Knowledge Graph
The knowledge layer.
Most tools store findings in a table and look context up one row at a time. Sentrasec stores security knowledge as a graph, which is what makes a finding able to explain itself.
Why a graph
A vulnerability is not an isolated fact. It is an instance of a weakness class, expressed in a particular package version, reachable through a particular code path, resolved by a particular change, and relevant to a particular project.
Stored as rows, each of those is a separate lookup and the connections have to be rebuilt by hand every time, which is exactly the work security analysts describe as triage.
Stored as a graph, the connections are the data. Asking why a finding matters is a traversal, and the answer arrives with the path that produced it.
What the graph holds
A shared body of security knowledge, plus the projects and findings specific to your workspace.
Rules
Every detection rule in the engine, with the conditions it tests and the languages it applies to.
CVE
Known vulnerabilities with affected version ranges, resolved against the dependency trees actually present in your code.
CWE
The weakness class beneath a finding: what is structurally wrong, independent of the specific instance.
OWASP
Category mappings that connect an individual finding to the risk taxonomy your programme already reports against.
Remediations
Changes known to resolve a weakness class, such as code patterns and version upgrades, used to build remediation plans.
Packages
Dependencies, their versions and the transitive relationships between them.
Relationships
The connections themselves: what a rule detects, which weakness a vulnerability expresses, and which remediation resolves which class.
Context
Your projects and the findings from their scans, linked to the shared knowledge.
From rule to explanation
The path a single finding travels through the graph before it reaches a person.
- Rulewhat fired
- CWEweakness class
- OWASPrisk category
- Remediationknown change
- Evidencesupporting artefacts
- Findingyour instance
- Explanationin context
Relationships, not lookups
Because relationships are stored directly, an explanation can show how a finding connects to its weakness class, its OWASP category and the remediation that resolves it.
Shared by every surface
The graph backs explanations in the web app, the CLI and the MCP tools alike. A developer in an editor and an analyst in the web app are reading the same knowledge.
Explanations you can trace
Triage decisions are made from evidence, not by a model. A language model only writes the explanation prose, working from the recorded evidence and the graph.
See it applied
Workspace Chat lets you ask about your findings in plain language.