New product gives every machine and AI agent a verifiable IPv6 identity and checks each connection against a 47-billion-object internet graph before it is made
Whisper Security (viaGraph B.V.), a Dutch internet infrastructure intelligence company, has launched Whisper Graph XDR, a detection, identity and response product for endpoints and AI agents. Graph XDR gives each machine, container, AI agent and device its own public IPv6 address on Whisper’s network, checks every lookup and connection against WhisperGraph, the company’s graph of internet infrastructure, and lets security teams cut off a compromised identity from the network side, outside the machine. The product debuted at CyberSec Netherlands in Utrecht in September and is available now, including a free tier.
Once an attacker owns a machine, the host’s own report can no longer be trusted. Graph XDR moves the decision to the network, where a compromised host cannot undo it.”
— Kaveh Ranjbar, Co-Founder and CEO of Whisper Security
Most endpoint security tools run on the host they protect. Once an attacker gains administrative control of a machine, software on that machine can be tampered with, including the agent meant to contain it. Network policy has a similar weakness: rules built on IP address lists go out of date quickly because attackers rotate addresses, while the organisations and networks behind those addresses change far less often. The growing use of autonomous AI agents adds a third gap, since many agents act on corporate networks without an identity of their own.
Also Read: CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight
“Security tools have spent two decades asking the host to report on itself. Once an attacker owns the machine, that report can no longer be trusted,” said Kaveh Ranjbar, co-founder and CEO of Whisper Security and former CIO of RIPE NCC. “Graph XDR moves the decision to the network. Every machine and agent gets an identity anyone can check, every connection is judged on who is really behind the address, and containment happens at our edge, where a compromised host cannot undo it.”
An identity anyone can verify
Each Graph XDR identity is a single IPv6 address (a /128) on AS219419, the autonomous system Whisper operates under a RIPE allocation. The identity carries signed reverse DNS, a pinned certificate and a public registry record, so a third party can verify it with standard DNS and registry lookups without an account or a call to a Whisper service. Machines join through a routed tunnel, an egress proxy for selected applications, or Whisper’s resolver alone. The resolver-only option requires no software on the device, which makes it suitable for OT and IoT equipment.
Policy written in owners and jurisdictions
Graph XDR evaluates each destination against WhisperGraph as the name resolves and as traffic leaves. Rules can target named organisations and networks wherever their addresses move, countries, known bulletproof hosting networks, Tor exit nodes, sanctioned names, addresses and networks, destinations reached over routes that fail RPKI validation, and recently registered domains. Teams can run rules in monitor mode to see what would have been blocked before switching to enforcement. Every connection is logged with the owner, network, country and risk of the destination, and a separate inbound view shows who is looking up an organisation’s identities, reconnaissance that never reaches the host.
“An IP address on its own says very little. The graph joins it to the network, the owner, the country and every feed that lists it, so a rule can be written the way a risk team actually thinks: never reach anything sanctioned, wherever it is hosted,” said Soroush Rafiee Rad, co-founder and CPSO of Whisper Security.
Containment the host cannot veto
Revoking an identity stops it resolving, drops its traffic at Whisper’s edge and withdraws its public record, even when the host no longer responds. The console shows the blast radius before an action is committed, and every action is recorded in an audit trail and can be reversed. An optional host sensor adds process, file and network activity joined into a single causal chain, with detections for ransomware behaviour, process injection, download-then-run sequences and Sigma rules. Detections are held for an analyst’s decision rather than acted on silently. The Linux sensor runs at kernel level and can deny an execution. The Windows sensor runs in user mode without a kernel driver. On macOS, connection telemetry is available today, with deeper host visibility in development.
Evidence for auditors and service providers
Graph XDR maps control evidence to SOC 2, ISO 27001, PCI DSS, HIPAA and CMMC, and each control cites a live count or a check that can be re-run. CSV and JSON exports carry a SHA-256 digest, and every identity grant or revocation is written to a public, append-only log cosigned by a witness. For managed security service providers, a partner portal brings every client fleet into one queue, with branded reports and the ability to block infrastructure for all clients at once.
Catch more CIO Insights: How Are CIOs Aligning Technology with Workforce Agility?
[To share your insights with us, please write to psen@itechseries.com ]
