Skip to main content

Graph Explorer — Risk Paths Preset

Shipped in: sv0-platform PR #18 (2026-03-04)

What It Does​

The Risk Paths preset collapses the full authority graph down to the entities that matter most for immediate triage:

  1. Entities with critical or high severity active findings — the directly risky nodes
  2. Their direct (1-hop) neighbors — both outbound targets and inbound sources

The result is a focused subgraph showing where risk lives and what it connects to, without any manual filter setup.

How to Activate​

  1. Open Graph Explorer (/graph)
  2. In the left filter sidebar, find the Presets section (only visible in browse mode — not available when a node is in focus)
  3. Click Risk Paths

The button turns red when active and shows a node count:

Risk Paths  (14 nodes)

Click again to deactivate and return to the full graph.

What Gets Shown​

Included nodes:

  • Any entity that has at least one active finding with severity critical or high
  • Any entity that is a direct outbound relationship target of those entities (1-hop forward)
  • Any entity that has a direct outbound relationship pointing to those entities (1-hop backward)

Excluded nodes:

  • Entities with only medium or low severity findings
  • Entities with no findings
  • Entities more than 1 hop away from a high/critical finding entity

Edges: only edges between nodes that survive the filter are shown.

Use Cases​

ScenarioHow Risk Paths helps
Incident triageImmediately surface which workloads or identities have active critical findings, without scrolling through hundreds of graph nodes
CISO walkthroughShow the board a focused "danger zone" view — entities with confirmed risk and what they connect to
Pre-pilot reviewQuickly validate that no unexpected high-risk paths exist before a customer demo
Post-scan reviewAfter a connector scan, check whether the new findings created new high-risk subgraphs

Interaction with Other Filters​

The Risk Paths preset is only available in browse mode (when no node is in focus). Once you click into a node (focus mode), the preset button disappears — focus mode has its own 1-hop context view.

Other filters (entity type, relationship type, "has findings only") continue to apply on top of the preset. For example, enabling Risk Paths and also filtering to only workload entity types shows only workload nodes with critical/high findings and their workload neighbors.