endpoint: install the host sensor on Linux or Windows, read your estate in the operator console, and contain a machine at the network layer.
- [Network & DNS](https://www.whisper.security/docs/network.md): Egress from an agent's own IPv6 address, graph-first name resolution, encrypted DNS for a phone or laptop, and the signed zones behind every identity.
- [Partners](https://www.whisper.security/docs/partners.md): Run a book of customers from one portal: onboard them, triage the queue, search one indicator across every estate, contain it, and prove what happened.
- [Agent Identity](https://www.whisper.security/docs/identity.md): How Whisper gives an agent, host, device or vehicle one routable IPv6 address as its identity, and how anyone checks it with no account.
- [Recipes](https://www.whisper.security/docs/recipes.md): Copy-paste Cypher for the patterns behind Whisper's guided workflows, by job: SOC triage, threat intel, recon, brand, BGP, DNS, compliance and OSINT.
- [Firms, Customers, Endpoints](https://www.whisper.security/docs/partners/model.md): How the partner portal counts: a firm holds customers, a customer holds accounts, an account holds endpoints, and each endpoint holds one address.
- [Egress](https://www.whisper.security/docs/network/egress.md): How outbound traffic leaves from an agent's own IPv6 address: the connectivity tiers, the bound proxy, the egress bearer, and the keyless source echo.
- [How the Sensor Works](https://www.whisper.security/docs/endpoint/how-it-works.md): Inside the Whisper host sensor: user-space collectors for process, file, socket and DNS events, a forward-first stream, and a digest shipped each window.
- [Agents & MCP](https://www.whisper.security/docs/ai.md): Connect any MCP client to WhisperGraph: 7 tools, a provably read-only surface, a workflow gallery, and evidence-backed answers for AI agents.
- [Nodes, Names and Tags](https://www.whisper.security/docs/whalenet/nodes.md): What a Whalenet node is, how its canonical name follows from its address, the optional short label beside it, and how tags are minted and restated.
- [The Request Envelope](https://www.whisper.security/docs/control-plane/envelope.md): The whisper.agents wire format: the POST body, the map literal syntax, and the op, ok, status, result and error columns every call returns.
- [The Address as Identity](https://www.whisper.security/docs/identity/address.md): How a Whisper agent name is derived from its IPv6 address, what the account handle is, and why the forward and reverse records must agree.
- [POST /api/query](https://www.whisper.security/docs/cypher-api/reference/query-post.md): POST /api/query reference: headers, the JSON body, the response envelope, parameter binding, batch statements and form bodies, in five languages.
- [CLI](https://www.whisper.security/docs/cli.md): Query WhisperGraph from the command line with the whisper CLI: raw Cypher, named recipes, a local MCP server for Claude Code and Cursor, a graph explorer.
- [Integrations](https://www.whisper.security/docs/integrations.md): Connect WhisperGraph to your stack: Splunk, OpenCTI, Microsoft Sentinel, Wazuh and MISP, the REST Cypher API, and MCP for AI assistants.
- [Products and services](https://www.whisper.security/docs/overview.md): WhisperGraph is the engine and data, Whisper Intelligence asks it questions, and Whisper Graph XDR turns answers into enforcement. One account, one key.
- [Cypher](https://www.whisper.security/docs/cypher.md): WhisperGraph's read-only Cypher over HTTP: how every query is shaped (anchor, traverse, return) and where the clause and function references live.
- [Indicator Triage (SOC)](https://www.whisper.security/docs/recipes/soc.md): SOC triage Cypher for WhisperGraph: reconciled verdicts, explain() evidence, feed categories, network attribution, co-hosting, TLS fingerprints, IOCs.
- [HTTP API](https://www.whisper.security/docs/cypher-api.md): Query WhisperGraph over REST: POST read-only Cypher to graph.whisper.security/api/query and read one JSON envelope of columns, rows, and statistics.
- [Workflows](https://www.whisper.security/docs/workflows.md): Run prepared WhisperGraph investigations in the browser: indicator triage, attack-surface recon, typosquat takedowns, BGP, DNS and email, supply chain.
- [Entities](https://www.whisper.security/docs/whisper-graph/schema/entities.md): Every WhisperGraph node label, from DNS, addressing and routing to WHOIS, geo, threat and physical infrastructure, with counts and queryable properties.
- [WhisperGraph](https://www.whisper.security/docs/whisper-graph.md): WhisperGraph joins naming, routing, ownership, email, certificates, threat and physical data into one graph you query in one pass.
- [Getting Started](https://www.whisper.security/docs/whisper-graph/getting-started.md): Run your first WhisperGraph query without a key, then one request that crosses DNS, BGP routing, geo, and threat feeds.
- [Join a Firm](https://www.whisper.security/docs/partners/join.md): Gain partner authority over a firm in two control-plane calls: an administrator offers it, and the operator joining accepts it on their own key.
- [Inspect Your Fleet](https://www.whisper.security/docs/whalenet/inspect.md): Read a Whalenet fleet from the command line: this node and its peers, a measured round trip, what answered for this host, and who holds any address.
- [Create an Identity](https://www.whisper.security/docs/identity/create.md): Mint a Whisper agent identity with one control-plane call, capture the API key shown once, and confirm the new /128 in public DNS.
- [Keys and Scopes](https://www.whisper.security/docs/control-plane/auth.md): Whisper control plane credentials: the X-API-Key header, the read-only bearer token, and the scope each whisper.agents operation requires.
- [Install](https://www.whisper.security/docs/endpoint/install.md): Bring a Linux or Windows host onto Whisper Endpoint: the CLI, your key, the bound host identity, then the sensor service, in that order.
- [Connectivity Tiers](https://www.whisper.security/docs/network/egress/tiers.md): Tier 1 routed WireGuard, Tier 1.5 source-bound proxy and Tier 2 resolver-only: what each gives an agent, what it needs, and how to select one.
- [Setup](https://www.whisper.security/docs/ai/mcp/setup.md): Connect an MCP client to WhisperGraph: Claude's Connectors Directory, config for Claude Code, Cursor, VS Code, Windsurf and ChatGPT, OAuth or API key.
- [Query](https://www.whisper.security/docs/cli/query.md): whisper query runs read-only Cypher against WhisperGraph from the terminal, with --param for safe parameters and --json for the full result envelope.
- [What Every Connector Guarantees](https://www.whisper.security/docs/integrations/contract.md): The contract every Whisper connector shares: guaranteed and conditional fields, one threat-level enum, and a coverage watchdog that flags a silent table.
- [GET /api/query](https://www.whisper.security/docs/c
