Threat intel platforms store intelligence.
This one analyzes it with you.
the graph is the product · conversation is the interface
Traditional Threat Intelligence Platforms (TIPs) are enriched repositories: everything hangs off siloed report objects, and the analysis is still on you. GraphCTI extracts what reports actually assert, the claims about actors, TTPs, intent, and indicators, into nodes an interpretation layer can traverse. The result: threat profiles in seconds, a fast-moving landscape you can interrogate at scale, and a clear view of what your collection knows and doesn't. Those gaps feed straight back into your PIRs. It does the labor; you own the judgment. Watch one claim become structure.
The intelligence cycle, automated end to end
These five steps are how every intelligence function on earth works. The order below is the order they run: each stage feeds the next. Watch where a traditional platform stops, and where this one doesn't.
Requirements
A lightweight profile (sector, geography, stack) defines what matters to you.
Collection
Connectors pull leak sites, ATT&CK, KEV, and the premium feeds you already license.
Processing
Extraction, entity resolution, and dedup turn raw records into provenance-tagged claims.
Analysis
A reasoning model traverses the graph: trends, divergences, actor profiles.
Dissemination
Written briefings, on schedule, in intelligence-community language: fact, then assessment.
Legacy platforms cover phases two and three, then hand you a search box. The other half of the cycle, the half that was your job, is the product here.
▸ click any phase to watch it run
Phase 1 · Requirements — GraphCTI
PIRs are nodes, not paperworkPhase 2 · Collection — GraphCTI
every source, one graphPhase 3 · Processing — GraphCTI
claims, resolved and deduplicatedPhase 4 · Analysis — GraphCTI
relevance is a traversalPhase 5 · Dissemination — GraphCTI
augmented report writing: drafted by the graph, owned by the analyst · not built yetqilin disclosed 17 healthcare victims this week. graph: 3 sources · PIR-01
New edge-device exploitation reporting links T1190 to two actors active in your sector. PIR-02
Elevated risk to regional providers over the next quarter; prioritize edge appliance patching. moderate confidence
NOT BUILT YET: dissemination here is augmentation, not replacement. The graph drafts grounded facts and surfaces insights; the analyst writes the assessment and owns the product. Teams that prefer fully analyst-written reports keep them; the graph just does the gathering.
Phase 1 · Requirements — traditional TIP
a document, not dataPhase 2 · Collection — traditional TIP
feeds in, rows outPhase 3 · Processing — traditional TIP
DIY playbooks · paywalled rulesPhase 4 · Analysis — traditional TIP
you are the traversal enginePhase 5 · Dissemination — traditional TIP
manual drafting, every weekThe same intelligence, two ways
Below is one dataset rendered twice. A traditional TIP stores victimology as records and makes you page through them; relationships exist only if you think to ask. A knowledge graph stores the relationships as the data, so the pattern is the first thing you see, not the last thing you find.
| disclosed | group | victim | sector | country |
|---|---|---|---|---|
| 2026-06-08 | qilin | acme-imaging.com | Healthcare | US |
| 2026-06-07 | INC Ransom | acme-fabrication.com | Manufacturing | US |
| 2026-06-06 | qilin | acme-clinics.org | Healthcare | US |
| 2026-06-05 | ShinyHunters | acme-metallwerk.de | Manufacturing | DE |
| 2026-06-04 | INC Ransom | acme-health.net | Healthcare | US |
| 2026-06-03 | qilin | acme-medical.ca | Healthcare | CA |
| 2026-06-02 | INC Ransom | acme-machining.com | Manufacturing | US |
| 2026-06-01 | qilin | acme-surgical.com | Healthcare | US |
Every fact is in here. The connections between facts (shared techniques, sector concentration, actor overlap) are not. Click a row: the detail view is a dead end.
Same eight records, restructured as a knowledge graph: every entity is a node and every relationship can be traversed. An answer is a path. Start at PIR-01, walk to the sector it covers, to the victims inside the window, to the actors behind them, to the technique those actors share. The conclusion emerges from the hops, not from rereading reports.
A TIP answers "show me records matching X." A graph answers "what connects X to Y": paths, not pages.
Dashboards pre-compute the questions someone anticipated. The graph takes the question you have today.
In a repository the value is in the rows. In intelligence the value was always in the edges between them.
Reports become claims, not stored prose
A twenty-page vendor report is mostly narrative. Its intelligence payload is a handful of atomic assertions. Extraction keeps the assertions, each grounded to a verbatim source span, and lets the prose go.
…Initial access in the observed intrusions followed exploitation of CVE-2024-3400 on internet-facing PAN-OS appliances, with web shells staged within minutes of first contact. After credential harvesting and lateral movement over SMB, the operators deployed a Rust-based locker consistent with T1486 across both ESXi and Windows estates. Victimology over the period clusters in US healthcare delivery organizations, mirroring leak-site cadence we track separately. Overlap in negotiation portal infrastructure and payload code-signing supports attribution to Qilin with moderate confidence…
Grounded by architecture, not by promise
This is retrieval-augmented generation (RAG) in its strictest form: retrieval returns structured assertions and deterministic query results, not loose text snippets. Facts in an answer come only from the graph; the model's own knowledge is fenced off as labeled assessment; and what the graph doesn't contain is reported as a gap, never papered over. Every fact carries a receipt:
Ask the graph a question
No query language, no dashboard builder. A question in plain English becomes validated Cypher (deduplicated, date-bounded, auditable) and comes back as an answer you can put in front of leadership. Including what the graph doesn't know: known unknowns are a deliverable here, not an embarrassment.