Whisper

What Whisper does

Whisper (Whisper Security), operated by the Dutch private limited company viaGraph B.V. and headquartered in Amsterdam, sells an Internet Infrastructure Intelligence Graph called WhisperGraph: a pre-joined graph database of approximately 7.42 billion nodes and 39.2 billion edges across 39 node labels and 44 materialized edge types. The graph fuses DNS, BGP, RPKI, WHOIS/RDAP, GeoIP, the web link graph, email infrastructure (MX, SPF, DMARC), DNSSEC, certificate transparency, TLS fingerprints, Tor-exit relays, and physical infrastructure (facilities, IXPs, submarine cables) with 43 reconciled threat-intel feeds across 25 categories. Customers query the graph in open Cypher, traverse it through AI agents via a native Model Context Protocol (MCP) server at mcp.whisper.security, or integrate it into Splunk, Microsoft Sentinel, OpenCTI, and Cortex XSOAR.

The platform's differentiated technical assets are the cross-layer pre-joins (so a single Cypher traversal crosses from a domain to its true datacenter and ASN), the Indenture host-identity contract (identify/assess/walk/origins) that separates ownership from verdict and treats 'no data' as unknown rather than benign, the sub-millisecond anchored lookup performance on a 7.4B-node graph, and a self-correcting query validator with seven safety rules. The company monetizes via tiered subscriptions (Anonymous, Free, Pro, Enterprise) distinguished by hop depth and rate limits, plus on-prem and cloud-hosted deployment with separate SLAs for paid plans, and runs a product-led go-to-market anchored on a keyless anonymous entry point and free API key tier with sales-led conversion to Enterprise via a 'Book a demo' HubSpot flow.

Whisper's primary buyer personas are SOC/DFIR analysts, threat-intel analysts, brand-protection teams, network/BGP operators, attack-surface/red teams, and infrastructure/compliance teams, with a secondary horizontal layer serving cyber-insurance, law enforcement, and security researchers. Its academic-affiliated research arm (Whisper Labs) holds a multi-year partnership with MIT CSAIL alongside collaborations with Stanford Security Lab and UC Berkeley, and publishes quarterly threat-landscape reports and the annual State of DNSSEC report. As of mid-2026 the company has no parent, no disclosed funding beyond ~$3.52M of seed-stage capital, and no published revenue.

Name

Whisper

Legal name

viaGraph B.V.

Website

https://whisper.security

Company type

Private

Founded year

2025

Operating status

Operating

Headcount range

11–50 employees

Short description

Whisper (viaGraph B.V.) sells WhisperGraph, a pre-joined live graph database of DNS, BGP, RPKI, WHOIS, threat-intel, and physical-infrastructure data queryable in Cypher or via an MCP server for AI agents, serving SOC, threat-intel, and network-security teams.

Ownership category

akta.pro rank

Product category

Cybersecurity Infrastructure Intelligence

NAICS

Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (5182)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro industry

PRIMARYHDAEANAD

LLMOps & Generative AI Platforms (Prompt/Agent Orchestration, RAG)

Hardware, Technology & Telecom/Enterprise Platforms & Databases/Artificial Intelligence Platforms for Enterprise

Keywords

• Infrastructure intelligence graph
• Threat intelligence platform
• Internet security analytics
• BGP DNS monitoring
• Cyber attack attribution

Headquarters

HQ city

Amsterdam

HQ country

Netherlands

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Infrastructure, Personnel, Operations, Marketing or Sales

Revenue model

1. Subscription tiers (Anonymous, Free, Pro, Enterprise): Recurring subscription plans tiered by query depth and rate limits. Anonymous: 2 hops, ~100 req/hr, keyless. Free: 3 hops, raised limits, all procedures. Pro/Professional: 5 hops, raised limits. Enterprise: unlimited depth and usage. MCP server 99.5% monthly availability target applies.
2. Usage-based API consumption and rate/quotas: Each account is subject to a published rate limit and query-cost budget that varies by plan tier. Customers on a paid plan may be entitled to a separate Service Level Agreement; over-usage is governed by the published quota system (whisper://quota resource).
3. Freemium entry tier (anonymous + free API key): Free, anonymous access to a 2-hop query subset, plus a free key tier with 3 hops. Designed for evaluation and lightweight use; not intended to support production workloads. Land-and-expand into paid plans as customers grow.
4. On-prem / cloud-hosted enterprise deployment: Enterprise deployment options include cloud-hosted and on-prem installations, with separate Service Level Agreements available for paid plans.

Pricing tiers

Go-to-market motion6 records

Distribution channels5 records

Marketing channels10 records

Core offering

Whisper sells WhisperGraph, a pre-joined, live Internet Infrastructure Intelligence Graph (~7.4B nodes, ~39.2B edges) that fuses DNS, BGP, RPKI, WHOIS, GeoIP, web, mail, threat intelligence, and physical-infrastructure layers into a single queryable graph. Customers access it through a web console, a Cypher Query REST API, and a native Model Context Protocol (MCP) server for AI agents. The platform is sold via freemium (Anonymous and Free tiers) and tiered subscriptions (Pro and Enterprise) to SOC/DFIR, threat-intelligence, brand-protection, network/BGP, attack-surface, compliance, and research personas, with native SIEM/SOAR and AI-client integrations extending it into existing security stacks.

Product overview

Whisper sells a single unified product, WhisperGraph — an Internet Infrastructure Intelligence Graph that fuses DNS, BGP, RPKI, WHOIS, and threat-indicator data and is exposed through two complementary interfaces: the WhisperGraph Console (a web UI for human analysts and key/query management) and the Cypher Query API at graph.whisper.security/api/query (a REST API for programmatic and agent access). The same graph is also served to AI agents through the Whisper MCP Server at mcp.whisper.security, which packages the platform's tools, prompts, and safety rules for Claude, Cursor, OpenAI, VS Code, Windsurf, and Antigravity. Forward-looking capabilities and long-form research (e.g., the 2025 State of DNSSEC Report, the Q4 2025 Threat Landscape Report, and the Context Graph module) are published under the Whisper Labs sub-brand.

Differentiator

Problem solved

Functional benefit

Brands

• Whisper Labs: Research and Innovation Hub for threat intelligence and cybersecurity, publishing research, industry reports, academic collaborations, and media content.
• WhisperGraph

Products and services

• WhisperGraph Pre-joined, live Internet Infrastructure Intelligence Graph (~7.4B nodes, ~39.2B edges) that fuses DNS, BGP, RPKI, WHOIS, GeoIP, web, mail, threat intel, and physical infrastructure layers. Sold to SOC/DFIR, CTI, AI-agent, brand-protection, network/BGP, and compliance teams via subscription tiers, with native MCP access for AI agents.
• WhisperGraph Console Web-based management plane for human analysts to obtain API keys, run Cypher queries against the live graph, monitor quota, and configure access tiers to WhisperGraph.
• Whisper MCP Server Model Context Protocol server exposed at mcp.whisper.security that lets AI agents (Claude, OpenAI, Cursor, VS Code, Windsurf, Antigravity) query WhisperGraph through a defined surface of tools, resources, and prompts with embedded safety rules and a self-correcting validator.
• Cypher Query API Public REST API at graph.whisper.security/api/query accepting Cypher-style graph queries with full-graph read access, rate-limited per tier (anonymous, registered, partner, enterprise) and authenticated via X-API-Key header.
• Whisper Labs Research Hub Research and innovation sub-brand publishing long-form reports (e.g., 2025 State of DNSSEC, Q4 2025 Threat Landscape), academic partnerships (MIT CSAIL, Stanford, UC Berkeley), webinars, podcasts, and videos.
• Context Graph AI-native extension to the Internet Infrastructure Intelligence Graph, introduced in Whisper Labs to add richer contextual relationships for advanced threat-actor and infrastructure investigations.

Quantifiable outcome

• 95.3% of global internet reported vulnerable to DNS hijacking; 100% DNSSEC adoption in regulated sectors vs 0% on major corporate brand domains
• +4 more outcomes

Named customers3 records

Segments9 records

Ideal customer profiles8 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration10 records

AI capability10 records

Feature10 records

Partnerships

13 partnerships are on record, tiered flagship and core.

• MIT CSAILflagshipStrategic or Co-development Partner · 15 December 2025Multi-year research partnership announced Dec 15, 2025, between Whisper Labs and MIT CSAIL, focused on machine learning applications and graph-based threat analysis. Listed on the Whisper Labs partners page as an academic collaborator.
• SplunkcoreTechnology or IntegrationNative SIEM integration listed in the homepage 'Access & integration' section, alongside Microsoft Sentinel, OpenCTI, and Cortex XSOAR. A dedicated integrations page sits in the docs. Customers can ingest WhisperGraph indicators and verdicts directly into Splunk workflows.
• Microsoft SentinelcoreTechnology or IntegrationNative SIEM integration listed in the homepage 'Access & integration' section. The Whisper Cypher API and MCP server feed indicator enrichment and threat verdicts into Microsoft Sentinel.
• OpenCTIcoreTechnology or IntegrationNative threat-intel platform integration listed in the homepage 'Access & integration' section. Lets OpenCTI users enrich indicators with WhisperGraph's reconciled 43-feed verdict and infrastructure pivots.
• Cortex XSOARcoreTechnology or IntegrationNative SOAR integration listed in the homepage 'Access & integration' section. Enables XSOAR playbooks to call WhisperGraph for indicator enrichment and blast-radius investigations.
• Claude (Anthropic)coreTechnology or IntegrationAI-client integration featured in the homepage 'Access & integration' section. Native MCP setup for Claude lets the assistant query WhisperGraph (10 tools, 8 resources, 17 prompts) directly in conversation.
• OpenAIcoreTechnology or IntegrationAI-client integration featured in the homepage 'Access & integration' section. MCP setup guide for OpenAI clients enables agentic use of WhisperGraph.
• CursorcoreTechnology or IntegrationAI-IDE integration featured in the homepage 'Access & integration' section. Native MCP setup for Cursor lets developers call WhisperGraph from inside the editor.
• VS CodecoreTechnology or IntegrationAI/IDE integration featured in the homepage 'Access & integration' section. MCP setup lets developers use WhisperGraph inside VS Code.
• WindsurfcoreTechnology or IntegrationAI-IDE integration featured in the homepage 'Access & integration' section. Native MCP setup for Windsurf.
• AntigravitycoreTechnology or IntegrationAI-client integration featured in the homepage 'Access & integration' section. MCP setup enables Antigravity users to query the live graph.
• Stanford Security LabcoreStrategic or Co-development PartnerAcademic collaboration via Whisper Labs on joint research into DNS security and infrastructure protection methodologies. Listed on the Whisper Labs partners page.
• UC BerkeleycoreStrategic or Co-development PartnerAcademic partnership via Whisper Labs focused on machine learning applications in threat intelligence. Listed on the Whisper Labs partners page.

Scale indicators10 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• DomainTools: DomainTools operates Iris, a DNS/WHOIS/pivot-graph platform widely used by SOC, DFIR, and CTI teams for infrastructure investigations and indicator enrichment. It is the closest direct competitor to Whisper's pre-joined graph, though it does not expose the same BGP/RPKI/physical-infrastructure layers or an MCP-native interface.
• Silent Push: Silent Push offers a forward-looking threat-intel platform built on enriched DNS, WHOIS, and infrastructure pivots, marketed heavily to SOC and CTI teams. It overlaps directly with Whisper on infrastructure-pivot intelligence and adversary-infrastructure mapping, competing for the same DFIR/CTI buyer.
• Validin: Validin sells a DNS and infrastructure-pivot platform aimed at CTI analysts and security researchers, with a graph-style pivot UI. It is a direct competitor in the infrastructure-intelligence-for-threat-hunting category that Whisper targets.
• Censys: Censys provides internet-wide scanning data (hosts, certificates, services) used by attack-surface and CTI teams. It is comparable to Whisper on internet-infrastructure data and attack-surface use cases, though it relies on active scanning rather than Whisper's pre-joined BGP/DNS/WHOIS/physical graph.

Broad incumbents

• Recorded Future: Recorded Future is a large, established threat-intelligence platform that ingests broad telemetry (including DNS, WHOIS, dark web, and feeds) and serves enterprise SOC/CTI buyers. It competes with Whisper at the threat-intelligence layer but does not expose an open Cypher/MCP graph or physical-infrastructure pivots.
• Microsoft Defender Threat Intelligence (formerly RiskIQ): Microsoft's Defender Threat Intelligence (built on the RiskIQ asset) provides internet-wide asset, DNS, and infrastructure intelligence inside the Microsoft security stack. It is a broad incumbent competing with Whisper for enterprise infrastructure-intelligence budgets, especially within Microsoft Sentinel customers.
• Team Cymru: Team Cymru operates a long-standing threat-intelligence data feed (Pure Signal, Atlas, Scout) with BGP, DNS, and botnet-tracking data sold to enterprises and governments. It overlaps with Whisper's BGP/infrastructure threat-data layer and competes for similar security-operations buyers.

Emerging players

• GreyNoise: GreyNoise specializes in internet-background-noise and mass-exploitation intelligence, with internet-scanning data and a SOC-focused product. It is comparable to Whisper on internet-scale threat data for SOC triage, but with a narrower focus on scanner/benign-bot classification rather than full infrastructure graphs.
• Shodan: Shodan is an internet-device search engine widely used by attack-surface and recon teams for host, service, and certificate intelligence. It is comparable to Whisper on attack-surface/recon use cases, though it is built on active scanning and lacks the BGP/WHOIS/physical-infrastructure layers.
• Netlas: Netlas offers internet-wide search and infrastructure-pivot data (domains, IPs, certificates, WHOIS) aimed at security researchers and CTI analysts. It is comparable to Whisper as a smaller, graph-style infrastructure-intelligence alternative, with partial overlap on DNS/WHOIS pivots but less depth on BGP/physical layers.

Market position

Strengths5 records

Weaknesses4 records

Competitive moat6 records

Key risks5 records

Key highlights6 records

Customer concentration

• YouTubelabs.whisper.security/media/context-graph-demo-video
• LinkedInlinkedin.com/company/whispersecurity
• Xx.com/WhisperSec36054

Revenue estimate

Valuation estimate

Number of profiles

Profiles5 records

Subsidiaries1 record

Funding overview

Funding rounds3 records

Investors5 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Whisper