The security graph

The graph is the core of OpenSourceOM. Instead of treating every CVE or misconfiguration as equal, we model relationships: what can reach what, through which identities and network paths.

Nodes and edges

• Nodes — workloads, containers, identities, data stores, network interfaces, findings
• Edges — network reachability, IAM permissions, data access, vulnerability presence

Attack path queries

Security teams ask graph questions to cut through noise. Examples:

# Critical CVEs on internet-exposed paths to production data
MATCH (i:Internet)-[*..5]->(v:Vulnerability {severity:'critical'})-[:AFFECTS]->(w:Workload)-[:CAN_REACH]->(d:Datastore {env:'prod'})
RETURN v, w, d

# Over-privileged roles reachable from a compromised VM
MATCH (vm:VM {compromised:true})-[:ASSUMES|CAN_ASSUME*1..3]->(r:Role)
WHERE r.admin = true
RETURN r

Prioritization

Findings inherit risk from graph context: exposure, path length, asset sensitivity, and exploit intelligence. A critical CVE on an isolated dev box ranks lower than a high CVE on a path to prod.

Compared to traditional CNAPP

Proprietary platforms like Wiz popularized graph-native cloud security. OpenSourceOM brings similar concepts — attack paths, toxic combinations, identity blast radius — to an auditable, self-hosted, Apache-2.0 codebase you can extend.