For agents and the people who build them
A model's memory, a document search or a graph: which one should your agent ask?
Three ways to give an agent security facts, what each is good for, and where a graph answer is the wrong choice.
4 minute read
The same question, three ways
Take a CVE and ask what an analyst would do next: which techniques it enables, and what can detect them.
| A model's memory | Document search | A graph over public sources | |
|---|---|---|---|
| Where the answer comes from | Whatever the model absorbed in training | Passages retrieved from documents you indexed | Records and links in a published snapshot |
| Which source said it | Often not stated, sometimes invented | The document that was retrieved | Named on every link, and the answer says whether a source stated it or it was inferred |
| A question that needs several steps | Answered from memory, with gaps filled in | Depends on whether one passage covers all the steps | A fixed path from the id through the links, with a status on each step |
| When there is nothing | Tends to answer anyway | Returns the nearest passage | Says the graph holds nothing on it |
| How current | As of its training | As of your last index | As of the snapshot, and the snapshot is named |
| Free-text questions | Strong | Strong | Weak: lookup by id and prefix, not free text |
When a graph is the right choice
- The question starts from an identifier you already have: a CVE, a technique, a weakness, a group.
- The answer needs to be checked by a person, so the source of each fact matters more than fluent wording.
- You want the agent to say where it has no data, and not fill the gap.
When it is the wrong choice
- The question is free text and has no identifier. Use a search over documents.
- The question is about your own systems. Lattice has no view of them.
- You need every CVE. The graph is not complete, and a lookup that returns nothing is not proof that an id does not exist.
How the three fit together
They are not exclusive. A model can write the explanation, a document search can find the runbook, and a graph can supply the facts and their sources. Lattice supplies the last part and no more: it answers from public knowledge, it does not act, and a person decides.
Where to go next
- IT and security for small firms — The service behind the reference layer: someone who looks after your own estate.
- The IT check — Reference material tells you what is known. The check tells you where your own estate stands.
- OCO, the cyber graph behind this — Lattice serves public knowledge. OCO is the product that works on a real estate.
- Get a Lattice trial key — read the beta terms first.