In any retrieval-augmented security assistant, the retriever quietly decides what the model is allowed to know. When it fails, the model fills the gap with plausible invention. In cybersecurity, a single invented detail can do real damage: a misremembered CVE, a non-existent patch, or an asset placed in the wrong network segment can mislead mitigation attempts. More relevant to the approaches explored, graph traversal for example captures structure, such as which adversary can reach which server, but it cannot rank free-text relevance. The answer explored was a hybrid retriever. It runs sparse, dense, and graph retrieval in parallel, and merges their output using customized tools designed within the CyberNEMO project. That way, exact matches, semantic matches, and structurally connected entities all have a fair chance to reach the model’s context.

The second lesson was that retrievers can only be as good as what they embed. Early iterations embedded raw node properties and log fragments directly. The results were thin vectors that carried little meaning. CyberNEMO therefore introduced systematic, description-enriched embedding. Every entity in the security property graph received a templated natural-language description, generated from its properties and immediate relationships and then embedded alongside the structured data. Because the same template was applied consistently across all entities, embeddings became comparable. Retrieval quality improved noticeably on the questions asked, mixing the exact identifier with contextual qualifiers. The most important benefit, however, was protection against catastrophic hallucination.

Deploying large language models in security operations exposes a hard truth. A model that answers correctly once may answer differently the next time. Identical alerts can be assigned different levels of severities. A phishing sample can be called malicious in one run and suspicious in another. Hence, remediation steps can shift in that order between sessions. In a domain built on repeatable playbooks, that variability can undermine trust.

To this end, CyberNEMO explored strict, versioned personas in its decision support design. Instead of one general-purpose assistant, specialized roles such as a security analyst, Threat Intelligence Correlator, and a Compliance Reviewer were used. Additionally, madate fields, explicit exclusions, fixed decision rubric, output contracts with a fixed template and fallback rules were also defined.

The outcome led to more realistic and stable model outputs across repeated runs on the benchmark set. Outputs became noticeably more consistent in structure, severity grading, and in terminology. The preliminary results in CyberNemo show that disciplined prompt design is one of the most cost-effective first steps toward trustworthy LLM security tooling.

Graph-based Retrieval-Augmented Generation (Graph-RAG) is changing how security knowledge reaches large language models. Conventional RAG splits documents into chunks and retrieves them by vector similarity. Graph-RAG instead grounds the model in a structured knowledge graph, where entities such as hosts, user accounts, software versions, CVEs, firewall rules, and MITRE ATT&CK techniques are linked by explicit relationships. This approach is explored in the CyberNEMO project with promising results in actionable retrieval. It permits a shift from merely finding texts that are similar, to finding connections that are relevant. Take the query “Which internet-facing assets could an adversary reach by exploiting CVE-2024-XXXX”? Flat vector search cannot answer it reliably, because the answer is not in any single document. A credible answer emerges only by traversing several hops: from the vulnerability to the affected package, to the server running it, to the subnet, to the identity with lateral-movement privileges. Graph-RAG turns that traversal into the context the model reasons over. Its answers can be traced back through the graph and checked by an analyst.

The property graph model is what makes this work for a customized enterprise infrastructure. Nodes and edges are typed, and both can carry key-value attributes. So, an edge such as (:Workstation)-[:AUTHENTICATES_TO {protocol:”Kerberos”, first_seen:…, risk_score:0.82}]->(:DomainController) captures not just that a relationship exists, but its context, time, and weight. The solutions in CyberNEMO explored the benefits of this level of expressiveness for organizations whose environments are unique by design. Notwithstanding the benefits, several milestones must still be reached before the target performance is achieved. Graph construction remains the first hurdle, where extracting entities and relations from unstructured threat intelligence with LLMs introduces noise, and entity resolution is still non-trivial. Schema governance is the second. Ontologies must evolve as the infrastructure changes without breaking downstream queries, which argues for alignment with standards such as STIX 2.1 and the Unified Cybersecurity Ontology. Scale and latency matter too: multi-hop traversals over graphs with billions of edges must return within seconds an incident responder can afford. Finally, the field lacks standardized benchmarks for judging whether Graph-RAG outputs are complete and faithful in security contexts.