AI-Augmented Cybersecurity Triage Using Graph RAG for Cloud Security Operations

deloitte · Consulting · 2025 · source Agentic: yes · promotional bias: med · source-backed · extracted with prompt 0.5.2 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Cloud security triage

Deloitte SecOps teams needed to reduce thousands of cloud security findings into actionable remediations using organization-specific policy and production context.

Constraints:

alert overload
regulated timelines
human accountability
organizational memory

Architecture

Deloitte’s AI for Triage uses AWS’s GraphRAG Toolkit as the retrieval substrate for a cybersecurity intelligence center. A hierarchical lexical graph stores long-term organizational memory from policy, runbooks, architecture guidance, and previous triage records. A document graph captures current tool feeds such as Wiz issues. The pipeline distills raw alerts into triage records, generates evidence/remediation in JSON/report form, and keeps analysts in the loop for annotation, rejection, and automation decisions.

Diagram confidence: reconstructed (reconstructed from prose).

flowchart LR
  graphrag-toolkit["GraphRAG Toolkit"]
  hierarchical-lexical-graph["hierarchical lexical graph"]
  document-graph["document graph"]
  wiz-issue-pipeline["Wiz issue pipeline"]
  triage-record-factory["triage record factory"]
  ai-for-triage["AI for Triage"]
  analyst-review["analyst review"]
  graphrag-toolkit --> hierarchical-lexical-graph
  graphrag-toolkit --> document-graph
  wiz-issue-pipeline --> document-graph
  wiz-issue-pipeline --> triage-record-factory
  triage-record-factory --> ai-for-triage
  ai-for-triage --> hierarchical-lexical-graph
  ai-for-triage --> analyst-review
  triage-record-factory --> analyst-review

Drag to pan · scroll or use +/− to zoom · reconstructed from the source's described component topology

Components

Component	Role	Interacts with
`GraphRAG Toolkit`	Open-source library used to combine graph and vector retrieval for the cybersecurity intelligence center.	`hierarchical lexical graph`, `document graph`, `AI for Triage`
`hierarchical lexical graph`	Long-term organizational memory made of attributed statements from policy, runbooks, architecture guidance, and triage records.	`GraphRAG Toolkit`, `AI for Triage`
`document graph`	Short-term/working-memory graph built from tool feeds such as Wiz findings and domain-specific vocabularies.	`GraphRAG Toolkit`, `Wiz issue pipeline`
`Wiz issue pipeline`	Ingests and distills cloud-security findings into usable triage records.	`document graph`, `triage record factory`
`triage record factory`	Creates evidence, remediation, JSON output, reports, annotations, rejection decisions, and automation candidates.	`Wiz issue pipeline`, `analyst review`, `AI for Triage`
`AI for Triage`	Human-in-the-loop triage application that combines long-term organizational memory with current security findings.	`GraphRAG Toolkit`, `hierarchical lexical graph`, `triage record factory`, `analyst review`
`analyst review`	Security analyst review/annotation/rejection stage before automation or remediation.	`triage record factory`, `AI for Triage`

Data flow

Cloud-security tools such as Wiz generate large alert volumes. The pipeline distills those findings into a document graph and triage records, combines them with the toolkit’s long-term hierarchical lexical graph, generates evidence/remediation outputs, and sends reports to analysts for review, annotation, rejection, and possible automation.

4 supporting quotes

“AI for triage uses the GraphRAG toolkit to maintain this ever evolving organizational knowledge base, which comprises things such as policy documents, run books, architectural guidance, and triage records.”transcript, implied

“we needed a document graph. We built a document graph, we add that to the GraphRag toolkit.”transcript, stated

“we run our pipeline. We distilled 50,000 issues to just over 1,300 that's usable that we want to investigate further.”transcript, stated

“our analyst can look at it, they can annotate it, they can reject it. And based on the evidence we found, we also create automation from that.”transcript, stated

Why this architecture

GraphRAG is used because SecOps needs both semantic similarity and structural relevance: current alerts alone are short-term memory, while remediation decisions require organization-wide context. The toolkit is also a library rather than a full application, fitting Deloitte’s need to combine it with its own cybersecurity intelligence center and triage factory.

4 supporting quotes

“with hybrid RAG, we use vector search to find that semantically similar content and graph search to find the structurally relevant but potentially dissimilar content.”transcript, stated

“to react, especially in cyber, but with many other tools only out of short-term memory the here in and now.”transcript, stated

“Key point is it's a library, it's not a full-blown application. It's intended that you combine it with other tools, other libraries in order to build out more fully featured applications.”transcript, stated

“exactly what Deloitte had done in employing it in this cybersecurity intelligence center.”transcript, implied

Models used: Amazon Bedrock models

Scale

A real run across seven AWS domains reduced 50,000 issues to about 1,300 investigable items.
“taking an account, seven AWS domains. We switch it on and within just over a couple of weeks, four weeks, 50,000 issues, we run our pipeline.”transcript, stated
The pipeline converted those findings into more than 6,500 nodes and over 19,000 relationships.
“Rapidly convert that into just over six and a half thousand nodes or automate it in just over 19,000 actual relationships.”transcript, stated
The output includes evidence, remediation, JSON, reports, analyst decisions, and automation candidates.
“it generates for us evidence remediation and so forth. In a JSON format because ultimately we're gonna pump the JSON format back.”transcript, stated

Alternatives considered (roads not taken)

Short-term alert triage from current tool output only

Rejected because: The source frames short-term-only reaction as unable to establish the true nature of a problem across the organization.

“to react, especially in cyber, but with many other tools only out of short-term memory the here in and now. And that becomes problematic because what we cannot establish is the true nature of the problem across your entire organization.”transcript, stated

Vector-only semantic RAG

Rejected because: Hybrid RAG adds graph search for structurally relevant but semantically dissimilar content.

“we need to be able to retrieve content that is similar to the question being asked and content that is structurally relevant but potentially dissimilar to the question being asked.”transcript, implied

Patterns

`rag-retrieval` (security)

Graph RAG grounds triage in organizational policy, historic experience, and production-system context.

“Using AWS's open-source Graph RAG Toolkit, Deloitte built "AI for Triage," a human-in-the-loop system that combines long-term organizational memory (stored in hierarchical lexical graphs) with short-term operational data (document graphs) to generate AI-assisted triage records.”summary, stated

`human-in-the-loop-gate` (security)

The system assists SecOps decisions while keeping remediation accountability with humans.

“sions based on organizational policies, historical experiences, and production system context, while maintaining human accountability and creating automation recipes rather than brittle code-based solutions.”summary, stated

Tradeoffs

How to automate triage.

Chose AI-assisted records and automation recipes over brittle direct remediation code.

Rationale: The approach supports contextual decisions without removing human accountability in security operations.

“xperiences, and production system context, while maintaining human accountability and creating automation recipes rather than brittle code-based solutions.”summary, stated

Gotchas (what bit them)

Cloud security tools can create a second problem after finding risks.

Root cause: SecOps must judge significance and remediation impact across complex production environments under time pressure.

Resolution: Use Graph RAG to add organization-specific policies and relationships before remediation decisions.

“ts up, suddenly hundreds, possibly thousands of alerts or non-compliance notifications. So now having solved one problem that of identifying potential security risks in your cloud”transcript, stated

Evaluation

Deloitte reports reduction from raw issues to actionable items and graph scale.

Metrics: 50,000 issues to ~1,300 actionable items · 6,500 nodes · 19,000 relationships

“The solution reduced 50,000 security issues across 7 AWS domains to approximately 1,300 actionable items, converting them into over 6,500 nodes and 19,000 relationships for contextual analysis.”summary, stated

Outcomes

The triage system converts cloud findings into contextual, reviewable remediation decisions.

AWS/Deloitte presentation; results are implementation-reported.

“in hierarchical lexical graphs) with short-term operational data (document graphs) to generate AI-assisted triage records.”summary, stated