# Compare us to anyone - Whisper vs the EDR/XDR market

Six vendors, eight categories, 79 capabilities, 474 cells, every one
carrying a source resolvable in the references at the foot of this page. The default
comparison is Whisper vs CrowdStrike, the account every buyer benchmarks; the tables
below carry all five selected market leaders. Where a rival leads, the matrix says so
at the same weight, cited from the rival's own words. Where Whisper leads, the claim
traces to a proof a stranger can run keyless.

The thesis, in one sentence: Whisper is not a better host agent. It is a different
shape of EDR - a calm cross-platform sensor plus the network and identity plane no
host-only EDR can bolt on, because Whisper serves the DNS the fleet points at and
holds a 7.52B-node / 38.6B-edge graph of the internet's naming and routing.

## The vendors

Selected market leaders (scored columns):

- **Whisper** - Whisper Identity-Native EDR/XDR
- **CrowdStrike** - CrowdStrike Falcon (default comparison)
- **Microsoft Defender** - Microsoft Defender for Endpoint / Defender XDR
- **SentinelOne** - SentinelOne Singularity
- **Cortex XDR** - Palo Alto Networks Cortex XDR
- **Trend Vision One** - Trend Micro Trend Vision One

Held out as profiles (strong vendors, a tier below the leader test; profiled, not column-scored):

- **Sophos Intercept X** - 15-consecutive-year Gartner EPP Leader and top SE Labs/AV-Comparatives scorer, but weighted to mid-market/MSP and a Strong-Performer/MDR (not XDR-Leader) analyst profile; strongest optional add-in for an MSP/SMB buyer.
- **Bitdefender GravityZone** - Excellent independent-lab track record and low-alert MITRE result, but a Gartner Visionary (not Leader) and Forrester Strong Performer (not Leader); best optional add-in for a value/SMB comparison.
- **Cybereason Defense Platform** - A 2022 EPP Leader with a strong MalOp correlation model, but non-Leader in 2024 and dropped from the 2026 Gartner quadrant entirely, with evidenced 2024-2025 financial/leadership instability; weakest pick for a multi-year commitment. Keep only as an add-in when a buyer already shortlists it.

## The scorecard

Category scores are computed, not curated: yes = 1, partial = 0.5, no and n/a = 0,
averaged over the category's rows. LEAD marks count rows a vendor clearly leads.

| Category | Whisper | CrowdStrike | Microsoft Defender | SentinelOne | Cortex XDR | Trend Vision One |
|---|---|---|---|---|---|---|
| **Sensor & Telemetry** | 83% (2 leads) | 92% | 92% | 88% | 92% | 92% |
| **Detection & ATT&CK** | 73% (4 leads) | 77% (3 leads) | 73% | 73% (1 lead) | 77% | 77% |
| **Backend, Analytics & Graph** | 89% (3 leads) | 56% (2 leads) | 56% | 50% (1 lead) | 56% | 56% |
| **Network & Identity** | 80% (6 leads) | 30% (1 lead) | 30% | 30% | 40% | 35% (1 lead) |
| **Response & Containment** | 68% (4 leads) | 64% (1 lead) | 55% | 68% (1 lead) | 64% (1 lead) | 64% |
| **Coverage & Platforms** | 50% (1 lead) | 81% (1 lead) | 75% | 56% | 69% | 81% (1 lead) |
| **Deployment & Footprint** | 71% (2 leads) | 50% | 50% | 71% | 36% | 64% |
| **Independent Validation & Standing** | 29% (1 lead) | 86% | 79% (1 lead) | 71% | 86% | 86% (1 lead) |

Row leads across the whole matrix: Whisper 23 of 79, CrowdStrike 8,
other vendors 8; 40 rows have no clear leader.

## The matrix

Legend: Yes = has the capability; Partial = has it with material caveats; No = does
not have it; n/a = not applicable or not disclosed. LEAD = clearly leads that row.
Every cell carries a bracketed [src] id resolvable in the references below.

### Sensor & Telemetry

| Capability | Whisper | CrowdStrike | Microsoft Defender | SentinelOne | Cortex XDR | Trend Vision One |
|---|---|---|---|---|---|---|
| **Single unified agent (EPP+EDR+XDR in one agent)** | Yes - Single MIT-licensed Go binary, cross-compiled per platform [ws-collectors] | Yes - One lightweight Falcon sensor, all modules [cs-os] | Yes - Endpoint agent unified; identity is a separate MDI product [ms-mdi] | Yes - One Singularity agent across Win/macOS/Linux/K8s [s1-linux] | Yes - Single Cortex XDR agent [cx-datalake] | Yes - Single Vision One ES agent [tm-os] |
| **Kernel-independent sensor (user-space / eBPF, no loadable kernel module)** | **LEAD** Yes - User-space on every OS: eBPF/NETLINK+fanotify (Linux), ETW (Windows), Apple ES via Swift daemon (macOS); brain deliberately off-host [ws-parity-win] | Partial - Windows still a kernel-mode driver (Channel File 291 BSOD'd ~8.5M hosts); Linux eBPF, macOS ES [cs-outage] | Partial - Windows in-OS/kernel-integrated; Linux eBPF no-module; macOS ES [ms-linux] | Partial - Linux eBPF no-module, macOS kextless; Windows kernel driver/minifilter [s1-linux] | Partial - Windows/macOS kernel drivers/SysExt; Linux needs a kernel module for full EDR (user-space only on 5.0+) [cx-linux] | Partial - Kernel/driver components (behavior monitoring, real-time scan, host IPS) in the Apex One/Deep Security lineage [tm-vp] |
| **Process-execution telemetry (exec + parent-process graph)** | Partial - NETLINK (Linux) / ETW (Windows) exec collector, parent graph in both; macOS ships an entitlement-free exec collector (a kern.proc.all process-table sampler with proc_pidpath, argv and the kernel code-signing identity); the higher-fidelity ES exec push remains gated on the Apple Endpoint Security entitlement [ws-collectors] | Yes - Process execution streamed to cloud [cs-os] | Yes - Process/behavioral telemetry [ms-linux] | Yes - Process events stitched into Storyline [s1-contain] | Yes - Records all endpoint process activity [cx-datalake] | Yes - Process/behavior telemetry [tm-vp] |
| **File-system telemetry (create/modify/rename/delete)** | Partial - fanotify (Linux) / ETW File (Windows); macOS ES file events are built and gated on the Apple Endpoint Security entitlement (flip-on-grant) [ws-collectors] | Yes - File telemetry [cs-os] | Yes - File telemetry [ms-linux] | Yes - File telemetry [s1-contain] | Yes - File telemetry [cx-datalake] | Yes - File + integrity monitoring [tm-vp] |
| **Network-connection telemetry (outbound connect)** | Yes - Live on all three platforms: Linux + Windows, and now macOS via a calm entitlement-free libproc socket sampler (proven on real hardware, 58 real conn events, correct in/out classification). Real-time per-flow is the one gated upgrade. [ws-parity-mac] | Yes - Network-connection telemetry cross-platform [cs-os] | Yes - Network-connection telemetry [ms-linux] | Yes - Network-connection + cross-process events [s1-contain] | Yes - Network-connection telemetry [cx-datalake] | Yes - Network-connection telemetry [tm-vp] |
| **DNS-query telemetry (observing qname)** | Yes - qname collector on Linux; and Whisper IS the resolver so it sees every query (macOS NE-gated) [ws-platform] | Yes - DNS-query telemetry streamed to cloud [cs-os] | Yes - DNS observed via host network protection [ms-netprot] | Partial - Sees connections; DNS-request-time reputation is not a core capability [s1-firewall] | Yes - Tunneled/DNS-based threat detection via analytics + NGFW feed [cx-nta] | Yes - Web/URL/C&C callback reputation on DNS/web traffic [tm-vp] |
| **Registry telemetry (Windows)** | Yes - ETW registry visibility on Windows [ws-parity-win] | Yes - Registry telemetry [cs-os] | Yes - Registry telemetry [ms-linux] | Yes - Registry telemetry [s1-contain] | Yes - Registry telemetry [cx-datalake] | Yes - Registry telemetry [tm-vp] |
| **Script / command-line telemetry** | Yes - exec argv captured; recovery-tool argv classifiers [ws-collectors] | Yes - Script + command-line activity [cs-os] | Yes - Command-line + script telemetry [ms-linux] | Yes - Command-line telemetry [s1-contain] | Yes - Command-line telemetry [cx-datalake] | Yes - Command-line telemetry [tm-vp] |
| **Real-time memory / injection visibility** | Partial - Windows VirtualQueryEx sweep live, ETW-TI built-dark; Linux post-hoc /proc maps sweep; the macOS real-time path (ES REMOTE_THREAD/MPROTECT/MMAP + DYLD vector) is built and gated on the Apple Endpoint Security entitlement, which darkens the memory path; exec now ships an entitlement-free producer and the file collector is proven on real Apple hardware [ws-parity-mac] | Yes - Mature in-memory/injection detection (IOA) [cs-mitre25] | Yes - Behavioral memory/injection detection [ms-mitre24] | Yes - On-execution behavioral AI over memory [s1-mitre] | Yes - In-process shellcode + exploit protection (Windows) [cx-mitre] | Yes - Behavioral + exploit prevention [tm-vp] |
| **Measured, calm footprint with a published resource SLA** | **LEAD** Yes - cgroup-v2 SLA (CPUQuota=25%, MemoryHigh=150M/Max=250M, IOWeight=10) + self-metered heartbeat; ~17MB measured under 1169 exec events; adaptive calm scheduler [ws-epic] | Partial - Marketed lightweight; precise footprint not published [cs-os] | Partial - eBPF marketed as minimal overhead; no published SLA [ms-linux] | Partial - Independent reviews report agent can be resource-heavy on low-spec/loaded hosts (esp. scans) [s1-resource] | Partial - Documented mins ~2GB RAM/5GB disk (Windows); heavier [cx-linux] | Partial - Reviewer-cited performance impact + ~600MB installer [tm-installer] |
| **Offline / disconnected protection** | Yes - On-device correlators + fail-open collectors keep serving offline [ws-epic] | Yes - On-sensor ML + IOA prevention offline; full EDR needs cloud [cs-arch] | Yes - On-host next-gen AV/behavior offline; offline sig updates on Linux [ms-linux] | Yes - On-device behavioral AI holds when offline [s1-linux] | Yes - Local Analysis ML + WildFire cache offline [cx-datalake] | Yes - Smart Scan local pattern offline [tm-airgap] |
| **Tamper protection / anti-uninstall** | Partial - Structural answer: brain + containment live OFF the host, so killing the thin fail-open agent does not blind or lift containment; no hardened on-host self-protect emphasized [ws-epic] | Yes - Anti-tamper; kernel residency cited as tamper resistance [cs-contain] | Yes - Windows Tamper Protection (cross-platform parity unverified) [ms-netprot] | Yes - Anti-tamper: no uninstall without out-of-band approval [s1-tamper] | Yes - Password-gated tamper protection [cx-isolate] | Yes - Self-protect / tamper + integrity monitoring [tm-vp] |

### Detection & ATT&CK

| Capability | Whisper | CrowdStrike | Microsoft Defender | SentinelOne | Cortex XDR | Trend Vision One |
|---|---|---|---|---|---|---|
| **Behavioral ransomware detection (T1486 / T1490)** | Yes - Canary + mass-write + uniform-ext burst + mass-delete fusion + recovery-tool argv; fired live @1.0 end to end on Windows [ws-parity-win]; on macOS the engine is built and its ES feed is entitlement-gated, so it has never fired on a live Mac | Yes - Behavioral ransomware IOA; MITRE 2025 100% protection claim [cs-mitre25] | Yes - Human-operated + remote-encryption ransomware detection [ms-air] | Yes - Behavioral AI + VSS rollback [s1-rollback] | Yes - Anti-ransomware BTP module [cx-mitre] | Yes - Ransomware behavior detection + rollback lineage [tm-remote] |
| **Dropper / event-chain correlation (write -> exec -> connect)** | Yes - the event-chain engine links write->exec->outbound-connect in order; fired live (Windows 0.9) [ws-parity-win] | Yes - IOA behavioral chains [cs-mitre25] | Yes - Behavioral chain + incident correlation [ms-mitre24] | Yes - Storyline automated cross-process correlation [s1-contain] | Yes - Behavioral Threat Protection chains + causality [cx-mitre] | Yes - Observed Attack Techniques chain correlation [tm-mitre] |
| **Process injection detection (T1055)** | Partial - Windows + Linux are post-hoc / built-dark; the macOS real-time path is built and gated on the same Apple Endpoint Security entitlement [ws-parity-mac] | Yes - Mature injection detection [cs-mitre25] | Yes - Injection behavioral detection [ms-mitre24] | Yes - Behavioral AI injection detection [s1-mitre] | Yes - In-process shellcode / injection protection [cx-mitre] | Yes - Behavioral injection detection [tm-vp] |
| **Driver-blocklist / BYOVD (T1068)** | Yes - 85-rule ETW ImageLoad matcher (45 name + 40 sha256); name lane live, fires even when memory-integrity is off (Windows) [ws-parity-win] | Yes - Vulnerable-driver / BYOVD coverage [cs-mitre25] | Partial - ASR + vulnerable-driver blocklist [ms-air] | Partial - Behavioral driver-abuse detection [s1-mitre] | Yes - Dynamic kernel protection (Windows) [cx-mitre] | Yes - Virtual patching / host IPS shields driver exploits [tm-vp] |
| **Open, portable rule engine (Sigma / DRL)** | **LEAD** Yes - Pure-Go sigma-go over 79 bundled rules (34 upstream SigmaHQ verbatim under DRL 1.1, 45 first-party under MIT) + operator rule dir, per-GOOS admission, no GPL packs [ws-sigma] | No - Proprietary IOA engine; no open Sigma engine [cs-mitre25] | Partial - Custom KQL detection rules, not Sigma [ms-hunt] | Partial - STAR custom rules, not Sigma [s1-contain] | Partial - BIOC / correlation rules + XQL, not Sigma [cx-xql] | Partial - Custom detection rules + OAT, reviewers note limited custom logic [tm-mitre] |
| **Static / ML pre-execution NGAV** | Partial - Known-good allowlist + graph reputation; YARA-X built-dark; no heavy on-device ML AV model (younger analytic layer, stated) [ws-atomic] | **LEAD** Yes - On-sensor ML NGAV refined over a decade [cs-mitre25] | Yes - Next-gen AV (behavior + cloud ML) [ms-mitre24] | Yes - Static AI pre-execution model [s1-mitre] | Yes - Local Analysis ML + WildFire [cx-mitre] | Yes - ML/AI pre-exec + pattern AV [tm-vp] |
| **Cloud ML / large behavioral-analytics stack** | Partial - Behavioral engines + graph reputation; analytic breadth narrower than incumbents' decade-old ML stacks (stated honestly) [ws-atomic] | **LEAD** Yes - Cloud ML + IOA behavioral analytics [cs-mitre25] | Yes - Cloud ML/AI analytics + incident correlation [ms-mitre24] | Yes - Behavioral AI + Storyline [s1-mitre] | Yes - Cloud Analytics ML profiling (credential theft, tunneled DNS) [cx-mitre] | Yes - ML/AI behavioral analytics [tm-mitre] |
| **Local, zero-network known-good hash allowlist** | **LEAD** Yes - Local O(1) map seeded from fleet dpkg hashes (3075 live); zero network lookup [ws-knowngood] | Partial - Cloud reputation / allowlisting [cs-threatgraph] | Partial - Cloud reputation [ms-intel] | Partial - Cloud reputation [s1-datalake] | Partial - WildFire cloud verdicts [cx-mitre] | Partial - Smart Protection Network cloud reputation [tm-spn] |
| **YARA file / memory scanning** | Partial - YARA-X engine present but built-dark (CGO, opt-in tag; default ships the stub) [ws-yara-ja] | Partial - YARA supported via custom IOAs / RTR [cs-contain] | Partial - Signature + custom indicators [ms-mitre24] | Partial - Static AI (not YARA-centric) [s1-mitre] | Partial - WildFire + pattern engines [cx-mitre] | Partial - Pattern + heuristic engines [tm-vp] |
| **JA3 / JA4 TLS client fingerprinting** | Partial - Engine reference-pinned + unit-tested but built-dark (no production capture tap yet) [ws-yara-ja] | Partial - Some TLS/network fingerprinting via cloud telemetry [cs-threatgraph] | No - Not a documented capability [ms-netprot] | No - Not a documented capability [s1-firewall] | Partial - Network analytics via NGFW feed [cx-nta] | Partial - NDR network sensors inspect TLS metadata [tm-ndr] |
| **ATT&CK technique mapping (on-host tactics)** | Yes - 64 live-capable named on-host techniques across Linux 45 / Windows 44 (57 of the 91 mapped are at the parent technique), verified per-platform against a coverage manifest. A further 27 are macOS-only and ALL 70 macOS entries are feed-gated on the Apple Endpoint Security entitlement, so they are built rather than live; telemetry visibility (37/37) reported separately from named detection, never merged. [ws-atomic] | Yes - Detections mapped to ATT&CK; multiple published MITRE rounds [cs-mitre25] | Yes - ATT&CK-aligned detections + device timeline [ms-mitre24] | Yes - ATT&CK-mapped across all evaluated OSes [s1-mitre] | Yes - 100% technique-level detection claim (MITRE ER6) [cx-mitre] | Yes - Observed Attack Techniques ATT&CK mapping [tm-mitre] |
| **Adversary-INFRASTRUCTURE ATT&CK columns (Recon TA0043 / Resource-Dev TA0042) from the attacker's own domains/IPs/certs** | **LEAD** Yes - Now emitted as NAMED ATT&CK-tagged detections, not just scored: 19 techniques across Reconnaissance TA0043 + Resource-Development TA0042 (+ C2 / Exfil), origin=graph, each with a keyless re-runnable receipt, on the 7.52B/38.6B internet graph. The four columns no host-only EDR can reach. [ws-attackmatrix] | Partial - Deep finished intel (Counter Adversary Ops) but inferred from host + reporting, not a live resolution control point [cs-intel] | Partial - Covered only as far as Microsoft's reputation feed reaches the host [ms-intel] | Partial - Curated-feed intel; a host-resident sensor is structurally weak on these columns [s1-datalake] | Partial - WildFire / Unit 42 indicator feeds; on-host recon substeps only [cx-nta] | Partial - SPN reputation + NDR sensors; visible only where it touches a host or a Trend sensor [tm-spn] |
| **C2-infrastructure + exfil-destination reputation at the resolution plane (act before the connection is made)** | **LEAD** Yes - Named C2-infrastructure (T1071.001/T1568.002 DGA/T1572/T1090/T1102) + exfil-destination (T1048/T1567) findings at the resolution plane, acted before the connect. Combined with the on-host set: 103 distinct techniques across 14 of 14 tactics. [ws-attackmatrix] | Partial - Reputation from intel; the host observes the connection, does not gate it at resolution [cs-intel] | Partial - Host-side reputation block (network protection) [ms-netprot] | Partial - Curated feed enrichment [s1-datalake] | Partial - Bad-domain lists enforced via PAN NGFW / DNS Security enforcement points [cx-dns] | Partial - C&C callback blocking + SPN reputation + inline NDR [tm-ndr] |
| **GenAI SOC assistant (NL triage / hunting)** | No - No marketed GenAI copilot; control is a single Cypher verb + graph queries [ws-platform] | **LEAD** Yes - Charlotte AI generative triage + NL-to-CQL hunting [cs-ngsiem] | Yes - Security Copilot integration [ms-air] | Yes - Purple AI generative assistant [s1-contain] | Partial - Agentic-AI direction (XSIAM / Koi) [cx-xql] | Yes - TrendAI / Companion assistant [tm-mitre] |
| **Validated low-alert / signal-to-noise posture** | Partial - Calm-by-design + separate telemetry-vs-analytic reporting, but alert volume not independently MITRE-measured [ws-atomic] | Yes - SE Labs 100% accuracy, zero FP; MITRE zero-FP claim [cs-selabs] | Yes - Zero-FP claim in 2024 MITRE round [ms-mitre24] | **LEAD** Yes - 88% fewer alerts than median (2024 MITRE) - strongest low-noise figure [s1-mitre] | Yes - Zero FP in MITRE ER6 protection test [cx-mitre] | Partial - Strong coverage but Trend itself notes HIGHER alert volume; reviewers cite FPs [tm-installer] |

### Backend, Analytics & Graph

| Capability | Whisper | CrowdStrike | Microsoft Defender | SentinelOne | Cortex XDR | Trend Vision One |
|---|---|---|---|---|---|---|
| **Cross-customer security-telemetry graph (hosts/workloads/identities)** | Partial - Per-endpoint + cross-tenant graph exists but production scale is small/early vs incumbents [ws-epic] | **LEAD** Yes - Threat Graph: 40+ PB, trillions events/day, ~70M req/sec across all customers [cs-threatgraph] | Yes - 100T+ signals/day; unified XDR incident graph (Kusto) [ms-intel] | Yes - Singularity Data Lake cross-fleet [s1-datalake] | Yes - Cortex Data Lake stitching [cx-datalake] | Yes - Smart Protection Network, 250M+ sensors [tm-spn] |
| **Internet-scale naming/routing graph (domains, IPv4/6, ASN, RDAP, certs, passive DNS)** | **LEAD** Yes - 7.52B-node / 38.6B-edge graph OF THE INTERNET ITSELF - the structural inverse of a host-telemetry graph; no host-only EDR has this [ws-graph] | No - Threat Graph is security telemetry, not an internet naming/routing graph [cs-threatgraph] | Partial - Graph threatIntelligence IS customer-queryable passive DNS, WHOIS, host pairs, subdomains and certs (GA). No BGP, RPKI or ASN: naming, not routing, and a research surface rather than a predicate in the endpoint policy builder [ms-graph-ti] | No - Curated feed intel, not an internet-infrastructure graph [s1-datalake] | No - WildFire/Unit 42 indicator feeds, not an internet graph [cx-nta] | No - SPN is product-telemetry reputation, not an internet naming/routing graph [tm-spn] |
| **Serves the DNS: graph-first policy resolver the fleet points at** | **LEAD** Yes - Whisper IS the resolver (agents point at it like 1.1.1.1); every destination scored graph-first at the resolution plane, real DNS when graph has no opinion [ws-platform] | No - Observes DNS as telemetry; not a recursive/authoritative resolver for devices [cs-os] | No - Host-side web/network protection, not a resolver the fleet queries [ms-netprot] | No - No DNS resolver / policy plane in the product line [s1-firewall] | No - Enforcement via PAN NGFW/DNS Security (a separate network product), not a resolver Cortex operates [cx-dns] | No - Web/URL/C&C reputation blocking, not an owned recursive resolver [tm-vp] |
| **Per-endpoint graph, Cypher/graph-queryable** | Yes - Per-/128 graph (processes over churn + distinct destinations) served over one Cypher /api/query [ws-epic] | Partial - Threat Graph per-host views [cs-threatgraph] | Partial - Device timeline + Advanced Hunting [ms-hunt] | Partial - Storyline per-host graph [s1-contain] | Partial - Causality / root-cause view [cx-datalake] | Partial - Workbench per-incident graph [tm-mitre] |
| **Graph JOIN depth (process -> DNS -> peer -> ASN -> actor -> cross-tenant, temporal, nested subtree)** | **LEAD** Yes - The moat: deep joins from on-host telemetry into the internet graph + 1,916 ACTOR nodes (344 of them carrying USES_TECHNIQUE edges) and across tenants - not one-hop enrichment [ws-attackmatrix] | Partial - Rich cross-customer telemetry joins, but not into an internet-infrastructure graph [cs-threatgraph] | Partial - Cross-signal correlation within a tenant [ms-hunt] | Partial - Cross-process/host joins within tenant [s1-datalake] | Partial - Causality stitching across the estate [cx-datalake] | Partial - Cross-layer correlation within tenant [tm-mitre] |
| **Finished threat-intelligence program (adversary tracking, human research)** | Partial - Graph carries the full ATT&CK taxonomy + 1,916 ACTOR nodes (344 of them carrying USES_TECHNIQUE edges), but not a human finished-intel shop [ws-attackmatrix] | **LEAD** Yes - Counter Adversary Ops: 250+ adversaries, 2,300+ reports/yr [cs-intel] | Yes - MSTIC: 1,500+ groups incl. 600+ nation-state [ms-intel] | Partial - Curated feeds (historically Mandiant-derived) [s1-datalake] | Yes - Unit 42 research + WildFire [cx-mitre] | Yes - 15 global research centers (SPN) [tm-spn] |
| **Hunting query language** | Yes - Cypher - graph-native queries over the endpoint + internet graph [ws-epic] | Yes - CQL (CrowdStrike Query Language) [cs-ngsiem] | Yes - KQL (Kusto Query Language) [ms-hunt] | Yes - Deep Visibility + Power Query + NL via Purple AI [s1-datalake] | Yes - XQL (Cortex Query Language) [cx-xql] | Yes - Vision One Search [tm-mitre] |
| **Data retention (default window; storage economics)** | Yes - Node-local, fixed-cost partition-drop retention, no external store on a hot path [ws-epic] | Partial - NG-SIEM ~7-day default, extendable to 36 months (paid) [cs-ngsiem] | Partial - 30-day default; longer needs Microsoft Sentinel (extra product + cost) [ms-hunt] | **LEAD** Yes - Up to 24-month Data Lake, 365-day EDR OOB (tier-dependent) [s1-datalake] | Partial - 30-day floor; longer sold as capacity [cx-datalake] | Partial - 30-day default, extendable to 90/180/365 (paid); Workbench 180 days [tm-retention] |
| **Customer-queryable cross-tenant correlation** | Yes - Cross-tenant graph is queryable (small scale today, but self-serve) [ws-attackmatrix] | Partial - Cross-customer signal informs detection fleet-wide, not customer-queryable [cs-threatgraph] | Partial - Curated cross-org TI, not a queryable cross-tenant graph [ms-intel] | No - Within-tenant + curated feed only [s1-datalake] | Partial - WildFire shared verdicts, not a cross-org relationship graph [cx-datalake] | Partial - SPN global reputation, not customer-queryable graph [tm-spn] |

### Network & Identity

| Capability | Whisper | CrowdStrike | Microsoft Defender | SentinelOne | Cortex XDR | Trend Vision One |
|---|---|---|---|---|---|---|
| **Operates authoritative DNS + reverse-DNS (PTR / ip6.arpa) for agent identities** | **LEAD** Yes - Dynamic forward zones (delegated from Cloudflare) + dynamic reverse DNS + per-/128 RDAP + inet6num docs [ws-platform] | No - Not a DNS operator [cs-os] | No - Not a DNS operator [ms-netprot] | No - Not a DNS operator [s1-firewall] | No - Not a DNS operator (relies on PAN network stack) [cx-dns] | No - Not a DNS operator [tm-vp] |
| **DNS-layer policy enforcement (block/allow at resolution, pre-connection)** | **LEAD** Yes - Per-geo/listing/category and per-device policy applied at the resolver before the connection is made. Lead is over the EDR/XDR cohort this matrix compares: an SSE platform (Cloudflare Gateway, Zscaler, Cisco Umbrella) has DNS-layer policy as an architectural default and would not be led here [ws-platform] | No - Observes DNS; no resolver-level enforcement [cs-os] | Partial - Host-side domain/URL/IP block (Network Protection), enforced on the endpoint not at resolution [ms-netprot] | No - No DNS-layer enforcement [s1-firewall] | Partial - Via PAN NGFW/DNS Security enforcement points if the customer runs the PAN stack [cx-dns] | Partial - Web/URL/C&C reputation blocking at host/gateway [tm-vp] |
| **Verifiable identity-on-the-wire (routable per-agent /128, DNSSEC/DANE-anchored, keyless-verifiable)** | **LEAD** Yes - Routable /128 per agent from 2a04:2a01::/32 (AS219419), FCrDNS + DANE TLSA 3 1 1, DNSSEC-signed, 7 keyless proofs; sensors pre-auth by their /128 [ws-identity] | No - Directory/account identity (AD/Entra/Okta), not a routable wire identity [cs-itdr] | No - Directory identity via MDI; no routable per-agent network identity [ms-mdi] | No - Directory identity (AD/Entra); agent identity is an install token/console record [s1-identity] | No - Directory-based ITDR, not identity-on-the-wire [cx-itdr] | No - Identity telemetry/ASRM, not a routable wire identity [tm-identity] |
| **Per-sub-agent / nested identity (a distinct routable identity per spawned agent)** | **LEAD** Yes - A routable /128 per agent AND per sub-agent - built for AI agents spawning sub-agents [ws-identity] | No - No per-sub-agent network identity [cs-itdr] | No - No per-sub-agent network identity [ms-mdi] | No - No per-sub-agent network identity [s1-identity] | No - No per-sub-agent network identity [cx-itdr] | No - No per-sub-agent network identity [tm-identity] |
| **Directory / account ITDR (AD / Entra / Okta behavioral detection)** | No - Not directory ITDR - Whisper answers 'which routable address', not 'which user/account' [ws-identity] | **LEAD** Yes - Falcon Identity/ITDR: AD/Entra/Okta, real-time credential-abuse, automated containment [cs-itdr] | Partial - Defender for Identity (separate product; sensors on DC/AD FS/AD CS/Entra Connect) [ms-mdi] | Yes - Singularity Identity + Ranger AD + Hologram deception [s1-identity] | Yes - ITDR add-on: identity analytics + posture [cx-itdr] | Partial - Identity telemetry + ASRM account risk [tm-identity] |
| **Per-agent egress / source-bound traffic (agent's own /128)** | **LEAD** Yes - WireGuard Tier-1 (routed) or SOCKS5/HTTP Tier-1.5 source-bound via AnyIP + IP_FREEBIND over 2a04:2a01::/32; every flow attributable by reverse-DNS [ws-egress] | No - No per-agent routable egress fabric [cs-firewall] | Partial - Entra Agent ID gives an agent a first-class identity with Conditional Access scoped to it, and the secure web/AI gateway applies network policy. One agent class, via a tenant-level baseline profile, and it lapses entirely when an agent authenticates with an API key - no routable per-agent address [ms-agentid] | No - No per-agent routable egress fabric [s1-firewall] | No - No per-agent routable egress fabric [cx-hostfw] | No - No per-agent routable egress fabric [tm-vp] |
| **Per-agent firewall / byte-metering from the network position** | Yes - Per-/128 firewall driven over Cypher + per-agent byte-metering, enforced off-host [ws-egress] | Partial - Host-firewall management (on the endpoint agent) [cs-firewall] | Partial - Host firewall via ASR/policy [ms-netprot] | Partial - Firewall Control of the native OS host firewall [s1-firewall] | Partial - Host Firewall module [cx-hostfw] | Partial - Host firewall + host IPS [tm-vp] |
| **Host firewall management (traditional, on-endpoint)** | Partial - Not the primary surface; policy lives at the resolver + egress plane [ws-egress] | Yes - Falcon Firewall Management across Win/macOS/Linux [cs-firewall] | Yes - Windows firewall policy via ASR [ms-netprot] | Yes - Firewall Control (native OS firewall) [s1-firewall] | Yes - Host Firewall module + USB device control [cx-hostfw] | Yes - Host firewall + host IPS + device control [tm-vp] |
| **Network Detection & Response (NDR) sensor tier** | Partial - Resolution-plane visibility instead of a packet-NDR sensor; JA3/JA4 tap built-dark [ws-yara-ja] | Partial - Network containment, but no dedicated NDR sensor line [cs-contain] | Partial - Network protection + device discovery (Windows-driven) [ms-discovery] | Partial - Ranger network discovery (LAN fingerprinting) [s1-netdisco] | Yes - Network Traffic Analysis via NGFW-as-sensor + Pathfinder [cx-nta] | **LEAD** Yes - Real NDR: Deep Discovery Inspector / TippingPoint, inline blocking, IoT/IIoT/unmanaged-device visibility [tm-ndr] |
| **Reverse-DNS / RDAP attribution of every outbound flow to an identity** | **LEAD** Yes - Reverse-DNS on the egress /128 + per-/128 RDAP attributes every outbound flow to a specific agent identity [ws-identity] | No - No wire-level per-flow identity attribution [cs-itdr] | No - No wire-level per-flow identity attribution [ms-mdi] | No - No wire-level per-flow identity attribution [s1-identity] | No - No wire-level per-flow identity attribution [cx-itdr] | No - No wire-level per-flow identity attribution [tm-identity] |

### Response & Containment

| Capability | Whisper | CrowdStrike | Microsoft Defender | SentinelOne | Cortex XDR | Trend Vision One |
|---|---|---|---|---|---|---|
| **Process kill / terminate** | Yes - process.stop in the bounded action set (implemented: Linux 4/4, Windows 3/4, macOS 3/4; e2e-proven: Linux 3 (package.update spawned but did not complete), Windows 3 (process.stop, service.restart and quarantine.file); on macOS the refusal fences fired on a real Mac, a successful stop not yet exercised end to end) [ws-respond] | Yes - Terminate process [cs-contain] | Yes - Kill process (Live Response / AIR) [ms-air] | Yes - Kill process [s1-contain] | Yes - Kill process [cx-isolate] | Yes - Terminate process [tm-isolate] |
| **File quarantine** | Yes - quarantine.file in the bounded action set (e2e-proven on Linux and Windows; not yet exercised on macOS) [ws-respond] | Yes - Quarantine / IOC block [cs-contain] | Yes - Stop-and-quarantine file [ms-air] | Yes - Quarantine [s1-contain] | Yes - Auto-quarantine malicious files [cx-isolate] | Yes - Quarantine file [tm-isolate] |
| **Host network isolation (on-host / agent-enforced)** | Partial - On-host bounded tier exists; primary isolation is done OFF-host via resolver default-deny + /128 revoke [ws-respond] | Yes - Network-contain / isolate host [cs-contain] | Yes - Isolate device / contain unmanaged device [ms-netprot] | Yes - Network Quarantine / isolation [s1-contain] | Yes - Endpoint isolation [cx-isolate] | Yes - Endpoint isolation by IP/hostname [tm-isolate] |
| **OFF-HOST containment that holds even when the host OS is owned below the agent** | **LEAD** Yes - Revoke / kill-switch / DNS default-deny / auto-contain enforced from the network + identity plane, not by the on-host agent - holds when the host is fully compromised. Lead is over the EDR/XDR cohort this matrix compares: for an SSE platform off-host is the only place enforcement happens, so it would not be led here either [ws-respond] | No - Containment is agent-enforced on the host (the control an attacker targets first) [cs-contain] | No - Host/endpoint-enforced isolation (or neighboring Windows devices) [ms-netprot] | No - On-host agent-enforced isolation [s1-contain] | Partial - An External Dynamic List pushed to a Palo Alto firewall IS enforced off the host, at the network. Requires a PAN-OS 9.0+ Palo Alto firewall - an adjacent product, not the endpoint agent - and host isolation itself stays agent-enforced [cx-edl] | No - Host-driven or perimeter-sensor-driven containment [tm-isolate] |
| **DNS default-deny / resolver-plane containment** | **LEAD** Yes - Resolver default:deny cuts a compromised agent's resolution at the network plane [ws-respond] | No - Not a resolver-plane control [cs-contain] | No - Not a resolver-plane control [ms-netprot] | No - Not a resolver-plane control [s1-contain] | No - Not a resolver-plane control (PAN network stack separate) [cx-dns] | No - Not a resolver-plane control [tm-vp] |
| **/128 revocation / kill-switch on the wire** | **LEAD** Yes - Revoke the agent's /128 on the wire - identity + routability withdrawn independent of the host [ws-respond] | No - No wire-level identity revocation [cs-itdr] | No - No wire-level identity revocation [ms-mdi] | No - No wire-level identity revocation [s1-identity] | No - No wire-level identity revocation [cx-itdr] | No - No wire-level identity revocation [tm-identity] |
| **Remote shell / live response** | No - Deliberately NO shell - argv-only, absolute compile-time program paths, reset env (a safety invariant, not a gap) [ws-respond] | Yes - Real Time Response (RTR) remote shell [cs-contain] | Yes - Live Response remote shell [ms-air] | Yes - RemoteOps remote shell + Forensics [s1-contain] | Yes - Live Terminal remote shell [cx-isolate] | Yes - Remote Shell Session + custom script [tm-remote] |
| **Ransomware file rollback / restore** | No - No file rollback - prevention + off-host containment instead [ws-respond] | Partial - RTR remediation, no snapshot rollback [cs-contain] | No - No native file rollback (contain + remediate; rely on backups) [ms-air] | **LEAD** Yes - VSS-based ransomware rollback (Windows-only) [s1-rollback] | Partial - Quarantine + remediation, no universal rollback [cx-isolate] | Partial - Ransomware rollback (Apex One lineage; Vision One scope partly unverified) [tm-remote] |
| **Bounded, safe-by-design response contract (no-shell, argv-only, own-scope, watchdog, ledger)** | **LEAD** Yes - Seven-invariant contract: no shell, own-/128-only + double-armed, relative-deadline watchdog + single executor, root-owned age-horizoned ledger, honest terminal, sticky disarm; macOS csops(2) code-sign fence [ws-respond] | Partial - Powerful RTR shell - flexible, not bounded-by-design [cs-contain] | Partial - Live Response shell + configurable AIR automation levels [ms-air] | Partial - RemoteOps shell + STAR rules [s1-contain] | Partial - Live Terminal shell (Python/PowerShell) [cx-isolate] | Partial - Remote shell with 2h/10min-idle caps [tm-remote] |
| **SOAR / automation** | Yes - One Cypher verb control plane (register/identity/policy/logs/revoke/list), two-tier keyless/keyed [ws-platform] | Yes - Falcon Fusion SOAR (native, no-cost) [cs-contain] | Yes - Sentinel SOAR playbooks + AIR [ms-air] | Yes - STAR + orchestration/automation [s1-contain] | **LEAD** Yes - Cortex XSOAR (best-in-class) [cx-xql] | Yes - Built-in playbooks + XSOAR/Chronicle/D3 integrations [tm-remote] |
| **Managed Detection & Response (MDR) service** | No - No MDR service today (MSSP-beachhead GTM) [ws-epic] | **LEAD** Yes - Falcon Complete Next-Gen MDR (Forrester Leader) [cs-contain] | Partial - Defender Experts (managed) [ms-air] | Yes - Vigilance / WatchTower MDR [s1-contain] | Yes - Unit 42 MDR [cx-mitre] | Yes - Trend Service One managed [tm-mssp] |

### Coverage & Platforms

| Capability | Whisper | CrowdStrike | Microsoft Defender | SentinelOne | Cortex XDR | Trend Vision One |
|---|---|---|---|---|---|---|
| **Windows sensor** | Yes - LIVE - proven e2e on Windows Server 2022; 21/22 axes parity-or-better vs Linux (the one trail is response actions) [ws-parity-win] | Yes - Broad Windows incl. legacy/embedded [cs-os] | Yes - Built into Windows 10/11 + Server 2019+ [ms-linux] | Yes - Windows workstation + server [s1-linux] | Yes - Broadest module coverage on Windows [cx-linux] | Yes - Windows desktop + server [tm-os] |
| **macOS sensor** | Partial - Collectors proven on Apple silicon; engines exercised in datapath tests; connection telemetry now LIVE via an entitlement-free conn producer (conn-layer parity today; of 13 deep axes 2 are fully live, 3 partial, and 8 dark until the entitlement lands, event-chain CONNECT LEG plus 3 conn-stream Sigma rules that fire on the entitlement-free conn telemetry; the event-chain composite cannot complete without the ES feed). The live ES deep feed remains Apple-entitlement-gated (flip-on-grant). [ws-parity-mac] | Yes - Apple silicon + Intel, current releases [cs-os] | Yes - Full AV+EDR+behavioral via Apple ES [ms-linux] | Yes - Recent releases, kextless [s1-linux] | Yes - Supported with some Windows-only module gaps [cx-linux] | Yes - Latest 5 macOS versions [tm-os] |
| **Linux sensor** | Yes - LIVE flagship - 17,092 exec events / 0 drops across 37 techniques on Debian 12 [ws-atomic] | Yes - Broad distro matrix, eBPF [cs-os] | Yes - eBPF sensor; positioned for servers (not desktop parity) [ms-linux] | Yes - 10+ distros, eBPF no-module [s1-linux] | Partial - Narrowest module set; kernel module or user-space 5.0+ [cx-linux] | Yes - Broad distros + containers [tm-os] |
| **Mobile (iOS / Android)** | No - No mobile sensor in this product (Whisper Guard mobile is a separate line) [ws-epic] | Yes - Falcon for Mobile (iOS/Android) [cs-os] | Yes - Android + iOS [ms-linux] | Partial - Mobile threat defense via partner [s1-linux] | Yes - Android/iOS agents (minimal coverage) [cx-linux] | Yes - Trend Vision One Mobile [tm-os] |
| **ChromeOS / agentless ingest** | No - Not covered [ws-epic] | **LEAD** Yes - Falcon Insight for ChromeOS - agentless Google event ingest [cs-os] | Partial - Some coverage via MS ecosystem [ms-linux] | No - Not covered [s1-linux] | Partial - Chrome OS referenced in collateral [cx-linux] | No - Not covered [tm-os] |
| **Legacy enterprise UNIX (Solaris / AIX / HP-UX)** | No - Not covered [ws-epic] | No - Not covered [cs-os] | No - Not covered [ms-linux] | No - Not covered [s1-linux] | No - Not covered [cx-linux] | **LEAD** Yes - Solaris/AIX/HP-UX for server/workload (Deep Security lineage) [tm-os] |
| **Containers / K8s / cloud workloads** | Partial - Linux sensor runs in containers; not a dedicated CWPP tier [ws-atomic] | Yes - Falcon Cloud Security / CNAPP [cs-threatgraph] | Yes - Defender for Cloud workloads [ms-linux] | Yes - Kubernetes agent [s1-linux] | Yes - Cloud/container agent (user-space or eBPF kernel-space) [cx-linux] | Yes - Deep Security / cloud-workload + OpenShift [tm-os] |
| **Agent/AI-native: routable identity + governance per spawned AI agent** | **LEAD** Yes - Per-agent AND per-sub-agent routable /128 identity + governance - built for AI agents, not retrofitted [ws-identity] | Partial - 'Secure AI' / Charlotte agentic direction (nascent, not routable identity) [cs-mitre25] | Partial - Copilot / agent-security direction (nascent) [ms-air] | No - No agent-native identity primitive [s1-contain] | Partial - Secure Agentic AI with Koi (nascent direction) [cx-xql] | Partial - TrendAI agent direction (nascent) [tm-mitre] |

### Deployment & Footprint

| Capability | Whisper | CrowdStrike | Microsoft Defender | SentinelOne | Cortex XDR | Trend Vision One |
|---|---|---|---|---|---|---|
| **Cloud SaaS console** | Partial - Self-hostable Cypher-only backend; not a multi-tenant SaaS console today [ws-epic] | Yes - Cloud-native multi-tenant SaaS [cs-os] | Yes - SaaS via Defender portal [ms-linux] | Yes - Cloud-managed SaaS [s1-onprem] | Yes - Cloud-delivered SaaS [cx-datalake] | Yes - SaaS (multi-region) [tm-airgap] |
| **On-prem / self-hosted control plane** | Yes - Self-hostable control backend (one /api/query), node-local, no external store on a hot path [ws-epic] | No - Multi-tenant cloud only; no customer self-hosted control plane [cs-os] | No - Cloud-managed backend [ms-linux] | Yes - On-prem / self-managed consoles offered [s1-onprem] | No - Cloud Data Lake; not the default posture [cx-datalake] | Yes - Sovereign / Private Cloud / on-premises [tm-airgap] |
| **Air-gapped deployment** | Yes - Node-local stores; each node self-contained, no external dependency on a hot path [ws-epic] | No - Not a standard offering [cs-os] | Partial - Offline sig updates (Linux); not a true air-gap product [ms-linux] | Yes - Air-gapped console for isolated environments [s1-onprem] | No - Cloud-managed; air-gap unverified [cx-datalake] | Yes - Air-gapped / offline (Sovereign) [tm-airgap] |
| **MSSP / multi-tenant management** | Partial - Per-tenant model (dedicated DoH + /128 resolver per tenant); MSSP-beachhead GTM, young [ws-platform] | Yes - Falcon Flight Control [cs-os] | Partial - M365 Lighthouse (historically less first-class) [ms-discovery] | Yes - Strong MSP/MSSP motion [s1-onprem] | Yes - MSSP + Unit 42 managed [cx-pricing] | Yes - Vision One for Service Providers [tm-mssp] |
| **Zero-config / one-command onboarding** | **LEAD** Yes - Single binary, standard ports (:443/:53), addressed by hostname, zero-config ethos; two-tier keyless-first [ws-platform] | Yes - Agent-only, fast cloud rollout [cs-os] | Partial - In-box on Windows, but complex E3/E5 licensing [ms-pricing] | Yes - Single-agent autonomous default policy [s1-onprem] | Partial - Fast prevention; slower to operationalize analytics (learning curve) [cx-pricing] | Partial - Broad platform, credit-model + setup complexity [tm-installer] |
| **Open-source / permissively-licensed sensor** | **LEAD** Yes - MIT-licensed Go sensor, GPL-free by default (eBPF/YARA-X are opt-in build tags) [ws-collectors] | No - Proprietary [cs-os] | No - Proprietary [ms-linux] | No - Proprietary [s1-linux] | No - Proprietary [cx-linux] | No - Proprietary [tm-os] |
| **Published / transparent pricing** | No - Not published in-repo (GTM = MSSP-beachhead + agent-fleet identity) [ws-epic] | Partial - Go/Pro/Enterprise list prices; Complete custom quote [cs-pricing] | Yes - Per-user list (Plan 1 ~$3 / Plan 2 ~$5.20), though bundling is complex [ms-pricing] | No - Quote/marketplace-based [s1-resource] | No - Quote-based + separately-metered data lake [cx-pricing] | No - Consumption 'credit' model (reviewers call it confusing) [tm-installer] |

### Independent Validation & Standing

| Capability | Whisper | CrowdStrike | Microsoft Defender | SentinelOne | Cortex XDR | Trend Vision One |
|---|---|---|---|---|---|---|
| **Gartner Magic Quadrant for EPP standing** | No - No analyst coverage yet (young product) [ws-epic] | Yes - Leader, 5+ consecutive; highest Ability to Execute [cs-gartner] | Yes - Leader, 7 consecutive years (through 2026) [ms-gartner] | Yes - Leader, 6 consecutive years [s1-gartner] | Yes - Leader, 4 consecutive years (2023-2026) [cx-gartner] | **LEAD** Yes - Leader, 20 consecutive - the longest streak of any EPP vendor [tm-gartner] |
| **Forrester Wave XDR standing** | No - No analyst coverage yet [ws-epic] | Yes - Leader (highest Vision/Innovation/Roadmap) [cs-forrester] | Yes - Overall Leader (highest Current Offering/Strategy/Market Presence) [ms-forrester] | Partial - Strong Performer (not Leader) in XDR Q2 2024 [s1-forrester] | Yes - Leader, XDR Q2 2024 [cx-forrester] | Yes - XDR Leader + NAV Wave Leader [tm-forrester-nav] |
| **MITRE ATT&CK Evaluation entry** | No - NO MITRE Evaluation entry - our published result is a self-run Atomic Red Team measurement, framed as telemetry coverage, not a MITRE round [ws-atomic] | Yes - Multiple rounds; 2025 100%/zero-FP (vendor framing of un-scored data) [cs-mitre25] | Yes - 2024 Enterprise (first macOS round); 100% claim [ms-mitre24] | Yes - 2024 Round 6; 100% detection + 88% fewer alerts claim [s1-mitre] | Yes - 2024 ER6; 100% technique-level + 8/10 protection, 0 FP claim [cx-mitre] | Yes - 2024 ER6; 99-100% analytic coverage claim [tm-mitre] |
| **SE Labs / AV-Comparatives / AV-TEST certification** | No - No independent-lab certification (young) [ws-epic] | Yes - SE Labs AAA (100%, 0 FP); AVC EPR certified [cs-selabs] | Partial - Participates in independent tests [ms-mitre24] | Partial - Selective participation; current medal unverified [s1-resource] | Yes - AVC EPR 99%/99% Strategic Leader [cx-avc] | Yes - Long AV-TEST / AV-Comparatives history [tm-vp] |
| **Production scale (deployed endpoints)** | Partial - Small / early; cross-customer fleet-learning volume correspondingly early [ws-epic] | Yes - Hundreds of millions of endpoints [cs-threatgraph] | **LEAD** Yes - Largest telemetry estate (100T+ signals/day) [ms-intel] | Yes - Large installed base [s1-datalake] | Yes - Large installed base [cx-datalake] | Yes - 250M+ sensors (SPN) [tm-spn] |
| **Corporate / financial stability** | Partial - Young startup [ws-epic] | Yes - Public, large-cap [cs-gartner] | Yes - Microsoft [ms-gartner] | Yes - Public [s1-gartner] | Yes - Palo Alto Networks [cx-gartner] | Yes - Public, established [tm-gartner] |
| **Published engineering / test rigor (mutation-tested deciders, CI durability gates)** | **LEAD** Yes - 84.21% mutation score on the 5 deciders; four durability CI gates each proven to block a planted regression; 2065 Go + 127 Swift tests [ws-tests] | n/a - Not publicly disclosed [cs-mitre25] | n/a - Not publicly disclosed [ms-mitre24] | n/a - Not publicly disclosed [s1-mitre] | n/a - Not publicly disclosed [cx-mitre] | n/a - Not publicly disclosed [tm-mitre] |

## Where each vendor genuinely leads

### Whisper

- **Kernel-independent sensor (user-space / eBPF, no loadable kernel module)** (Sensor & Telemetry) - User-space on every OS: eBPF/NETLINK+fanotify (Linux), ETW (Windows), Apple ES via Swift daemon (macOS); brain deliberately off-host [ws-parity-win]
- **Measured, calm footprint with a published resource SLA** (Sensor & Telemetry) - cgroup-v2 SLA (CPUQuota=25%, MemoryHigh=150M/Max=250M, IOWeight=10) + self-metered heartbeat; ~17MB measured under 1169 exec events; adaptive calm scheduler [ws-epic]
- **Open, portable rule engine (Sigma / DRL)** (Detection & ATT&CK) - Pure-Go sigma-go over 79 bundled rules (34 upstream SigmaHQ verbatim under DRL 1.1, 45 first-party under MIT) + operator rule dir, per-GOOS admission, no GPL packs [ws-sigma]
- **Local, zero-network known-good hash allowlist** (Detection & ATT&CK) - Local O(1) map seeded from fleet dpkg hashes (3075 live); zero network lookup [ws-knowngood]
- **Adversary-INFRASTRUCTURE ATT&CK columns (Recon TA0043 / Resource-Dev TA0042) from the attacker's own domains/IPs/certs** (Detection & ATT&CK) - Now emitted as NAMED ATT&CK-tagged detections, not just scored: 19 techniques across Reconnaissance TA0043 + Resource-Development TA0042 (+ C2 / Exfil), origin=graph, each with a keyless re-runnable receipt, on the 7.52B/38.6B internet graph. The four columns no host-only EDR can reach. [ws-attackmatrix]
- **C2-infrastructure + exfil-destination reputation at the resolution plane (act before the connection is made)** (Detection & ATT&CK) - Named C2-infrastructure (T1071.001/T1568.002 DGA/T1572/T1090/T1102) + exfil-destination (T1048/T1567) findings at the resolution plane, acted before the connect. Combined with the on-host set: 103 distinct techniques across 14 of 14 tactics. [ws-attackmatrix]
- **Internet-scale naming/routing graph (domains, IPv4/6, ASN, RDAP, certs, passive DNS)** (Backend, Analytics & Graph) - 7.52B-node / 38.6B-edge graph OF THE INTERNET ITSELF - the structural inverse of a host-telemetry graph; no host-only EDR has this [ws-graph]
- **Serves the DNS: graph-first policy resolver the fleet points at** (Backend, Analytics & Graph) - Whisper IS the resolver (agents point at it like 1.1.1.1); every destination scored graph-first at the resolution plane, real DNS when graph has no opinion [ws-platform]
- **Graph JOIN depth (process -> DNS -> peer -> ASN -> actor -> cross-tenant, temporal, nested subtree)** (Backend, Analytics & Graph) - The moat: deep joins from on-host telemetry into the internet graph + 1,916 ACTOR nodes (344 of them carrying USES_TECHNIQUE edges) and across tenants - not one-hop enrichment [ws-attackmatrix]
- **Operates authoritative DNS + reverse-DNS (PTR / ip6.arpa) for agent identities** (Network & Identity) - Dynamic forward zones (delegated from Cloudflare) + dynamic reverse DNS + per-/128 RDAP + inet6num docs [ws-platform]
- **DNS-layer policy enforcement (block/allow at resolution, pre-connection)** (Network & Identity) - Per-geo/listing/category and per-device policy applied at the resolver before the connection is made. Lead is over the EDR/XDR cohort this matrix compares: an SSE platform (Cloudflare Gateway, Zscaler, Cisco Umbrella) has DNS-layer policy as an architectural default and would not be led here [ws-platform]
- **Verifiable identity-on-the-wire (routable per-agent /128, DNSSEC/DANE-anchored, keyless-verifiable)** (Network & Identity) - Routable /128 per agent from 2a04:2a01::/32 (AS219419), FCrDNS + DANE TLSA 3 1 1, DNSSEC-signed, 7 keyless proofs; sensors pre-auth by their /128 [ws-identity]
- **Per-sub-agent / nested identity (a distinct routable identity per spawned agent)** (Network & Identity) - A routable /128 per agent AND per sub-agent - built for AI agents spawning sub-agents [ws-identity]
- **Per-agent egress / source-bound traffic (agent's own /128)** (Network & Identity) - WireGuard Tier-1 (routed) or SOCKS5/HTTP Tier-1.5 source-bound via AnyIP + IP_FREEBIND over 2a04:2a01::/32; every flow attributable by reverse-DNS [ws-egress]
- **Reverse-DNS / RDAP attribution of every outbound flow to an identity** (Network & Identity) - Reverse-DNS on the egress /128 + per-/128 RDAP attributes every outbound flow to a specific agent identity [ws-identity]
- **OFF-HOST containment that holds even when the host OS is owned below the agent** (Response & Containment) - Revoke / kill-switch / DNS default-deny / auto-contain enforced from the network + identity plane, not by the on-host agent - holds when the host is fully compromised. Lead is over the EDR/XDR cohort this matrix compares: for an SSE platform off-host is the only place enforcement happens, so it would not be led here either [ws-respond]
- **DNS default-deny / resolver-plane containment** (Response & Containment) - Resolver default:deny cuts a compromised agent's resolution at the network plane [ws-respond]
- **/128 revocation / kill-switch on the wire** (Response & Containment) - Revoke the agent's /128 on the wire - identity + routability withdrawn independent of the host [ws-respond]
- **Bounded, safe-by-design response contract (no-shell, argv-only, own-scope, watchdog, ledger)** (Response & Containment) - Seven-invariant contract: no shell, own-/128-only + double-armed, relative-deadline watchdog + single executor, root-owned age-horizoned ledger, honest terminal, sticky disarm; macOS csops(2) code-sign fence [ws-respond]
- **Agent/AI-native: routable identity + governance per spawned AI agent** (Coverage & Platforms) - Per-agent AND per-sub-agent routable /128 identity + governance - built for AI agents, not retrofitted [ws-identity]
- **Zero-config / one-command onboarding** (Deployment & Footprint) - Single binary, standard ports (:443/:53), addressed by hostname, zero-config ethos; two-tier keyless-first [ws-platform]
- **Open-source / permissively-licensed sensor** (Deployment & Footprint) - MIT-licensed Go sensor, GPL-free by default (eBPF/YARA-X are opt-in build tags) [ws-collectors]
- **Published engineering / test rigor (mutation-tested deciders, CI durability gates)** (Independent Validation & Standing) - 84.21% mutation score on the 5 deciders; four durability CI gates each proven to block a planted regression; 2065 Go + 127 Swift tests [ws-tests]

### CrowdStrike

- **Static / ML pre-execution NGAV** (Detection & ATT&CK) - On-sensor ML NGAV refined over a decade [cs-mitre25]
- **Cloud ML / large behavioral-analytics stack** (Detection & ATT&CK) - Cloud ML + IOA behavioral analytics [cs-mitre25]
- **GenAI SOC assistant (NL triage / hunting)** (Detection & ATT&CK) - Charlotte AI generative triage + NL-to-CQL hunting [cs-ngsiem]
- **Cross-customer security-telemetry graph (hosts/workloads/identities)** (Backend, Analytics & Graph) - Threat Graph: 40+ PB, trillions events/day, ~70M req/sec across all customers [cs-threatgraph]
- **Finished threat-intelligence program (adversary tracking, human research)** (Backend, Analytics & Graph) - Counter Adversary Ops: 250+ adversaries, 2,300+ reports/yr [cs-intel]
- **Directory / account ITDR (AD / Entra / Okta behavioral detection)** (Network & Identity) - Falcon Identity/ITDR: AD/Entra/Okta, real-time credential-abuse, automated containment [cs-itdr]
- **Managed Detection & Response (MDR) service** (Response & Containment) - Falcon Complete Next-Gen MDR (Forrester Leader) [cs-contain]
- **ChromeOS / agentless ingest** (Coverage & Platforms) - Falcon Insight for ChromeOS - agentless Google event ingest [cs-os]

### Microsoft Defender

- **Production scale (deployed endpoints)** (Independent Validation & Standing) - Largest telemetry estate (100T+ signals/day) [ms-intel]

### SentinelOne

- **Validated low-alert / signal-to-noise posture** (Detection & ATT&CK) - 88% fewer alerts than median (2024 MITRE) - strongest low-noise figure [s1-mitre]
- **Data retention (default window; storage economics)** (Backend, Analytics & Graph) - Up to 24-month Data Lake, 365-day EDR OOB (tier-dependent) [s1-datalake]
- **Ransomware file rollback / restore** (Response & Containment) - VSS-based ransomware rollback (Windows-only) [s1-rollback]

### Cortex XDR

- **SOAR / automation** (Response & Containment) - Cortex XSOAR (best-in-class) [cx-xql]

### Trend Vision One

- **Network Detection & Response (NDR) sensor tier** (Network & Identity) - Real NDR: Deep Discovery Inspector / TippingPoint, inline blocking, IoT/IIoT/unmanaged-device visibility [tm-ndr]
- **Legacy enterprise UNIX (Solaris / AIX / HP-UX)** (Coverage & Platforms) - Solaris/AIX/HP-UX for server/workload (Deep Security lineage) [tm-os]
- **Gartner Magic Quadrant for EPP standing** (Independent Validation & Standing) - Leader, 20 consecutive - the longest streak of any EPP vendor [tm-gartner]

## Where Whisper is behind, named

Rows where a competitor is Yes and Whisper is Partial or No:

- **Process-execution telemetry (exec + parent-process graph)** (Sensor & Telemetry) - Whisper *partial*: NETLINK (Linux) / ETW (Windows) exec collector, parent graph in both; macOS ships an entitlement-free exec collector (a kern.proc.all process-table sampler with proc_pidpath, argv and the kernel code-signing identity); the higher-fidelity ES exec push remains gated on the Apple Endpoint Security entitlement [ws-collectors]
- **File-system telemetry (create/modify/rename/delete)** (Sensor & Telemetry) - Whisper *partial*: fanotify (Linux) / ETW File (Windows); macOS ES file events are built and gated on the Apple Endpoint Security entitlement (flip-on-grant) [ws-collectors]
- **Real-time memory / injection visibility** (Sensor & Telemetry) - Whisper *partial*: Windows VirtualQueryEx sweep live, ETW-TI built-dark; Linux post-hoc /proc maps sweep; the macOS real-time path (ES REMOTE_THREAD/MPROTECT/MMAP + DYLD vector) is built and gated on the Apple Endpoint Security entitlement, which darkens the memory path; exec now ships an entitlement-free producer and the file collector is proven on real Apple hardware [ws-parity-mac]
- **Tamper protection / anti-uninstall** (Sensor & Telemetry) - Whisper *partial*: Structural answer: brain + containment live OFF the host, so killing the thin fail-open agent does not blind or lift containment; no hardened on-host self-protect emphasized [ws-epic]
- **Process injection detection (T1055)** (Detection & ATT&CK) - Whisper *partial*: Windows + Linux are post-hoc / built-dark; the macOS real-time path is built and gated on the same Apple Endpoint Security entitlement [ws-parity-mac]
- **Static / ML pre-execution NGAV** (Detection & ATT&CK) - Whisper *partial*: Known-good allowlist + graph reputation; YARA-X built-dark; no heavy on-device ML AV model (younger analytic layer, stated) [ws-atomic]
- **Cloud ML / large behavioral-analytics stack** (Detection & ATT&CK) - Whisper *partial*: Behavioral engines + graph reputation; analytic breadth narrower than incumbents' decade-old ML stacks (stated honestly) [ws-atomic]
- **GenAI SOC assistant (NL triage / hunting)** (Detection & ATT&CK) - Whisper *no*: No marketed GenAI copilot; control is a single Cypher verb + graph queries [ws-platform]
- **Validated low-alert / signal-to-noise posture** (Detection & ATT&CK) - Whisper *partial*: Calm-by-design + separate telemetry-vs-analytic reporting, but alert volume not independently MITRE-measured [ws-atomic]
- **Cross-customer security-telemetry graph (hosts/workloads/identities)** (Backend, Analytics & Graph) - Whisper *partial*: Per-endpoint + cross-tenant graph exists but production scale is small/early vs incumbents [ws-epic]
- **Finished threat-intelligence program (adversary tracking, human research)** (Backend, Analytics & Graph) - Whisper *partial*: Graph carries the full ATT&CK taxonomy + 1,916 ACTOR nodes (344 of them carrying USES_TECHNIQUE edges), but not a human finished-intel shop [ws-attackmatrix]
- **Directory / account ITDR (AD / Entra / Okta behavioral detection)** (Network & Identity) - Whisper *no*: Not directory ITDR - Whisper answers 'which routable address', not 'which user/account' [ws-identity]
- **Host firewall management (traditional, on-endpoint)** (Network & Identity) - Whisper *partial*: Not the primary surface; policy lives at the resolver + egress plane [ws-egress]
- **Network Detection & Response (NDR) sensor tier** (Network & Identity) - Whisper *partial*: Resolution-plane visibility instead of a packet-NDR sensor; JA3/JA4 tap built-dark [ws-yara-ja]
- **Host network isolation (on-host / agent-enforced)** (Response & Containment) - Whisper *partial*: On-host bounded tier exists; primary isolation is done OFF-host via resolver default-deny + /128 revoke [ws-respond]
- **Remote shell / live response** (Response & Containment) - Whisper *no*: Deliberately NO shell - argv-only, absolute compile-time program paths, reset env (a safety invariant, not a gap) [ws-respond]
- **Ransomware file rollback / restore** (Response & Containment) - Whisper *no*: No file rollback - prevention + off-host containment instead [ws-respond]
- **Managed Detection & Response (MDR) service** (Response & Containment) - Whisper *no*: No MDR service today (MSSP-beachhead GTM) [ws-epic]
- **macOS sensor** (Coverage & Platforms) - Whisper *partial*: Collectors proven on Apple silicon; engines exercised in datapath tests; connection telemetry now LIVE via an entitlement-free conn producer (conn-layer parity today; of 13 deep axes 2 are fully live, 3 partial, and 8 dark until the entitlement lands, event-chain CONNECT LEG plus 3 conn-stream Sigma rules that fire on the entitlement-free conn telemetry; the event-chain composite cannot complete without the ES feed). The live ES deep feed remains Apple-entitlement-gated (flip-on-grant). [ws-parity-mac]
- **Mobile (iOS / Android)** (Coverage & Platforms) - Whisper *no*: No mobile sensor in this product (Whisper Guard mobile is a separate line) [ws-epic]
- **ChromeOS / agentless ingest** (Coverage & Platforms) - Whisper *no*: Not covered [ws-epic]
- **Legacy enterprise UNIX (Solaris / AIX / HP-UX)** (Coverage & Platforms) - Whisper *no*: Not covered [ws-epic]
- **Containers / K8s / cloud workloads** (Coverage & Platforms) - Whisper *partial*: Linux sensor runs in containers; not a dedicated CWPP tier [ws-atomic]
- **Cloud SaaS console** (Deployment & Footprint) - Whisper *partial*: Self-hostable Cypher-only backend; not a multi-tenant SaaS console today [ws-epic]
- **MSSP / multi-tenant management** (Deployment & Footprint) - Whisper *partial*: Per-tenant model (dedicated DoH + /128 resolver per tenant); MSSP-beachhead GTM, young [ws-platform]
- **Published / transparent pricing** (Deployment & Footprint) - Whisper *no*: Not published in-repo (GTM = MSSP-beachhead + agent-fleet identity) [ws-epic]
- **Gartner Magic Quadrant for EPP standing** (Independent Validation & Standing) - Whisper *no*: No analyst coverage yet (young product) [ws-epic]
- **Forrester Wave XDR standing** (Independent Validation & Standing) - Whisper *no*: No analyst coverage yet [ws-epic]
- **MITRE ATT&CK Evaluation entry** (Independent Validation & Standing) - Whisper *no*: NO MITRE Evaluation entry - our published result is a self-run Atomic Red Team measurement, framed as telemetry coverage, not a MITRE round [ws-atomic]
- **SE Labs / AV-Comparatives / AV-TEST certification** (Independent Validation & Standing) - Whisper *no*: No independent-lab certification (young) [ws-epic]
- **Production scale (deployed endpoints)** (Independent Validation & Standing) - Whisper *partial*: Small / early; cross-customer fleet-learning volume correspondingly early [ws-epic]
- **Corporate / financial stability** (Independent Validation & Standing) - Whisper *partial*: Young startup [ws-epic]

## How we read the numbers

Every vendor's headline "100%" in the validation rows is that vendor's own
aggregation of MITRE Engenuity's un-scored raw per-substep data; MITRE assigns no
scores, rankings, or winner [mitre-noscore]. Those figures are cited throughout as
vendor framing, not as an independent verdict. Whisper has no MITRE entry; its
published coverage figure is a self-run Atomic Red Team measurement, framed as
telemetry coverage, and never rounded up to a MITRE claim.

We are early on coverage breadth and independent validation, and the scorecard prices
that in at equal weight. Everything in the categories Whisper wins is a structural
property of being the DNS and the network. A host-only vendor can bolt on cloud
pieces; it cannot bolt on being the network.

## Verify it yourself, keyless

Every Whisper Yes is checkable with tools you already have:

    dig -x {addr} +dnssec ; delv {host} ; openssl s_client -dane_tlsa_domain {host}
    curl -s https://rdap.whisper.online/checkpoint

## References (89)

Rival capabilities are cited from the rival's own pages; Whisper capabilities are
cited to runnable proofs, the open sensor source, or published engineering reports.

### Whisper - runnable proofs and public engineering artifacts

- **[ws-parity-win]** Windows sensor proven e2e on Windows Server 2022 (341 spool records, T1486@1.0, T1105@0.9; 21/22 axes parity-or-better) - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-parity-mac]** macOS engines proven on Apple-silicon Mac over the ES datapath (the exec, file and socket collectors are proven on real Apple hardware; the /dev/bpf qname tap needs root and is exercised through a scripted read seam rather than a live device; the engines are exercised in datapath tests rather than fired by a live Endpoint Security feed); ES feed entitlement-gated (AMFI -423), which darkens the memory path; exec now ships an entitlement-free producer and the file collector is proven on real Apple hardware; connection telemetry live via an entitlement-free libproc sampler - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-epic]** Identity-first EDR thesis; brain off-host; shipped (v0.206.0, ~17MB under 1169 exec events); cgroup SLA; DANE-/128 pre-auth; kill-switch - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-atomic]** Live Atomic Red Team self-eval: 37/37 telemetry (100%), 32/37 signature (86%), 17,092 exec events / 0 drops (self-run, not a MITRE round) - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-collectors]** Cross-platform collectors + five event kinds (exec/file/conn/qname/detection) + the technique mapper T-ID vocabulary (~34) - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-sigma]** Pure-Go sigma-go over 79 bundled rules (34 upstream SigmaHQ verbatim under DRL 1.1, 45 first-party under MIT) (17 Linux / 21 Windows / 59 macOS by platform admission), per-GOOS admission, operator rule dir, no GPL packs - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-knowngood]** Local O(1) zero-network known-good hash allowlist seeded from fleet dpkg hashes (3075 loaded live) - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-yara-ja]** YARA-X (CGO, opt-in tag) + JA3/JA4 engine, both built-dark (scanner/capture-tap off by default) - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-attackmatrix]** 712-technique / 1,916-ACTOR internet-graph taxonomy across the 14 Enterprise tactics; the four infrastructure columns (Recon TA0043, Resource-Dev TA0042, C2 TA0011, Exfil TA0010) served graph-first - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-tests]** 2065 Go + 127 Swift tests; 84.21% mutation score on 5 deciders; four durability CI gates each proven to block a planted regression - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-graph]** 7.52B-node / 38.6B-edge graph of the internet's naming + routing (HOSTNAME/IPv4-6/EMAIL/ORG/ASN/certs/RDAP/passive-DNS); graph-first assessment over the internet graph - `whisper.online graph figures` (public figure) (2026-08)
- **[ws-platform]** Graph-first policy resolver (serves DNS) + authoritative/RDAP; per-/128 from 2a04:2a01::/32 (AS219419); one-Cypher-verb control plane; per-tenant DoH + /128 resolver - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-identity]** Routable /128 per agent AND sub-agent, reverse-DNS->identity, FCrDNS + DANE TLSA 3 1 1, DNSSEC-signed, 7 keyless proofs; DANE-pinned mTLS pre-auth - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-egress]** Per-/128 egress (WireGuard Tier-1 routed; SOCKS5/HTTP Tier-1.5 source-bound via AnyIP + IP_FREEBIND over 2a04:2a01::/32); per-agent firewall + byte-metering over Cypher - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)
- **[ws-respond]** Bounded on-host tier: closed action set (process.stop/quarantine.file/service.restart/package.update) under a seven-invariant safety contract (no-shell argv-only, own-/128 double-armed, deadline+watchdog, root-owned ledger, sticky disarm); off-host revoke/kill-switch/DNS default-deny - Whisper platform - live e2e proof, reproducible on the public control plane (2026-08)

### Cross-cutting

- **[mitre-noscore]** MITRE Engenuity ATT&CK Evaluations assign NO scores, rankings, or 'winner'; every vendor's '100%' is its own aggregation of the raw per-substep data - <https://evals.mitre.org/methodology-overview/> (2026)

### CrowdStrike - their own sources

- **[cs-mitre25]** CrowdStrike-reported 100% detection/protection, zero FP in 2025 MITRE ATT&CK Enterprise eval (vendor framing of un-scored MITRE data) - <https://www.crowdstrike.com/en-us/blog/crowdstrike-achieves-100-percent-2025-mitre-attack-enterprise-evaluation/> (2025-12-10)
- **[cs-gartner]** Leader, 2024 Gartner MQ for EPP (5th consecutive); highest Ability to Execute, furthest Completeness of Vision - <https://www.businesswire.com/news/home/20240925793981/en/> (2024-09-25)
- **[cs-forrester]** Leader, Forrester Wave XDR Platforms Q2 2024 (highest scores Vision/Innovation/Roadmap); continued Leader Q2 2026 - <https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-named-leader-xdr-independent-research-firm/> (2024-06)
- **[cs-outage]** Channel File 291 RCA: kernel-mode Windows sensor logic error BSOD'd ~8.5M hosts Jul 19 2024 (evidence a host-resident kernel-coupled agent is itself an availability/attack surface) - <https://www.crowdstrike.com/en-us/blog/channel-file-291-rca-available/> (2024-08)
- **[cs-threatgraph]** Threat Graph: cross-customer graph of SECURITY TELEMETRY; 40+ PB stored, trillions events/day, ~70M req/sec (not an internet naming/routing graph) - <https://www.crowdstrike.com/en-us/blog/how-log-structured-merge-trees-enable-crowdstrike-to-process-trillions-of-events-per-day/> (2024)
- **[cs-intel]** Counter Adversary Operations: 250+ named adversaries, 2,300+ intel reports/yr, ATT&CK-mapped profiles (finished intel/reporting, not a live resolution control point) - <https://www.crowdstrike.com/en-us/platform/threat-intelligence/adversary-profiling/> (2026)
- **[cs-itdr]** Falcon Identity Threat Protection / ITDR: AD/Entra/Okta directory identity, real-time credential-abuse detection, automated containment (MFA/password reset) - <https://www.crowdstrike.com/en-us/platform/next-gen-identity-security/itdr/> (2026)
- **[cs-firewall]** Falcon Firewall Management: central HOST-firewall policy across Win/macOS/Linux via the agent - <https://www.crowdstrike.com/en-us/platform/endpoint-security/falcon-firewall-management/> (2026)
- **[cs-contain]** Falcon Complete MDR + network containment/isolation, process kill, IOC block, RTR remote shell, USB device control; host-agent-enforced containment - <https://www.crowdstrike.com/en-us/services/falcon-complete-mdr/> (2026)
- **[cs-ngsiem]** Falcon NG-SIEM/LogScale (Humio): CQL query language, ~7-day default retention extendable to 36 months (paid) - <https://www.crowdstrike.com/en-us/blog/falcon-next-gen-siem-top-faqs/> (2026)
- **[cs-pricing]** Falcon Go $7.99 / Pro $14.99 / Enterprise $19.99 per device/mo list; Complete MDR custom quote; module add-ons raise TCO - <https://zerometric.net/research/crowdstrike-falcon-pricing-decoded-2026/> (2026)
- **[cs-os]** OS matrix Win/macOS/Linux + Falcon for Mobile (iOS/Android) + Falcon Insight for ChromeOS (agentless, Google event ingest, ChromeOS 113+) - <https://www.crowdstrike.com/en-us/products/faq/> (2026)
- **[cs-arch]** Sensor arch: Windows kernel driver, Linux user-space eBPF, macOS Endpoint Security framework - <https://thenewstack.io/crowdstrike-a-wake-up-call-for-ebpf-based-endpoint-security/> (2024)
- **[cs-selabs]** SE Labs 2025 EPS: 100% Total Accuracy, zero false positives; AV-Comparatives EPR 2024/2025 certified - <https://selabs.uk/vendor/crowdstrike/> (2025)

### Microsoft - their own sources

- **[ms-mitre24]** MS-reported 100% technique-level detection + zero FP, 2024 MITRE Enterprise (first round with macOS; eBPF Linux sensor) - vendor framing of un-scored data - <https://www.microsoft.com/en-us/security/blog/2024/12/11/microsoft-defender-xdr-demonstrates-100-detection-coverage-across-all-cyberattack-stages-in-the-2024-mitre-attck-evaluations-enterprise/> (2024-12-11)
- **[ms-gartner]** Leader, Gartner MQ EPP - seventh consecutive year (through 2026) - <https://www.microsoft.com/en-us/security/blog/2026/05/29/microsoft-is-named-a-leader-in-the-2026-gartner-magic-quadrant-for-endpoint-protection/> (2026-05-29)
- **[ms-forrester]** Overall Leader, Forrester Wave XDR Platforms Q2 2024; highest Current Offering/Strategy/Market Presence; 15/22 criteria at highest - <https://www.microsoft.com/en-us/security/blog/2024/06/03/microsoft-is-named-a-leader-in-the-forrester-wave-for-xdr/> (2024-06-03)
- **[ms-linux]** Defender for Endpoint on Linux: eBPF now default event provider (no kernel module); positioned for SERVER workloads, not desktop parity - <https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux> (2026-05)
- **[ms-intel]** Microsoft Threat Intelligence: 100T+ signals/day (2025), 1,500+ threat groups incl. 600+ nation-state - <https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2024> (2025)
- **[ms-hunt]** Advanced Hunting with KQL; 30-day default raw retention; longer needs Microsoft Sentinel (extra product + cost) - <https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview> (2026)
- **[ms-netprot]** Network Protection / Web Content Filtering: HOST-enforced block of malicious URLs/domains/IPs by MS reputation; contain via neighboring onboarded Windows devices; host-enforced isolation - <https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts> (2026)
- **[ms-mdi]** Defender for Identity (SEPARATE product, E5/add-on): sensors on DC/AD FS/AD CS/Entra Connect; behavioral AD/Entra attack detection, not wire identity - <https://learn.microsoft.com/en-us/defender-for-identity/deploy/deploy-defender-identity> (2026)
- **[ms-air]** Automated Investigation & Remediation + attack disruption (block lateral movement + remote encryption); no native ransomware file-rollback - <https://www.microsoft.com/en-us/security/blog/2023/10/11/microsoft-defender-for-endpoint-now-stops-human-operated-attacks-on-its-own/> (2023)
- **[ms-pricing]** Plan 1 ~$3/user/mo (prevention), Plan 2 ~$5.20 (EDR/AIR/hunting); best value gated behind M365 E5; Defender for Business 300-seat cap - <https://agileit.com/news/defender-endpoint-p1-pricing-features-comparison/> (2026)
- **[ms-discovery]** Device discovery driven by onboarded WINDOWS devices; NOT supported from macOS/Linux sensors; multi-tenant via M365 Lighthouse (historically weak) - <https://learn.microsoft.com/en-us/defender-endpoint/device-discovery> (2026)

### SentinelOne - their own sources

- **[s1-mitre]** S1-reported 100% detection (16/16 steps, 80/80 sub-steps), zero delays, 88% fewer alerts than median - 2024 MITRE Enterprise (vendor framing) - <https://www.sentinelone.com/press/sentinelone-sets-the-standard-with-100-detection-and-88-fewer-alerts-than-median-across-all-vendors-evaluated-in-the-2024-mitre-attck-evaluations-enterprise/> (2024-12)
- **[s1-gartner]** Leader, Gartner MQ EPP - 6th consecutive year (2026 MQ) - <https://www.sentinelone.com/press/sentinelone-named-a-leader-in-the-gartner-magic-quadrant-for-endpoint-protection-platforms-for-6th-consecutive-year/> (2026-05-26)
- **[s1-forrester]** Strong Performer (NOT Leader), Forrester Wave XDR Q2 2024 (Leaders were MS/PAN/CRWD) - <https://www.sdxcentral.com/analysis/microsoft-palo-alto-networks-crowdstrike-top-forrester-xdr-wave/> (2024-06)
- **[s1-linux]** Single agent Win/macOS/Linux/K8s; Linux eBPF no-kernel-module, macOS kextless; on-device behavioral AI => offline protection - <https://www.sentinelone.com/cybersecurity-101/endpoint-security/endpoint-security-for-linux/> (2026)
- **[s1-datalake]** Singularity Data Lake: up to 24-month retention, 365 days EDR data OOB (tier/SKU dependent); Deep Visibility + Power Query hunting - <https://www.sentinelone.com/platform/data-lake/> (2026)
- **[s1-identity]** Singularity Identity + Ranger AD (ITDR): real-time AD/Entra attack detection + Hologram deception (directory identity) - <https://www.sentinelone.com/platform/singularity-ranger-ad/> (2026)
- **[s1-netdisco]** Ranger / Network Discovery: passive/active fingerprinting of IP devices on the LOCAL network (customer's own networks, not the internet) - <https://assets.sentinelone.com/iotranger/singularity-network-discovery-en> (2026)
- **[s1-firewall]** Firewall Control: manages the native OS HOST firewall (location-aware); not a network/DNS service - <https://www.sentinelone.com/blog/feature-spotlight-firewall-control/> (2026)
- **[s1-rollback]** Signature ransomware rollback via VSS snapshots (default 4-hour cadence) - WINDOWS-only - <https://www.sentinelone.com/cybersecurity-101/cybersecurity/what-is-ransomware-rollback/> (2026)
- **[s1-contain]** Storyline correlation; kill/quarantine/remediate/rollback/isolate; Network Quarantine (on-host enforced); RemoteOps remote shell + Forensics - <https://www.cynet.com/security-foundations/endpoint-security/understanding-sentinelone-edr/> (2026)
- **[s1-tamper]** Anti-tamper: no uninstall without out-of-band approval - <https://howtoharden.com/guides/sentinelone/> (2026)
- **[s1-onprem]** Cloud SaaS + on-prem/self-managed and air-gapped consoles for regulated/isolated environments; strong MSP/MSSP motion - <https://www.sentinelone.com/platform/singularity-complete/> (2026)
- **[s1-resource]** Recurring independent reviews: agent can be resource-heavy on low-spec/loaded hosts (esp. during scans); FP-sensitivity historically; steep learning curve - <https://www.gartner.com/reviews/market/endpoint-protection-platforms/vendor/sentinelone> (2026)

### Cortex XDR - their own sources

- **[cx-mitre]** PAN-reported 100% technique-level detection (no config changes, no delays) + 8/10 protection steps blocked with 0 FP - 2024 MITRE ER6 (vendor framing) - <https://www.paloaltonetworks.com/blog/2024/12/historic-results-in-the-2024-mitre-attck-enterprise-evaluations/> (2024-12)
- **[cx-gartner]** Leader, Gartner MQ EPP - 4 consecutive years (2023-2026) - <https://www.paloaltonetworks.com/blog/security-operations/cortex-xdr-named-a-leader-in-2026-gartner-magic-quadrant-for-endpoint-protection-platforms/> (2026-05-29)
- **[cx-forrester]** Leader, Forrester Wave XDR Platforms Q2 2024 - <https://www.paloaltonetworks.com/blog/2024/06/forrester-names-palo-alto-networks-a-leader-in-xdr/> (2024-06-03)
- **[cx-avc]** AV-Comparatives EPR 2025: 99% prevention + 99% response; Strategic Leader multiple years - <https://www.paloaltonetworks.com/blog/security-operations/cortex-xdr-is-the-only-endpoint-security-market-leader-to-achieve-99-in-both-threat-prevention-and-response-in-avc-epr/> (2025)
- **[cx-datalake]** Cortex Data Lake stitches endpoint+network+cloud+identity; XQL hunting; retention '30-day to unlimited' with 30-day floor, longer sold as capacity - <https://cdn.blueally.com/paloguard/datasheets/cortex-xdr.pdf> (2026)
- **[cx-itdr]** ITDR add-on: directory identity analytics (insider/lateral-movement/credential compromise, AD/Azure AD) - not identity-on-the-wire - <https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr> (2026)
- **[cx-nta]** Network Traffic Analysis via Palo Alto NGFW-as-sensor + Cortex broker/Pathfinder feeding analytics (e.g. tunneled-DNS); depends on PAN network stack - <https://www.boll.ch/datasheets/Cortex_XDR.pdf> (2026)
- **[cx-dns]** Can 'restrict network activity / update bad-domain lists' but ONLY through Palo Alto enforcement points (NGFW / DNS Security service) - not a resolver Cortex operates - <https://cdn.blueally.com/paloguard/datasheets/cortex-xdr.pdf> (2026)
- **[cx-hostfw]** Host Firewall module (inbound/outbound rules pushed to agent) + Disk Encryption mgmt + USB Device Control - <https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Host-firewall> (2026)
- **[cx-isolate]** Endpoint isolation (halts all host traffic except to Cortex), process kill, file quarantine, Live Terminal remote shell - agent-enforced on host - <https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/isolate-an-endpoint> (2026)
- **[cx-linux]** Full Linux EDR/ELF analysis needs a kernel module (or user-space mode on kernel 5.0+); unsupported kernels drop to asynchronous mode; narrowest module set - <https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/cortex-xdr-agent-for-linux-requirements> (2026)
- **[cx-xql]** XQL (Cortex Query Language) over xdr_data; XSOAR for automated playbooks - <https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-features> (2026)
- **[cx-pricing]** Tiered (Prevent/Pro) per-endpoint + Cortex Data Lake ingestion billed separately (~$11k/TB/yr est.) + module add-ons; quote-based, complex - <https://underdefense.com/industry-pricings/palo-alto-networks-pricing-ultimate-guide-for-security-products/> (2026)

### Trend Vision One - their own sources

- **[tm-mitre]** Trend-reported 100% analytic coverage of major steps, 100% sub-steps macOS/Linux/server, 99% overall - 2024 MITRE ER6; notes HIGHER alert volume (vendor framing) - <https://newsroom.trendmicro.com/2024-12-11-Trend-Micro-Achieves-100-Coverage-Rate-in-MITRE-ATT-CK-R-Evaluations> (2024-12-11)
- **[tm-gartner]** Leader, Gartner MQ EPP - 20th consecutive time (longest Leader streak of any EPP vendor); highest in 3 Critical Capabilities use cases - <https://newsroom.trendmicro.com/2025-07-17-Trend-Micro-Celebrates-20th-Consecutive-Recognition-as-a-Leader-in-Gartner-R-Magic-Quadrant-TM-Endpoint-Protection-Platforms> (2025-07-17)
- **[tm-forrester-nav]** Leader, Forrester Wave Network Analysis & Visibility (highest current-offering score of 12); also XDR Wave Leader - <https://www.malaymail.com/news/money/mediaoutreach/2025/10/22/trend-micro-named-a-leader-in-network-analysis-and-visibility/420835> (2025-10-22)
- **[tm-ndr]** Real NDR tier: XDR for Networks via Deep Discovery Inspector / standalone virtual sensors / TippingPoint IPS; inline blocking + lateral-movement + unmanaged/IoT/IIoT visibility - <https://www.trendmicro.com/content/dam/trendmicro/global/en/core/docs/datasheets/ds-xdr-for-networks.pdf> (2026)
- **[tm-spn]** Smart Protection Network: 250M+ sensors, 5T+ threat queries/yr, 15 research centers; product-telemetry reputation feed, NOT an owned internet naming/routing graph - <https://www.trendmicro.com/content/dam/trendmicro/global/en/business/technologies/smart-protection-network/ds_smart-protection-network.pdf> (2022)
- **[tm-os]** Broad OS: Win/macOS/Linux + legacy enterprise UNIX (Solaris/AIX/HP-UX) for server/workload (Deep Security lineage); containers/VMs/OpenShift - <https://success.trendmicro.com/en-US/solution/KA-0013185> (2026)
- **[tm-retention]** XDR Data Explorer/OAT default 30 days, extendable to 90/180/365 with a data-retention license; Workbench alerts 180 days - <https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-xdr-data-retention> (2026)
- **[tm-isolate]** Endpoint isolation (by IP/hostname) + inline NDR/IPS blocking; host-driven or perimeter-sensor-driven containment - <https://docs.trendmicro.com/en-us/enterprise/trend-micro-vision-one-olh/common-apps/response-management/response-actions/isolating-endpoints.aspx> (2026)
- **[tm-airgap]** SaaS + Sovereign/Private Cloud / on-premises incl. air-gapped/offline; fullest capability set is cloud-hosted - <https://www.trendmicro.com/en_us/business/products/deployment-options.html> (2026)
- **[tm-mssp]** Vision One for Service Providers: multi-tenant single pane, competitive MSSP pricing - <https://www.msspalert.com/news/trend-micro-stands-up-new-service-provider-module-of-vision-one-cybersecurity-platform> (2026)
- **[tm-identity]** Identity telemetry + ASRM (identity posture / account risk), part of zero-trust story - not a routable per-agent wire identity - <https://www.helpnetsecurity.com/2024/04/22/trend-vision-one-platform/> (2024-04-22)
- **[tm-vp]** On-agent engines: ML/AI, behavior monitoring, host IPS with virtual patching (ZDI-fed vulnerability shielding), DLP, app control, device control, C&C callback blocking, web reputation - <https://invgate.com/itdb/vision-one-endpoint> (2026)
- **[tm-installer]** Reviewer-cited limitations: performance impact, ~600MB installer hard to push to bandwidth-constrained sites, agent-removal difficulty, FPs/alert volume, credit-model confusion - <https://www.gartner.com/reviews/market/endpoint-protection-platforms/vendor/trend-micro/product/trend-vision-one-endpoint-security/likes-dislikes> (2026)
- **[tm-remote]** Remote Shell Session (CLI, 2h cap/10min idle) + Run Remote Custom Script; ransomware rollback (Apex One lineage) - <https://www.docs.trendmicro.com/en-us/enterprise/trend-vision-one-olh/common-apps/response-management/response-actions/start-remote-shell-s.aspx> (2026)

### Sophos - profile sources

- **[so-gartner]** Sophos: Leader, Gartner MQ EPP 15th consecutive; Peer Insights Customers' Choice 4.8/5 - <https://www.sophos.com/en-us/blog/sophos-named-a-leader-in-the-2024-gartner-magic-quadrant-for-endpoint-protection-platforms> (2024-09-23)
- **[so-mitre]** Sophos: 100% detection across 16 steps/90 sub-steps, 86/90 full Technique - 2025 MITRE round 7 (vendor framing) - <https://www.sophos.com/en-us/blog/sophos-achieves-its-best-ever-results-in-the-mitre-attck-enterprise-2025-evaluation> (2025)
- **[so-rollback]** Sophos CryptoGuard automatic ransomware file rollback; Adaptive Attack Protection; cloud-only Central (no air-gapped mgmt) - <https://www.sophos.com/en-us/content/ransomware-attacks> (2026)

### Bitdefender - profile sources

- **[bd-mitre]** Bitdefender: 91% analytic coverage, 6 FP; 100%/0-FP Linux+macOS; ~3 alerts/incident vs 209 median - 2024 MITRE ER6 - <https://www.bitdefender.com/en-us/blog/businessinsights/the-numbers-game-why-alerts-volume-and-false-positives-matter-in-mitre-attck-enterprise-evaluations-2024> (2024-12)
- **[bd-gartner]** Bitdefender: VISIONARY (not Leader), 2024 Gartner MQ EPP; Strong Performer Forrester XDR Q2 2024 - <https://www.bitdefender.com/en-us/news/bitdefender-positioned-as-a-visionary-in-2024-gartner-magic-quadrant-for-endpoint-protection-platforms> (2024-09-24)

### Cybereason - profile sources

- **[cy-datasheet]** Cybereason Defense Platform: MalOp correlation; Network/Identity modules are THIRD-PARTY integrations (firewall/NDR + IAM); on-host isolation; Cloud/Hybrid/On-Prem/Air-Gapped - <https://www.cybereason.com/hubfs/dam/collateral/data-sheets/cr-defense-platform.pdf> (2026)
- **[cy-instability]** Cybereason 2024-2025 instability: layoffs, CEO resignation + lawsuit, terminated Trustwave merger, $120M rescue investment - <https://www.calcalistech.com/ctechnews/article/skyp5fajjg> (2025)
- **[cy-gartner-drop]** Cybereason: 2022 EPP MQ Leader, not a Leader in 2024, DROPPED from the quadrant entirely in the subsequent report - <https://itchanneloxygen.com/gartner-names-6-leaders-in-18bn-endpoint-protection-market-who-are-they/> (2026)