What a security context graph is and why it matters

Context is what turns a generic verdict into your verdict

An alert says a user signed in from a new country. Whether that matters depends on facts the alert does not carry: the user travels every month, the user is a domain admin, there is an approved change ticket, the device is managed. A human analyst carries those facts in memory. An agent needs them stored.

A context graph is that store, shaped as linked entities: users, devices, applications, owners, tickets, past incidents, and the relationships between them.

Vendors build the graph from different raw material

Mate's Security Context Graph stores 'memories', facts with a source, a confidence and a freshness, plus decision traces, guardrails and architecture. Mate says it learns the organisation in hours from tickets, documentation, incidents and configurations, and queries data where it lives rather than copying it (Data Collection post, 2026-11-02).

Torq's context comes from Jit, acquired on 2026-05-19: identities, roles, privileges and data sensitivity. Its SOC Brain, from 2026-07, learns from analyst decisions. Microsoft builds on the Sentinel data lake and Sentinel graph, both in preview. Simbian keeps persistent memory of assets and past verdicts. Legion learns from recorded analyst investigations in the browser.

Freshness is the property most vendors skip

Facts go stale. A user changes role, a server is decommissioned, a travel pattern ends. A graph without freshness will keep reasoning from last year's org chart. Of the twelve vendors, only Mate states freshness as a property of each stored fact.

Ask any vendor how a stale fact is detected and retired, and how a wrong fact is corrected by an analyst. If the answer is 'the model learns', ask to see the correction in the product.

Learning from analysts needs a guard

Several platforms learn from analyst decisions: Torq's SOC Brain, Prophet, Legion. That is useful and risky. If an analyst closes a real incident as benign, the platform can learn the mistake.

Prophet's answer is to preview and backtest learned changes before they apply. Ask every vendor for the equivalent: can you see what was learned, from which decision, and roll it back.

Test context with five known facts

In a trial, write down five facts about your environment that matter for triage: an admin who works nights, a service account that always looks odd, a lab subnet, a VIP list, a change window. Do not tell the vendor. After two weeks of shadow mode, check whether the agent's investigations use each one.

Then change one fact and see how long the agent takes to notice. That is the freshness test.

Context grounding is 15 percent of the index

Our context grounding criterion rewards vendors that say what is stored, where it comes from and how it is maintained. Mate scores 9, Legion 8, Torq and Simbian 7. SentinelOne scores 5: it reasons over OCSF-normalised data, but organisational learning is not described on the pages read.

Where the data lives affects cost and risk

Some platforms copy your telemetry into their own store; others query it where it already sits. Mate says it queries data where it lives (Data Collection post, 2026-11-02). Exaforce describes a unified data layer over 100+ sources. Microsoft builds on the Sentinel data lake. Each approach has trade-offs.

Copying gives the vendor speed and a consistent schema, but you pay twice for storage and widen the set of places sensitive data sits. Querying in place keeps data where your controls already apply, but depends on the speed and retention of your existing tools. Ask which model the vendor uses for each source, and where the graph itself, the derived facts, is stored and for how long.

The graph is a target too

A store that knows your admins, your crown-jewel systems and your normal behaviour is valuable to an attacker. Ask how the graph is encrypted, who at the vendor can read it, and whether it is single-tenant. Prophet states single-tenant deployment. Mate shows SOC 2, ISO and HIPAA badges with a Vanta trust center, though the scope and dates were not readable without JavaScript on 2026-11-03.

Also ask what happens to the graph when you leave. You should be able to export it, and the vendor should delete it within a stated period.

Context from people is the hardest to capture

Tickets and configurations are structured. Tribal knowledge is not: the reason a service account looks odd, the team that always deploys on Fridays. Legion's approach, learning from browser recordings of analyst investigations, targets exactly this. Mate says it learns from documentation and incidents. Ask each vendor to show a fact it learned from a person rather than a log, and where that fact came from.

Ask for the graph to be shown, not described

In a demo, ask the vendor to open the stored facts behind one real verdict: which entities, which relationships, what source and date for each. If the platform cannot show this, its context is a claim you cannot audit.

Platforms discussed in this guide

• Mate Security, rank 1, 6.70
• Torq, rank 2, 6.50
• Simbian, rank 9, 5.80

Terms used

• Security context graph
• Evidence trail

More guides

• How to run a 30-day agentic defense proof of value
• Gamebooks versus playbooks: what changes when procedures become structured guidance
• Reading an AI SOC accuracy claim: sample, method, date