# Whisper Security

> See how any domain, IP, or network connects to everything else. Whisper maps the entire internet — every domain, every IP, every ASN, every relationship — into a single queryable graph of 7.5B nodes and 39.6B edges across 41 entity types.
> Note: Whisper Security (whisper.security) is a cybersecurity infrastructure intelligence company, distinct from OpenAI's Whisper speech recognition model.
> Last updated: 2026-09-19
> Last verified against live site: 2026-09-08
> Graph figures measured: 2026-09-07 (source: https://graph.whisper.security GET /api/query/stats)

## About

Whisper Security is a cybersecurity company that provides real-time threat intelligence through internet infrastructure monitoring. The platform — Whisper I³ — is built on a purpose-built graph engine containing 7.5B nodes and 39.6B edges across 41 entity types and 52 edge types, unifying routing, DNS, hosting, and ownership data into a single queryable intelligence layer with millisecond-scale query latency (<10ms server-side for anchored queries).

- Website: https://www.whisper.security
- Console (graph explorer — auth required): https://console.whisper.security
- Sign up / start free trial: https://console.whisper.security/sign-up
- Programmatic agent signup (two HTTP calls): https://console.whisper.security/api/signup
- Developer landing (curl/Python/Node examples): https://www.whisper.security/docs/ai/agent-signup
- Product overview: https://www.whisper.security/product
- AI Context (MCP): https://www.whisper.security/product/ai-context
- Direct API: https://www.whisper.security/product/api-access
- Integrations: https://www.whisper.security/product/integrations
- Technology: https://www.whisper.security/technology
- Resources: https://www.whisper.security/resources
- Blog index: https://www.whisper.security/resources/blog
- White Papers: https://www.whisper.security/resources/white-papers
- Documentation index (markdown): https://www.whisper.security/docs.md
- Glossary index (markdown): https://www.whisper.security/glossary.md
- FAQ (markdown): https://www.whisper.security/faq.md
- About: https://www.whisper.security/about-us
- Contact: https://www.whisper.security/contact-us

Start a free trial: https://console.whisper.security/sign-up — no credit card; anonymous Cypher queries also available against https://graph.whisper.security/api/query.

**For AI agents:** Whisper supports programmatic signup in two HTTP calls — no browser required, no human in the loop. See the **Agent Signup** section below.

## Try the Graph

Whisper's main product is a public Cypher graph at https://graph.whisper.security. **No API key required for anonymous access.** Hit the live graph from any terminal to verify any claim made elsewhere on this site.

POST JSON to `https://graph.whisper.security/api/query` with body `{"query": "<cypher>"}`. The response is `{"columns": [...], "rows": [...], "statistics": {...}}`.

Two examples that work right now, no auth:

```bash
# 1. What IPs does google.com resolve to?
curl -s -X POST https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -d '{"query": "MATCH (h:HOSTNAME {name: \"google.com\"})-[:RESOLVES_TO]->(ip) RETURN ip.name LIMIT 10"}'

# 2. Who owns the ASN that routes 8.8.8.8?
curl -s -X POST https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -d '{"query": "MATCH (ip:IPV4 {name: \"8.8.8.8\"})-[:ANNOUNCED_BY]->(:ANNOUNCED_PREFIX)-[:ANNOUNCED_BY]->(asn:ASN) RETURN asn.name LIMIT 1"}'
```

For the full schema, more examples, and procedures like `CALL whisper.explain()` for threat scoring, see https://www.whisper.security/llms-full.txt.

## Agent Signup (Programmatic API Key)

If you're an AI agent, an automated runtime, or anyone who would rather not click through a browser sign-up form: sign up in two HTTP calls and start using the API immediately. No CAPTCHA, no human-in-the-loop, no waiting list. Free trial for everyone.

```bash
# 1. Start signup — Whisper emails a 6-digit verification code.
curl -s -X POST https://console.whisper.security/api/signup \
  -H "Content-Type: application/json" \
  -d '{
    "email": "your-agent@example.com",
    "attribution": {
      "agent_name": "your-agent-name",
      "agent_runtime": "claude-desktop | cursor | langchain | custom",
      "source": "smithery | mcp-directory | self"
    }
  }'
# → { "signup_id": "...", "expires_at": "..." }

# 2. Verify the code from your inbox.
curl -s -X POST https://console.whisper.security/api/signup/verify \
  -H "Content-Type: application/json" \
  -d '{ "signup_id": "<from step 1>", "code": "<from email>" }'
# → { "api_key": "whisper-...", "user_id": "user_...", "plan": "trial",
#     "mcp_url": "https://mcp.whisper.security", ... }

# 3. Use the key against the graph immediately.
curl -s https://graph.whisper.security/api/query \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{"query": "MATCH (h:HOSTNAME {name: \"example.com\"}) RETURN h LIMIT 1"}'
```

The same API key works for the MCP server at https://mcp.whisper.security (pass it via the `Authorization: Bearer` header in your MCP client config). The `attribution` field is **optional and never gating** — we use it for product telemetry so we know which agent runtimes adopt Whisper. Set it if you want us to prioritize improvements that help your specific runtime.

The verification code expires in 15 minutes; you have 5 attempts. Lose either and re-call `/api/signup` for a fresh code.

Developer landing page with Python and Node examples: https://www.whisper.security/docs/ai/agent-signup

## Company Facts

- Founded: January 2025
- Headquarters: Europe (Netherlands)
- Funding: EUR 1.6M pre-seed
- Emerged from Antler's fall 2024 program, top 0.41% of 8,000+ startups
- Investors: Antler, Atlas SGR, Volve Capital, D11Z, Tioga Trust
- CEO: Kaveh Ranjbar (former RIPE NCC CIO and K-root DNS architect)

## What Whisper Does

Whisper builds the infrastructure intelligence layer for the internet. The platform monitors and analyzes internet infrastructure in real time, connecting data across routing (BGP), DNS, hosting providers, WHOIS/ownership, DNSSEC, certificate transparency, and 134 threat-intelligence feeds. This unified view enables security and risk teams to detect, investigate, and respond to threats faster than traditional approaches.

### Three Ways to Access

1. **Platform Connectors**: Native integrations for Splunk (shipped, on Splunkbase), OpenCTI (shipped, https://hub.filigran.io/en/cybersecurity-solutions/opencti-integrations/whisper), Microsoft Sentinel (shipped, https://marketplace.microsoft.com/en-us/product/whisper-security.azure-sentinel-solution-whisper), Wazuh (shipped, installed from the GitHub releases at https://github.com/whisper-sec/whisper-wazuh — not yet in the Wazuh catalogue), and MISP (shipped, an expansion and hover module distributed inside misp-modules, https://misp.github.io/misp-modules/expansion/#whisper).
2. **Direct API**: Full Cypher query access via REST at https://graph.whisper.security/api/query — parameterized queries, schema introspection, built-in procedures (`CALL explain()`, `CALL whisper.history()`, `CALL whisper.quota()`).
3. **AI Context via MCP**: Model Context Protocol server at https://mcp.whisper.security for AI assistants — 7 tools, 4 resources, 10 prompts. Every tool is read-only (`query`, `explain_indicator`, `explain_schema`, `read_docs`, `list_workflows`, `run_workflow`, `identify`): nothing on this server writes to the graph, and the `mcp:read` OAuth scope grants the whole surface. Every deployment advertises the same seven. Works with Claude (Desktop, Code), OpenAI/ChatGPT, Cursor, VS Code, Continue, Windsurf, Antigravity, and any MCP-compatible agent.

## Getting access

Start free at https://console.whisper.security/sign-up — Console, API and MCP access, no credit card. Anonymous access, with no sign-up at all, is also available.

Teams needing historical context, SIEM and SOAR integrations, higher throughput, a dedicated cloud or a white-label deployment should talk to us at https://www.whisper.security/contact-us.

## Whisper Knowledge Graph

The core of Whisper is a knowledge graph that maps the global internet into a single queryable graph: 7.5B nodes and 39.6B edges across 41 entity types and 52 edge types, covering 116K ASNs, 2.5M prefixes, 54.2K cities across 424 countries, and 15.2K sampled web hyperlinks. Every entity on the internet becomes a node, every observed relationship becomes an edge. Threat intelligence: 134 live feeds across 32 categories; 10.7M LISTED_IN threat edges.

The graph is queried using Cypher via REST at https://graph.whisper.security/api/query (POST with JSON body containing `query` and optional `parameters`). Authentication via X-API-Key header, Bearer token, or query parameter. Anonymous access needs no sign-up; a key identifies your traffic and is required by the calls that say so on their own pages.

### Node Types
- DNS & Web: HOSTNAME, TLD, TLD_OPERATOR
- IP & Routing: IPV4, IPV6, PREFIX, ASN, ASN_NAME, RIR
- Registration: REGISTRAR, ORGANIZATION, EMAIL, PHONE
- Geography: COUNTRY, CITY
- Threat Intel: FEED_SOURCE, CATEGORY
- BGP (live): REGISTERED_PREFIX, ANNOUNCED_PREFIX

### Key Relationships
- DNS: RESOLVES_TO, CHILD_OF, NAMESERVER_FOR, MAIL_FOR, ALIAS_OF
- SPF: SPF_INCLUDE, SPF_IP, SPF_A, SPF_MX, SPF_EXISTS, SPF_REDIRECT
- Routing: BELONGS_TO, ANNOUNCED_BY, ROUTES, BGP_NEIGHBOR
- Registration: HAS_REGISTRAR, REGISTERED_BY, HAS_EMAIL, HAS_PHONE
- Web: LINKS_TO
- Threat Intel: LISTED_IN
- Geography: LOCATED_IN, HAS_COUNTRY

### Threat Intelligence
Nodes are enriched with `threatScore`, `threatLevel`, and flags: `isC2`, `isTor`, `isMalware`, `isPhishing`. The `CALL explain()` procedure gives full threat and reputation assessment for any IP, domain, ASN, or CIDR prefix. ASN nodes carry aggregate threat statistics across all routed prefixes. 134 live threat-intelligence feeds across 32 categories; 10.7M LISTED_IN threat edges in the graph.

### Historical Data
The `CALL whisper.history()` procedure returns WHOIS and BGP routing history — registrar changes, nameserver changes, BGP origin changes, prefix announcements, and withdrawals over time.

## Key Capabilities

- Real-time infrastructure monitoring across BGP, DNS, hosting, WHOIS, DNSSEC, and certificate transparency
- Purpose-built graph engine with 7.5B nodes and 39.6B edges across 41 entity types, queryable via Cypher
- Single-digit-millisecond server-side latency for anchored queries
- Evidence-first threat verdicts — score, factors, and source feeds for every indicator
- Infrastructure change detection and alerting
- Attack surface discovery and monitoring
- Supply chain risk assessment
- Incident investigation and forensics
- Brand and domain protection
- BGP hijack detection (multi-origin prefix analysis)
- Email security posture auditing (MX, SPF chain analysis)
- Takedown support (registrar, hosting provider, upstream network identification)
- Historical "Time Machine" for WHOIS and BGP routing changes over time
- AI-native MCP server for direct AI-agent access


## Use Cases

12 validated, runnable WhisperGraph workflows — each a multi-tool security investigation collapsed into one guided run. 9 are marked "Only in Whisper" (a cross-layer join no single incumbent tool does in one step); the rest are "Faster in Whisper". Browse by compass domain at https://www.whisper.security/use-cases.

- Anycast DNS-Root Sovereignty (Only in Whisper): Could a country still resolve names if it were isolated? This assesses a nation's DNS-root resilience — how many of the core root servers have a copy inside its borders, and who operates them — the sovereignty read for national-resilience and policy analysis.: https://www.whisper.security/use-cases/infrastructure-supply-chain/anycast-dns-root-sovereignty
- Attack-Surface Mapper (Faster in Whisper): See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside.: https://www.whisper.security/use-cases/attack-surface-recon/attack-surface
- BGP Hijack & Routing-Hygiene Audit (Only in Whisper): Routing security you can act on. This grades a network on the conflicts and gaps that make route hijacking possible, then traces any conflict to the specific domains and organisations exposed on the affected blocks. An adversarial audit — not just a profile — for finding where a hijack could hurt and who it would hit.: https://www.whisper.security/use-cases/network-routing/bgp-hijack-exposure
- Takedown Evidence Package (Faster in Whisper): When you've found a malicious domain, the next hurdle is proving it. This assembles a one-pass takedown package — the reputation verdict, who owns it, the abuse lists naming it, and the infrastructure around it — laid out ready to hand to a registrar or hosting provider so the takedown actually sticks.: https://www.whisper.security/use-cases/brand-protection/build-takedown-evidence-package
- Threat Investigation (Faster in Whisper): The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint — the related domains, the real servers behind any CDN, the neighbouring infrastructure — and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check says 'look closer.': https://www.whisper.security/use-cases/threat-investigation/indicator
- Indicator Enrichment (Only in Whisper): Everything worth knowing about one indicator, on a single card. Give it a domain or an address and it fills in the picture: who registered it, where it's hosted and in which country, its mail and name servers, the network behind it, and a reputation read. The fast way to go from a bare indicator to real context before you decide what to do with it.: https://www.whisper.security/use-cases/dns-email-security/indicator-enrichment
- Digital Infrastructure Mapping (Only in Whisper): Map the digital estate an indicator belongs to. Starting from any domain, IP, ASN or prefix, this works out the true owner — even behind privacy WHOIS and CDNs — via the atlas operator, the canonical registrant organization and the registrant email, then enumerates everything that owner owns: the subdomain namespace, the rest of its domain estate, the networks and prefixes that host it, and the facilities it physically sits at. Assets run by someone else (CDN, managed DNS, cloud) are marked as the vendor border, not owned.: https://www.whisper.security/use-cases/infrastructure-supply-chain/infrastructure-mapping
- Nameserver & DNS Delegation Audit (Only in Whisper): Your name servers decide where your domain points — and a broken or inconsistent setup is a hijacking opportunity. This audits a domain's delegation, flags stale or mismatched name servers, sizes how much each provider actually handles, and surfaces registry facts — so you can catch delegation weakness before it's exploited.: https://www.whisper.security/use-cases/dns-email-security/nameserver-hijack-dns-consistency
- Network & Routing Report (Only in Whisper): The full picture of how a network is put together and reaches the internet. Give it a network or address block and get a health card: what it announces, who it peers and buys transit from, whether it leans dangerously on a single upstream, and how well its routes are protected. The one-look report for network engineers assessing reach and resilience.: https://www.whisper.security/use-cases/network-routing/route-health
- Subdomain Takeover Detection (Only in Whisper): A dangling subdomain — one still pointing at a service you've since torn down — is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.: https://www.whisper.security/use-cases/attack-surface-recon/subdomain-takeover
- Typosquat & Brand-Impersonation Scanner (Only in Whisper): Someone registering a look-alike of your domain usually isn't doing it for fun. This finds the registered impersonations of a brand — across misspellings and risky extensions — checks whether each is yours or a stranger's, and flags the ones that are freshly registered, hidden behind privacy, or already flagged for abuse. The brand-protection sweep that turns look-alikes into a prioritised list.: https://www.whisper.security/use-cases/brand-protection/typosquat
- Supply-Chain Dependency Mapping (Only in Whisper): Maps every external provider a domain depends on — nameservers, mail exchangers, third-party email senders (SPF), CDN and hosting networks, registrar and DKIM vendors — by reading each layer of the graph and keeping only providers whose registrable apex differs from the target’s own. Each dependency is grouped by function and the flow flags single-vendor concentration: one DNS operator, one mail provider or one hosting network is a single point of failure whose outage takes the whole function down. The mirror of Digital Infrastructure Mapping: that flow maps what an entity owns, this maps what it depends on.: https://www.whisper.security/use-cases/infrastructure-supply-chain/supply-chain

## Compare

How Whisper positions against alternative tools — a full capability matrix across the field (passive DNS, EASM, threat-intel and BGP/routing), passive vs. active posture, and the layers only Whisper models:

- Compare Hub: https://www.whisper.security/compare

## Differentiators

- Only platform that unifies BGP, DNS, hosting, and ownership data in a single graph
- Purpose-built graph engine (not a general-purpose graph database) — custom-engineered for internet-scale infrastructure
- Real-time monitoring (not periodic snapshots)
- Single-digit-millisecond server-side latency at 7.5B nodes and 39.6B edges
- Internet-native data types: IPv4, IPv6, CIDR, ASN as first-class types
- Cypher query API for programmatic graph queries
- AI-native: MCP server built in from day one for AI assistant integration
- Built by internet infrastructure veterans including former RIPE NCC CIO and K-root DNS architect

## Documentation

Technical documentation for the Whisper platform. Every URL below is the **markdown sibling** — drop the trailing `.md` to view the rendered HTML page.

- Recipes: WhisperGraph recipes: copy-paste Cypher for the query patterns behind Whisper's guided workflows, organized by job — SOC triage, threat intel, recon, brand protection, BGP, DNS, compliance, and OSINT.: https://www.whisper.security/docs/recipes.md
- CLI: Query WhisperGraph from the command line with the whisper CLI: raw Cypher, named recipes, a local MCP server for Claude Code and Cursor, and a graph explorer.: https://www.whisper.security/docs/cli.md
- Agents & MCP: Connect any MCP client to WhisperGraph: 7 tools, a provably read-only surface, a workflow gallery, and evidence-backed answers for AI agents.: https://www.whisper.security/docs/ai.md
- POST /api/query: POST /api/query reference for the Whisper API: headers, JSON request body, response envelope, parameter binding, batch statements, form-encoded bodies — with curl, Python, Node, Go, and Ruby.: https://www.whisper.security/docs/cypher-api/reference/query-post.md
- Indicator Triage (SOC): SOC triage recipes for WhisperGraph: reconciled verdicts, explain() evidence chains, feed categories, network attribution, co-hosting, TLS-fingerprint lookups, and batch IOC enrichment.: https://www.whisper.security/docs/recipes/soc.md
- HTTP API: Query WhisperGraph over REST: POST read-only Cypher to graph.whisper.security/api/query and read one JSON envelope of columns, rows, and statistics.: https://www.whisper.security/docs/cypher-api.md
- Reference: WhisperGraph reference: the changelog, and how to open a support ticket that gets answered on the first reply.: https://www.whisper.security/docs/reference.md
- Workflows: Run prepared WhisperGraph investigations in the browser: indicator triage, passive attack-surface recon, typosquat takedowns, BGP and RPKI hygiene, DNS and email posture, supply-chain concentration.: https://www.whisper.security/docs/workflows.md
- Entities: Reference for every WhisperGraph node label: DNS, addressing, routing, WHOIS, geo, threat, physical infrastructure — with counts and the queryable properties on each.: https://www.whisper.security/docs/whisper-graph/schema/entities.md
- Cypher: WhisperGraph's read-only Cypher dialect: supported clauses, subqueries and functions at a glance, five rules that keep queries fast, and the full language reference.: https://www.whisper.security/docs/cypher.md
- WhisperGraph: WhisperGraph pre-joins DNS, BGP/RPKI routing, WHOIS and RDAP ownership, GeoIP, email posture, threat intel, and the physical internet into one queryable graph.: https://www.whisper.security/docs/whisper-graph.md
- Integrations: Connect WhisperGraph to your stack: the Splunk add-on, the OpenCTI connector, the Microsoft Sentinel solution, the Wazuh connector, the MISP module, the REST Cypher API, and MCP for AI assistants.: https://www.whisper.security/docs/integrations.md
- Coverage — what we looked at: The WhisperGraph coverage contract: what known-clean, malicious-evidenced, ambiguous and no-data mean, which procedures return coverage, and why structural-only is not an assess value.: https://www.whisper.security/docs/whisper-graph/coverage.md
- Setup: Set up an MCP client to query WhisperGraph — connect on Claude from the Connectors Directory, config snippets for Claude Code, Cursor, VS Code, Windsurf and ChatGPT, OAuth and API-key auth, and the scope table.: https://www.whisper.security/docs/ai/mcp/setup.md
- Campaign Pivoting: Pivot one indicator into the whole campaign: co-tenancy, WHOIS registrant, nameserver, TLS fingerprint and CT pivots, infrastructure signals, and actor/ATT&CK lookups as copy-paste Cypher recipes.: https://www.whisper.security/docs/recipes/threat-intel.md
- Connection Types: Reference for every WhisperGraph edge type: DNS, BGP, WHOIS, geo, threat, email, and physical-infrastructure connections, with direction and traversal rules.: https://www.whisper.security/docs/whisper-graph/schema/connections.md
- Syntax & Clauses: MATCH, OPTIONAL MATCH, WHERE, RETURN, WITH, UNWIND, UNION, CALL procedures and subqueries, EXISTS and COUNT, comprehensions, parameters, batching, EXPLAIN and PROFILE, and path syntax — the Cypher WhisperGraph supports, each with an example.: https://www.whisper.security/docs/cypher/syntax.md
- GET /api/query: GET /api/query reference for the Whisper API: pass Cypher in the q URL parameter, set its optional fields, headers, response envelope, and when to use GET vs POST — with curl, Python, Node, Go, Ruby.: https://www.whisper.security/docs/cypher-api/reference/query-get.md
- Getting Started: Run your first WhisperGraph query without a key, then one request that crosses DNS, BGP routing, geo, and threat feeds.: https://www.whisper.security/docs/getting-started.md
- Query: whisper query runs read-only Cypher against WhisperGraph from the command line, with --param for safe parameters and --json for the columns, rows and statistics envelope.: https://www.whisper.security/docs/cli/query.md
- Graph Schema: Overview of the WhisperGraph schema: the layered structure of the graph, its entity relationships, and links to the full entity, connection-type, and pivoting references.: https://www.whisper.security/docs/whisper-graph/schema.md
- API Reference: HTTP reference index for the Whisper query API: POST /api/query, GET /api/query, and GET /api/query/stats, plus shared authentication, the response envelope, advisories, and errors.: https://www.whisper.security/docs/cypher-api/reference.md
- What Every Connector Guarantees: The contract every Whisper connector shares: guaranteed and conditional fields, what a detection must do when one is absent, the single threat-level enum, and the coverage watchdog that makes a silent table audible.: https://www.whisper.security/docs/integrations/contract.md
- Your first investigation: A worked WhisperGraph MCP investigation: explain_indicator, the coverage block, a Tor-exit pivot, and how to falsify a verdict against the enclosing network before you escalate.: https://www.whisper.security/docs/investigate.md
- Pivoting Examples: Cross-layer pivoting examples for WhisperGraph: domain to ASN, IP to country, ASN to facility and RDAP entity, submarine cable to landing, phishing-kit path to hosts, threat feeds to categories — each with runnable Cypher.: https://www.whisper.security/docs/whisper-graph/schema/pivoting.md
- GET /api/query/stats: GET /api/query/stats reference for the Whisper API: graph-wide node and edge counts, the threat-intel summary, and per-layer freshness and coverage in one call that needs no key — with curl, Python, Node, Go, Ruby.: https://www.whisper.security/docs/cypher-api/reference/stats.md
- Recipes from the terminal: whisper graph runs WhisperGraph's named recipes from the command line: vendor identity, threat posture, typosquats, attack surface and BGP exposure, each with its own --help.: https://www.whisper.security/docs/cli/recipes.md
- Threat Feeds & Categories: WhisperGraph's threat-intel feeds and categories: how listings become LISTED_IN edges and node verdicts, refresh cadence, and example queries.: https://www.whisper.security/docs/whisper-graph/threat-feeds.md
- Functions: Aggregation, string, numeric, collection, node/relationship, type-conversion, date, and geospatial functions in WhisperGraph Cypher, each with a call and its result, plus the ones introspection leaves out.: https://www.whisper.security/docs/cypher/functions.md
- Procedures: Overview of WhisperGraph stored procedures: explain(), whisper.assess(), whisper.identify(), whisper.history(), whisper.origins(), the CVE plane, helpers and schema introspection, with exact YIELD columns and how CALL works.: https://www.whisper.security/docs/whisper-graph/procedures.md
- Workflow gallery: Whisper MCP workflow gallery: the list_workflows and run_workflow contracts, the 12 business-oriented workflows, how to read a partial result, and a worked typosquat-sweep example.: https://www.whisper.security/docs/ai/mcp/workflow-gallery.md
- Local MCP server: whisper mcp runs a local stdio MCP server for WhisperGraph. One command writes the config for Claude Code and Cursor; the graph tools match the hosted connector and every catalog recipe becomes a tool.: https://www.whisper.security/docs/cli/mcp.md
- External Recon: Passive external recon on WhisperGraph: subdomain enumeration, Certificate Transparency discovery, IP-footprint enrichment, owner attribution with confidence, CDN de-cloaking, and TLS-fingerprint pivots.: https://www.whisper.security/docs/recipes/pentest-recon.md
- Best Practices: Anchor, bound, and traverse WhisperGraph Cypher for speed — the performance habits, the do-this-not-that table, edge directions, and the graph's working rules as instructions.: https://www.whisper.security/docs/cypher/best-practices.md
- Your First Connector: Install a Whisper connector into Splunk, Microsoft Sentinel, OpenCTI, Wazuh or MISP and get to one enriched record on screen — including what does and does not work on a default install.: https://www.whisper.security/docs/integrations/first-connector.md
- Reference: WhisperGraph MCP server reference: the seven read-only tools with per-tool arguments, batch shapes and return fields, the 4 resources, the 10 prompts, and the evidence and coverage model.: https://www.whisper.security/docs/ai/mcp/reference.md
- Changelog: WhisperGraph documentation and product changelog — track API additions, schema changes, Splunk add-on releases, and breaking changes over time.: https://www.whisper.security/docs/reference/changelog.md
- Lookalike Hunting: Cypher recipes for brand protection: generate registered typosquats, resolve and score them in one pass, expand phishing clusters, and rank and expand phishing-kit fingerprints in WhisperGraph.: https://www.whisper.security/docs/recipes/brand-protection.md
- Cheat Sheet: One-page Cypher cheat sheet for WhisperGraph: labels, edge directions, traversal chains, procedure one-liners with exact YIELD columns, and query rules.: https://www.whisper.security/docs/cypher/cheat-sheet.md
- explain() — Threat Verdicts: CALL explain() in WhisperGraph: scored threat verdicts for IPs, hostnames, ASNs, CIDRs, hashes and CVEs, with factors, feed evidence, verdict levels, the bundle form for automation, and batch patterns.: https://www.whisper.security/docs/whisper-graph/procedures/explain.md
- Agent Skills: WhisperGraph Agent Skills — open-source, MIT-licensed investigation playbooks for the Whisper MCP connector. Install as a Claude Code plugin or in any Agent Skills client.: https://www.whisper.security/docs/ai/mcp/skills.md
- whisper.assessUrl() — URL verdicts: whisper.assessUrl returns apex_band, path_band and a reconciled band for a URL, catching the malicious-path-on-a-clean-apex shape that host-only lookups miss.: https://www.whisper.security/docs/whisper-graph/procedures/assess-url.md
- BGP & RPKI: Cypher recipes for BGP and RPKI on WhisperGraph: MOAS detection, ROA checks, hijack and route-leak posture, AS paths, cloud regions, SaaS egress ranges and physical footprint.: https://www.whisper.security/docs/recipes/bgp-routing.md
- Support: WhisperGraph support: how to open a ticket with the right context, the ticket template, and where to look in the docs.: https://www.whisper.security/docs/reference/support.md
- Query language: WhisperGraph MCP query reference: the typed error envelope and its eleven errorCode values, the ten query-safety rules, self-correcting queries, callable procedures, and the traversal landmines.: https://www.whisper.security/docs/ai/mcp/query.md
- Posture Audits: Audit SPF chains, DKIM signers, DMARC reporting, MX and nameserver posture across a domain portfolio with copy-paste Cypher recipes on WhisperGraph.: https://www.whisper.security/docs/recipes/dns-email.md
- whisper.variants() — Lookalike Generation: whisper.variants() generates typosquat and homoglyph lookalikes of a domain and returns the registered ones. Strategies, exists semantics, the function form, examples.: https://www.whisper.security/docs/whisper-graph/procedures/variants.md
- whisper.history() — Point-in-Time: whisper.history() returns timestamped WHOIS registration and BGP routing snapshots for a domain, IP, ASN, or prefix — the time axis of the graph.: https://www.whisper.security/docs/whisper-graph/procedures/history.md
- Programmatic Signup (for Agents): Sign up to Whisper programmatically in two HTTP calls — built for AI agents and automated runtimes. Email verification only, no browser and no human in the loop.: https://www.whisper.security/docs/ai/agent-signup.md
- Third-Party & Portfolio Posture: Cypher recipes for third-party risk and audit evidence: hosting attribution, jurisdiction and residency, sanctions screening, RPKI checks, datacenter and cable concentration, CDN overlap, and CVE exposure.: https://www.whisper.security/docs/recipes/third-party-posture.md
- Connector changelog: Changelog for the Whisper MCP connector: tool, resource, prompt and response-field changes with dates, plus the live endpoints that answer what the surface looks like right now.: https://www.whisper.security/docs/ai/mcp/changelog.md
- Deprecation policy: Whisper MCP deprecation policy: what counts as a breaking change to the connector, the notice given before a tool or field is removed, where changes are announced, and how to build an agent that survives one.: https://www.whisper.security/docs/ai/mcp/deprecation.md
- whisper.origins() — Origin Discovery: whisper.origins() finds the real origin IPs behind a CDN or proxy from MX, SPF, sibling and web-link signals, ranked by confidence — passive, no packets sent.: https://www.whisper.security/docs/whisper-graph/procedures/origins.md
- whisper.identify() — Identity & Assessment: whisper.identify(), whisper.assess(), and whisper.walk() in WhisperGraph: resolve whose infrastructure a host is, whether it is dangerous, and its structural neighborhood.: https://www.whisper.security/docs/whisper-graph/procedures/identify.md
- Attribution & Law Enforcement: Pivot from indicators to operators with WHOIS, registrar chains, hosting, dated history, Tor-relay identity and dark-web domain lookups. Copy-paste Cypher for defensible attribution packets.: https://www.whisper.security/docs/recipes/law-enforcement.md
- Errors: WhisperGraph API errors: the RFC 7807 problem+json body, every type slug the engine returns and what to do about each, the suggestions array, what an unrecognised key really does, and how to report a problem.: https://www.whisper.security/docs/cypher-api/errors.md
- Helpers — Naming & Lookups: WhisperGraph helper procedures: whisper.psl.*, whisper.topAsnsByPrefixCount, whisper.asnCountries, whisper.lookupTorRelay, whisper.lookupTlsFingerprint, whisper.search, whisper.resolve, whisper.cve.byPackage, whisper.vulnPosture, whisper.export, whisper.version.: https://www.whisper.security/docs/whisper-graph/procedures/helpers.md
- Internet Measurement: Bulk infrastructure surveys, topology measurement, RPKI coverage, root-server and TLD ecosystems, and reproducible cross-layer research queries on WhisperGraph for academics and research teams.: https://www.whisper.security/docs/recipes/research.md
- Cross-Layer Patterns: Cross-layer WhisperGraph patterns: sourced verdicts, blast radius, WHOIS and BGP history, physical footprint, batch enrichment for whole watchlists, and stable columns for automation. Copy-paste read-only Cypher.: https://www.whisper.security/docs/recipes/cross-cutting.md
- Attack Paths: How WhisperGraph models an external attack path: the edges that compose one, the shared-infrastructure choke point, blast radius in both directions, and what a traversal cannot prove.: https://www.whisper.security/docs/whisper-graph/attack-paths.md
- Exporting at volume: How to use whisper.export: the one-map contract, the three labels, cursor pagination with limit and next_cursor, the truncated flag, and when to write a Cypher query instead.: https://www.whisper.security/docs/guides/bulk-export.md
- Splunk Integration: Whisper Security Add-on for Splunk — IOC enrichment, ad-hoc graph queries, threat intelligence, and attack-surface monitoring across your Splunk indexes.: https://www.whisper.security/docs/integrations/splunk/overview.md
- Install & Configure: Install the Whisper Security Add-on for Splunk: requirements, Splunkbase install, creating the whisper index, and configuring the account, proxy and logging.: https://www.whisper.security/docs/integrations/splunk/install.md
- Standing watches: Create, list and cancel WhisperGraph watches with whisper.watch: the one-map contract, the three actions, the three kinds and their keys, what a watch cannot see, and how to remove one.: https://www.whisper.security/docs/guides/watches-and-alerting.md
- Deployment Architecture: Enterprise deployment patterns for the Whisper Splunk add-on: SHC, deployment server, indexer cluster, Splunk Cloud Victoria/Classic.: https://www.whisper.security/docs/integrations/splunk/deployment-architecture.md
- Using It: Whisper Splunk add-on in use — whisperlookup, whisperquery, whisperschema, whisperflush and whisperevict, the enrichment field contract, and the three scheduled modular inputs.: https://www.whisper.security/docs/integrations/splunk/using-it.md
- Splunk Dashboards Reference: Whisper Splunk dashboards — investigation, attack surface, compliance, and add-on health — with field reference and links to underlying saved searches.: https://www.whisper.security/docs/integrations/splunk/dashboards.md
- Reference: Whisper Splunk add-on reference: shipped sourcetypes, CIM field aliases, CSV lookups, KV Store collections, macros and saved searches, each with a status.: https://www.whisper.security/docs/integrations/splunk/reference.md
- Enterprise Security Integration: Whisper Splunk + Splunk ES: threat-intel KV Store collections, adaptive response actions, CIM aliases, graph macros, and worked detection examples.: https://www.whisper.security/docs/integrations/splunk/es-integration.md
- Troubleshooting: Troubleshoot the Whisper Splunk add-on: common errors, diagnostic commands, log locations, file precedence rules, and where to escalate for support.: https://www.whisper.security/docs/integrations/splunk/troubleshooting.md
- Changelog: Release history for the Whisper Security Add-on for Splunk (TA-whisper-graph): the published 1.0.0 release, every pre-release tag, and where the package changelog and the release list disagree.: https://www.whisper.security/docs/integrations/splunk/changelog.md
- OpenCTI Integration: Whisper connector for OpenCTI — enrich IPs, domains, and AS numbers with DNS, WHOIS, BGP, and threat intelligence as STIX 2.1 objects inside OpenCTI.: https://www.whisper.security/docs/integrations/opencti/overview.md
- Requirements: OpenCTI, Docker, a Whisper API key, and HTTPS access to graph.whisper.security — the prerequisites for the Whisper OpenCTI connector, with the platform version it was verified against.: https://www.whisper.security/docs/integrations/opencti/requirements.md
- Installation: Install the Whisper connector for OpenCTI: pull opencti/connector-whisper from Docker Hub, add one compose service, and verify registration in the OpenCTI UI.: https://www.whisper.security/docs/integrations/opencti/installation.md
- Configuration: Configure the Whisper OpenCTI connector: environment variables, connector scope, auto-enrichment, the TLP ceiling, and retry behavior.: https://www.whisper.security/docs/integrations/opencti/configuration.md
- Enriching Observables: Enriching observables with the Whisper OpenCTI connector: what comes back for IPs, domains, and AS numbers, and how to read the threat-evidence notes.: https://www.whisper.security/docs/integrations/opencti/enrichment.md
- Data Mapping: Whisper OpenCTI data-mapping reference: how WhisperGraph nodes and edges become STIX 2.1 objects, with deterministic IDs, bundle authorship, and current limitations.: https://www.whisper.security/docs/integrations/opencti/data-mapping.md
- Troubleshooting: Troubleshoot the Whisper OpenCTI connector: registration failures, empty enrichments, authentication errors, transport failures, and how to escalate.: https://www.whisper.security/docs/integrations/opencti/troubleshooting.md
- Microsoft Sentinel Integration: Whisper Security solution for Microsoft Sentinel — enrich incidents with threat scores, infrastructure context, WHOIS/BGP history, and ASN reputation, from the Content Hub.: https://www.whisper.security/docs/integrations/sentinel/overview.md
- Requirements: Prerequisites for the Whisper Security solution for Microsoft Sentinel: resource-group roles, a Sentinel workspace, an RBAC-mode Key Vault, and a Whisper API key.: https://www.whisper.security/docs/integrations/sentinel/requirements.md
- Installation: Install the Whisper Security solution for Microsoft Sentinel: the Key Vault secret, the Content Hub install wizard, verification, and the first-data timeline.: https://www.whisper.security/docs/integrations/sentinel/installation.md
- Configuration: Configure the Whisper solution for Microsoft Sentinel: grant playbook permissions, wire automation rules, enable analytics rules, and set the watchlists.: https://www.whisper.security/docs/integrations/sentinel/configuration.md
- Playbooks: Whisper playbooks for Microsoft Sentinel: explain IPs, domains, and ASNs, WHOIS/BGP history, co-hosted discovery, batch enrichment, and automation pairings.: https://www.whisper.security/docs/integrations/sentinel/playbooks.md
- Workbooks & Detections: Whisper workbooks, analytics rules, and hunting queries for Microsoft Sentinel: attack surface, threat landscape, ASN reputation, and infrastructure hunts.: https://www.whisper.security/docs/integrations/sentinel/workbooks-detections.md
- Data Reference: Data reference for the Whisper Sentinel solution: column contracts for the WhisperThreatIntel, WhisperInfraContext, WhisperHistory, and WhisperASNReputation tables, and the pipelines that write them.: https://www.whisper.security/docs/integrations/sentinel/data-reference.md
- Troubleshooting: Troubleshoot the Whisper solution for Microsoft Sentinel: AuthorizationFailed deploys, Key Vault 403s, API error codes, empty tables, and empty workbook panels.: https://www.whisper.security/docs/integrations/sentinel/troubleshooting.md
- Release History: Release history for the Whisper Security solution for Microsoft Sentinel: what each version shipped, sourced from the solution's own release notes.: https://www.whisper.security/docs/integrations/sentinel/changelog.md
- Wazuh integration — overview: The Whisper connector for Wazuh: keyless per-alert enrichment, the optional keyed modes, supported indicator types, and what Whisper never receives.: https://www.whisper.security/docs/integrations/wazuh/overview.md
- Install the Wazuh integration: Install the Whisper connector on a Wazuh 4.x manager: bootstrap, tarball, OS package, or the official Wazuh integrations repo, then verify enrichment.: https://www.whisper.security/docs/integrations/wazuh/installation.md
- Configure the Wazuh integration: Configure the Whisper Wazuh connector: trigger groups and rule IDs, the enrichment envelope under data.whisper, how the verdict is derived, and troubleshooting.: https://www.whisper.security/docs/integrations/wazuh/configuration.md
- MISP integration — overview: The Whisper expansion module for MISP: supported attribute types, what lands on the event, the keyed settings, and where the module is distributed from.: https://www.whisper.security/docs/integrations/misp/overview.md
- Install and configure the MISP module: Install the Whisper module for MISP: upgrade misp-modules, enable the module and its settings, and verify an enrichment request reaches the Whisper graph API.: https://www.whisper.security/docs/integrations/misp/installation.md

## Glossary

Plain-language definitions of cybersecurity and internet-infrastructure terms used in real investigations. Every URL below is the **markdown sibling** — drop the trailing `.md` to view the rendered glossary entry.

- ASN Footprint: https://www.whisper.security/glossary/asn-footprint.md
- ASN Reputation: https://www.whisper.security/glossary/asn-reputation.md
- Attack Path Analysis: https://www.whisper.security/glossary/attack-path-analysis.md
- Attack Surface: https://www.whisper.security/glossary/attack-surface.md
- Attack Surface Management: https://www.whisper.security/glossary/attack-surface-management.md
- Autonomous System (ASN): https://www.whisper.security/glossary/autonomous-system.md
- BGP Hijacking: https://www.whisper.security/glossary/bgp-hijacking.md
- BGP Routing: https://www.whisper.security/glossary/bgp-routing.md
- Blast Radius: https://www.whisper.security/glossary/blast-radius.md
- Bulletproof Hosting: https://www.whisper.security/glossary/bulletproof-hosting.md
- C2 (Command and Control) Infrastructure: https://www.whisper.security/glossary/c2-infrastructure.md
- Certificate Transparency: https://www.whisper.security/glossary/certificate-transparency.md
- Choke Point Analysis: https://www.whisper.security/glossary/choke-point-analysis.md
- Co-hosted Domains: https://www.whisper.security/glossary/co-hosted-domains.md
- Concentration Risk: https://www.whisper.security/glossary/concentration-risk.md
- Coverage-Qualified Assessment: https://www.whisper.security/glossary/coverage-qualified-assessment.md
- Cypher (Query Language): https://www.whisper.security/glossary/cypher.md
- DMARC: https://www.whisper.security/glossary/dmarc.md
- DNS: https://www.whisper.security/glossary/dns.md
- DNSSEC: https://www.whisper.security/glossary/dnssec.md
- Domain Generation Algorithm (DGA): https://www.whisper.security/glossary/domain-generation-algorithm.md
- Fast Flux DNS: https://www.whisper.security/glossary/fast-flux-dns.md
- Forward Threat Intelligence: https://www.whisper.security/glossary/forward-threat-intelligence.md
- Indicator of Compromise (IOC): https://www.whisper.security/glossary/indicator-of-compromise.md
- Infrastructure Intelligence: https://www.whisper.security/glossary/infrastructure-intelligence.md
- Infrastructure Pivoting: https://www.whisper.security/glossary/infrastructure-pivoting.md
- Internet Exchange Point (IXP): https://www.whisper.security/glossary/internet-exchange-point.md
- Knowledge Graph: https://www.whisper.security/glossary/knowledge-graph.md
- MITRE ATT&CK: https://www.whisper.security/glossary/mitre-attack.md
- MOAS Conflict: https://www.whisper.security/glossary/moas-conflict.md
- Model Context Protocol (MCP): https://www.whisper.security/glossary/mcp.md
- Origin-IP Discovery: https://www.whisper.security/glossary/origin-ip-discovery.md
- Passive DNS (pDNS): https://www.whisper.security/glossary/passive-dns.md
- Prompt Injection: https://www.whisper.security/glossary/prompt-injection.md
- RDAP (Registration Data Access Protocol): https://www.whisper.security/glossary/rdap.md
- RPKI / Route Origin Authorization (ROA): https://www.whisper.security/glossary/rpki-roa.md
- Reconciled Verdict: https://www.whisper.security/glossary/reconciled-verdict.md
- Reverse DNS / PTR: https://www.whisper.security/glossary/reverse-dns.md
- Route Origin Validation: https://www.whisper.security/glossary/route-origin-validation.md
- SPF: https://www.whisper.security/glossary/spf.md
- Subdomain Enumeration: https://www.whisper.security/glossary/subdomain-enumeration.md
- Submarine Cable: https://www.whisper.security/glossary/submarine-cable.md
- Supply-Chain Risk: https://www.whisper.security/glossary/supply-chain-risk.md
- TLS Fingerprint (JA3 / JARM): https://www.whisper.security/glossary/tls-fingerprint.md
- TTPs (Tactics, Techniques, and Procedures): https://www.whisper.security/glossary/ttp.md
- Threat Hunting: https://www.whisper.security/glossary/threat-hunting.md
- Threat Intelligence: https://www.whisper.security/glossary/threat-intelligence.md
- Tor Exit Node: https://www.whisper.security/glossary/tor-exit-node.md
- Typosquatting: https://www.whisper.security/glossary/typosquatting.md
- WHOIS: https://www.whisper.security/glossary/whois.md

## Blog

Articles and analysis from the Whisper team. Every URL below is the **markdown sibling** — drop the trailing `.md` to view the rendered post.

- Prince of Persia: mapping the backend, and a reserve of domains staged for what comes next: Whisper maps Prince of Persia’s infrastructure, uncovering a new server, 58 dormant domains, and DNS signals that may reveal future C2 activity before activation.: https://www.whisper.security/resources/blog/prince-of-persia-mapping-the-backend-and-a-reserve-of-domains-staged-for-what-comes-next.md
- The infrastructure you depend on but don't own: The May 2026 .de DNSSEC outage exposed a hidden risk: your services can depend on infrastructure you don't own. See how those dependencies create real blast radius.: https://www.whisper.security/resources/blog/the-infrastructure-you-depend-on-but-dont-own.md
- What an ASN actually is: Learn what an Autonomous System Number (ASN) is, how internet routing works, and why ASN analysis is the starting point for infrastructure investigations and threat intelligence: https://www.whisper.security/resources/blog/what-an-asn-actually-is.md
- Whisper welcomes Jonathan Cave: We’re proud to officially welcome Jonathan Cave to the Whisper Advisory Board.: https://www.whisper.security/resources/blog/whisper-welcomes-jonathan-cave.md
- Whisper welcomes Jeff Osborn: We’re excited to announce that Jeff Osborn, is joining Whisper’s Advisory Board.: https://www.whisper.security/resources/blog/whisper-welcomes-jeff-osborn.md
- Whisper welcomes Merike Kaeo: We’re proud to announce that Merike has joined the Whisper Advisory Board.: https://www.whisper.security/resources/blog/whisper-welcomes-merike-kaeo.md
- Whisper Welcomes Geoff Huston: Geoff Huston — Chief Scientist at APNIC and a foundational voice in BGP routing — has joined Whisper's Advisory Board. What his expertise brings to WhisperGraph.: https://www.whisper.security/resources/blog/whisper-welcomes-geoff-huston.md
- Whisper welcomes Maarten Botterman: whisper welcomes Maarten Botterman to the Whisper Advisory Board.: https://www.whisper.security/resources/blog/whisper-welcomes-maarten-botterman.md
- Every World Cup Threat Report Is a Starting Point: World Cup 2026 phishing campaigns are rapidly expanding. Learn how Whisper MCP transforms public threat reports into deeper infrastructure investigations using graph intelligence.: https://www.whisper.security/resources/blog/world-cup-phishing-infrastructure.md
- Your AI agent is only as smart as what it can see: AI agents in security lack context, not data. How MCP and graph-based infrastructure intelligence enable agents to reason over connected data.: https://www.whisper.security/resources/blog/your-ai-agent-is-only-as-smart-as-what-it-can-see.md
- Concentration risk: when half the internet depends on three companies: Most organizations overlook shared infrastructure dependencies across cloud, DNS, and ASNs. Learn how to identify and quantify concentration risk before.: https://www.whisper.security/resources/blog/blogcloud-concentration-risk-and-hidden-dependencies.md
- The Internet Has a Map. Most Defenders Can't Read It.: The internet’s infrastructure is public but fragmented. Learn how graph intelligence connects DNS, BGP, WHOIS, and certificates to reveal hidden threat.: https://www.whisper.security/resources/blog/mapping-internet-infrastructure-with-graph-intelligence.md
- Why blocklists are always one step behind: Blocklists react to attacks after they happen. Learn how infrastructure intelligence and graph analysis reveal phishing campaigns before new domains go.: https://www.whisper.security/resources/blog/why-blocklists-are-always-one-step-behind.md
- One Phishing Domain Is Never Just One: Detect phishing campaigns by mapping shared infrastructure, domain clusters, DNS patterns, and hosting relationships using graph intelligence: https://www.whisper.security/resources/blog/one-phishing-domain-is-never-just-one.md
- Your Vendors' Infrastructure Is Your Attack Surface Too: Your firewall isn't your perimeter — your vendors are. Learn how Whisper reveals hidden attack surface risks across third-party infrastructure. Try it.: https://www.whisper.security/resources/blog/vendor-infrastructure-is-your-attack-surface.md
- Attackers Change Their Domains. They Rarely Change Their Habits.: Attackers rotate domains daily but their infrastructure habits persist. Learn how infrastructure fingerprinting detects threats before they strike. Try.: https://www.whisper.security/resources/blog/attackers-change-domains-not-habits.md
- Rahul Saggar Joins Whisper as CRO: Whisper welcomes Rahul B Saggar as CRO, strengthening its founding team to scale commercial growth and accelerate its cybersecurity vision.: https://www.whisper.security/resources/blog/rahul-saggar-joins-whisper-as-cro.md
- Whisper is Coming to WebSummit 2025: Whisper will exhibit at WebSummit 2025 in Lisbon, showcasing its predictive cybersecurity platform and live 'God Mode' internet threat intelligence demos.: https://www.whisper.security/resources/blog/whisper-is-coming-to-websummit-2025.md
- Inside the D11Z Academy: Learning, Growing, and Building Together: Whisper attended D11Z Academy in Heilbronn, gaining practical insights, sharing experiences with fellow founders, and strengthening investor relationships.: https://www.whisper.security/resources/blog/inside-the-d11z-academy-learning-growing-and-building-together.md
- Whisper Welcomes Roman Viliavin!: Whisper welcomes Roman Viliavin as COO, strengthening its founding team with proven operational leadership to scale growth and cybersecurity innovation.: https://www.whisper.security/resources/blog/whisper-welcomes-roman-viliavin.md
- Meet the Minds Behind the Whisper's Mission: Whisper is a cybersecurity startup using deep internet and mathematical expertise to deliver infrastructure intelligence and help prevent cyber threats.: https://www.whisper.security/resources/blog/meet-the-minds-behind-the-whispers-mission.md
- Whisper Secures €1.6M in Pre-Seed Funding to Scale Its Internet-Infrastructure Graph: Whisper raised €1.6 million in pre-seed funding to expand its infrastructure-intelligence platform — a queryable graph of the internet that helps teams investigate and respond to cyber threats.: https://www.whisper.security/resources/blog/whisper-secures-eu1-6m-in-pre-seed-funding-to-revolutionize-predictive-cybersecurity.md
- Whisper Emerges from Stealth with a Queryable Map of Internet Infrastructure: Whisper, a Dutch cybersecurity startup, exits stealth with a threat-intelligence platform built on a queryable graph of internet infrastructure — helping teams investigate domains, IPs, and networks and respond faster.: https://www.whisper.security/resources/blog/whisper-emerges-from-stealth-with-god-mode-to-predict-and-combat-cybercrime.md
- Whisper at Slush'D Heilbronn: A Day of Innovation, Community, and European Optimism: Whisper attended Slush'D Heilbronn, connecting with investors and founders, and celebrating Europe's vibrant, optimistic startup ecosystem.: https://www.whisper.security/resources/blog/whisper-at-slushd-heilbronn-a-day-of-innovation-community-and-european-optimism.md

## Markdown Siblings

The links in **Documentation**, **Glossary**, **Blog**, and **FAQ** above already point to clean markdown versions of each page (the `.md` URL convention from llmstxt.org). The same convention works for any HTML URL on this site — append `.md`:

- https://www.whisper.security/docs.md (docs index, all pages flattened into one markdown file)
- https://www.whisper.security/docs/<path>.md (any individual doc page)
- https://www.whisper.security/glossary.md (glossary index)
- https://www.whisper.security/glossary/<uid>.md (any individual glossary entry)
- https://www.whisper.security/faq.md (full FAQ as markdown)
- https://www.whisper.security/resources/blog/<slug>.md (any blog post)

The HTML versions (without `.md`) are for human readers and are also indexed in https://www.whisper.security/sitemap.xml. The `.md` versions are intentionally not indexed but are stable and citation-safe.

## FAQ

- Frequently Asked Questions: https://www.whisper.security/faq.md

## Optional

Secondary content. Per the llms.txt spec, parsers may skip this section under context pressure.

- Privacy Policy: https://www.whisper.security/privacy-policy
- Terms & Conditions: https://www.whisper.security/terms-conditions

## Full Documentation

For comprehensive information, see: https://www.whisper.security/llms-full.txt