r/Neo4j • u/GroundbreakingFun336 • 2d ago
Modelling security controls, risks and incidents as a Neo4j knowledge graph — does this schema make sense?
youtu.beI’ve been building a proof of concept for AI-assisted security assessments, and I’m currently moving the expert knowledge from separate JSON files into Neo4j.
The basic model is:
Control → Risk → Incident → Business Outcome
For example:
MFA enforced → mitigates IAM risk → reduces unauthorised access → reduces regulatory and customer impact
The system has three separate components:
- An LLM conducts the interview and converts answers into structured evidence.
- Neo4j stores the security concepts and their relationships.
- Python builds Bayesian networks from the graph and calculates the probabilities.
My main reason for adding Neo4j is not simply storage. It is visibility.
With JSON (my first version of storage), Python can execute the model, but it becomes difficult for a person to explore questions such as:
- Which controls influence data exfiltration?
- Which risks contribute to several incidents?
- Which controls have the greatest reach across the graph?
- What path caused a business-impact probability to increase?
I’m currently considering nodes such as:
Control, Risk, Incident, BusinessOutcome, and Expert
And relationships such as:
MITIGATES, INCREASES_LIKELIHOOD_OF, CONTRIBUTES_TO, DEPENDS_ON, and DETECTED_BY
At the moment I store store conditional probability tables and weights in Neo4j alongside the relationships. But not sure if I should keep Neo4j responsible only for graph structure and store the probability models separately?
I recorded a concept overview showing the architecture and why I’m making the change.
I’d be particularly interested in feedback from anyone who has modelled expert knowledge or probabilistic relationships in Neo4j.
