Whisper Security Launches Graph XDR to Contain AI Agents From Outside the Host

New product gives every machine and AI agent a verifiable IPv6 identity and checks each connection against a 47-billion-object internet graph before it is made

AMSTERDAM, NETHERLANDS, October 28, 2026 /EINPresswire.com/ — Whisper Security (viaGraph B.V.), a Dutch internet infrastructure intelligence company, has launched Whisper Graph XDR, a detection, identity and response product for endpoints and AI agents. Graph XDR gives each machine, container, AI agent and device its own public IPv6 address on Whisper’s network, checks every lookup and connection against WhisperGraph, the company’s graph of internet infrastructure, and lets security teams cut off a compromised identity from the network side, outside the machine. The product debuted at CyberSec Netherlands in Utrecht in September and is available now, including a free tier.

Most endpoint security tools run on the host they protect. Once an attacker gains administrative control of a machine, software on that machine can be tampered with, including the agent meant to contain it. Network policy has a similar weakness: rules built on IP address lists go out of date quickly because attackers rotate addresses, while the organisations and networks behind those addresses change far less often. The growing use of autonomous AI agents adds a third gap, since many agents act on corporate networks without an identity of their own.

“Security tools have spent two decades asking the host to report on itself. Once an attacker owns the machine, that report can no longer be trusted,” said Kaveh Ranjbar, co-founder and CEO of Whisper Security and former CIO of RIPE NCC. “Graph XDR moves the decision to the network. Every machine and agent gets an identity anyone can check, every connection is judged on who is really behind the address, and containment happens at our edge, where a compromised host cannot undo it.”

An identity anyone can verify

Each Graph XDR identity is a single IPv6 address (a /128) on AS219419, the autonomous system Whisper operates under a RIPE allocation. The identity carries signed reverse DNS, a pinned certificate and a public registry record, so a third party can verify it with standard DNS and registry lookups without an account or a call to a Whisper service. Machines join through a routed tunnel, an egress proxy for selected applications, or Whisper’s resolver alone. The resolver-only option requires no software on the device, which makes it suitable for OT and IoT equipment.

Policy written in owners and jurisdictions

Graph XDR evaluates each destination against WhisperGraph as the name resolves and as traffic leaves. Rules can target named organisations and networks wherever their addresses move, countries, known bulletproof hosting networks, Tor exit nodes, sanctioned names, addresses and networks, destinations reached over routes that fail RPKI validation, and recently registered domains. Teams can run rules in monitor mode to see what would have been blocked before switching to enforcement. Every connection is logged with the owner, network, country and risk of the destination, and a separate inbound view shows who is looking up an organisation’s identities, reconnaissance that never reaches the host.

“An IP address on its own says very little. The graph joins it to the network, the owner, the country and every feed that lists it, so a rule can be written the way a risk team actually thinks: never reach anything sanctioned, wherever it is hosted,” said Soroush Rafiee Rad, co-founder and CPSO of Whisper Security.

Containment the host cannot veto

Revoking an identity stops it resolving, drops its traffic at Whisper’s edge and withdraws its public record, even when the host no longer responds. The console shows the blast radius before an action is committed, and every action is recorded in an audit trail and can be reversed. An optional host sensor adds process, file and network activity joined into a single causal chain, with detections for ransomware behaviour, process injection, download-then-run sequences and Sigma rules. Detections are held for an analyst’s decision rather than acted on silently. The Linux sensor runs at kernel level and can deny an execution. The Windows sensor runs in user mode without a kernel driver. On macOS, connection telemetry is available today, with deeper host visibility in development.

Evidence for auditors and service providers

Graph XDR maps control evidence to SOC 2, ISO 27001, PCI DSS, HIPAA and CMMC, and each control cites a live count or a check that can be re-run. CSV and JSON exports carry a SHA-256 digest, and every identity grant or revocation is written to a public, append-only log cosigned by a witness. For managed security service providers, a partner portal brings every client fleet into one queue, with branded reports and the ability to block infrastructure for all clients at once.

Availability and pricing

Graph XDR runs in Whisper’s EU-hosted cloud by default, on premises on a single server, or air-gapped with signed graph delivery. A free tier covering five identities and one seat has no time limit. More information is available at https://www.whisper.security/products/graph-xdr

About Whisper Security

Whisper Security (viaGraph B.V.) is a Dutch internet infrastructure intelligence company. Its WhisperGraph joins DNS, BGP routing and RPKI, registration data, certificates, threat intelligence from 150+ feeds and physical infrastructure into one queryable graph of more than 47 billion objects. Two products are built on it: Whisper Intelligence, which shows who is behind any internet address, and Whisper Graph XDR, which controls what machines and AI agents may reach and contains them from outside the host. Whisper operates its own RIPE-allocated network, AS219419. The company was founded in January 2025 by Kaveh Ranjbar, former CIO of RIPE NCC and architect of the K-root DNS root server, and Soroush Rafiee Rad, and has raised EUR 1.6 million in pre-seed funding.

For more information, visit https://www.whisper.security or contact hello@whisper.security

Kaveh Ranjbar
Whisper Security
Visit us on social media:
LinkedIn
YouTube

Media gallery