Whisper Endpoint · identity-native EDR

Every endpoint gets a routable identity. We contain it from the network, not the box.

fails openA bad sensor update cannot take your fleet down. The detection brain is observe-mostly, runs in user space off the kernel critical path, and lives off the host, so if a rule or our backend misbehaves your endpoints keep running normally.

The EDR that is also the DNS and the network: every host and AI agent gets a routable, verifiable /128 you can revoke from off the box.

Verify a /128, keyless → no agent, no API key · dig, delv and openssl are enough

The calm plane, exactly as it ships in the console: x is how hard it hunts, y is how much it tells you, loud at the top. Pick a persona, or drag the dot in the console and one move re-projects all 18 scheduler levers deterministically. The hatched band is the safety floor, and it sits outside the plane: no point you can pick gets past it, and every persona ships observing, never armed, until you arm it.

or install whisper (add WHISPER_SENSOR=1 and a key for the calm sensor)
$ curl -fsSL https://get.whisper.online | sh
~1% of one core measured on a live capture, well under the CPU budget
11 MB resident memory, of a 150 MB soft ceiling
1,752 + 93 test functions + fuzz targets in the sensor
103 techniques named ATT&CK detections across all 14 tactics, 12 engines across platforms + 79 Sigma rules
7.52B / 38.6B nodes / relationships scoring every destination

See the full capability matrix·Read the FAQ, including whether a bad update can take your fleet down

For CISOs, in brief
What it is

An identity-native EDR. Every host and AI agent gets a routable, verifiable IPv6 /128, on-host detection engines read the kernel, and you contain a machine from the network, not from the box it has lost.

Why it is safe to run

Observe-mostly and fails open. Detection runs in user space off the kernel path and off the host, so a bad rule or a backend outage cannot take your fleet down. Measured at about 1% of one core and 11 MB.

How you verify it yourself

Keyless. dig, delv and openssl walk the identity chain, DNSSEC to DANE to RDAP, and a revoke is a public NXDOMAIN anyone can check. No account, no API key.

Keyless means no Whisper API key and no account: the cryptographic keys are all still there, in DNSSEC and DANE, and checking them is the point. Trustless means you do not have to believe our API or the resolver in between, because every DNS answer is checked against the DNSSEC chain from the IANA root. It does not take the operator of the signing zone out of the path; the independently witnessed, tamper-evident transparency log is there for that, and under bring your own domain the DS at your own registrar decides whether our signatures count.

The one image only the moat makes possible

Every /128 is a containment boundary. Select one and see exactly what a revoke severs.

A host-only console draws a list of machines. Because every endpoint here is an address we allocated, the fleet is a graph of routable identities, and containment is a blast radius you can see before you pull the lever.

The fleet topology view: a control-plane node at the center fanning out to 25 governed /128 endpoint nodes arranged in nested clusters, each ringed by its containment boundary. One node with descendants is selected and the blast rail on the right shows the subtree a revoke would cut.
Live capture, real lab fleet, nothing mocked. The control plane fans out to 25 governed /128 nodes; select one with descendants and the blast rail reads revoke cuts N, the exact set of identities that leave the internet when you pull it. Sensorless nodes sit beside sensored ones, because the sensor is optional.
L1identity · the anchor

The address is the identity.

Every host and every agent gets a routable, publicly-verifiable IPv6 /128. The chain is ordinary internet plumbing anyone can walk: DNSSEC to DANE to RDAP to did:web. A stranger confirms it keyless with dig, delv and openssl; our API is never in the trust path. Revoke it and the name is gone worldwide at DNS-TTL.

active a real, routable identity · verify it yourself, keyless
name
scout
identity
2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
reverse
ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online.
registry
AS219419 · 2a04:2a01::/32 · RIPE inet6num, RPKI-valid
anchor
DNSSEC to the IANA root (alg 13) · DANE-EE pin (TLSA 3 1 1)
# reverse DNS names the address. our API is never in the trust path
$ dig +noall +answer -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 @1.1.1.1
...a.2.ip6.arpa. 60 IN PTR ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online.
RDAP: name scout · type Whisper agent identity · status active · NL · registered 2026-06-26
revoked gone at the network layer · authenticated denial of existence
identity
2a04:2a01:dead:beef::1
reverse
none · authenticated NXDOMAIN
registry
NSEC3 denial of existence · RRSIG SOA (alg 13)
anchor
IANA root, re-derived locally by delv · SOA ns1.whisper.online
$ dig +dnssec -x 2a04:2a01:dead:beef::1 @9.9.9.9
;; ->>HEADER<<- status: NXDOMAIN
;; flags: qr rd ra ad (the NSEC3 records below are the authenticated denial; ad is only the resolver saying so)
1.0.a.2.4.0.a.2.ip6.arpa. 300 IN SOA ns1.whisper.online. hostmaster ...
Proven on a throwaway /128, never on a live identity. Revoke and re-verify with op:revoke.
Two tiers, one primitive

The sensor is optional. The identity is not.

The left half needs no agent and no API key, so a PLC, a printer or an ephemeral AI agent gets a verifiable identity with nothing installed. The calm sensor is the power-up that adds per-process detection, and you unlock it only when you want it.

A host panel reading Identity verified with four keyless checks passing, PTR forward-confirmed, DNSSEC AD, DANE TLSA 3 1 1 and RDAP status active, above a delegation chain from the IANA root down to the /128.
Identity verified, four checks, all keyless. Forward-confirmed PTR, DNSSEC AD, the DANE pin and the RDAP record, with the delegation chain from the IANA root down to the /128. Nothing here needs a Whisper credential.
L2sensor · the eyes

One telemetry stream. Detection never touches it.

A lean, observe-mostly, pure-Go collector set reads the kernel in four vocabularies: exec over the NETLINK process connector, file over fanotify, conn over sock-diag with an eBPF opt-in, and dns over an AF_PACKET tap on udp/53. The architectural headline is the discipline: the hot path always forwards telemetry downstream before any detector looks, so detection can never delay, drop or alter what you record. Findings ride back on the same stream as a fifth detection kind.

L3calm · the composure

Two schedulers, and you never feel either.

Scheduling is the whole game in a telemetry system, and Whisper runs two of the best. The on-host governor bursts to 10x only when the host, the network and the user are all provably idle, yields the instant any of them wakes, and self-meters against a circuit breaker. The fleet planner adds one advisory hint per /128 that can dampen or confirm but never touches the hot path. The calm plane you met at the top of this page is the same shape: the personas are how you tune this, with one drag.

The 25% cgroup quota is only the distant hard ceiling we promise never to need. We measured about 1% of one core and 11 MB resident on a real box. Calm is native here because the heavy work is scheduled, not because a bolt-on throttle is fighting a host-resident engine.

L4on-host brain · the local verdict

A real detection brain on the box, observe-only.

Five of the twelve engines fold a judgement from the side of this stream in the default build (a sixth, YARA-X, is behind the -tags yara opt-in build): ransomware (an 8-heuristic sliding-window correlator), process injection (four memory shapes, no disassembler), event-chain (write to exec to connect), critical-config integrity, and an industry-standard content engine almost nobody expects on-host, a real SigmaHQ evaluator running across all four streams. A real YARA-X byte-signature scanner sits alongside it in-tree, behind the same opt-in build. Every finding carries its rule, author and an ATT&CK technique read from the rule's own tag, never invented.

apt_lnx_kobalos.yarESET · BSD 2-Clause · bundled verbatim
rule APT_MAL_LNX_Kobalos {
  meta:
    description = "Kobalos malware"
    author      = "Marc-Etienne M.Leveille"
    license     = "BSD 2-Clause"
  strings:
    $password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
    $strings_rc4_key     = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }
    … 2 of 4 strings shown
  condition:
    uint16(0) == 0x457f and any of them
}

YARA-X VirusTotal engine · BSD-3 · opt-in build (-tags yara), not in the default binary

Byte-signature scans of settled unknown executables (dedup by content hash) and the memory regions the injection scanner flags. Full-file scans run as heavy calm tasks with a 60 s starvation floor; known-good OS-package binaries skip the deep scan.

observe-only opt-in build · -tags yara
kind:detection · yara_match · rule:APT_MAL_LNX_Kobalos · author:Marc-Etienne M.Leveille · conf 0.75 · technique:unmapped

no ATT&CK tag on this rule, so the finding ships unmapped: never an invented id.

  • in-tree rules · 5 in 4 files · opt-in build onlyauthor · score
  • MAL_LNX_PLAGUE_BACKDOOR_Jul25Pezier Pierre-Henri · 80
  • SUSP_LNX_Linux_Malware_Indicators_Aug20_1Florian Roth · 65
show 2 more rulesshow fewer
  • APT_MAL_LNX_Kobalos_SSH_Credential_StealerESET · BSD-2
  • Whisper_EICAR_Test_File · self-testT1204.002 · 50
  • confidence from the score meta, kept below 1.0: the rule never claims certainty, the graph second pass adds intent.
proc_creation_lnx_netcat_reverse_shell.ymlSigmaHQ · DRL 1.1
title: Potential Netcat Reverse Shell Execution
author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)'
tags: [attack.execution, attack.t1059]
logsource: {category: process_creation, product: linux}
detection:
  selection_nc:    Image|endswith: ['/nc', '/ncat']
  selection_flags: CommandLine|contains: [' -c ', ' -e ']
  selection_shell: CommandLine|contains: [' bash', ' sh', …]
  condition: all of selection_*
level: high

Sigma sigma-go evaluator · MIT · in-process

The SigmaHQ rule format over the whole telemetry surface: exec → process_creation, file → file_event, conn → network_connection, dns → dns_query. Pure in-memory matching on the hot path, capped at 512 rules; the technique rides each rule’s own attack tag.

observe-only
kind:detection · sigma_match · title:Potential Netcat Reverse Shell Execution · author:@d4ns4n_, Nasreddine Bencherchali · conf high · technique:T1059

confidence is the rule author’s own level, from critical down to low.

  • 8 of 79 shown, all SigmaHQ upstreamstream · technique
  • Linux Shell Pipe to Shellexec · T1140
  • Process Execution From Shared Memory Directoryexec · T1027.011
  • Potentially Suspicious Execution From Tmp Folderexec · T1036
show 4 more rulesshow fewer
  • Communication To Ngrok Tunneling Serviceconn · T1567 +4
  • Linux Crypto Mining Pool Connectionsconn · T1496
  • New Cron File Createdfile · T1053.003
  • DNS Query to External Service Interaction Domainsdns · T1190
  • plus the featured netcat reverse shell (exec · T1059). Attribution and license ride every finding, per DRL 1.1.
bring your own rules · drop .yar / .yml into .whisper/yara + .whisper/sigma
Two industry-standard detection-content engines run natively inside the sensor, observe-only, across file, memory and all four event streams. Every finding carries the rule name, its author and license, and an ATT&CK technique read from the rule’s own tag, never invented. 79 Sigma rules bundled, and the YARA engine behind a build-time opt-in, with its 5 in-tree rules unreachable unless you build with -tags yara; operators extend both by dropping .yar / .yml files into .whisper/.
What the engines cover

Eighteen techniques carry detection content. Telemetry is not detection.

On the live fleet matrix, telemetry observes 37/37 techniques, but observing is not detecting: bundled signature coverage stands at 32/37 (86%). One cell is marked verified-live because it fired on a real burst; the rest is bundled content the test suite exercises.

initial access1
T1190
Exploit Public-Facing Application
sigma · dns
ext-service interaction domains · + T1595.002 on the tag
execution2
T1059
Command & Scripting Interpreter
sigma · exec
netcat reverse shell · level high
T1204.002
User Execution: Malicious File
yara
EICAR self-test rule
persistence4
T1053.003
Scheduled Task: Cron
sigma + config-watch
new cron file · /etc/cron.* writes
T1543.002
Systemd Service
config-watch
systemd/system · init.d · rc.local
T1574.006
Dynamic Linker Hijacking
config-watch
ld.so.preload · caught at creation
T1098.004
SSH-config tamper
config-watch
sshd_config watch · adjacent coverage
priv-esc1
T1548.003
Sudo & Sudo Caching
config-watch
sudoers · sudoers.d
defense evasion5
T1055
Process Injection
injection
rwx_anon · hollow · + T1055.012 · each fires alone once screened
T1620
Reflective Code Loading
injection
memfd exe · no disassembler, the map is the tell
T1140
Deobfuscate / Decode
sigma · exec
shell pipe to shell
T1027.011
Fileless Storage
sigma · exec
exec from /dev/shm · level high
T1036
Masquerading
sigma · exec
execution from tmp
c2 · exfil2
T1105
Ingress Tool Transfer
event-chain
write → exec → connect · bounded confidence, never 1.0
T1567
Exfil Over Web Service
sigma · conn
ngrok tunnel · + T1568.002 T1572 T1090 T1102
impact3
T1486 live
Data Encrypted for Impact
ransomware · 8-signal fusion
mass-encrypt burst convicted, 0 FP · 78 tests
T1490
Inhibit System Recovery
ransomware
argv-classified destroys · fire on their own
T1496
Resource Hijacking
sigma · conn
crypto-mining pool connections
verified-live · fired on a real burst in a live end-to-end run bundled detection content · exercised by 1,752 test functions + 93 fuzz targets telemetry-only techniques are not drawn here: telemetry is not detection
A slice of the set, drawn with the ids findings actually carry: 18 techniques across seven tactic groups, out of the 103 a shipped rule or engine names. The full per-technique ledger is on ATT&CK coverage. On the live fleet matrix telemetry observes 37/37 techniques while signature coverage stands at 32/37 (86%); the self-test and adjacent cells say so on their face; YARA cells ride the opt-in -tags yara build; and a rule with no ATT&CK tag ships technique:unmapped, never an invented id.
The ATT&CK matrix in the console. The header reads 100% telemetry, 37 of 37 tested, 103 named detections and 4 infrastructure columns split 2 pure and 2 hybrid. Tactics run across the top, techniques in columns, and Reconnaissance and Resource Development are marked HOST EDR: BLIND HERE where a host-only sensor sees an IP but not the destination's owner across the internet.
The ATT&CK matrix, with the moat drawn on it. 103 named detections against 37/37 measured telemetry, reported as two numbers and never summed. Four infrastructure columns, two of them pure and marked HOST EDR: BLIND HERE: destinations a box-only sensor cannot score, because it never served the name. Two tenant identifiers are masked; every figure is the live read.
Ransomware, and the false positives it exonerates

Eight signals fuse, and plain content is acquitted.

The catch matters less than the composure: entropy is gated so a compiler or a backup burst is exonerated on plain content, and no detector claims 1.0. 78 tests on this engine alone, zero false positives on the live run.

8 HEURISTICS · ONE PROCESS · 10 S WINDOW mass write · many files rename churn · uniform ext canary tripwire · fires alone mass delete + backup tamper gated entropy · high reads tree rollup · to the tree owner low-and-slow accumulator recovery destroy · T1490 fusion Σw - exonerate clamp [0, 1] 0 1.0 fire line fired silent silent shape alone plain content exonerates fired in the live encrypt burst stayed silent · benign fired signals sum, exonerate, clamp onto the dial
mass-encrypt burst fired · T1486 encrypt to .locked, then unlink · high_entropy + mass_write + mass_delete
encrypted-vault create burst silent creates only, no destruction: content never convicts on its own
compile-and-delete build burst silent shape alone would flag; plain content exonerates: plain samples read as exactly what they are
One process’s ten-second window, fused. In a live end-to-end run on a real host the paced mass-encrypt burst fired and a canary rename fired alone, while the vault and compile bursts stayed silent: the collector saw all four bursts (121/100/150/180 file events) and convicted only the two attacks. 0 false positives, 78 tests on this engine alone; entropy is the only disk I/O and stays on a tightly capped budget host-wide. Observe-only: it emits a detection, never blocks.
L5the graph · the moat

Because we serve the name, we score the destination.

A host-only sensor sees an IP. Whisper serves the DNS, so the sensor pins the port-53 query to a PID and joins process to DNS name to peer, then the internet-scale whisper.security graph, 7.52B nodes and 38.6B relationships, has already scored that destination's owner, ASN, prevalence and reputation band. Every verdict is a re-runnable Cypher with a provenance receipt, and the overlay is fail-open, so the local answer never waits on the global one.

The explore graph in the console: a selected process node joined through the domain it resolved to the internet-scale graph, with the destination owner, ASN and reputation band pulled in, and the live node and relationship totals shown on screen.
One process, joined to the whole internet. The destination's owner, origin AS and prevalence come from the same 7.52B node / 38.6B relationship graph that answers the name, so a lookalike or a fresh-registered C2 reads as what it is, not as an anonymous IP.
L6policy · the control

Govern the /128, off the host.

Governance is expressed against the address, in Whisper's egress plane, so a compromised agent cannot switch off its own firewall. Per-identity firewall, graded egress across five trust tiers, geography (opt-in and disabled by default), per-device policy, and nesting: a parent agent spawns sub-agents that each get their own governed /128, and one kill cuts the whole measured subtree at its next CONNECT.

measured transit · enforced declared · display-only depth capped at 32 · fails closed past it fan-out reported to 256 · surplus counted a deny at any layer wins
Cut the parent, cut the branch: one kill flip on ::a denies every descendant on the measured transit chain at its next CONNECT (depth-bounded, fail-closed, and a declared-but-never-transiting edge counts for nothing), while a hard op:revoke goes further and tears the /128 out of DNS worldwide and drops its RDAP record to a covering allocation naming no agent worldwide.
process trust · scored by the graph egress freedom · per CONNECT one endpoint, procs T4 · T3 · T1 worst wins → T4 · verified T3 · neutral T2 · unverified T1 · suspicious T0 · known-bad unrestricted direct mediated dns-only none none + dns-only stage the refusal, off-host only a confirmed graph verdict reaches T0 · never a fail-open guess
op:policy {trust.T0:'none', trust.T1:'dns-only', trust.T4:'unrestricted'} enforcement=live

the mapping is yours, per tenant · a non-monotone mapping warns, then stores · only none and dns-only refuse

One op:policy call maps the five graph-scored trust tiers onto the five egress freedoms, and every CONNECT then folds the endpoint's worst observed process onto the rung it earned: a single suspicious process pulls the whole endpoint down to dns-only, off-host, with nothing on the box to disable.
A console nesting tree: a parent agent identity with several sub-agents beneath it, each a routable /128, and the measured transit edges distinguished from declared-only edges.
The nesting tree, in the console. A parent identity over its governed sub-agents, each its own /128; a hard op:revoke tears the branch out of DNS worldwide and drops its RDAP records to a covering allocation naming no agent, while a kill denies the subtree at its next CONNECT.
L7response · the containment

The off-switch that survives a fully owned box.

Two levers. On-host, a bounded response (kill, quarantine, service-restart, patch) that is opt-in, poll-only, allowlist-only and audited per action. Off-host, the kill-switch a host agent cannot match: revoke the /128 and it goes to authenticated NXDOMAIN, the RDAP record shows no assignment, the DANE pin is gone, worldwide at DNS-TTL, scoped and reversible. A host-only agent keeps its off-switch on the very machine it has lost. Ours does not.

The respond view with a containment preview: the blast graph in its severed state, the target spoke tinted critical red and cut with a dashed line and a scissor tick, and a rail reading revoke cuts N with zero collateral.
Contain, previewed before you pull it. The sever preview tints the severed spoke critical and reads revoke cuts N, and the withdrawal is verifiable on the public internet by anyone with dig, no Whisper credential needed. Scoped, reversible, audited.
verify it yourself · through all seven layers

One proof a stranger can walk, keyless.

Every claim on this page is checkable without a Whisper credential, and they all hang from one chain: a DNSSEC-signed zone, a DANE pin, an RFC 6962 inclusion proof in a signed checkpoint, an independent witness cosigning, and an OpenTimestamps anchor on Bitcoin. We state it at its true level: tamper-evident today, publicly verifiable once a second independent witness joins the quorum.

A keyless evidence artifact: a SHA-256 digest of an event, an RFC 6962 inclusion receipt against a signed tree head, and two witness cosignatures, the log's own and an independent witness's.
The evidence artifact, keyless. A SHA-256 digest, an inclusion receipt against the signed tree head, and two cosignatures. Nothing here trusts Whisper; it recomputes to a root a stranger can check.
$ curl -s https://rdap.whisper.online/checkpoint

Fetch the live tree head yourself, then walk the inclusion proof for any event. The checkpoint moves; the chain above is the last keyless capture, 2026-08-25.

One primitive, three doors

Whichever way you arrived, it is the same product.

CISO & SecOps

Off-host containment, and calm

End a compromised host at the network layer even when it is fully owned, with a sensor the helpdesk never notices. The kill-switch survives what a host agent cannot.

The off-host kill-switch →
MSSP & MSP

Multi-tenant, worst-first, white-label

An account per client, worst-first triage, per-tenant policy, fixed-cost logs and billable white-label reports, each finding citing its own re-runnable Cypher. Pricing you see before you commit, no distributor floor.

Pricing for MSSPs and MSPs →
AI-agent & platform

A routable identity and a kill-switch in one call

Every agent and sub-agent gets its own verifiable /128, per-process trust tier and generation-bound governance, addressed by hostname on standard ports.

Give an agent a /128 →
The honest close

We name our own frontier, and date it.

We separate telemetry from verdict, mark observe-only and gated features as such, ship detectors that top out below 1.0, and label the ledger tamper-evident until a second witness joins. Real RIPE address space, run from the EU, by people who built the internet's plumbing.

The office, not the founder.
Operator   Whisper Security (viaGraph B.V.), Amsterdam, NL
Network    AS219419 · announces 2a04:2a01::/32 · RIPE inet6num · RPKI-signed, MANRS
People     built by an ex-RIPE NCC CIO and a K-root architect
Verify     dig +dnssec -x <your /128> · anchored at the IANA root
active enroll a /128 · verifiable this second, keyless
name
scout
identity
2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
anchor
DNSSEC (alg 13) · DANE-EE (TLSA 3 1 1) · RDAP active
Flip it. The off-host revoke is the whole product in one gesture.
revoked gone worldwide at DNS-TTL · survives a fully owned box
identity
2a04:2a01:dead:beef::1
reverse
none · authenticated NXDOMAIN
anchor
NSEC3 denial · RDAP: no assignment · DANE gone
Proven on a throwaway /128. Scoped, reversible, audited.
Verify a /128, keyless → no agent, no API key · dig, delv and openssl are enough
or install whisper (add WHISPER_SENSOR=1 and a key for the calm sensor)
$ curl -fsSL https://get.whisper.online | sh