{"slug": "blastradius-why-severity-scores-lie-and-how-graph-ai-solves-real-attack-paths", "title": "BlastRadius: Why Severity Scores Lie, and How Graph AI Solves Real Attack Paths", "summary": "A developer built BlastRadius, an open-source graph-native AI agent that uses FalkorDB and the Model Context Protocol to map real attack paths through hybrid cloud infrastructure rather than ranking vulnerabilities by CVSS severity. The tool traces reachability from internet-facing entry points to crown-jewel assets via OpenCypher variable-length path queries, arguing that vector-database RAG approaches fail because vector distance does not capture topological connectivity.", "body_md": "**\"Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win.\"**\n\n— John Lambert, Distinguished Engineer, Microsoft Threat Intelligence\n\nIt is 2:14 AM. Your security scanner finishes sweeping your hybrid cloud infrastructure and drops a fresh spreadsheet into your ticketing queue: **4,821 open vulnerabilities**.\n\nTwo hundred of them are flagged with a **CVSS 9.8 or 10.0 Critical**.\n\nYour SecOps team has the engineering bandwidth to patch roughly ten servers this sprint. How do you choose?\n\nIf you do what 95% of security teams do, you sort the column by **CVSS descending** and start patching from the top:\n\n`legacy-ftp`: CVSS 10.0 (Log4j remote code execution).` batch-legacy`: CVSS 9.8 (CGI deserialization exploit).\nCongratulations: your team spent 36 uninterrupted engineering hours patching two isolated, legacy servers sitting on an air-gapped staging subnet with zero egress and zero access to customer data.\n\nMeanwhile, an unpatched **CVSS 7.5 OpenSSL bug** on your internet-facing `api-gateway` sat at ticket #384 in your backlog. Six hours later, an adversary used that single gateway to pivot into your microservices mesh and exfiltrate your entire customer database in **three hops**.\n\n```\n[The Vulnerability Mirage]\n\nIsolated Subnet:\n  [Attacker] ──x──> [legacy-ftp (CVSS 10.0)] ──x──> (DEAD END)\n\nProduction Route:\n  [Attacker] ─────> [api-gateway (CVSS 7.5)] ─────> [db-customers (PII)]\n                    ▲\n                    └── THE REAL ATTACK PATH\n```\n\n**Severity scores tell you how dangerous a vulnerability is in isolation. They tell you nothing about whether an adversary can actually reach your crown jewels.**\n\nWe built **[BlastRadius](https://github.com/saksham-2x7/BlastRadius_V1)** to invert this paradigm: a graph-native, autonomous AI agent powered by **FalkorDB** and the **Model Context Protocol (MCP)** that maps true network reachability, calculates topological choke points, and safely remediates attack paths without taking down production.\n\nWhy hasn't the cybersecurity industry solved this already? Because answering the fundamental question—*\"Can an attacker on the public internet walk from an exposed ingress point to our customer database through exploitable vulnerabilities?\"*—is computationally agonizing in relational databases.\n\nTo trace lateral movement across a dynamic cloud network in a relational database, you must execute recursive Common Table Expressions (`WITH RECURSIVE`) across five separate tables: `hosts`, `network_interfaces`, `firewall_rules`, `installed_services`, and `cve_vulnerabilities`.\n\nAt 4 hops, relational engines devolve into massive Cartesian joins that bring relational query planners to their knees.\n\nMany modern \"AI security tools\" attempt to dump scan reports into vector databases (RAG) and prompt an LLM: *\"Find the attack path.\"*\n\nThis fails disastrously. **Vector distance is not topological connectivity.** LLMs cannot reliably trace multi-hop network paths in natural language; they hallucinate hops through air-gapped subnets, fabricate firewall allowances, and skip critical lateral constraints.\n\nIn **[FalkorDB](https://www.falkordb.com/)**, network infrastructure is represented in its natural state: a directed property graph.\n\nBecause FalkorDB is built on sparse matrix linear algebra (GraphBLAS) running over the ultra-fast Redis wire protocol, variable-length path traversal is not a pointer-chasing crawl—it is an optimized linear algebraic matrix multiplication executed in microseconds.\n\nFinding all paths from the public internet to our crown jewel database is a single OpenCypher query:\n\n``` php\nMATCH path = (entry:InternetEntry)-[:EXPLOITABLE_ROUTE*1..5]->(target:CrownJewel {name: 'db-customers'})\nRETURN path, length(path) AS hops\n[Public Internet]\n       │\n       ├──> [edge-apache] ──> [api-gateway] ──┐\n       ├──> [edge-nginx]  ──> [api-gateway] ──┼──> [db-customers] (CROWN JEWEL)\n       ├──> [edge-node]   ──> [api-gateway] ──┘\n       └──> [edge-apache] ──> [worker-java]  ─────> [db-customers]\n```\n\nOne query. Instant topological reality. FalkorDB identifies the exact four attack routes an adversary can execute today.\n\nTo reflect real enterprise environments, BlastRadius ingests live vulnerability telemetry:\n\nLook at how raw scores compare to graph-grounded reality in our testbed:\n\n| Server Host | Role | Primary Vulnerability | CVSS | EPSS / KEV | Graph Attack Paths | True Threat Status | \n|---|---|---|---|---|---|---|\n| `legacy-ftp` | Deprecated Storage | Log4j (CVE-2021-44228) | **10.0** | High (KEV) | **0** | **Noise** (No route to crown jewels) | \n| `batch-legacy` | Internal Batch Job | CGI RCE (CVE-2014-6271) | **9.8** | Moderate | **0** | **Noise** (Dead-end subnet) | \n| `api-gateway` | Microservice Ingress | OpenSSL (CVE-2022-3602) | **7.5** | Low | **3 of 4** | **CRITICAL CHOKE POINT** | \n\nIf you follow traditional security advice, you spend your week patching `legacy-ftp` and `batch-legacy`. Your customer database remains completely exposed.\n\nBlastRadius immediately surfaces that patching a single CVE on `api-gateway` eliminates **75% of your total attack surface** in one stroke.\n\nA common anti-pattern in generative AI projects is \"Text-to-SQL\" or \"Text-to-Cypher,\" where the LLM is asked to write raw queries against production databases.\n\nIn cybersecurity, this is unacceptable:\n\nBlastRadius uses the **Model Context Protocol (MCP)**. The LLM agent never writes raw Cypher. Instead, it interacts with FalkorDB through deterministic, strongly-typed MCP tools:\n\n```\n┌─────────────────┐       MCP Request       ┌──────────────────┐\n│                 │ ──────────────────────> │                  │\n│    AI Agent     │                         │  FalkorDB Engine │\n│ (Reasoning Core)│ <────────────────────── │ (Ground Truth)   │\n└─────────────────┘       Typed Subgraph    └──────────────────┘\n```\n\n`find_choke_points()`: Runs FalkorDB's betweenness centrality algorithms to mathematically score nodes that funnel the highest percentage of attack traffic.`get_shortest_attack_path(source, target)`: Executes FalkorDB's native shortest-path traversal to calculate minimum attacker effort.`simulate_remediation(target_node)`: Clones the active subgraph in memory, simulates patching or isolating the node, and recalculates remaining attack paths.`apply_remediation(target_node)`: Commits changes to the live graph and updates state.` draft_jira_ticket(finding)`: Formats an engineering ticket containing exact reproduction paths, affected assets, and rollback plans.\nWhen an operator asks: *\"Show the shortest route an attacker could take\"*, real-world networks often feature symmetric microservice ingress paths.\n\nIn our reference architecture, FalkorDB evaluates all possible attack routes and detects a **four-way tie**, each requiring exactly 3 hops:\n\n`internet` → `edge-apache` → `api-gateway` → `db-customers`\n`edge-nginx` → `edge-node` → `worker-java` → Rather than arbitrarily picking one route or truncating results, BlastRadius highlights all four tied paths across our **React Flow** topology canvas simultaneously. Operators immediately grasp the redundancy of the adversary's options.\n\nThe biggest obstacle to AI agents in infrastructure is **trust**. Nobody wants an autonomous agent making blind changes to production services.\n\nMost AI projects attempt to enforce safety through system prompts:\n\n*\"You are a helpful assistant. Please do not modify critical servers without asking.\"*\n\nThis is dangerous. LLM system prompts can be bypassed, misunderstood, or ignored under complex context windows.\n\nIn BlastRadius, **the graph enforces safety, not the AI prompt.**\n\n```\n                  [User: \"Fix everything safe\"]\n                                │\n                                ▼\n                   [Agent: Inspect Node Tier]\n                                │\n               ┌────────────────┴────────────────┐\n               ▼                                 ▼\n      [Tier 1: Leaf Worker]             [Tier 3: Choke Point]\n    (Low Betweenness Centrality)       (High Centrality / Ingress)\n               │                                 │\n               ▼                                 ▼\n       Simulate in FalkorDB              REFUSE TO MODIFY\n               │                                 │\n               ▼                                 ▼\n         Apply Patch                     Draft Jira Ticket with\n       (Paths Drop: 4 → 1)               Rollback & Graph Proof\n```\n\nBefore touching any node, the MCP server calculates the node's **Autonomy Tier** directly from FalkorDB metrics:\n\nWhen the operator types: *\"Fix everything that is safe\"*, the agent patches the edge servers autonomously—dropping attack paths from 4 down to 1.\n\n**But when it encounters `api-gateway`, it explicitly refuses.**\n\nThe agent informs the operator:\n\n*\"Remediation refused for `api-gateway`. This node has high topological centrality and serves active ingress routes. Severing or modifying this node without maintenance coordination risks dropping production traffic. I have drafted Jira ticket SEC-402 with full graph evidence, affected paths, and a rollback plan for human approval.\"*\n\nThe model did not decide this out of caution; the **graph topology mathematically forbade it**.\n\nTraditional chatbot agents suffer from stateless amnesia. If you return to the console three days later and ask: *\"Why didn't you patch the API gateway on Tuesday?\"*, a typical agent has no idea what you're talking about.\n\nBlastRadius writes its actions, simulations, and refusals back into FalkorDB as **first-class graph entities**:\n\n```\nCREATE (d:AgentDecision {\n    action: 'REMEDIATION_REFUSED',\n    target: 'api-gateway',\n    reason: 'HIGH_BETWEENNESS_CHOKE_POINT',\n    risk_score: 0.89,\n    timestamp: 1729208000\n})-[:EVALUATED_AGAINST]->(h:Host {name: 'api-gateway'})\n```\n\nBecause reasoning is stored natively in the graph:\n\nEnterprise security tools cannot be toy prototypes with hardcoded data.\n\nBlastRadius allows teams to click **Use your own data**, upload network inventory or vulnerability scans, and instantly instantiate a private, isolated graph.\n\nBecause FalkorDB handles multi-tenant graph namespaces with zero overhead, each user or organization operates within a strictly partitioned graph space—allowing rapid scan-to-graph conversion without infrastructure friction.\n\nMost security tooling generates more data, more alerts, and more cognitive fatigue.\n\nBlastRadius does the opposite:\n\nAttackers will always think in graphs. It’s time our defenses did too.", "url": "https://wpnews.pro/news/blastradius-why-severity-scores-lie-and-how-graph-ai-solves-real-attack-paths", "canonical_source": "https://dev.to/kaustubh_negi/-blastradius-why-severity-scores-lie-and-how-graph-ai-solves-real-attack-paths-4846", "published_at": "2026-10-17 18:28:55+00:00", "updated_at": "2026-10-17 18:36:09.375544+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "agent-protocols", "ai-safety", "developer-tools"], "entities": ["BlastRadius", "FalkorDB", "Model Context Protocol", "Microsoft", "John Lambert", "OpenCypher", "GraphBLAS"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/blastradius-why-severity-scores-lie-and-how-graph-ai-solves-real-attack-paths", "markdown": "https://wpnews.pro/news/blastradius-why-severity-scores-lie-and-how-graph-ai-solves-real-attack-paths.md", "text": "https://wpnews.pro/news/blastradius-why-severity-scores-lie-and-how-graph-ai-solves-real-attack-paths.txt", "jsonld": "https://wpnews.pro/news/blastradius-why-severity-scores-lie-and-how-graph-ai-solves-real-attack-paths.jsonld"}}