Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using Graph-Based Threat Detection
Transcript
- Lucas: Luna, I want to talk about a technique that's quietly become one of the most effective ways to catch attackers who know how to avoid traditional detection: graph-based threat detection. Luna: Graph-based—like, mapping relationships instead of just looking at individual alerts? Lucas: Exactly. Most security tools still work on a rule-based model: if event X happens, trigger alert Y. But sophisticated attackers don't trigger single events. They chain together actions that look benign in isolation—a credential here, a file access there. Luna: So the graph approach connects those dots. Lucas: Right. Instead of monitoring logs, you build a graph of every entity in your environment—users, devices, applications, data stores—and the relationships between them. Then you look for anomalous paths. Luna: I read about a case in Q2 this year—a healthcare firm that had a supply-chain compromise. Their SIEM didn't catch it, but a graph-based system did. Lucas: That's the one I was going to mention. The attackers got in through a vendor's API key. They used that key to query patient records—but only about 50 records over a week, well below any threshold the SIEM had. The graph system flagged it because those records had never been accessed by that API key before, but more importantly, the path from the API key to those records crossed a sensitive data domain it had never touched. Luna: So the anomaly wasn't the volume, it was the relationship. Lucas: Precisely. And this is why graph databases like Neo4j have been making inroads into security operations. They're built for exactly this kind of query—'show me all the paths from this entity to a sensitive data store that are unusual.' Luna: How does that work in practice? Is it something the SOC runs daily? Lucas: It's increasingly real-time. You feed identity logs, network flows, cloud API calls into a graph database. Each event updates the graph—adds edges, updates timestamps. Then you run graph algorithms like PageRank or community detection to find outliers. One SOC I talked to said they cut their mean time to detect from 12 hours to under 4. Luna: That's a massive improvement. But it sounds like it requires a different skill set. Most analysts think in rules, not graphs. Lucas: That's the biggest barrier. The tools are good now—Neo4j, Amazon Neptune, even some open-source options. But the query language, Cypher, is nothing like SQL or Splunk's SPL. And interpreting the results requires understanding graph theory basics—like what a 'bridge' node is, or why a node with high betweenness centrality might indicate a pivot point in an attack. Luna: So teams are having to train analysts in graph literacy. Lucas: Yes, and it's not trivial. But the payoff is huge, especially for detecting lateral movement and living-off-the-land attacks. Those are exactly the kinds of attacks that don't leave a loud signature—they just use native tools like PowerShell or WMI. A graph model can spot that a workstation suddenly has an SSH connection to a server it's never talked to, even if the traffic looks normal. Luna: That's where traditional tools fail. They'd see the SSH connection and maybe flag it if it's to an unusual port, but if it's on 22, they'd likely ignore it. Lucas: Exactly. The graph doesn't care about the port. It cares whether that edge has ever existed before, and if it's consistent with the user's typical behavior. And if that user never uses SSH—ever—then that edge is a huge red flag. Luna: What about scaling? I imagine the graph gets huge in a large enterprise. Lucas: It does. A company with 50,000 employees and hundreds of thousands of devices can have billions of edges. Querying that in real time is computationally expensive. But there are techniques—time-windowed graphs, edge pruning, summarization. Most teams only keep the last 30 to 90 days of activity in the active graph, and archive older data. Luna: And they combine it with other tools, I assume? Lucas: Right. Graph detection isn't a replacement for SIEM or EDR. It's a complementary layer. The really mature SOCs run graph models alongside their rule-based detections and use the graph to prioritize alerts. If a low-severity rule fires, but the graph shows that the involved entity has never connected to that part of the network before, they escalate. Luna: Makes sense. So where do you see this going? Lucas: I think within two years, every major SIEM will have a graph module built in. Splunk already has some graph capabilities, but they're clunky. Microsoft is investing heavily—Sentinel has graph-based UEBA. And the startups are innovating fast. Luna: You know, conversations like this are exactly why this podcast exists. And I know Lucas and I both feel the same way—if you're getting value out of these episodes, there's a simple way to help keep them going. Lucas: Yeah, a couple of dollars a month is genuinely what keeps these going. If you've gotten something out of them, buy me a coffee dot com slash fexingo goes directly to supporting the show. Luna: It's a small thing, but it makes a real difference—keeps everything independent and ad-free. Appreciate everyone who's helped so far. Lucas: Back to graph detection—one area that's really promising is using graph algorithms to find 'super-spreaders.' These are devices or users that connect to many parts of the network, often legitimate, but if compromised, they can cause massive damage. Luna: So you'd want to monitor those especially closely. Lucas: Exactly. You can compute a centrality score for every node in the graph and tag the top 1% as high-value targets. Then you apply stricter controls—maybe require step-up authentication for any action they take. Luna: That's smart. It's like asset-based risk scoring but dynamic. Lucas: Yes, and it adapts as the network changes. If a new server comes online and starts connecting to many departments, its centrality score rises, and it gets added to the watchlist automatically. Luna: What about false positives? Graphs can generate a lot of noise if you're not careful. Lucas: They can. The trick is to baseline 'normal' over a period—say 30 days—and then only alert on edges that deviate significantly. Also, using attribution: if a user is logging in from a new device, that's a new edge, but it might be normal. Context is everything. Luna: So you need to enrich the graph with HR data, asset ownership, maybe even physical location. Lucas: Exactly. The best implementations I've seen tie in identity governance data—so they know that a particular account belongs to a contractor who only works from 9 to 5. If that account creates a new edge at 2 a.m., it's immediately suspicious. Luna: That's the kind of nuance that rules just can't capture. Lucas: Rules can do time-of-day, but they can't easily combine it with relationship context. That's the power of the graph. Luna: One concern I've heard is privacy. If you're mapping every connection, isn't that a surveillance risk? Lucas: It's a valid concern. Security teams need to be transparent about what they're collecting. Most graph deployments focus on machine to machine and user to application relationships, not content. They're looking at metadata—who connected to what, when, from where—not what data was transmitted. Luna: So you can get the benefit without inspecting emails or files. Lucas: Exactly. And that's usually enough. Attackers' behavior patterns are what you're after, not the content of their messages. Luna: Any advice for a CISO considering graph detection? Lucas: Start with a pilot on a single high-value data set—maybe your Active Directory environment or your cloud IAM logs. Use an open-source graph database like Neo4j community edition to prove the concept. Then show the security team a concrete example of a threat that would have been missed. Once they see it, they'll want more. Luna: And the cost? Lucas: Storage is cheap. The main cost is engineering time to set it up and train analysts. But given the improvement in detection, it's a good investment. Luna: I'm sold. Let's see if more teams adopt it this year. Lucas: I think they will. Graph-based detection is one of those techniques that sounds complex until you see it in action, and then it feels obvious. It's just a better way to think about security.