Whiteswan Active Directory ITDR & Protection

whiteswansecurity.com

WindowsLinux

Spec score 6.7 #14 of 26 in Identity Threat Detection and Response Software

What it is

Whiteswan Active Directory ITDR & Protection is paid software for monitoring and enforcing on-premises identity activity after authentication. Lightweight endpoint agents for Windows and Linux evaluate activity inline against Whiteswan’s policy engine. Listed threats include DCSync, Pass-the-Ticket, Golden Ticket creation, unauthorized LDAP queries, and lateral movement. The platform discovers and maps on-premises service accounts, governs them through policy, and places Active Directory activity in the same decision engine and unified audit trail as other identity surfaces. Whiteswan says deployment requires no changes to the Active Directory schema, forest trusts, or domain controller configuration. It works alongside identity infrastructure including Okta, Microsoft, and AWS. Policy decisions, audit logs, and credentials are encrypted in transit and at rest, with keys managed separately from protected data. Whiteswan says its controls are designed and internally tested against SOC 2 Type II and ISO 27001 criteria, while clarifying these are not independent certifications. Pricing is on request, and the vendor invites organizations to scope a pilot.

Spec sheet

Purpose: Whiteswan’s Active Directory surface provides in-line inspection and enforcement of on-prem identity activity after authentication.Read 9 Oct 2026 · whiteswansecurity.com
Intended users: Whiteswan presents the platform for enterprise security teams and also describes a multi-tenant console for managed service providers.Read 9 Oct 2026 · whiteswansecurity.com
Deployment: The Active Directory surface uses lightweight on-premises endpoint agents for Windows and Linux.Read 9 Oct 2026 · whiteswansecurity.com
Integrations: Whiteswan says it works alongside identity infrastructure including Okta, Microsoft, and AWS.Read 9 Oct 2026 · whiteswansecurity.com
Security: Whiteswan says policy decisions, audit logs, and credentials are encrypted in transit and at rest, with keys managed separately from the protected data.Read 9 Oct 2026 · whiteswansecurity.com
Support: The contact page describes Premium Support as a service provided to all users and offers meetings scoped to a customer’s identity infrastructure.Read 9 Oct 2026 · whiteswansecurity.com
Headquarters: San Jose, California, United StatesRead 28 Sep 2026 · whiteswansecurity.com
Certifications: Whiteswan says its controls are designed and internally tested against SOC 2 Type II and ISO 27001 criteria, and that these are not independent certifications.Read 9 Oct 2026 · whiteswansecurity.com
Compliance status: The vendor says its controls are designed and tested against SOC 2 Type II and ISO 27001 criteria, and clarifies these are not formal third-party certifications.Read 9 Oct 2026 · whiteswansecurity.com
Data handling: Whiteswan says it processes access decisions and audit metadata rather than the underlying application data, while residency, retention, and deletion terms are set in the customer agreement.Read 9 Oct 2026 · whiteswansecurity.com
Deployment requirement: The product does not require changes to the Active Directory schema, forest trusts, or domain controller configuration.Read 9 Oct 2026 · whiteswansecurity.com
Directory changes: Whiteswan says it does not require changes to the Active Directory schema, forest trusts, or domain controller configuration.Read 9 Oct 2026 · whiteswansecurity.com
Endpoint agents: Lightweight endpoint agents evaluate identity activity against Whiteswan’s policy engine in-line on Windows and Linux.Read 9 Oct 2026 · whiteswansecurity.com
Intended customers: The vendor describes the platform as an enterprise identity security product and lists industries including banking, healthcare, manufacturing, insurance, and government.Read 9 Oct 2026 · whiteswansecurity.com
Pricing: The contact page offers quote requests and pricing inquiries but does not state a price or named plan.Read 9 Oct 2026 · whiteswansecurity.com
Product scope: Whiteswan describes Active Directory protection as an in-line identity security layer for monitoring and enforcing on-premises identity activity after authentication.Read 9 Oct 2026 · whiteswansecurity.com
Sales and trial: The product page invites organizations to scope a pilot, while the contact page directs prospective buyers to request a quote; neither page states a trial duration or public price.Read 9 Oct 2026 · whiteswansecurity.com
Security controls: The company says policy decisions, audit logs, and credentials are encrypted in transit and at rest, with keys managed separately from the data.Read 9 Oct 2026 · whiteswansecurity.com
Service accounts: The platform says it discovers and maps on-premises service accounts and governs them through its policy engine.Read 9 Oct 2026 · whiteswansecurity.com
Threat coverage: The vendor identifies lateral movement through Kerberos and NTLM, unauthorized LDAP queries, and unmonitored service accounts as risks it addresses.Read 9 Oct 2026 · whiteswansecurity.com
Unified policy and audit: Active Directory activity uses the same decision engine as the platform’s other identity surfaces and contributes to a unified audit trail.Read 9 Oct 2026 · whiteswansecurity.com

Strong points and limits

Strong points

Covers human and machine identities
Detects listed Active Directory attack techniques
Uses lightweight Windows and Linux agents
Requires no directory schema changes
Provides automated response and unified auditing

Limits

Pricing is available only on request
SOC 2 and ISO 27001 status is not independent certification
Residency, retention, and deletion depend on customer agreement

Who it suits

The product is presented for enterprise security teams in industries such as banking, healthcare, manufacturing, insurance, and government. Its multi-tenant console also targets managed service providers.

Verdict

Whiteswan focuses on inline Active Directory identity enforcement without changing core directory configuration. Its threat coverage, service-account governance, and encrypted audit controls are aimed at enterprise deployments, with pricing handled through a quote.