# Platform support Identity, graph verdicts, policy and the off-host kill-switch cover any host, Linux, Windows or Mac, at the network layer today, because that plane rides the network, not the OS. On-host deep detection runs on Linux and now Windows, with the core engines proven end to end on a real Windows Server 2022 host; on macOS the same engines are exercised on Apple-silicon over the bridge datapath (the exec, file and socket collectors are proven on real Apple hardware; the /dev/bpf qname tap needs root and is exercised through a scripted read seam rather than a live device; the engines are exercised in datapath tests rather than fired by a live Endpoint Security feed), and the live Endpoint Security feed is entitlement-gated. The table below says exactly where each sensor stands. A host sensor is only ever part of the story here. Whisper Endpoint is seven layers: identity, sensor, calm, the local verdict, the graph, policy, and response. Three of them run on the host and are per-OS; four of them run on Whisper infrastructure and are OS-independent by construction. The sensor is optional. This page covers both halves, and keeps them apart. ## The support matrix | Platform | On-host sensor | Status | What that means | |---|---|---|---| | Linux | Deep sensor | Live | Deep detection is live: the full engine set runs on-host. Debian / Ubuntu and the RHEL family; the coverage run was measured on kernel 6.1. Four telemetry collectors (NETLINK proc-connector exec by default, pure-Go and GPL-free; fanotify files; NETLINK_SOCK_DIAG sockets; per-process DNS attribution, so the query is tied to the PID that made it), folded into an on-host process/file/socket/DNS graph. Twelve behavioral engines, ransomware, process injection and the write-exec-connect event chain among them, plus native Sigma (79 bundled rules) and YARA rule engines run over the streams, observe-only. Measured at about 1% of one core and 11 MB. eBPF is opt-in behind `-tags ebpf`. Fails open below kernel 5.3. See [the Linux sensor](/docs/linux-sensor) and [inside the sensor](/docs/sensor-internals). | | Windows | ETW telemetry + deep detection | Live | Deep detection is live on Windows: one real-time ETW session over four manifest providers carries process starts, the full file verb set (create, modify, move, delete), outbound connects, DNS queries and image loads, a pure-Go collector with no kernel driver; and the ransomware correlator (T1486), the dropper event chain (T1105) and the process-injection region sweep (T1055) run on-host, proven end to end on a real Windows Server 2022 host (T1486 fired at confidence 1.0 with four correlated signals and a tripped canary). Named plainly, still gated: the Sigma evaluator's Windows false-positive tuning pass (the evaluator itself runs live and opt-in with nine curated Windows rules, the same gate Linux uses), YARA-X stays a separate build, and the ETW-TI tier is built but dark, gated on Microsoft's anti-malware attestation (ELAM co-sign and program membership), not on engineering. See [the Windows sensor](/docs/windows-sensor). | | macOS | Endpoint Security + Network Extension bridge | In development | The engines are exercised on Apple-silicon over the bridge datapath (the exec, file and socket collectors are proven on real Apple hardware; the /dev/bpf qname tap needs root and is exercised through a scripted read seam rather than a live device; the engines are exercised in datapath tests rather than fired by a live Endpoint Security feed): the ransomware correlator (T1486, T1490), the process-injection correlator (T1055), the event chain and the fenced response tier all exercised over the bridge datapath. Separately, and this part IS proven on real hardware: the exec collector runs unentitled on a real Mac and reads the kernel's code-signing identity (signing id, cdhash, platform-binary) where the kernel will give it, a signal Linux has no kernel-attested equivalent for. The wire contract is byte-identical (a macOS event encodes the same bytes, proven by a mutation-guarded contract corpus). The live Endpoint Security feed is gated on Apple's ES entitlement, and the gate is proven, not asserted: an ad-hoc-signed build is killed by the OS before it reads an event, so broad distribution flips on approval. Today: developer and internal builds, not a customer ship. See [the macOS sensor](/docs/macos-sensor). | | OT / IoT (PLC, camera, printer) | No on-host agent | Network layer | No sensor runs on the device. Point its DNS at Whisper, or give it a /128 resolver, and it gets graph-first resolution policy, destination reputation, per-/128 egress metering, and the off-host kill-switch. | | Personal / contractor device | No installed sensor | Network layer | A per-device token mints encrypted DoH/DoT plus a routable /128 with reverse DNS and RDAP. Two-tier: keyless verify for everyone, keyed control and egress once an API key is supplied. | | AI agents / sub-agents | Identity-native | Network layer | Each agent, and each nested sub-agent, gets its own governed /128, with policy composing down the tree: revoke or kill the parent and the whole branch is cut at the egress plane. No OS to install on; identity is the primitive. | The three words are exact. *Live* means shipped and proven on a real box: Linux measured on kernel 6.1, Windows proven with real detections on Windows Server 2022. *In development* means built, contract-tested and, for macOS, exercised over the bridge datapath in compiled arm64 tests, but not yet customer-installable (the live Endpoint Security feed is entitlement-gated). *Network layer* means there is no host sensor, and the endpoint is still covered by identity, resolution and containment. We never round any of them up. ## Seven layers, two homes The reason the matrix reads the way it does: only three of the seven layers live on the host, and they are the optional three. The four that decide protection, identity, the graph verdict, policy and response, sit on Whisper infrastructure and cover everything on the wire at once, whatever the operating system. ``` RIDES THE NETWORK · any OS, any device, any agent +---------------+----------------+----------------+------------------+ | 1 IDENTITY | 5 THE GRAPH | 6 POLICY | 7 RESPONSE | | verifiable | destination | firewall · | off-host | | /128 · DNSSEC | verdicts · | graded egress ·| kill-switch · | | DANE · RDAP | 7.52B nodes / | geo · device · | revoke worldwide,| | keyless-check | 38.6B edges | nesting | survives a | | | | off-host | lost box | +---------------+----------------+----------------+------------------+ the sensor is optional · these four cover every endpoint RIDES THE HOST · optional, per-OS +----------------------+----------------------+------------------------+ | 2 SENSOR | 3 CALM | 4 LOCAL VERDICT | | exec · file · socket | two schedulers · | 12 engines + Sigma + | | · DNS streams, | ~1% of one core, | Sigma, on-host graph, | | forward-first | kernel-bounded | held not contained | +----------------------+----------------------+------------------------+ ON-HOST DEPTH TODAY · depth of visibility, never depth of protection +---------------+----------------+------------------+------------------+ | Linux | Windows | macOS | OT · unmanaged · | | deep · live | deep · live | engines proven · | agents · none | | | | ES feed gated | | +---------------+----------------+------------------+------------------+ ``` The network rows do not change shape as you move across operating systems, because a revoke, a policy and a graph verdict act on Whisper infrastructure, not on the endpoint. Only the host rows vary, because a sensor has to be built and signed per platform. And one thread runs through all seven: every layer's claim is checkable keyless, with stock tools. Sensor depth is the depth of what you can see on the box; it is never the depth of what you can contain. A Linux host with the deep sensor and a printer with nothing installed carry the same four network-side layers, and the same one-call revoke. ## Covered without a sensor Whole classes of endpoint have no host to install on, and they are exactly the ones an incumbent host-only EDR leaves uncovered: - OT and IoT. A PLC, a camera or a printer cannot run an agent, but it can point DNS at Whisper or take a /128 resolver. It then gets graph-first resolution, destination reputation on every lookup, per-/128 egress metering, and a one-call revoke. The endpoint-graph ontology reserves node and edge bands for future device collectors, so a purpose-built sensor is a drop-in later, not a redesign. - Personal and contractor machines. An unmanaged laptop takes a per-device token: encrypted DoH/DoT and a routable /128 with reverse DNS and public RDAP, no installed sensor. Keyless verification is open to anyone; the keyed control plane and egress unlock when the owner supplies an API key. - AI agents and their sub-agents. There is no OS layer to sit under. Each agent is issued its own routable, governed /128, and a spawned sub-agent nests under its parent with its own identity and its own policy, composed down the tree: a deny at any ancestor binds the descendant, and revoking or killing the parent cuts the whole branch at the egress plane. This is a fleet-of-agents model laptop-era consoles have no primitive for. See [Fleet, logs and console](/docs/fleet) for the nesting surface. ## The fleet is mixed The operator console reads a live fleet with Linux, Windows and macOS hosts side by side (screenshot on the HTML page, captured 2026-08-25): 53 managed endpoints, 318 verifiable /128 identities on the wire, worst-host names including a Windows and a macOS demo box, and an on-host sensor-depth bar reading 36 shipping, 4 stale, 13 none. Fleet coverage: every /128 carries policy and containment at the network layer, sensor or not. The connectivity tier bar (routed, egress, resolver) is how each endpoint reaches the network. The sensor-depth bar (shipping, stale, none) is how much the host sensor can see. They are drawn as two different bars on purpose, because one is reach and the other is visibility, and neither is the same as protection. ## Roadmap | Item | Status | Gate | |---|---|---| | macOS customer ship | In development | The Apple Endpoint Security entitlement plus Developer ID notarization. The engines are exercised on Apple-silicon over the bridge datapath (the exec, file and socket collectors are proven on real Apple hardware; the /dev/bpf qname tap needs root and is exercised through a scripted read seam rather than a live device; the engines are exercised in datapath tests rather than fired by a live Endpoint Security feed) and the gate itself is proven (an ad-hoc build is killed by the OS); externally clocked, not an engineering gap, and approval flips the live feed on. | | Windows ETW-TI tier (+ Microsoft Vulnerable Driver blocklist matching) | Built, dark | The ETW-TI decode and signal mapping are shipped and tested; the live subscribe needs Microsoft's anti-malware attestation (an ELAM co-signed service and program membership), an external clock, not an engineering gap. Driver-load telemetry is live and the 46-rule blocklist matcher is built and unit-tested; wiring the matcher onto the live feed is the filed follow-up. | | Public MITRE ATT&CK Evaluation | Roadmap, 2027 | Scheduled, not yet run. We publish the reader-runnable proof instead until then. | None of these gates touches the four network-side layers on those platforms. A Windows or macOS host has a verifiable /128, carries policy, and can be contained off-host today, whether or not its deep sensor has shipped.