GraphRAG for cybersecurity: relationships, sources and permissions

“Which version fixes this advisory?” seeks a specific fact. “Which components concentrate critical dependencies across our applications?” asks for relationships across sources. A graph can represent those relationships if their origin and status remain available.

GraphRAG, introduced by Edge and colleagues, extracts entities and relationships and prepares community summaries. Its study addresses global questions over document collections. That result does not establish that every graph outperforms every passage-retrieval system.

Match representation to questions

The project documentation distinguishes local and global search among other modes. An entity-centred question may use neighbours and source passages, while a global synthesis involves broader reporting and processing.

Separate factual lookup, relationship traversal and corpus-wide synthesis in evaluation. A system may improve one category while worsening another. One average score hides that distinction.

A fictional dependency example

Portal-A -- uses(observed version, date, inventory source) --> Library-B
Advisory-C -- affects(version range, vendor reference)    --> Library-B

These two relationships do not prove that the portal is exploitable. Compare the observed version, advisory conditions and execution context. An automatically extracted relationship remains a candidate until its evidence supports confirmation.

Our proposed record includes a source passage, date, type and verification status for each relationship. Preserve conflicting sources rather than silently merging them. Unknown information must not become a negative relationship.

Summaries inherit confidentiality problems

A community summary can combine several documents. If it contains information from two customers, hiding the second customer’s graph nodes later cannot remove information already embedded in the summary.

Treat summaries as derivatives with explicit access rules. Depending on requirements, options include separated corpora, summaries computed within an authorised scope or invalidation after source changes. Test cross-customer behaviour; a tenant field on nodes alone does not prove isolation.

Source deletion must also reach dependent relationships, summaries and caches. Otherwise, the graph can retain a conclusion after its supporting evidence disappears.

Account for maintenance cost

Include extraction, verification, summaries, rebuilds and deletion handling. A small source change may affect more than one passage, depending on graph dependencies. Measure both steady-state use and a sequence of updates.

At query time, record latency, consulted sources, citations and verification effort. An attractive graph may still contain incorrect links. A useful answer lets its reader return to evidence for each decisive relationship.

Choose a graph when relationships genuinely serve your questions and provenance can be maintained. Keep passage retrieval as a baseline for point lookups. Compare the same questions under the same permissions, including ambiguous and conflicting evidence.

Continue with hybrid retrieval and agent memory lifecycle. The AI and security series connects the architecture to access controls and evaluation.