Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Property graphs can help application-security teams reason about whether untrusted input can travel through a codebase to a sensitive operation—not just whether an individual line matches a risky pattern. In a code property graph (CPG), program structure and relationships such as calls, control flow and data flow are represented together, allowing analysis to trace and rank possible attack paths. That can improve context and prioritization, but a path found in static code is not, by itself, proof that an attacker can exploit it.
What the Qwiet AI use case says—and what it does not establish
Qwiet AI, now presented as Qwiet AI by Harness, describes a proprietary code property graph for mapping source code, predicting attack paths and identifying vulnerabilities. The claim is associated with a Data Science Central interview featuring founder and CTO Chetan Conikee, as referenced in Qwiet AI’s LinkedIn post. The public information available here does not establish the graph schema, model architecture, supported languages, accuracy, false-positive rate or present-day product availability. Treat the description as a vendor use case, not independent validation of performance.
The broader technical idea is useful beyond any one vendor: when security depends on how code elements connect, a graph can make those relationships queryable. A 2025 ACL program page describes research into directed heterogeneous graphs for multi-hop code localization; that is evidence of a broader research direction, not proof of Qwiet’s product results. See the ACL 2025 program.
What a property graph represents
A property graph consists of nodes and relationships, with attributes attached to either. In code analysis, nodes can represent program elements, while edges capture how those elements relate. Properties add context that a bare connection would not convey.
#1 Best Overall
| Graph element | Code-security examples | Why it matters |
|---|---|---|
| Nodes | Files, functions, variables, endpoints, database calls, libraries, or external inputs | They identify the code entities and security-relevant elements being analyzed. |
| Properties | Symbol name, type, source location, language, repository, commit, ownership, or taint state | They allow queries to filter or prioritize relationships by context. |
| Edges | Calls, imports, inheritance, control-flow transitions, data flow, reads, writes, sanitization, or authorization checks | They connect code elements into paths that can be inspected or ranked. |
A property graph is not one single analysis. A code property graph generally combines several views of a program:
- Abstract syntax: how expressions, statements and declarations are nested and structured.
- Control flow: which statements may execute after others, including branches and exception paths.
- Data flow: how values move through assignments, parameters, calls, returns and transformations.
- Call relationships: which functions or methods can invoke others.
- Dependencies and semantics: imports, library use, framework entry points, and security annotations where modeled.
A CPG can combine these views so a query can follow an HTTP parameter through several calls, account for a conditional branch, and check whether a recognized control interrupts the path to a database operation. An abstract syntax tree alone describes structure; a dependency graph alone describes package relationships. Neither necessarily answers that combined path question.
How graph analysis can find a possible attack path
Consider a web request whose parameter is inserted into a database query. The relevant security question is not only whether query-building code uses string concatenation. It is whether an attacker-controlled value can reach an execution API without effective parameterization or validation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Untrusted HTTP parameter
↓
Controller argument
↓
Helper function
↓
String construction
↓
Database execution API
↓
Sensitive database operationA graph-based analysis can try to connect the source (the request input) to the sink (the database execution API), across functions and data transformations. It may also look for sanitizers, parameterized calls, authentication checks, and relevant branches. The result is a candidate path for review—not an automatic finding of real-world exploitability.
Questions a reviewer should ask about the path
- Is the endpoint externally reachable, and is the value actually attacker-controlled?
- Does parameterization or another effective control break the unsafe flow?
- Does authentication merely identify a user, or is authorization checked for this specific action and object?
- Is the relevant branch reachable in the deployed configuration, or is it dead, test-only, or disabled behind a feature flag?
- Does the affected service contain sensitive data, and is the deployed dependency version affected?
The same path-oriented reasoning can help investigate shell execution, file writes, template rendering, deserialization and outbound requests. It can also help determine whether a vulnerable library function is called from an externally reachable route. Whether a particular product models these cases accurately depends on its language, framework and library coverage.
What “prediction” can mean
The word prediction can describe several distinct capabilities. A graph traversal is not automatically machine learning, and a risk score is not the same thing as a demonstrated exploit path.
| Capability | What it does | What it does not prove on its own |
|---|---|---|
| Reachability analysis | Checks whether a source or entry point can connect to a sink through modeled program relationships. | That the path is exploitable in production. |
| Path ranking | Orders candidate paths using factors such as exposure, confidence or asset context. | That the ranking is accurate unless the method is evaluated. |
| Vulnerability classification | Labels a pattern or path as a likely vulnerability type. | That the label is correct for every framework or code pattern. |
| Risk prioritization | Estimates which findings warrant earlier attention. | That lower-ranked findings are safe to ignore. |
| Change prediction | Estimates whether a commit or changed path may introduce risk. | That a change will cause a vulnerability or that unchanged code is safe. |
| Machine-learning inference | Uses learned patterns or labeled examples to estimate a class or risk. | That the result is a deterministic program-analysis proof. |
A system may combine deterministic static analysis with statistical scoring, but buyers should ask which part produced each result. The available public description of the Qwiet use case does not specify how graph traversal, static analysis and machine learning are divided.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Where graphs can improve security signal
Traditional rules remain useful for known unsafe calls and coding policies. A graph can add context where a finding depends on relationships beyond one line or function: user input may pass through helper layers, a security control may live in middleware, or dependency risk may matter only when a vulnerable call is reachable. When analysis traces a plausible path, teams can use that context to prioritize review and focus remediation.
Graphs can also support changed-code analysis: a pull request may alter a path even when the dangerous sink is in an untouched file. Whether a tool does this incrementally, deduplicates findings across branches, or connects results to deployed services is product-specific and should be tested. Graph analysis complements rather than replaces dependency analysis, secret scanning, dynamic testing, fuzzing or threat modeling.
How a practical CPG security pipeline works
- Ingest code and build context. Collect repositories, build files, lockfiles, dependency manifests, compiler settings, generated-source rules, branch and commit information. Failed builds or missing private dependencies can leave important relationships out of the graph.
- Parse and normalize. Convert supported languages into an intermediate representation while preserving file and line locations, symbols, types, call and return structure, branches and exception paths.
- Construct program relationships. Add syntax, control-flow, data-flow, call, import, inheritance, read/write and dependency edges. Model taint propagation and controls such as validation, sanitization and authorization where possible.
- Attach security context. Identify likely sources, such as request parameters or uploaded files; sinks, such as SQL or shell execution; trust boundaries; sensitive assets; and deployment or ownership details.
- Query and prioritize paths. Search for source-to-sink flows, public entry points reaching sensitive operations, changed paths, and vulnerable calls. A ranking layer may consider reachability, exposure, asset sensitivity, confidence and remediation cost.
- Present evidence for review. Show the entry point, intermediate calls, sink, relevant control or missing control, code locations, path rationale, confidence and a remediation suggestion.
Illustrative query logic might ask: “Find externally reachable entry points that reach sensitive operations without an accepted validation or authorization control.” A Cypher-style query could express a source-to-sink traversal, but query syntax and semantics vary by graph platform; no example here is a confirmed Qwiet command. A score without a traceable path is harder for developers to assess than a result that shows its supporting code flow.
Where the approach can fail or mislead
- Dynamic dispatch and reflection: A static call graph may miss runtime-selected methods, plugins, reflection or dependency injection. An over-approximation can add infeasible paths; an under-approximation can miss real ones.
- Sanitizer mistakes: The analyzer may fail to recognize a custom sanitizer or may treat an ineffective check as protective. Function names alone do not establish security semantics.
- Framework-generated behavior: Routes, serializers, ORM operations and authorization can be indirect or generated. Application-source parsing may not capture them completely.
- Aliasing and transformations: Values can be copied, renamed, encoded, decoded, serialized, concatenated or stored in collections. Weak data-flow modeling causes both false positives and false negatives.
- Dead or conditional code: A path in unused, test-only, dormant or feature-flagged code is not equivalent to a path exercised by a production service.
- Third-party dependencies: A vulnerable package may be installed but its affected function may not be called. Conversely, first-party-only analysis may miss risk that flows through a dependency.
- Polyglot and incomplete repositories: Cross-language edges are difficult, and partial checkouts, failed builds or unavailable packages can omit relationships.
- Business logic and authorization: A graph may show that some authentication check occurs without proving the correct user can perform the specific action. Human threat modeling remains important.
- Model drift or bias: Learned predictions can reflect the limits of historical labels and lose accuracy as frameworks, coding styles and attack techniques change.
Static reachability is evidence that a path may exist in the modeled program. Production exploitability additionally depends on runtime configuration, deployment, data, access controls and attacker capability.
Recommended Free Tools
How to evaluate a graph-based security product
Ask the vendor to demonstrate the tool against representative repositories and known issues, rather than relying on a general claim that it predicts attacks. Record the exact code, build state, configuration and expected outcomes so results can be compared with other tools.
Best Value
- Coverage: Which languages, frameworks, libraries, generated code and third-party dependencies are modeled? How are reflection, macros, dynamic dispatch and cross-language flows handled?
- Build behavior: What happens when dependencies are unavailable, a build fails, or only part of a repository is present? Can the product show what was not analyzed?
- Analysis method: Which findings come from deterministic rules or reachability, and which from statistical models? How are sanitizers and framework protections recognized?
- Validation: Ask for precision, recall or false-positive measurement methods, benchmark datasets and dates, reproducibility details, and evidence of production reachability. A benchmark number without conditions is not enough to compare tools.
- Explainability: Can developers inspect the source, path, sink, controls, code locations and reasoning behind each priority?
- Workflow and scale: Check incremental pull-request analysis, deduplication, baselining, ownership, issue-tracker and CI/CD integrations, scan times, repository limits and resource needs.
- Remediation: Does the suggested fix target the correct abstraction and preserve intended behavior? Can developers distinguish confirmed, likely and heuristic results?
- Data handling: Confirm whether source code leaves your environment, how long it is retained, and whether it is used to train models.
- Interoperability: Verify export and integration needs such as SARIF, SAST, SCA, SBOM and vulnerability-management workflows.
For a pilot, select repositories with known vulnerable and safe paths, include the frameworks and build conditions used in production, and have engineers adjudicate a sample of findings. Measure useful confirmed findings, missed cases, review effort and time to remediate—not just the number of alerts generated.
How CPG analysis fits with other security controls
| Control | Best suited to | How it complements graph analysis |
|---|---|---|
| Traditional SAST | Deterministic rules for common coding flaws and policy checks. | Rules can catch local patterns; graph context may help examine deeper paths. |
| Software-composition analysis (SCA) | Known vulnerable packages, licenses and supply-chain inventory. | CPG-style reachability may help assess whether affected library code is used, when supported. |
| Secret scanning | Credentials and tokens committed to code. | Addresses a different class of exposure from program-flow analysis. |
| DAST and IAST | Behavior observed in a running application; IAST connects runtime observations with code. | Can validate behavior that static models cannot fully resolve, subject to test coverage. |
| Fuzzing | Input-driven crashes, parser bugs and memory-safety issues. | Exercises runtime behavior but needs useful harnesses and coverage. |
| Threat modeling | System trust boundaries, abuse cases, authorization and business logic. | Supplies context a source-code graph may not infer from code alone. |
Open-source code-property-graph tooling can be useful for research and custom queries, while commercial platforms may provide managed workflows and integrations. Their supported languages, maturity and operational trade-offs should be verified against current documentation; the mere use of a graph does not make two implementations equivalent.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
