Whiteswan Active Directory ITDR & Protection

What Whiteswan Active Directory ITDR & Protection is

Whiteswan Active Directory ITDR & Protection is an in-line identity security layer for monitoring and enforcing on-premises identity activity after authentication. Lightweight endpoint agents for Windows and Linux evaluate activity against Whiteswan’s policy engine. The product addresses threats including DCSync, Pass-the-Ticket, Golden Ticket creation, unauthorized LDAP queries, and lateral movement. It also discovers and maps on-premises service accounts and governs them through the policy engine. Active Directory activity uses the same decision engine as Whiteswan’s other identity surfaces and contributes to a unified audit trail. The company says deployment does not require changes to the Active Directory schema, forest trusts, or domain controller configuration, and that the product works alongside identity infrastructure including Okta, Microsoft, and AWS. Policy decisions, audit logs, and credentials are encrypted in transit and at rest, with keys kept separately from the data. Whiteswan says its controls are designed and internally tested against SOC 2 Type II and ISO 27001 criteria, but clarifies that these are not independent certifications. The product is presented for enterprise security teams and managed service providers. Pricing is available on request.