How Sola Security Uses PuppyGraph and Iceberg to Give AI Agents Security Context

Summary

Sola Security builds an assets graph of the environment before AI agents begin an investigation. PuppyGraph queries that graph directly in Apache Iceberg tables on S3 Tables, making access paths across identities, cloud resources, and security findings available for analysis. An agent can investigate what an identity can reach and how that access changes the significance of a finding.

Sola's design starts with the environment that security questions concern. Modeling only what existing rules need, or leaving an agent to reconstruct the environment after each question, can limit the context available for an investigation. Sola prepares the graph and selected security paths ahead of time, then lets agents use curated context and explore further through PuppyGraph. Iceberg provides the storage foundation for that broad asset model.

The Challenge: Understanding Risk Beyond the Finding

In his presentation, Sola Security CTO Leon Goldberg framed the problem with John Lambert's observation about how defenders and attackers approach security.

“Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win.”

John Lambert, Microsoft, 2015

An active login belonging to a former employee is a finding. How serious it is depends on what the account can still access.

Sola illustrates this with an employee who left three weeks earlier. Her HR record shows that she has left, but her Okta login remains active. Group memberships and AWS permissions connect that identity through Identity Center, a permission set, and an IAM role to a KMS key that encrypts production data. HR, Okta, and AWS each hold part of the evidence. The access path crosses all three. The same login finding has very different consequences if the group reaches nothing or can decrypt production data.

The scope of the model matters. In the rule-driven approach Sola describes, the model contains what the rules need to read. Available context is therefore bounded by what the rule author anticipated. An investigation that follows access beyond those assumptions needs a broader view of the environment.

Giving an AI agent tools to inspect the systems introduces another challenge: its conclusions depend on how much of the environment it actually examines. In Sola's cloud-investigation study, Claude Code sampled 40 of roughly 5,000 S3 buckets and concluded that no bucket policies existed. The environment contained 65 buckets with wildcard-principal read grants. The example exposes the risk of drawing an environment-wide conclusion from a partial inspection.

Broader coverage also has a storage and analysis cost. A model spanning more systems must retain more resources and edges and support analysis across them. Sola needed to account for the memory and compute burden as that graph grew.

The Solution: Building Security Context Before the Question

Sola organizes its platform around an environment graph that is built before questions arrive. Iceberg stores the assets graph, and PuppyGraph supplies the graph queries used to analyze it. This gives agents an existing model to investigate, along with selected security context prepared in advance.

Modeling the environment for questions beyond existing rules

Sola starts from what the organization runs: identities, hosts, cloud resources, SaaS applications, and their connections. The graph provides a model on which security questions can operate, including questions that extend beyond the rules already defined.

Identities and resources become nodes. Group membership, identity mappings, and access connections become edges. An Okta group can be connected to its corresponding AWS Identity Center group, making a path across the two systems explicit. Sola derives these edges from source records through SQL jobs. In his November 2026 presentation, Goldberg described approximately 1,400 kinds of source tables across dozens of products and graph ETL processing more than 500 million edges a day.

Building the graph ahead of time establishes cross-system paths before an agent chooses what to inspect for a particular question. For the former employee, the identity and permission chain is already represented. An agent can traverse that chain and continue investigating its reach.

Keeping the graph in Iceberg and querying it with PuppyGraph

Goldberg had previously built on graph databases at Cider Security and Palo Alto Networks. For Sola's full assets graph, he weighed the memory and compute burden of keeping a large graph hot, including replicas. Sola chose Iceberg on S3 Tables, accepting a trade-off in millisecond lookups so that the graph can grow at object-storage prices.

The decision also concerned how data changes. When a source supplies a complete listing, the system must identify resources it has stopped reporting. Sola publishes each completed collection run as a version and retires old runs by dropping their partitions. This makes versioning and data retirement part of the storage design.

The lake holds the full assets graph, with one table per node type and edge type, partitioned by customer and collection run. Storage, compaction, and retention use the lakehouse's table format and services.

PuppyGraph makes those tables queryable as a graph without loading the full assets graph into a separate graph database. It maps graph patterns to tables, skips files using filters and statistics, and scans the required columns in parallel. Files are cached in memory and on local disk during query execution.

For its precomputed path-query workload, Sola reported a median latency of 0.45 seconds and a p95 of 1.5 seconds across 15,105 production path queries over three days. These figures describe that workload in Goldberg's November 2026 presentation.

As Sola publishes new versions, subsequent PuppyGraph queries read the updated Iceberg tables directly. Sola's application scopes queries to published runs, controlling which data versions agents see without a separate assets-graph reload.

Doing the graph work before agents investigate

Sola also computes selected paths in bulk on Iceberg as data lands. Results such as risky access paths and potential blast radius become curated context that agents can retrieve. This moves graph analysis for those paths ahead of the question, alongside the work of building the environment model.

For the former employee, prepared context includes the path to the production KMS key. An agent can then use PuppyGraph to investigate what else the IAM role reaches and consult source records for facts such as the employee's departure date. An answer can combine prepared security context, further graph traversal, and supporting records. Sola's application limits returned rows and flags truncated results so agents can refine a request.

This preparation is central to Sola's argument that coding agents need more than tool access. In a comparison covering 28 tasks in one live AWS environment, Sola's context-equipped system led on 24 tasks. Coverage measured weighted, validated findings from a combined pool of all three systems' answers. The study also reported a normalized token cost per task at question time of about one-eighteenth of Claude Code's. These are complete-system comparisons with different models and tools, rather than isolated PuppyGraph results. Sola's investigation study details the coverage and cost methods.

Sola also reported how context changed prioritization. Across 9,967 vendor HIGH findings from a cloud-native application protection platform and a cloud workload protection platform in eight environments, 58.5% were downgraded, 16.6% upgraded, and 24.9% kept their grade. Of 138 vendor rules, 62 produced both downgrades and upgrades on different resources. The presentation also reports 4,140 of 4,164 read-only checks against live infrastructure holding (99.4%). That rate describes those checks, rather than overall AI accuracy.

Conclusion

For Sola, context shapes the architecture: the environment to model, the graph to build before questions arrive, the paths to analyze in advance, and the updated evidence agents can explore. These choices determine what an agent has available when it judges the significance of a finding.

Iceberg and PuppyGraph support that approach by keeping the assets graph in the lake and making it available for graph analysis. In the employee example, that provides a way to follow an active login through the environment to production resources, then investigate beyond the original finding. The agent works from a prepared environment model and can use it to pursue new questions.

Further resources

• Context is the Architecture: Rethinking security platforms in the LLM era, Leon Goldberg, Sola Security, November 3, 2026 (PDF)
• Coding Agents Aren't Enough! Evaluating an Enterprise Security Brain for Agentic Cloud Investigations, Sola Security, arXiv 2609.30345v2, September 28, 2026
• AI Native Asset Intelligence, Sola Security, arXiv 2605.09115v2, May 12, 2026