The Runtime Identity Security Platform
One Engine. Four Surfaces. Decide and Enforce — Every Time an Identity Acts.
Whiteswan is a single authorization decision engine that governs human privileged sessions, Active Directory and on-prem infrastructure, cloud identity, and AI agents at the MCP chokepoint — through one policy engine, into one audit trail. Not four tools stitched together. One engine, built from the start to decide and enforce in the same motion, at the moment any identity acts.
Hybrid deployment — lightweight agents primary, gateways alongside. Aligned to EU AI Act, NIST AI RMF, SOC 2, ISO 27001, and DORA.
Four surfaces, one engine
Whiteswan Engine
Enforced. Logged.
Why One Engine
Decide and Enforce. Not Decide, Then Hope Something Else Enforces.
Most of the identity security market splits into two camps. Policy engines decide but hand enforcement off to something downstream. Gateways enforce but execute decisions made upstream, by someone else's engine. Whiteswan doesn't split the motion. The same engine that evaluates an identity's context, risk posture, and action intent is the engine that allows, denies, elevates, or blocks it — at the moment of action, not before it and not after it.
This is what makes Whiteswan additive rather than a rip-and-replace. It sits alongside your existing IdP, your existing AD, your existing cloud IAM — and closes the gap after the moment those systems consider their job done.
The Governing Sentence
Whiteswan makes one authorization decision — just-in-time, zero standing privilege — at the moment any identity acts.
Before that decision, nothing acts. After it, everything is on record.
One Engine, Four Surfaces
Whichever Surface an Identity Acts On, the Same Engine Decides.
Privileged Access →
Human privileged sessions — admins, engineers, vendors, third parties. Enforced via JIT gateway, zero standing privilege.
Active Directory →
On-prem infrastructure, domain controllers, legacy protocols. Enforced via lightweight endpoint agents, in-line.
Cloud Identity →
Non-human identities, service accounts, cloud workloads. Enforced via agentless gateway.
Agentic Gateway →
AI agents and MCP tool calls. Enforced via MCP gateway, cryptographic identity at spawn.
Every surface reports into the same policy engine and the same audit trail. A CISO does not need four dashboards to know who did what, when, and whether it was authorized.
Read the architecture argument in full: Decide and Enforce →
Engine Mechanics
From Request to Record, in One Motion.
Identity requests access or attempts an action
A human session, a service account call, an AI agent's tool invocation — whatever the surface, the request reaches the engine before it executes.
Whiteswan evaluates context
Caller identity, target sensitivity, time, behavioral posture, and — for AI agents — the cryptographic identity issued at spawn via SPIFFE/SPIRE.
Whiteswan decides and enforces, in the same motion
Allow the scoped action. Deny it in-line. Elevate it just-in-time. Nothing waits for a second system to catch up.
The action is logged
Every decision, across every surface, into one immutable audit trail — aligned to SOC 2, ISO 27001, NIST AI RMF, DORA, and EU AI Act.
Non-Disruptive by Design
Additive, Not Rip-and-Replace.
Whiteswan deploys alongside what you already run. Lightweight endpoint agents (Windows and Linux) are the primary deployment model for on-prem and Active Directory surfaces; gateways sit alongside for cloud, non-human identity, and MCP traffic. No Active Directory schema changes. No forced migration off your existing IdP.
EDR-independent
Whiteswan does not require a specific endpoint detection and response platform underneath it — it is additive to whatever security stack is already in place, not competitive with it.
See It Work on Your Own Estate
Start a Pilot, Scoped to Your Highest-Risk Surface
Whether that's Active Directory, cloud identity, or AI agents at the MCP chokepoint — see the engine decide and enforce on your own environment before you commit to anything.
"Whiteswan eliminated our VPN dependency and gave us complete visibility into vendor and internal access — before we asked for it, not after."
Puneet Sharma
Rockman Industries / Hero Group