How Prevalent AI Added Graph Traversal to Its Cyber Knowledge Graph on Apache Iceberg

Summary

Prevalent AI's security data fabric brings hundreds of enterprise data sources into an entity-resolved cyber knowledge graph on Apache Iceberg. Exploring that graph poses a different problem: users choose their own paths across people, hosts, and vulnerabilities, and the team's table-based approach did not deliver the results those users expected. Prevalent AI uses PuppyGraph to map its existing Iceberg schema to graph structures, supporting relationship queries on the tables its pipelines already maintain. Users can then follow the paths they choose, rather than the ones a dashboard defines in advance.

The Challenge: Following Paths That Cannot Be Predefined

Prevalent AI had already built pipelines to clean, normalize, and resolve data into a cyber knowledge graph on Apache Iceberg, with support for more than 200 enterprise sources. The company describes that graph as the contextual backbone of its Data Fabric, spanning assets, vulnerabilities, identities, and controls. The pipelines reconcile the different identifiers used for the same device, including application-specific IDs, IP addresses, MAC addresses, host names, and fully qualified domain names. For an application entity drawn from just two sources, the team described six or seven pipeline layers before the data reaches a clean state. Iceberg supports this foundation as the model changes, giving the team what it describes as the freedom to evolve with the data. The graph itself is stored as Iceberg tables of entities and the relationships between them. SQL can query those tables directly, and each step from one entity to the next is a join.

Exploring the graph is a different problem. For example, a CISO may seek the bigger picture while a security analyst follows one specific thread. A single predefined dashboard journey cannot accommodate that range of exploration. An analyst might ask which administrative users have a critical vulnerability on their machines, which means following relationships from people to hosts and then to vulnerabilities, with the user choosing where to go next.

Answering that question in tabular form requires multiple joins, across a graph that by November 2025 held more than 5 million nodes and more than 30 million edges, drawn from more than a billion records once history was included, with more than 20 data sources contributing to a single entity. Pre-aggregating into a gold layer prepares data for queries defined in advance, but self-service exploration leaves the next step to the user. The team reported that its table-based approach did not deliver the results users needed because those paths could not be predefined.

The Solution: A Graph Query Layer on Iceberg with PuppyGraph

Prevalent brought in PuppyGraph to query the entities and relationships its data fabric already maintained. PuppyGraph maps the Iceberg schema to graph structures, making those entities and their relationships available for graph analytics over the existing tables.

The data fabric's pipelines continue to supply the clean, entity-resolved data. PuppyGraph operates over that curated foundation, querying the Iceberg tables in place. Adding graph access therefore does not require a second copy of the entity-resolved data to load into a separate graph database and keep in step. Prevalent's presentation describes PuppyGraph as providing real-time, low-latency graph queries and high performance on large-scale data.

"So that's why we bring in PuppyGraph where it provides the graph analytics on top of Iceberg. So you can simply map the Iceberg schema to the graph structures."

Athul P, Lead Data Engineer, Prevalent AI

For the administrative-user question, the analyst starts from the person entity, filters for administrative users, follows their relationships to hosts, and then identifies critical vulnerabilities associated with those hosts. The graph query layer supports that path as the user chooses where to go next.

Prevalent exposes this through self-service dashboards, where users choose their own journey through the knowledge graph. Navigator, Prevalent's conversational analytics capability, offers another way in: users ask questions in plain language and receive graph-based answers, without navigating the dashboards themselves. Prevalent supplies these user-facing experiences; PuppyGraph supplies graph analytics over the Iceberg data beneath them.

The Result: Self-Service Exploration and Conversational Analytics

With PuppyGraph, Prevalent AI added graph traversal to its existing Iceberg foundation, without a separate graph store to load and keep in step. Self-service dashboards and Navigator's plain-language questions both draw on that graph access, along paths users choose for themselves.

Further resources

• Building a Cyber Knowledge Graph at Scale using Apache Iceberg, Bangalore Apache Iceberg Meetup, November 2025