- Home
- Identity Threat Detection and Response Software
- Whiteswan Active Directory ITDR & Protection
Whiteswan Active Directory ITDR & Protection
San Jose, California, United States
What it is
Whiteswan Active Directory ITDR & Protection is paid software for monitoring and enforcing on-premises identity activity after authentication. Lightweight Windows and Linux endpoint agents evaluate activity against Whiteswan’s policy engine in line. Listed threats include DCSync, Pass-the-Ticket, Golden Ticket creation, unauthorized LDAP queries, and lateral movement. The platform discovers and maps on-premises service accounts and governs them through policy. Active Directory activity uses the same decision engine as Whiteswan’s other identity surfaces and contributes to a unified audit trail. Deployment does not require changes to the Active Directory schema, forest trusts, or domain-controller configuration. Whiteswan says it works alongside identity infrastructure including Okta, Microsoft, and AWS. Policy decisions, audit logs, and credentials are encrypted in transit and at rest, with keys managed separately from protected data. The company describes controls designed and internally tested against SOC 2 Type II and ISO 27001 criteria, while clarifying these are not independent certifications. The product covers human and machine identities, offers privilege-abuse and directory-attack detection, and supports automated response. Pricing is available by quote request.
For and against
For
- Inline Windows and Linux endpoint agents
- Detects multiple Active Directory attacks
- No schema or domain-controller changes required
- Human and machine identity coverage
- Automated response and unified audit
Against
- Paid product with quote-based pricing
- SOC 2 and ISO claims are not independent certifications
- Residency and retention depend on customer agreement
The verdict
Whiteswan focuses on inline Active Directory threat detection, policy enforcement, and audit coverage without directory configuration changes. Buyers should review the stated compliance status and customer-agreement terms for data handling.
Who it suits
It is presented for enterprise security teams and managed service providers protecting Active Directory identities. Listed industries include banking, healthcare, manufacturing, insurance, and government.
On the record
- Certifications
- Whiteswan says its controls are designed and internally tested against SOC 2 Type II and ISO 27001 criteria, and that these are not independent certifications.whiteswansecurity.com · read 9 Oct 2026
- Compliance status
- The vendor says its controls are designed and tested against SOC 2 Type II and ISO 27001 criteria, and clarifies these are not formal third-party certifications.whiteswansecurity.com · read 9 Oct 2026
- Data handling
- Whiteswan says it processes access decisions and audit metadata rather than the underlying application data, while residency, retention, and deletion terms are set in the customer agreement.whiteswansecurity.com · read 9 Oct 2026
- Deployment
- The Active Directory surface uses lightweight on-premises endpoint agents for Windows and Linux.whiteswansecurity.com · read 9 Oct 2026
- Deployment requirement
- The product does not require changes to the Active Directory schema, forest trusts, or domain controller configuration.whiteswansecurity.com · read 9 Oct 2026
- Directory changes
- Whiteswan says it does not require changes to the Active Directory schema, forest trusts, or domain controller configuration.whiteswansecurity.com · read 9 Oct 2026
- Endpoint agents
- Lightweight endpoint agents evaluate identity activity against Whiteswan’s policy engine in-line on Windows and Linux.whiteswansecurity.com · read 9 Oct 2026
- Integrations
- Whiteswan says it works alongside identity infrastructure including Okta, Microsoft, and AWS.whiteswansecurity.com · read 9 Oct 2026
- Intended customers
- The vendor describes the platform as an enterprise identity security product and lists industries including banking, healthcare, manufacturing, insurance, and government.whiteswansecurity.com · read 9 Oct 2026
- Intended users
- Whiteswan presents the platform for enterprise security teams and also describes a multi-tenant console for managed service providers.whiteswansecurity.com · read 9 Oct 2026
- Pricing
- The contact page offers quote requests and pricing inquiries but does not state a price or named plan.whiteswansecurity.com · read 9 Oct 2026
- Product scope
- Whiteswan describes Active Directory protection as an in-line identity security layer for monitoring and enforcing on-premises identity activity after authentication.whiteswansecurity.com · read 9 Oct 2026
- Purpose
- Whiteswan’s Active Directory surface provides in-line inspection and enforcement of on-prem identity activity after authentication.whiteswansecurity.com · read 9 Oct 2026
- Sales and trial
- The product page invites organizations to scope a pilot, while the contact page directs prospective buyers to request a quote; neither page states a trial duration or public price.whiteswansecurity.com · read 9 Oct 2026
- Security
- Whiteswan says policy decisions, audit logs, and credentials are encrypted in transit and at rest, with keys managed separately from the protected data.whiteswansecurity.com · read 9 Oct 2026
- Security controls
- The company says policy decisions, audit logs, and credentials are encrypted in transit and at rest, with keys managed separately from the data.whiteswansecurity.com · read 9 Oct 2026
- Service accounts
- The platform says it discovers and maps on-premises service accounts and governs them through its policy engine.whiteswansecurity.com · read 9 Oct 2026
- Support
- The contact page describes Premium Support as a service provided to all users and offers meetings scoped to a customer’s identity infrastructure.whiteswansecurity.com · read 9 Oct 2026
