How a 1st Year Student Built an Autonomous Incident Response Agent Using FalkorDB Graph Theory and AI Agents

A first-year computer science student developed an autonomous incident response agent for cybersecurity incidents, demonstrating its capabilities at the Graph Hacks event organized by WeMakeDevs and FalkorDB. The agent, named BreachGraph, leveraged FalkorDB's in-memory graph database to trace multi-hop lateral movement in real-time and neutralize attacks without causing any business downtime.

Conventional database paradigms, such as relational SQL and vector databases, struggle to solve this problem efficiently. SQL requires complex recursive Common Table Expressions to determine network reachability, while vector databases cannot calculate physical topological reachability or verify TCP handshake establishment across security groups. In contrast, FalkorDB executes graph traversals in microseconds, enabling real-time query, simulation, and mutation of network state.

The project modelled the enterprise infrastructure as a heterogeneous directed property graph, unifying threat and business dependency graphs in a single database. The Minimum-Weight Cut (Min-Cut) algorithm was employed, which finds the optimal way to separate two nodes while minimizing the cost of severed edges. The agent queried FalkorDB to calculate the optimal cut dynamically, returning the least damaging option to the business.

In the case of a Trojan.Generic reverse-shell detected on a public web server, the agent determined that revoking the DB-Admin-Key resulted in no collateral business damage, while cutting the internal API gateway would cause $500,000 per hour in revenue loss. FalkorDB's query engine confirmed that the surgical cut was the optimal solution, revoking the credential key in just 0.4 seconds without any downtime to the checkout system.