Thanks, my actual product does that now. (qtra.io, collaboration tool for product level TRAs, exports to Jira for normal agile backlog grooming of threat/risk stories into iterations and development, shrinks TRAs from weeks to hours,) It generates a graph on the back end as well, aggregating risk data across all customers, without proprietary vuln data in it.

However, reality is on this project, all the input data exists in spreadsheets, which means you have to normalize it into your graph ontology data model. The SaaS here would be something like Graphene or hosted Neo4j.

If there were a graph model for something like powerBI for graphs, that could be a play. Else, it's more of a high dollar consulting solution.

Finding that SaaS in enterprise is limited because most enterprise people live in spreadsheets, which are both orders of magnitude more sophisticated, yet stunted compared to SaaS. But for all it's limitations, excel is turing complete, and your CRUD application never will be, even if the users don't know what that means. Enterprise tech is about generating data to drive conversations, it isn't about solving problems because managing that problem is somebody's job.

If a CIO came to me and said "fix my company," I would say, "sure, give me your data, then 6-12 months to herd all your cats" and I could do it. Nice lifestyle, but there's no exit in that.

Yes indeed. I work for a startup that offers an intelligence analysis platform built on a knowledge graph. It is open source.

https://github.com/vertexproject/synapse

SaaS is in the works.

to which extent does it scale? are we limited to in memory graphs?

We’re releasing a cluster version soon. It is a persistent graph (so not limited to RAM).

A single host can probably handle a billion nodes or so. Our largest in-production graph is about a third of that.