01 / Vulnerability management
Live graph maintenance, not a queue.
Most programs treat vulnerabilities as a backlog. The graph treats them as edges — between an asset, a weakness, an exploit, and what they reach. Hygiene is keeping the graph current. Prioritization falls out of which edges actually close attack paths.
02 / Remediation
By reachability and blast radius.
A critical CVSS on an unreachable node ranks below a medium one a step from your crown jewels. Remediation is a graph-reduction problem — which fix collapses the most reachable, high-impact paths per unit of effort, not which patch has the loudest score.
03 / Incident response
Traversal, not playbook lookup.
From an IOC, walk backward to find the real blast radius and forward to find what’s still at risk. Containment becomes a choice about which edges to cut, with the cost of each cut visible. The week-long tabletop reconstruction becomes a query.
04 / GRC
Graph coverage, audit-grade.
Controls protect edges. SOX, PCI, HIPAA, NIST, EU AI Act, OWASP LLM — frameworks are mappings from control families onto regions of the graph. Compliance posture is real when those mappings hold under threat traversal, and theatrical when they don’t. The graph makes the difference legible to auditors and engineers at the same time.
05 / The enterprise
One typed graph, not parallel truths.
Hosts, identities, data classes, third parties, controls, weaknesses, TTPs as typed nodes. Edges as trust, exposure, exploit-path, control-effectiveness. Dashboards, SIEM rules, risk registers, BIA documents become views over one model — not parallel sources of competing truth.
06 / Object model
Every event extends one base class.
A vulnerability, a violation of controls, a breached account, a regulatory policy change, a threat-intel hit, an IR finding — treat them as subclasses of one base graph object. Same detection, correlation, prioritization, routing, audit, and closure framework across the lot. New event types extend the base; the operating discipline doesn’t fragment per category. Object-oriented security at the model layer.
07 / Zero trust, evolved
Trust is an edge attribute, not a perimeter.
The original framing — network microsegmentation, verify per request, identity at every hop — was perimeter-shaped at heart. The shift: trust is now a per-edge attribute on a typed graph, continuously re-scored as identities authenticate, code ships, agents act, third parties change posture, and weaknesses surface. Autonomous agents and supply-chain reality made the wall metaphor insufficient. The graph is the model that scales with what verification has to mean now.
08 / Downstream impacts
Materialized in seconds.
Given a compromise of node N: which data, which services, which customers, which regulators? Answered in seconds, not after a week of analyst hours. Tabletop exercises become regression tests over the graph — rerun nightly, drift-detected, audit-trailed.
09 / Exploitation velocity
Vs. remediation velocity.
Attackers weaponize new classes of weakness at a measurable rate. So does your program close them. The number that matters is the gap between the two — per edge class, not in aggregate. Aggregate metrics hide the mismatches that cost you.
10 / Closing the gap
The point of the platform.
The Workbench exists to make remediation velocity catch up to exploitation velocity on the edges that matter — reachable, high-impact, fast-exploiting. The multi-model adjudication, the agent fleet, the control plane, the unified object model, the zero-trust edge attributes — they exist to make that economically feasible at enterprise scale.