Whisper Security launches Graph XDR for AI agents and endpoints

Whisper Security has launched Graph XDR, a new detection and response product that gives machines and AI agents verifiable IPv6 identities and can cut off compromised identities from outside the host. The Amsterdam-based company says the system is available now, including a free tier, as enterprises look for better control over autonomous software.

Why it matters: - Graph XDR is built to contain threats from the network side, so security teams are not depending on software running on a compromised machine. - The product addresses a growing gap as more companies deploy autonomous AI agents that need identity, policy and containment controls. - Whisper Security says the product can also help auditors, managed service providers and regulated organizations prove controls with reusable evidence.

What happened: - Whisper Security launched Whisper Graph XDR, a detection, identity and response product for endpoints and AI agents. - The product debuted at CyberSec Netherlands in Utrecht in September and is available now. - Whisper Security says Graph XDR gives each machine, container, AI agent and device its own public IPv6 address on Whisper's network. - The product checks every lookup and connection against WhisperGraph before traffic is allowed. - The company is offering a free tier.

The details: - Each Graph XDR identity is a single IPv6 address, or /128, on AS219419, the autonomous system Whisper operates under a RIPE allocation. - Each identity includes signed reverse DNS, a pinned certificate and a public registry record. - A third party can verify the identity through standard DNS and registry lookups without an account or a call to Whisper. - Machines can join through a routed tunnel, an egress proxy for selected applications, or Whisper's resolver alone. - The resolver-only option requires no software on the device and is designed for OT and IoT equipment. - Graph XDR evaluates destinations against WhisperGraph as the name resolves and again as traffic leaves. - Policies can target named organizations and networks, countries, known bulletproof hosting networks, Tor exit nodes, sanctioned names, sanctioned addresses and networks, destinations reached over routes that fail RPKI validation, and recently registered domains. - Security teams can run rules in monitor mode before switching them to enforcement. - Every connection is logged with the owner, network, country and risk of the destination. - A separate inbound view shows who is looking up an organization's identities, which captures reconnaissance before it reaches the host. - Revoking an identity stops it resolving, drops its traffic at Whisper's edge and withdraws its public record. - The console shows the blast radius before an action is committed. - Every action is written to an audit trail and can be reversed. - An optional host sensor adds process, file and network activity into a single causal chain. - The sensor includes detections for ransomware behavior, process injection, download-then-run sequences and Sigma rules. - Detections are held for analyst review instead of being acted on silently. - The Linux sensor runs at kernel level and can deny execution. - The Windows sensor runs in user mode without a kernel driver. - On macOS, connection telemetry is available now, with deeper host visibility still in development. - Graph XDR maps control evidence to SOC 2, ISO 27001, PCI DSS, HIPAA and CMMC. - Each control cites a live count or a re-runnable check. - CSV and JSON exports carry a SHA-256 digest. - Each identity grant or revocation is written to a public, append-only log cosigned by a witness. - Managed security service providers get a partner portal that puts client fleets into one queue, with branded reports and the ability to block infrastructure for all clients at once. - Graph XDR runs in Whisper's EU-hosted cloud by default, on premises on a single server, or air-gapped with signed graph delivery. - The free tier covers five identities and one seat with no time limit. - More information is available at the product page.

Between the lines: - Whisper Security is positioning Graph XDR as a response to a structural weakness in endpoint security: host-based tools can be disabled once an attacker gains administrative control. - The product also reflects a shift from IP-based blocking to identity-based policy, since addresses can change faster than the organizations behind them. - The combination of graph data, public verification and outside-the-host containment is meant to make policy harder to tamper with and easier to audit.

What's next: - Whisper Security says the free tier is available now, which could help the company seed adoption among smaller teams and early testers. - The company is also developing deeper host visibility for macOS. - Broader rollout will likely hinge on whether organizations adopt the network-side containment model for AI agents, OT devices and managed environments.

The bottom line: - Whisper Security is betting that verifiable network identity and graph-based policy can do what host-based tools cannot: contain compromised machines and AI agents from outside the host.