Whiteswan Security is a runtime identity security platform built around zero standing privileges (ZSP). Instead of granting access once and leaving it in place, Whiteswan makes a just-in-time authorisation decision at the moment any identity acts, and enforces it through a single decision engine that covers human privileged sessions, Active Directory, cloud identity and AI agents connecting through the Model Context Protocol (MCP). The platform combines privileged access management, identity threat detection and response (ITDR), identity-centric zero trust access and AI agent governance, and is designed to sit alongside an organisation’s existing identity provider and PAM tools rather than replace them. This overview explains how the platform works and what it covers, based on Whiteswan’s public product information and announcements.
At A Glance
| Vendor | Whiteswan Security |
|---|---|
| Category | Runtime identity security, zero standing privileges, just-in-time PAM, ITDR, AI agent governance |
| Identities covered | Administrators, engineers, vendors and third parties, Active Directory accounts, cloud workloads and AI agents |
| Platform surfaces | Privileged Access, Active Directory, Cloud Identity and the Agentic Gateway for AI agents |
| Deployment | Additive to existing identity providers and PAM tools; lightweight agent for Windows, macOS and Linux; available on AWS Marketplace |
| Workload identity | Cryptographic identity issuance using SPIFFE/SPIRE |
| Analyst recognition | KuppingerCole Rising Star (October 2025) |
What The Platform Does
Whiteswan describes its platform as one engine across four surfaces. The same just-in-time, zero standing privilege decision is applied wherever identity acts.
Privileged Access
Whiteswan replaces standing administrative access with just-in-time, scoped privilege elevation for administrators, engineers, vendors and third parties. Privilege is granted only when requested, for exactly what is needed, and revoked automatically when the task is complete. Key capabilities include:
- Just-in-time scoped elevation instead of permanent admin accounts
- Zero standing privilege for every human privileged session
- VPN-free access: vendor and internal users reach infrastructure through Whiteswan’s identity-first access rather than a standing VPN tunnel
- Session visibility: complete visibility of privileged activity
Whiteswan’s privileged access gateway works alongside the existing identity provider and any current PAM tooling. The gateway becomes the enforcement point for privileged sessions, while the existing directory remains the source of identity truth, so organisations do not need to migrate identities or rebuild their access model.
Active Directory
Whiteswan protects Active Directory with multi-factor authentication, passwordless authentication and just-in-time privileges, including for legacy Windows administrative access. This reduces the standing domain and local admin rights that attackers commonly target to escalate privileges and move laterally.
Cloud Identity
Whiteswan extends zero standing privileges to cloud platform IAM and cloud workloads. It replaces static, over-privileged credentials with just-in-time privilege elevation and issues cryptographic identities to workloads at spawn using SPIFFE/SPIRE, so workloads authenticate with short-lived, verifiable identities rather than long-lived secrets.
Identity Threat Detection And Response
Whiteswan’s AI-powered ITDR capabilities detect identity-based threats, such as privilege escalation and lateral movement, and respond to them. Because privileges are not left standing, the platform aims to stop attackers at the point where they try to escalate, not only at initial access.
Identity-Centric Zero Trust Access
Whiteswan creates identity-centric micro-perimeters around the applications, folders, URLs and networks that each user is supposed to access. Its single agent for Windows, macOS and Linux enforces these controls on endpoints and servers, securing against lateral movement, web threats and private access threats.
How The Architecture Works
| Component | What it does |
|---|---|
| Single decision engine | One policy engine makes every authorisation decision across privileged sessions, Active Directory, cloud workloads and AI agents, so the same just-in-time and least-privilege rules apply everywhere. |
| Enforcement points | Decisions are enforced through the privileged access gateway for human sessions, Active Directory controls, cloud IAM integration, the endpoint and server agent, and the Agentic Gateway for AI agents. |
| Additive deployment | Whiteswan connects to the existing identity provider and works alongside existing PAM tools, which remain in place. |
| Cryptographic workload identity | SPIFFE/SPIRE-based identity issuance gives workloads short-lived, verifiable identities from the moment they start. |
| Unified console | Identity, access and threat detection are managed from a single console. |
Agentic AI Capabilities
Whiteswan applies its runtime authorisation model to AI agents at what it calls the protocol chokepoint: the MCP layer through which agents reach tools and data.
Agentic Gateway
The Agentic Gateway governs AI agents as they connect to tools through MCP. Each agent action is subject to a just-in-time, zero standing privilege decision at the moment it acts, in the same engine that governs human and workload access.
MCP Security And Agent Visibility
Whiteswan provides visibility of every agent and its MCP activity, so security teams can see which agents are operating, what they are connecting to and what they are doing.
Runtime Audit Trails
Whiteswan produces runtime audit trails for AI agent activity, aligned to the EU AI Act and the NIST AI Risk Management Framework, to support governance and regulatory reporting.
Availability
Whiteswan states that its just-in-time, zero standing privilege decision is live today across privileged access and AI agents, and that it is investing to extend the same guarantee to full parity across all four platform surfaces.
Integrations
| Area | Documented coverage |
|---|---|
| Identity | Existing identity providers and Active Directory |
| Privileged access | Works alongside existing PAM tooling |
| Cloud | Cloud platform IAM and cloud workloads, with SPIFFE/SPIRE identity issuance |
| Endpoints and servers | Agent for Windows, macOS and Linux |
| AI agents | MCP-connected agents through the Agentic Gateway |
| Marketplace | AWS Marketplace |
Use Cases And Industries
Whiteswan publishes use cases for eliminating standing administrative privileges, just-in-time access for administrators and third-party vendors, replacing VPN-based infrastructure access, securing Active Directory with MFA and passwordless authentication, detecting and responding to identity threats, issuing cryptographic identities to cloud workloads, and governing AI agents at the MCP layer. Whiteswan’s platform is also offered through managed security service partners, including WaveStrong, which integrates Whiteswan’s ITDR, just-in-time access and zero standing privilege capabilities into its managed services. Whiteswan offers a free privileged access assessment to identify standing privilege risk.