# Whisper Endpoint - the EDR that governs identity and holds the off-host kill-switch. This is endpoint.whisper.online, the flagship endpoint-security product of Whisper Security. Whisper Endpoint is a real Linux EDR with one thing no host-only sensor has: it gives every host and every AI agent a routable, publicly-verifiable IPv6 /128 on our own address space, and it can end a compromised host or agent at the network layer even when the host is fully owned. Written so both an agent and a person can act on it. ## What it is An on-host Linux sensor (a GPL-free NETLINK exec collector + a fanotify file collector + a config-watch on critical files), a graph brain (the 712-technique ATT&CK taxonomy + the internet infrastructure graph, which scores the attacker's OWN infrastructure - reconnaissance and resource-development - coverage a host-only EDR structurally lacks), and an off-host kill-switch (one call revokes a host or agent's resolution and egress worldwide at DNS-TTL, even when the host is owned). Calm and cgroup-bounded, fail-open. ## The receipt (measured live, no mockups) On a real throwaway Debian 12 box (kernel 6.1), driving real Atomic Red Team atomics: - 100% telemetry: 37 of 37 ATT&CK techniques captured across 10 tactics, zero drops. - 32 of 37 signature (86%): the known tool captured by name (nmap really scanned, gpg really encrypted, /etc/ld.so.preload write captured). - 17,092 exec events captured, zero drops, including one scan loop of 10,974. Verbatim captured events: [T1003.008 read /etc/shadow] {"comm":"cat","filename":"/usr/bin/cat","pid":1658,"ppid":1656,"uid":0} [T1489 service stop] {"comm":"systemctl","filename":"/usr/bin/systemctl","pid":1718,"uid":0} [T1053.003 cron persistence] {"comm":"crontab","filename":"/usr/bin/crontab","pid":1732,"uid":0} [T1547.006 kernel module] {"comm":"insmod","filename":"/usr/bin/kmod","pid":1875,"uid":0} [T1027 obfuscation] {"comm":"base64","filename":"/usr/bin/base64","pid":1986,"uid":0} [T1071.001 C2 user-agent] {"comm":"curl","filename":"/usr/bin/curl","pid":2018,"uid":0} [T1485 data destruction] {"comm":"dd","filename":"/usr/bin/dd","pid":7462,"uid":0} [T1105 ingress transfer] {"comm":"rsync","filename":"/usr/bin/rsync","pid":7495,"uid":0} [T1574.006 ld.so.preload] {"kind":"file","event":"create","path":"/etc/ld.so.preload","critical":true} ## Telemetry vs detection (the load-bearing distinction) Telemetry is visibility: the measured 100% means the sensor saw every technique and named its signature process (exactly what MITRE Evaluations report first). It is NOT the same as an analytic verdict that alerts. Detection is the growing layer: live for graph reputation on C2/exfil destinations and file hashes and the per-process trust tier, and live-but-observe-only for the behavioral engines (Sigma, YARA, event-chain, ransomware and injection), which alert but do not yet enforce. Enforcement and copy-on-write rollback are the specified-not-shipped follow-on; Windows deep detection (the ransomware, dropper-chain and injection engines over live ETW telemetry) is proven on Windows Server 2022, with the ETW-TI tier built but dark behind Microsoft's anti-malware attestation; and a public MITRE Evaluation is targeted for 2027. We never claim a detection we cannot demo. ## Verify an identity yourself (keyless, no account) dig -x 2a04:2a01:e32a:155f:26cc:967b:8c5b:70a1 +short # -> a26cc967b8c5b70a1.t0f1c527d1cada8c6e8dfc46c74e013e5.agents.whisper.online. Reverse DNS names the address; DNSSEC anchors it to the IANA root; DANE-EE pins the key; public RDAP holds the allocation under AS219419 / 2a04:2a01::/32. Our own API is never in the trust path. ## Coverage of the uncoverable OT / IoT (PLCs, cameras, printers), AI agents and sub-agents, and personal or contractor devices all get a verifiable name and the kill-switch with no agent installed on them. ## Calm footprint (a published cgroup SLA) CPUQuota=25%, MemoryMax=250M, event-driven, fail-open. If the sensor is down, the host still resolves and runs. ## Install (one command) curl -fsSL https://get.whisper.online | sh ## Pages - / Overview - the question, the receipt, the coverage - /how-it-works The sensor, the identity, and the off-host kill-switch - /capabilities Every capability across 7 layers vs the host-only EDR model, honest where they lead - /setup Install and verify - /privacy EU sovereignty and data residency - /pricing Per-seat, no minimum, direct or through a partner - /faq Honest answers, including whether a bad sensor update can take your fleet down - /docs The docs landing - Whisper Endpoint overview ## Docs - /docs/quickstart From nothing to a verified identity - /docs/install-verify Install the sensor and verify the /128 keyless - /docs/architecture How the sensor works, end to end - /docs/linux-sensor The Linux sensor in depth - /docs/windows-sensor The Windows sensor: live ETW telemetry + deep detection (ransomware, dropper-chain, injection); ETW-TI built, dark - /docs/macos-sensor The macOS sensor: an Endpoint Security bridge, broad distribution entitlement-gated - /docs/sensor-internals Inside the sensor: hashing and YARA caps, trust tiers, measured actuals - /docs/collectors The telemetry collectors - /docs/detections The detection engines (observe-first) - /docs/attack-coverage The measured ATT&CK telemetry receipt - /docs/kill-switch Containment: on-host response and the off-host kill-switch - /docs/wire-identity The routable /128 identity - /docs/domains DNS and DNSSEC for your own domain (bring-your-own-domain, for a fleet) - /docs/footprint Calm footprint, SLA and scheduler - /docs/fleet Fleet, logs and the console - /docs/platforms Platform support (Linux live; Windows, macOS honest status) - /docs/evidence Tamper-evident compliance evidence ## Compliance Every identity and control event is written to an independently-witnessed, tamper-evident ledger an auditor checks themselves, keyless. Per-control evidence toward SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC, NIS2 and DORA. It never makes you compliant or certified; your auditor does that. ## Get started Sign in: https://console.whisper.online Reselling to a book of clients (white-label): https://www.whisper.security/solutions/mssp Building agents / a fleet / a platform: https://whisper.online/ ## The operator Operator: Whisper Security (viaGraph B.V.), Amsterdam, NL. Network: AS219419, IPv6-only, RPKI-signed, MANRS-compliant, announcing 2a04:2a01::/32. Built by an ex-RIPE NCC CIO and a K-root architect.