Field notes from the practitioner team.
Long-form writing, technical whitepapers, security research and case studies — for security buyers, architects, and SOC engineers evaluating graph-native platforms against the alternatives.
Top 20 vulnerabilities of the last six months: a graph-grounded analysis
A ranked, scored, and graph-contextualised review of the 20 most consequential vulnerabilities disclosed between December 2025 and May 2026 — and what they tell us about where the next breach is coming from.
Read the research →Blogs
Thirteen posts and counting. Practitioner writing on graph-native architecture, detection engineering, compliance and SOC operations — two a month, December 2025 onward.
Why graph-native SOC
A graph-native SOC is not a SIEM with a sphere on a slide. It changes how an analyst opens a ticket, how detections are written, how containment is scoped — and how audit evidence is produced.
CERT-In 6-hour reporting straight from the graph
India's CERT-In requires reportable incidents within 6 hours. Here is how a graph-native platform auto-fills the template — and how it compares to the manual screenshot workflow.
Multi-tenant pitfalls every MSSP discovers the hard way
The seven architecture mistakes that bite MSSPs in year two and three — and how tenant-id-everywhere, crypto-shredding, and per-tenant graphs avoid them.
"Air-gap ready" isn't a checkbox — it's an architecture decision
Most claims of "air-gap ready" fail under audit. Phone-home telemetry, license-server pings, cloud control planes — what the real architecture looks like.
UEBA after the honeymoon: why most behavior models go stale
UEBA dazzles in proof-of-value and degrades in production. Concept drift, label scarcity, the volume-precision tradeoff — what graph grounding fixes and what it doesn't.
SOAR without tears: code-first playbooks that survive an audit
Drag-and-drop SOAR playbooks rot within a year. The patterns that actually survive DPDP and ISO 27001 audits: versioning, blast-radius gating, approval ladders, idempotency.
AI-SOC overlays vs graph-native platforms: a buyer's framework
A scoring framework for security buyers weighing AI overlays on legacy SIEM, point AI-SOC tools, and graph-native unified platforms.
Retrospective detection: the quietly overlooked superpower
Every new or changed detection should replay against 90 days hot and 7 years cold before going live. Most SOCs skip this — not from laziness, but because their platform structurally cannot.
Blast radius as a first-class concept in incident response
Blast radius shouldn't be calculated post-hoc by an analyst in their head. It should be a one-hop graph query returning the actual remediation scope — and CVSS is not blast radius.
The DPDP 72-hour clock: a SOC operations checklist
A step-by-step runbook for the Digital Personal Data Protection Act 2023 72-hour notification: trigger conditions, the clock, evidence collection, regulator templates — and what auto-fills from the graph.
Detection-as-Code without a dedicated platform team
A four-person SOC can run Detection-as-Code if the pipeline is the platform's responsibility, not the SOC's. PRs, regression CI gates, retro replay before rollout — the concrete workflow.
MTTD vs correlation debt: the metric your SIEM doesn't tell you about
Your MTTD looks healthy because alerts are firing. Correlation debt — the percentage of alerts that needed cross-source context the platform couldn't supply — is the better predictor of breach cost.
Why the graph is the product, not a feature
If the security knowledge graph is bolted on top of a SIEM, you have a dashboard. If it is the substrate, detection becomes traversal and half your tool stack collapses.
Technical whitepapers
Architectural deep dives. Citable, reproducible methodology, and aimed at senior security architects.
Air-gapped & DPDP-first: sovereign SOC architecture for Indian enterprises
India's regulatory perimeter, plus the operational requirement of air-gapped deployments in defence, PSU, and BFSI. A sovereign SOC architecture, derived from first principles and shipped on the same codebase.
Closed-loop detection engineering: alert to drafted detection to validated rollout
The closed loop AI-SOC overlays cannot deliver: triage, investigate, root-cause, draft detection, adversary-validate, retro-replay, rollout, feedback — all reasoned against the same graph.
Graph-native correlation: the architectural case
Why a typed property graph is the only substrate that unifies detection, hunting, exposure, and SOAR under a single query language across logs, identity, code and cloud.
Security research
Vulnerability analysis, exploitation patterns, and graph-grounded threat models — published from the practitioner team.
Case studies
Sample deployments — anonymised composites of representative real outcomes across BFSI, healthcare, MSSP and manufacturing.
From bolted-on stack to one graph: a top-10 Indian private bank
A 1,800-branch Indian private bank consolidated a legacy enterprise SIEM, three cloud security tools and a standalone SOAR onto one graph. MTTR fell from six hours to eighteen minutes and SIEM cost dropped 71%.
DPDP-grade patient-data DSPM across 14 hospitals
A 14-hospital network across Mumbai, Pune and Bengaluru discovered 11,400 sensitive patient-data assets — 3,200 of them previously unknown — and cut over-permissioned identities by 84% in a six-week DSPM rollout.
Multi-tenant onboarding in days, not quarters: an India-headquartered MSSP
An India-based MSSP serving 47 enterprise clients across BFSI, pharma and IT services cut customer onboarding from eight weeks to four working days and reduced infrastructure cost per tenant by 62%.
Air-gapped OT/IT SOC across four plants
A chemicals-and-auto-parts manufacturer running 3,800 OT devices across four plants stood up an air-gapped OT/IT SOC. MTTD on the OT side moved from "eventually" to four minutes; insurance premium fell 18%.
FAQ
28 candid answers on why Netgraph differs from traditional and NextGen SIEM, what air-gap-ready really means, and what KPIs to measure.
Netgraph vs traditional SIEM
Eight answers for stacks that centre on a legacy enterprise SIEM with SOAR bolted on. Cost, substrate, dashboards-vs-graph, replacement timing.
Netgraph vs NextGen / AI-SOC platforms
Cloud-native SIEMs and AI-SOC overlays look modern. Eight answers on where the real differences are — substrate depth, hallucination, agent governance.
Deployment, sovereignty, data ownership
Where data lives, what air-gap-ready actually means, how DPDP/CERT-In/RBI/SEBI/IRDAI/MeitY are covered, and what compute footprint to budget.