Plans for every team
From AI-driven exploration to full enterprise deployment, and from one endpoint to a whole fleet. Pick the product, then the plan.
Unlimited access for a limited time, then Free. No card needed.
Every account starts with unlimited access
- 01Sign upNo card needed
- 02Unlimited accessfor a limited time
- 03Free, foreveror talk to us about Business
Compare features
Every difference between plans, in one place.
Need something different?
Volume pricing, custom contracts, and procurement support available.
Reselling to your clients? See Whisper for MSSPs. Building the graph into your own product? See how embedding works.
Whisper Graph XDR
Identity, control and containment for every endpoint and every AI agent, powered by a 47.2B-datapoint map of the internet.
Every other EDR watches the host. We watch the internet it talks to, and cut it off from outside the box.
A verifiable address for every host and agent
A routable IPv6 /128 on our own network, checkable by anyone with dig -x. No key, no account.
Attacker infrastructure blocked at the connection
Bulletproof, sanctioned and brand-new domains never resolve. The packet never leaves the host.
A kill-switch that holds when the host is owned
Containment runs on our network, not the endpoint. Root on the box does not get it back.
Evidence an auditor can verify, not an attestation
Signed exports anchored in a public transparency ledger. Provably unedited, and it replaces a GRC line.
Four tiers, one product
Graph XDR has no self-serve checkout yet. Free starts with a sign-up; Team, Business and Enterprise start with a conversation.
Not a trial. Forever.
- 5 identities, 1 seat, 7-day retention
- Real sensor, real detections, ATT&CK
- Off-host kill-switch included
billed annually (€4.79 monthly)
The whole product, uncapped.
- Unlimited endpoints, agents and seats
- Full egress control, host response
- Full graph lens and SIEM connectors
billed annually (€7.19 monthly)
Team, plus provable compliance.
- Signed evidence, ledger-anchored
- Control views for SOC 2, ISO 27001, PCI, HIPAA, CMMC
- 90-day audit window and data residency
MSSP, OEM and on-premises.
- White-label multi-tenant portal
- On-premises and air-gapped
- 24/7 support with a named TAM
What counts as an identity
One /128 is one billable identity: a laptop, a server, a container or an AI agent, all at the same rate. Agents are not a separate SKU or price.
Ships today
Everything in the capability ladder that is not marked coming soon, on every tier that lists it. One tenant per account on Free, Team and Business.
Roadmap
- SSO / SAML with enforced four-role RBAC
- External alert routing
- Partner portal: multi-tenant, white-label
- More than one tenant (Enterprise, with the partner portal)
The capability ladder
No seat bands anywhere. Compliance is the entire difference between Team and Business. Everything else is the same product, uncapped.
Compare all featuresHide all features
✓ included · ✓ plus text = included, with extra in that tier · text alone = the limit in that tier · – not in that tier
Start free. Five identities, one seat, forever.
Real sensor, real detections and a working off-host kill-switch. No card, no expiry.