safety security
The Detection Plan Survived When Every Address Changed
Graph-aware retrieval produced threat-hunting plans that relied on more durable attacker behavior than vector retrieval did.
Summary
Graph-aware retrieval produced threat-hunting plans that relied on more durable attacker behavior than vector retrieval did.
The experiment feeds the same incident reports and generation instructions to a knowledge-graph retrieval system and a conventional vector-retrieval system. After every IP address, domain and file hash in an APT28 report was rotated, the GraphRAG plan retained all of its detections while the comparison retained 29 percent. Nine reports from four vendors showed the same directional pattern toward harder-to-evade techniques. Prompt wording still mattered substantially, and this study evaluates generated hunting plans rather than proving operational detection performance in every security environment.
Why it matters
Graph-aware retrieval produced threat-hunting plans that relied on more durable attacker behavior than vector retrieval did.
Limits and context
No additional limitation was separately recorded.
Key claims
Graph-aware retrieval produced threat-hunting plans that relied on more durable attacker behavior than vector retrieval did.
Evidence: source-2026-08-14-007
Sources
- arXiv preprint 2608.13050arXiv · primary research
Corrections
No corrections have been recorded for this story.