Beyond RAG: Graph-Based and Agentic Retrieval Outperforms Vector Search for Cyber Threat Intelligence
arXiv·medium signal
Hamzic et al. systematically evaluate graph-based and agentic retrieval against traditional vector RAG for cyber threat intelligence, where queries require reasoning over relationships between threat actors, malware, and vulnerabilities across multiple documents. Traditional vector retrieval struggles because relevant evidence is distributed across text fragments. The graph-based and agentic approaches significantly outperform, providing a concrete playbook for CTI teams adopting RAG.