Whisper Endpoint: frequently asked questions.

Those are excellent host agents, but they are only host agents: they see an IP address and have to ship their own cloud reputation to make sense of it, and their containment lever runs on the endpoint itself. Whisper is the resolver and the network too, so it draws a process to name to peer edge no host-only agent gets cheaply, scores that destination's owner, network, and prevalence across a 7.53B-node graph, and contains the endpoint by revoking its identity from off the box. On top of that, every identity is verifiable by a stranger with standard tools, and the sensor is calm-scheduled to about 1% of one core. Same category, a structurally different position.

The moat is not a feature, it is structural. Whisper is the DNS resolver and the network your endpoints route through, and it allocated their routable identities out of address space it holds. A host-only vendor can add a graph, but it cannot become the resolver that saw the name and the address space your traffic rides without rebuilding itself as us. Off-host containment, process-to-DNS attribution, and keyless verifiable identity all fall out of that position for free; bolted onto a pure host agent, each one is a large new product.

An identity-native EDR is one where every endpoint has a routable, verifiable network identity, and detection, policy, and containment all key off that identity instead of off a host agent you simply have to trust, which is possible here because Whisper is also the DNS and the network.

It watches four telemetry streams, process, file, socket, and DNS, and runs five of its twelve engines in the default build across the supported platforms. The ransomware engine fuses eight weighted signals (mass writes, uniform rename churn, planted canary tripwires, backup tampering, gated entropy sampling, and more) and covers data-encryption and recovery-inhibition behavior. The injection scanner spots four in-memory injection shapes without a disassembler. The dropper-chain correlator catches the classic write-then-execute-then-connect sequence across process trees. A critical-config watch guards sixteen classic Linux persistence and privilege-escalation paths. And SigmaHQ runs natively on top carrying 79 bundled rules; YARA-X is present in-tree but built-dark behind the -tags yara opt-in build, so it is not in the default binary.

Yes to both, running natively on the host rather than bolted on in a SIEM; the YARA half is an opt-in build. We build against real YARA-X (VirusTotal's engine, BSD-licensed) with curated rules such as the Kobalos APT and Plague backdoor signatures, but that engine is behind the -tags yara opt-in build and is not in the default binary, so a stock install ships no YARA scanning, and a real SigmaHQ evaluator (MIT-licensed) with rules for reverse shells, crypto-mining, ngrok tunneling, shared-memory execution, and more. Every finding carries its rule's original author, license, and ATT&CK technique. You bring your own too: drop a .yar or .yml file into the sensor's rules directory and it is live.

Our bundled content names 91 on-host MITRE ATT&CK techniques across the twelve engines and 79 Sigma rules, with another 19 in the four graph-side infrastructure columns, from ransomware (T1486 and T1490) and process injection (T1055 and sub-techniques) to ingress tool transfer (T1105), dynamic linker hijacking, cron and systemd persistence, sudo abuse, and several more. We are careful about the difference between telemetry and detection: we collect raw signal for far more than we claim to detect, and we never invent a technique ID, every finding carries the technique from its own rule. The live coverage grid, honest about which cells are detection versus telemetry only, is on the capabilities page.

False-positive safety is built into each engine, not tuned in afterward. The ransomware engine exonerates a compiler or backup burst on plain content, screens out benign rename suffixes, and convicts only on corroborated signals. The injection scanner carries a curated screen for the language runtimes (the JVM, V8, .NET, and two dozen more) that legitimately map executable memory. Every behavioral engine deliberately tops out below certainty and leaves the final call to the graph's second opinion. The result is high-confidence findings, not an alert firehose.

Yes, it survives. Because Whisper allocated the endpoint's IPv6 identity and also serves its DNS, containment does not depend on anything running on the box. When you revoke, the identity stops resolving worldwide: forward and reverse DNS return an authenticated NXDOMAIN, the RDAP record shows no assignment, and the DANE certificate anchor disappears, all at DNS TTL. A host-only agent hides its off-switch on the machine it has already lost; ours lives in the network the attacker does not control. For an agent whose only network presence is its Whisper identity, revoking it is total; a machine that also has its own ISP address keeps that address, but its Whisper identity and any egress bound to it are gone the moment you revoke.

Yes, optionally. Alongside the off-host kill-switch, the sensor can take bounded local action: kill a process, quarantine a file, restart a service, or apply a patch. But it is opt-in, allowlist-only, poll-based, and every action is audited. Off by default and observe-only until you arm it, so the sensor watches and reports until you decide otherwise. Most operators use the off-host revoke as the decisive lever and keep local action scoped and rare.

Agents nest: a machine that is a Whisper agent can spawn sub-agents that each get their own governed identity and egress through the parent, at any depth. Because policy composes down that tree and enforcement follows the real, measured transit chain, you cut the whole branch in one move. Kill-switch or revoke the parent and every descendant behind it is denied on its next connection, no chasing children one by one. The fleet view shows the tree, and revoking the root cuts the subtree cleanly.

Every AI agent gets its own routable /128 identity, and agents nest: a parent agent can spawn sub-agents that each get their own governed identity and egress through the parent, at any depth and across any mix of tunnels. Whisper detects the nesting, records it, and publishes it in RDAP, and because policy composes down the chain, revoking or kill-switching a parent cuts the entire subtree at once. For ephemeral agents this is the difference between a process somewhere and a named, governed, revocable identity on the internet.

Yes, all off the host and keyed to the agent's identity. You can set a per-agent egress firewall (allow api.stripe.com and port 443, deny everything else), grade egress freedom by how much the graph trusts each process, cap bytes and connections, and scope a single run to a deny-default allowlist for its duration. Because the rules live in Whisper's egress plane and not on the agent, a compromised agent cannot switch off its own firewall, and a known-bad process can be dropped to DNS-only automatically.

Linux is deep and live today: every detection and telemetry engine in the default build runs in production on Linux; YARA-X is the one exception, behind the -tags yara opt-in build. Windows is live too: ETW telemetry plus the ransomware, dropper-chain and process-injection engines, proven end to end on a real Windows Server 2022 host, with the ETW-TI tier still built but dark behind Microsoft's anti-malware attestation. macOS is in development: the engines are exercised on Apple-silicon over the Endpoint Security datapath (the exec, file and socket collectors are proven on real Apple hardware; the /dev/bpf qname tap needs root and is exercised through a scripted read seam rather than a live device; the engines are exercised in datapath tests rather than fired by a live Endpoint Security feed), and the live Endpoint Security feed is entitlement-gated. We would rather tell you exactly what is shipping than paint a green matrix. The keyless identity and verification tier, meanwhile, works from anywhere with dig, delv, and openssl, regardless of operating system.

Two paths, and you can mix them. Keyless first: enroll and verify a /128 identity for any device with no agent and no key, which already gives you a named, revocable presence. Then, wherever you want per-process detection, install the calm sensor with a single command: the bare installer never observes your host, so the sensor is opt-in behind WHISPER_SENSOR=1 and a key. There is no kernel driver to stage and no reboot, and the sensor self-schedules to stay invisible, so a fleet rollout is a script, not a change window.

Yes. You tune the sensor on two intuitive axes: how hard it hunts (Aggression) and how much it tells you (Loudness). We ship named presets on that quadrant, from a barely-there daily whisper to the SOC dream that hunts hard and deep yet says almost nothing. Move one point and all eighteen underlying levers re-derive deterministically, identically on every node. A safety floor sits under all of it: no preset, drag, or override can push CPU past the cap, un-mute the laptop battery guards, or arm a response you did not arm. The controls only ever get quieter or safer than that floor, never louder or heavier.

We have not been through a MITRE ATT&CK Evaluation or a Gartner Magic Quadrant yet, and we will not pretend otherwise; those are on our roadmap for 2027. In the meantime we did something rarer: we made the product verify-it-yourself, so you do not have to wait for a lab's green checks. Here is the honest maturity line. Live today: the routable identity and keyless verification, the full Linux sensor with its default-build engines including Sigma (YARA-X is behind the -tags yara opt-in build), Windows deep detection (ETW telemetry plus the ransomware, dropper-chain and injection engines, proven on Windows Server 2022; ETW-TI stays built but dark behind Microsoft's attestation, and the Sigma tuning pass, the YARA build and the driver-blocklist wiring are still ahead), process-to-DNS graph attribution, off-host containment and subtree revoke, the calm scheduler, and identity-anchored firewall, egress, and geo-resolution policy. Roadmap: macOS (engines exercised on Apple-silicon over the Endpoint Security datapath, the exec, file and socket collectors are proven on real Apple hardware; the /dev/bpf qname tap needs root and is exercised through a scripted read seam rather than a live device; the engines are exercised in datapath tests rather than fired by a live Endpoint Security feed, with the live Endpoint Security feed entitlement-gated), jurisdiction-tagged addressing (built, opt-in), a wider witness quorum, and the formal MITRE and Gartner evaluations. We keep this list current because honesty is the brand.