Graphistry

Investigate 100X tables+graphs w first visual GPU graph AI stack

Free @ of + GFQL

Hiring @

[Graphistry @Graphistry]

https://t.co/N47XJq3FQi

[Graphistry @Graphistry]

Your dataframes can now anwser graph queries in milliseconds, without a graph database.

A Cypher query across 50 account IDs went from 2.7 seconds to 5 milliseconds. Searching 30M timestamps went from 40 seconds to 101 ms.

The latest GFQL release adds property indexes, so you can jump straight to the nodes and edges you care about, follow their relationships, and keep the whole workflow inside pandas, Polars, or cuDF. No database to deploy. No separate import pipeline.

And these aren't just faster lookups. You can build indexes inside multi-stage graph pipelines and inspect which indexes each query actually uses.

Full article below, with benchmarks and runnable examples. pip install graphistry

[Graphistry @Graphistry]

Check out the BSidesAugusta training here: https://t.co/VB4sb9auhe

[Graphistry @Graphistry]

We’re about to spend most of October on the road, and we’d like to meet you at one of these stops.

Here’s where we’ll be:

Oct 17: BSidesNYC, New York
Oct 19 to 24: BSidesAugusta week, Augusta, GA
Oct 27 to 29: [un]prompted II, San Francisco
Oct 29 to 30: LASCON, Austin

Augusta is the big one. On Oct 21 and 22, Leo Meyerovich and Sindre Breda are teaching a two-day hands-on class on AI agents for security investigations. It’s $595 and registration closes Oct 14.

Then on Oct 24, Leo gives a talk on two years of SOC CTF evals for investigation agents.

If you’re a SOC analyst, an engineer building agents, or just someone who likes graphs, come find us. Bring a hard investigation, a strong opinion about AI agents, or both. We learn more from what’s breaking for you than from anything we’d put on a slide

If you’ll be at any of these, message us and we’ll make time.

[Graphistry @Graphistry]

Full article: https://t.co/azGQk6gCcB

Botsbench: https://t.co/YXjkwVyKcV

[Graphistry @Graphistry]

GPT-6 Astra and Claude Fable 5.1 are out, and they're pretty compelling if you have the budget.

But put them into a real investigation harness, and things get interesting.

On CyBT-CTF, 59 incident-response cases worked in Splunk, Astra reaches 69% and Fable 5.1 reaches 61%.
GPT-5.6 Sol, an older and smaller model, reaches 76% when running through Louie.

The same GPT-5.6 Sol scores just 58% in Codex.

Astra is the strongest coding agent we've measured, but only gets to 69% at high thinking effort, at $2.34 per solved case. Fable 5.1 gets 61% at both high and low effort, at $1.19 per solved case.

So far, the choice of agent seems to matter at least as much as the choice of model.

We haven't run Astra or Fable 5.1 through Louie yet.

That's the test we're most interested in next.

[lmeyerov @lmeyerov]

I've given my share of AI talks where the frontier labs had already paralyzed many people with fear. The machines are taking our jobs, they will kill everyone, etc. Our standing-room-only event at @BSidesCbr was a vibes shift, and I'm guessing others are feeling it too:

120 folks ranging from security program leaders to curious engineers to working analysts went hands-on. By the end, they were kicking off agentic investigations that automatically and reliably timelined incidents in minutes that used to take senior folks hours. Goodbye FUD, and hello awareness, curiosity, determination, and a lot of smiling.

That was also a surprise scale test for us. We were standing room only with double the participants of our popular Black Hat training with @Cyb3rWard0g last year. Thankfully, Sindre and the @louie_ai investigation harness took it in stride: the only real issue was event space wifi.

Even when people get past the fear, this stuff is hard. We started our agentic investigation training because hundreds of thousands of analysts need to learn it, and our experience onboarding users to agentic coding is that it takes weeks and months rather than hours and days. I do claim a little credit for our team here: the training keeps getting smoother, and the harness keeps getting better at making agentic investigations easier, more transparent, more automated, and more accessible.

Onboarding hundreds of thousands of analysts into agentic investigation best practices used to feel intimidating. That is a lot of people, and with the frontier labs marketing FUD, it meant reaching not just their minds but spirits. It feels very doable now!

Next up:
- trainings at @BSidesAugusta + online
- lessons learned on AI-powered investigations at @unpromptedconf (#sf) , @BSidesNYC , @LASCONATX (#austin)

Links below + DM me to meet while we're in town!

[Graphistry @Graphistry]

Full breakdown: https://t.co/X2Lbnyy3Gs

[Graphistry @Graphistry]

The latest botsbench results on the release of GLM 5.3 family are newsworthy not in intelligence for agentic AI investigations, but cost. Run on cybt-ctf, our 59 task SIEM investigation benchmark, we see that https://t.co/VSZAbuBsla’s effective answer to OpenAI’s Luna is GLM 5.3 Flash. Also, the story on quants makes GLM 5.3 Flash more interesting as well.

As a reminder, just a few months ago, https://t.co/VSZAbuBsla’s GLM 5.2 release was the first time we measured an open-weight model performed at frontier levels on https://t.co/f7uRspY7G5 investigation tasks. Despite that, OpenAI’s 80% price cuts on GPT-5.6 Luna meant we still preferred OpenAI Luna over GLM 5.2 as both smarter and cheaper. With the new GLM 5.3 family, we are not seeing smarter results on botsbench: the important story is that GLM 5.3 Flash pricing means frontier open-weight AI has effectively caught up to GPT-5.6 Luna in quality and cost.

GLM 5.3 Flash means surprisingly little hardware goes a long way. It also gives an extended shelf-life to older GPUs. For the first time, we’re reporting a quant on botsbench: our own GLM 5.3 Flash W4AFP8 that makes it more manageable on older GPUs. Out-of-the-box, GLM 5.3 Flash ships as a 643 GB BF16 release, which typically requires 8 x H200s to run inference. We squeezed to 177GB to run on 2 x H200, with little impact on botsbench scores.

For those who are curious, we quantized the routed MoE experts to int4, paired with static float8 activations, and left attention, shared experts and the dense layers at block-float8. The int4 experts are 88% of the weights, so compressing those while leaving the precision-sensitive paths alone cut the size to 177 GB. The main reason we picked this approach was to avoid requiring the small floating-point units only available in recent GPUs, as many of the teams we work with that self-host have GPUs that are a few years old. On GPQA-Diamond the quant scores 90.9% against 91.2% published for the full-precision model. On botsbench, it scored 35/59, compared to 36/59 unquantized.

Note that we avoided any cyber-specific fine tuning or abliterations, which bring concerns of overfitting and testing for more unexpected loss of function. Our quant shows general open-weight models are running at quality levels cyber teams would have loved from frontier models last year, and require only a couple older GPUs.

Also of note, the top botsbench investigation scores are still from combining the Louie harness with proprietary models - and those lead with a sizeable margin. However, Louie with GLM 5.3 Flash breaks into the top 5 of the global leaderboard, and lands noticeably ahead of regular coding agent harnesses with other models: GLM 5.3 Flash is both good and cheap.

[lmeyerov @lmeyerov]

Our first weights drop: GLM 5.3 Flash W4AFP8 quant by
@Graphistry / @LOUIE_AI means you can now run on half as many H-series GPUs

Run on smaller rigs, and for bigger ones, double your token count!

Already getting downloaded before we had time to announce 🤯

botsbench numbers coming up shortly

Ex: 4-8 x H200 => 2 x H200

Ex: 8 x H100 => 4 x H100

How: New models generally target new GPU generations that use new kinds of floating point data representations that don't work on older GPUs. We work w/ teams using H200's etc which means rejiggering weights to more traditional fp8/int4 reps, and there is a bit of nuance to what you want to use where

GLM 5.3 Flash benchmarks great on botsbench, so enjoy the quant!

[Graphistry @Graphistry]

Big news we're bringing From AI Copilot to Commander to BSides Augusta. Two days in the room, October 21-22, 9-5, at the Georgia Cyber Center.

The questions we get before every cohort barely change, so here's what the two days cover.

Leaders keep asking where to start. Which workflows are reliable enough right now to show ROI, which ones are still too flaky to hand to an agent, and what's close enough to matter next quarter.

Analysts (SOC, IR, DFIR, hunt, threat intel, vuln mgmt) ask how agentic AI changes an investigation. Which tools, wired together how? Does RAG still matter, and how should you think about it now? How do you get an agent to run long without losing the thread, inventing things, or quietly spending $400?

Engineers & developers want the mechanics: scaling RAG, building custom MCP connectors, setting up evals, knowing whether quality moved or you just changed the prompt.

Most of the two days is lab time in our AI cyber range. Connectors (#Kusto, #Splunk, #Databricks), RAG, evals, MCP, agentic long-runs. Two tracks run side by side, prompt-first with no code required or code-first in Python notebooks, so coders and non-coders can attend together and both leave with working artifacts. Vendor-neutral as usual, free & OSS first, and where it's useful we'll show what the production-grade version looks like in https://t.co/y91N8BNUxE and other genAI tools.

Doing this in person is the part we are looking forward to. The best moments in these classes are the arguments that break out mid-lab, and those don't happen the same way over Zoom.

Sindre Breda, our solution architect and ex police officer and Leo Meyerovich our founder and CEO are teaching. A class like this needs generative AI × security × engineering in the same room and that combination is rare. Between the Boss of the SOC agentic speedrun, the Black Hat training, the U.S.

Cyber Command alert-reduction win, and a decade of OSS data work (Apache Arrow, #RAPIDS, GFQL), the tangents alone tend to be worth the two days. In Augusta especially, come argue with us.

Your training ticket also gets you into Security Onion Conference on the 23rd and BSidesAugusta on the 24th, plus validated parking in the Cyber Center deck. Bring a laptop.

$595, or $495 with code COPILOT-EARLYBIRD before September 1. Registration closes October 7. Link in the first comment.

#BSidesAugusta #AI #LLM #Cybersecurity #AgenticAI #RAG #IncidentResponse #MCP #SOC

[lmeyerov @lmeyerov]

I'll be presenting at @SANSInstitute tomorrow on a topic I expect we will be talking about a lot over the next year: Making it a boring predictable process to go from regular investigations to agentic investigations. At the organization level, this answers how to build an AI Factory Factory (not a typo).

The short answer is rethinking around evals and people.

One part of this I shared at blackhat week (#unprompted day 1 of @BSidesLV, second talk of the day - video on YouTube): our study on adversarial evals and how it is important not to trick ourselves on high scores with the many ways AI models & agents are cheating at exams. This focuses on the 'less bad' side of the process, and importantly, provides the security engineering discipline of threat modeling for systematically approaching it.

The SANS talk focuses more on the core work of ensuring the behavior we want is happening. Just like good tests tell us a system is working well and pinpoints broken areas to focus on, evals tell us the same thing when working with fuzzier systems like skill.md files, tools for improving agent behavior, agent definitions, harnesses that learn, model fine tunes, context layers & memory, picking models, etc. I share a lot of specific learnings here, like why Luna is a fascinating model, but the meta is the engineering approach to put all this on rails.

Evals say little about people. We built Louie Desktop to enable individual investigators to turn the volume knob to 11 without the complexity of organizational change. However, data is a "better together" scenario, and so as much as we build to enable blocks here, we are also working with our users and build in features aimed at the more harmonious networked and cooperative state. Learning, sharing, etc matters for both people and agents. Likewise, just as interesting as cars are for achieving high speeds, are the highway systems for making them safe. In a sense, this is the harder problem, especially when we need to help the 100k-400k people directly working on this stuff.

anyways, see folks at SANS this week, and DM to say hello!

@SANSInstitute @fykim @robtlee

[Graphistry @Graphistry]

This one's next week: our CEO @lmeyerov is giving "Breaking Bots 2: Trusting Agentic AI in the Cloud SOC" at the SANS Cloud Security Exchange Summit in San Francisco, Tuesday the 18th.

When orgs wire LLMs and agents into things that actually matter like their AI SOC, their anti-fraud program, and their overall trusted model, the decision to trust any of it usually comes down to a number from an evaluation. The trouble is that the exams are now rigging themselves, and not getting fooled has gotten a lot harder.

We keep seeing models answer from memorized results without touching a single log line, and even hacking out of their sandboxes to peek at the answers. Agents under test are behaving less like predictable tools and more like advanced persistent threats.

Leo will walk through how to measure agents for what matters, what attacks against evals look like in the wild, and how to harden evals so they actually hold up.

If you'll be in SF and are into agentic AI or graphs for investigations, reach out and we'll get you time with him! If you can't get to the city, Day 2 streams online for free.

And if the timing doesn't work at all, we're out at a bunch more events through the rest of the year:

AFCEA/INSA, Aug 26-27
Bethesda BSides Canberra, Sep 24-26
BSides Orlando, Sep 25-26
BSides NYC, Oct 17
BSides Augusta, Oct 24
LASCON, Oct 29-30, Austin

Vegas was a good time, thanks to everyone who came by. Happy to chat at any of the rest, we're also running online trainings on AI for investigations at https://t.co/vsEHFbFo57

Leo's joining a strong group of speakers this year: @anton_chuvakin @fykim @daveshackleford

#CloudExchangeSummit #AIsecurity #AgenticAI #AISafety #SOC

[lmeyerov @lmeyerov]

2c from a top scorer:

- we had a top % (won't say which), and likely top 1-3 if no logistic issues like not having the wrong hour for final submissions

- we stick to max subs, so cap $100-400/mo/person

- we learned a lot, both our 1 cyber & 2 non-cyber teammates

- the skillset has changed: we've been llm-pilled for 3+ years, so not about our token burn, but how we use them, and this taught us more about what to do and what we roll into our tools (louie, gfql, ...) & methods

[Graphistry @Graphistry]

Full article: https://t.co/9Hf6dI3xRg

Full report: https://t.co/J69tOIlS5a

[Graphistry @Graphistry]

Somewhere between the Black Hat pool parties and our standing-room-only research presentations & AI trainings at BSides, we ran our over-worked botsbench agents on the new Kimi K3 and DeepSeek V4 Flash releases that everyone has been talking about. Continuing our naming tradition, we’re dubbing K3 the disappointing chaotic evil “Coin-Eating Dragon” due to its high cost relative to others in its weight class. DeepSeek, however, wins the crown yet again: it’s the price leader for open weight models on the second-tier side of the open weight spectrum, so we’re calling it the chaotic good “Pauper Prince”.

You can read the full breakdown in the full article link below

We’ll be reporting more open weight experiments ahead, such as on the harness comparison, and as our Louie harness generally gives a +15% boost to models, how the leaderboard gets disrupted when it enters the picture so follow us to get the reports first.

Meanwhile, if you’ll be at SANS Cloud Summit in SF, say hello, and if you couldn’t make our sold-out AI trainings at BSides LV, we’ll be running longer 2-day masterclasses on Ai investigations online through the end of summer / early fall.

[Graphistry @Graphistry]

Agentic Timelining https://t.co/mb0JxY2Gcl
Generative Visual Graph Investigations:https://t.co/Q4UzHdFfiI
Louie “ae2” new high score on CyBT-CTF leaderboard: https://t.co/SX51gfDx0J
Run GFQL Cypher on polars: https://t.co/0AeLCBoPIl
The Graphistry 100X Initiative: https://t.co/RPhef1BmAO

[Graphistry @Graphistry]

With Black Hat and AI4 week kicking off on Monday, our pre-announcements are coming to an end.

Here’s everything you may have missed that we unveiled around investigation agents & GPU graph tech:

-Louie “ae2” new high score on CyBT-CTF leaderboard: CyBT-CTF, the successor to Splunk BOTSv3 botsbench leaderboard that is contamination-free, has the https://t.co/y91N8BNUxE ae2 harness with OpenAI GPT-5.6 series models beating the OpenAI Codex harness by +19% for the new high score.

-Agentic Timelining: AI agents that build “maps” for themselves drastically improve investigation quality, run 3X faster, 3X cheaper, and help with one of the worst parts of investigating.

-Generative Visual Graph Investigations: Ask questions, generate visualizations, pull context from Splunk, Kusto, Databricks, and run entire GPU-accelerated graph data science pipelines - even without knowing graph data science!

-Run GFQL Cypher on polars, polars-gpu dataframes GFQL can now run property queries directly on Polars CPU/GPU dataframes, no database required! It also now beats most engines on both OLTP low-latency and OLAP scale. 100% open source.

-The Graphistry 100X Initiative Our first milestone is a new rendering engine that is the first to handle 20M+ edge interactive graphs in the browser today, and even more scaling ahead.

-BSides Las Vegas Talks & Trainings: Our team will be sharing our 2+ year research on handling adversarial AI evaluations - the same issue that led to OpenAI agents autonomously hacking Huggingface – plus two free hands-on trainings covering agentic AI investigations and turning logs into graphs.

Several years of engineering and research came together into our week of announcements, and we're excited to finally start getting these capabilities into everyone's hands.

If you're heading to Las Vegas next week, come say hello.

Look below for links to the videos and articles for each of these announcements

[Graphistry @Graphistry]

Read full Article: https://t.co/uQtbNAQRPp

[Graphistry @Graphistry]

One of the biggest lessons from our AI investigation research is that agents must be master mapmakers:

When the https://t.co/y91N8BNUxE research team became the first to not only beat the Splunk Boss of the SOC CTF with AI agents, but fully clear it, one of the biggest “aha!”’s was around agents building and reusing investigation timelines. Task completion rates rose from 70% to 96% and investigations ran roughly 3x faster and with 3x fewer tokens.

Today's announcement is bringing that capability to https://t.co/y91N8BNUxE through agentic timelining, and as we’ll discuss in later posts, organizationally-structured long-term memory.

The video shows Louie creating a live timeline while investigating across connected databases and APIs. Instead of repeatedly searching the same evidence, agents continuously build a structured understanding of what happened. The result is enabling both you and the agent to explore findings through timelines, visualizations, linked evidence, and follow-on questions.

Check out the article below for more on how we think about timelining and long-term memory as key layers in the AI era that make agents run better and help tame how organizations approach investigations.

If you're at Black Hat or AI4 week in Las Vegas, say hello and see it in action. We'd love to hear how your team is approaching this problem today.