In any retrieval-augmented security assistant, the retriever quietly decides what the model is allowed to know. When it fails, the model fills the gap with plausible invention. In cybersecurity, a single invented detail can do real damage: a misremembered CVE, a non-existent patch, or an asset placed in the wrong network segment can mislead mitigation attempts. More relevant to the approaches explored, graph traversal for example captures structure, such as which adversary can reach which server, but it cannot rank free-text relevance. The answer explored was a hybrid retriever. It runs sparse, dense, and graph retrieval in parallel, and merges their output using customized tools designed within the CyberNEMO project. That way, exact matches, semantic matches, and structurally connected entities all have a fair chance to reach the model’s context.

The second lesson was that retrievers can only be as good as what they embed. Early iterations embedded raw node properties and log fragments directly. The results were thin vectors that carried little meaning. CyberNEMO therefore introduced systematic, description-enriched embedding. Every entity in the security property graph received a templated natural-language description, generated from its properties and immediate relationships and then embedded alongside the structured data. Because the same template was applied consistently across all entities, embeddings became comparable. Retrieval quality improved noticeably on the questions asked, mixing the exact identifier with contextual qualifiers. The most important benefit, however, was protection against catastrophic hallucination.