Tech riderRev. 20 Sept 2026

Whiteswan Active Directory ITDR & Protection

Ch 146.6of 26Identity Threat Detection and Response Software

1Runs onLinux, Windows
2Privilege abuse detectionYes
3Directory attack detectionYes
4Automated responseYes
5Identity coveragehuman + machine

5 lines stated Written from the maker's own pages: whiteswansecurity.com

Visit site Alternatives

The Whiteswan Active Directory ITDR & Protection homepage

Overview

Whiteswan Active Directory ITDR & Protection is ranked #14 of 26 in identity threat detection and response software on Specifiction. It runs on Linux, Windows.

Compared on identity threat detection and response software

Privilege abuse detection: Yeswhiteswansecurity.com
Directory attack detection: Yeswhiteswansecurity.com
Automated response: Yeswhiteswansecurity.com
Identity coverage: human_and_machinewhiteswansecurity.com

Facts

Product scope: Whiteswan describes Active Directory protection as an in-line identity security layer for monitoring and enforcing on-premises identity activity after authentication.whiteswansecurity.com · 9 Oct 2026
Threat coverage: The platform page lists DCSync, Pass-the-Ticket, Golden Ticket creation, unauthorized LDAP queries, and lateral movement among the Active Directory threats it addresses.whiteswansecurity.com · 9 Oct 2026
Deployment: The Active Directory surface uses lightweight on-premises endpoint agents for Windows and Linux.whiteswansecurity.com · 9 Oct 2026
Directory changes: Whiteswan says it does not require changes to the Active Directory schema, forest trusts, or domain controller configuration.whiteswansecurity.com · 9 Oct 2026
Service accounts: The platform says it discovers and maps on-premises service accounts and governs them through its policy engine.whiteswansecurity.com · 9 Oct 2026
Unified policy and audit: Active Directory activity uses the same decision engine as the platform’s other identity surfaces and contributes to a unified audit trail.whiteswansecurity.com · 9 Oct 2026
Integrations: Whiteswan says it works alongside identity infrastructure including Okta, Microsoft, and AWS.whiteswansecurity.com · 9 Oct 2026
Security controls: The company says policy decisions, audit logs, and credentials are encrypted in transit and at rest, with keys managed separately from the data.whiteswansecurity.com · 9 Oct 2026
Certifications: Whiteswan says its controls are designed and internally tested against SOC 2 Type II and ISO 27001 criteria, and that these are not independent certifications.whiteswansecurity.com · 9 Oct 2026
Data handling: Whiteswan says it processes access decisions and audit metadata rather than the underlying application data, while residency, retention, and deletion terms are set in the customer agreement.whiteswansecurity.com · 9 Oct 2026
Support: The contact page describes Premium Support as a service provided to all users and offers meetings scoped to a customer’s identity infrastructure.whiteswansecurity.com · 9 Oct 2026
Sales and trial: The product page invites organizations to scope a pilot, while the contact page directs prospective buyers to request a quote; neither page states a trial duration or public price.whiteswansecurity.com · 9 Oct 2026
Intended users: Whiteswan presents the platform for enterprise security teams and also describes a multi-tenant console for managed service providers.whiteswansecurity.com · 9 Oct 2026
Purpose: Whiteswan’s Active Directory surface provides in-line inspection and enforcement of on-prem identity activity after authentication.whiteswansecurity.com · 9 Oct 2026
Endpoint agents: Lightweight endpoint agents evaluate identity activity against Whiteswan’s policy engine in-line on Windows and Linux.whiteswansecurity.com · 9 Oct 2026
Deployment requirement: The product does not require changes to the Active Directory schema, forest trusts, or domain controller configuration.whiteswansecurity.com · 9 Oct 2026
Security: Whiteswan says policy decisions, audit logs, and credentials are encrypted in transit and at rest, with keys managed separately from the protected data.whiteswansecurity.com · 9 Oct 2026
Compliance status: The vendor says its controls are designed and tested against SOC 2 Type II and ISO 27001 criteria, and clarifies these are not formal third-party certifications.whiteswansecurity.com · 9 Oct 2026
Intended customers: The vendor describes the platform as an enterprise identity security product and lists industries including banking, healthcare, manufacturing, insurance, and government.whiteswansecurity.com · 9 Oct 2026
Pricing: The contact page offers quote requests and pricing inquiries but does not state a price or named plan.whiteswansecurity.com · 9 Oct 2026