Your dataframes can now anwser graph queries in milliseconds, without a graph database. A Cypher query across 50 account IDs went from 2.7 seconds to 5 milliseconds. Searching 30M timestamps went from 40 seconds to 101 ms. The latest GFQL release adds property indexes, so you can jump straight to the nodes and edges you care about, follow their relationships, and keep the whole workflow inside pandas, Polars, or cuDF. No database to deploy. No separate import pipeline. And these aren't just faster lookups. You can build indexes inside multi-stage graph pipelines and inspect which indexes each query actually uses. Full article below, with benchmarks and runnable examples. pip install graphistry

We’re about to spend most of October on the road, and we’d like to meet you at one of these stops. Here’s where we’ll be: Oct 17: BSidesNYC, New York Oct 19 to 24: BSidesAugusta week, Augusta, GA Oct 27 to 29: [un]prompted II, San Francisco Oct 29 to 30: LASCON, Austin Augusta is the big one. On Oct 21 and 22, Leo Meyerovich and Sindre Breda are teaching a two-day hands-on class on AI agents for security investigations. It’s $595 and registration closes Oct 14. Then on Oct 24, Leo gives a talk on two years of SOC CTF evals for investigation agents. If you’re a SOC analyst, an engineer building agents, or just someone who likes graphs, come find us. Bring a hard investigation, a strong opinion about AI agents, or both. We learn more from what’s breaking for you than from anything we’d put on a slide If you’ll be at any of these, message us and we’ll make time.

GPT-6 Astra and Claude Fable 5.1 are out, and they're pretty compelling if you have the budget. But put them into a real investigation harness, and things get interesting. On CyBT-CTF, 59 incident-response cases worked in Splunk, Astra reaches 69% and Fable 5.1 reaches 61%. GPT-5.6 Sol, an older and smaller model, reaches 76% when running through Louie. The same GPT-5.6 Sol scores just 58% in Codex. Astra is the strongest coding agent we've measured, but only gets to 69% at high thinking effort, at $2.34 per solved case. Fable 5.1 gets 61% at both high and low effort, at $1.19 per solved case. So far, the choice of agent seems to matter at least as much as the choice of model. We haven't run Astra or Fable 5.1 through Louie yet. That's the test we're most interested in next.

The latest botsbench results on the release of GLM 5.3 family are newsworthy not in intelligence for agentic AI investigations, but cost. Run on cybt-ctf, our 59 task SIEM investigation benchmark, we see that Z.ai’s effective answer to OpenAI’s Luna is GLM 5.3 Flash. Also, the story on quants makes GLM 5.3 Flash more interesting as well. As a reminder, just a few months ago, Z.ai’s GLM 5.2 release was the first time we measured an open-weight model performed at frontier levels on botsbench.com investigation tasks. Despite that, OpenAI’s 80% price cuts on GPT-5.6 Luna meant we still preferred OpenAI Luna over GLM 5.2 as both smarter and cheaper. With the new GLM 5.3 family, we are not seeing smarter results on botsbench: the important story is that GLM 5.3 Flash pricing means frontier open-weight AI has effectively caught up to GPT-5.6 Luna in quality and cost. GLM 5.3 Flash means surprisingly little hardware goes a long way. It also gives an extended shelf-life to older GPUs. For the first time, we’re reporting a quant on botsbench: our own GLM 5.3 Flash W4AFP8 that makes it more manageable on older GPUs. Out-of-the-box, GLM 5.3 Flash ships as a 643 GB BF16 release, which typically requires 8 x H200s to run inference. We squeezed to 177GB to run on 2 x H200, with little impact on botsbench scores. For those who are curious, we quantized the routed MoE experts to int4, paired with static float8 activations, and left attention, shared experts and the dense layers at block-float8. The int4 experts are 88% of the weights, so compressing those while leaving the precision-sensitive paths alone cut the size to 177 GB. The main reason we picked this approach was to avoid requiring the small floating-point units only available in recent GPUs, as many of the teams we work with that self-host have GPUs that are a few years old. On GPQA-Diamond the quant scores 90.9% against 91.2% published for the full-precision model. On botsbench, it scored 35/59, compared to 36/59 unquantized. Note that we avoided any cyber-specific fine tuning or abliterations, which bring concerns of overfitting and testing for more unexpected loss of function. Our quant shows general open-weight models are running at quality levels cyber teams would have loved from frontier models last year, and require only a couple older GPUs. Also of note, the top botsbench investigation scores are still from combining the Louie harness with proprietary models - and those lead with a sizeable margin. However, Louie with GLM 5.3 Flash breaks into the top 5 of the global leaderboard, and lands noticeably ahead of regular coding agent harnesses with other models: GLM 5.3 Flash is both good and cheap.

Big news we're bringing From AI Copilot to Commander to BSides Augusta. Two days in the room, October 21-22, 9-5, at the Georgia Cyber Center. The questions we get before every cohort barely change, so here's what the two days cover. Leaders keep asking where to start. Which workflows are reliable enough right now to show ROI, which ones are still too flaky to hand to an agent, and what's close enough to matter next quarter. Analysts (SOC, IR, DFIR, hunt, threat intel, vuln mgmt) ask how agentic AI changes an investigation. Which tools, wired together how? Does RAG still matter, and how should you think about it now? How do you get an agent to run long without losing the thread, inventing things, or quietly spending $400? Engineers & developers want the mechanics: scaling RAG, building custom MCP connectors, setting up evals, knowing whether quality moved or you just changed the prompt. Most of the two days is lab time in our AI cyber range. Connectors (#Kusto, #Splunk, #Databricks), RAG, evals, MCP, agentic long-runs. Two tracks run side by side, prompt-first with no code required or code-first in Python notebooks, so coders and non-coders can attend together and both leave with working artifacts. Vendor-neutral as usual, free & OSS first, and where it's useful we'll show what the production-grade version looks like in Louie.ai and other genAI tools. Doing this in person is the part we are looking forward to. The best moments in these classes are the arguments that break out mid-lab, and those don't happen the same way over Zoom. Sindre Breda, our solution architect and ex police officer and Leo Meyerovich our founder and CEO are teaching. A class like this needs generative AI × security × engineering in the same room and that combination is rare. Between the Boss of the SOC agentic speedrun, the Black Hat training, the U.S. Cyber Command alert-reduction win, and a decade of OSS data work (Apache Arrow, #RAPIDS, GFQL), the tangents alone tend to be worth the two days. In Augusta especially, come argue with us. Your training ticket also gets you into Security Onion Conference on the 23rd and BSidesAugusta on the 24th, plus validated parking in the Cyber Center deck. Bring a laptop. $595, or $495 with code COPILOT-EARLYBIRD before September 1. Registration closes October 7. Link in the first comment. #BSidesAugusta #AI #LLM #Cybersecurity #AgenticAI #RAG #IncidentResponse #MCP #SOC

This one's next week: our CEO @lmeyerov is giving "Breaking Bots 2: Trusting Agentic AI in the Cloud SOC" at the SANS Cloud Security Exchange Summit in San Francisco, Tuesday the 18th. When orgs wire LLMs and agents into things that actually matter like their AI SOC, their anti-fraud program, and their overall trusted model, the decision to trust any of it usually comes down to a number from an evaluation. The trouble is that the exams are now rigging themselves, and not getting fooled has gotten a lot harder. We keep seeing models answer from memorized results without touching a single log line, and even hacking out of their sandboxes to peek at the answers. Agents under test are behaving less like predictable tools and more like advanced persistent threats. Leo will walk through how to measure agents for what matters, what attacks against evals look like in the wild, and how to harden evals so they actually hold up. If you'll be in SF and are into agentic AI or graphs for investigations, reach out and we'll get you time with him! If you can't get to the city, Day 2 streams online for free. And if the timing doesn't work at all, we're out at a bunch more events through the rest of the year: AFCEA/INSA, Aug 26-27 Bethesda BSides Canberra, Sep 24-26 BSides Orlando, Sep 25-26 BSides NYC, Oct 17 BSides Augusta, Oct 24 LASCON, Oct 29-30, Austin Vegas was a good time, thanks to everyone who came by. Happy to chat at any of the rest, we're also running online trainings on AI for investigations at louie.ai/trainings/ai-agent-… Leo's joining a strong group of speakers this year: @anton_chuvakin @fykim @daveshackleford #CloudExchangeSummit #AIsecurity #AgenticAI #AISafety #SOC

Somewhere between the Black Hat pool parties and our standing-room-only research presentations & AI trainings at BSides, we ran our over-worked botsbench agents on the new Kimi K3 and DeepSeek V4 Flash releases that everyone has been talking about. Continuing our naming tradition, we’re dubbing K3 the disappointing chaotic evil “Coin-Eating Dragon” due to its high cost relative to others in its weight class. DeepSeek, however, wins the crown yet again: it’s the price leader for open weight models on the second-tier side of the open weight spectrum, so we’re calling it the chaotic good “Pauper Prince”. You can read the full breakdown in the full article link below We’ll be reporting more open weight experiments ahead, such as on the harness comparison, and as our Louie harness generally gives a +15% boost to models, how the leaderboard gets disrupted when it enters the picture so follow us to get the reports first. Meanwhile, if you’ll be at SANS Cloud Summit in SF, say hello, and if you couldn’t make our sold-out AI trainings at BSides LV, we’ll be running longer 2-day masterclasses on Ai investigations online through the end of summer / early fall.

With Black Hat and AI4 week kicking off on Monday, our pre-announcements are coming to an end. Here’s everything you may have missed that we unveiled around investigation agents & GPU graph tech: -Louie “ae2” new high score on CyBT-CTF leaderboard: CyBT-CTF, the successor to Splunk BOTSv3 botsbench leaderboard that is contamination-free, has the Louie.ai ae2 harness with OpenAI GPT-5.6 series models beating the OpenAI Codex harness by +19% for the new high score. -Agentic Timelining: AI agents that build “maps” for themselves drastically improve investigation quality, run 3X faster, 3X cheaper, and help with one of the worst parts of investigating. -Generative Visual Graph Investigations: Ask questions, generate visualizations, pull context from Splunk, Kusto, Databricks, and run entire GPU-accelerated graph data science pipelines - even without knowing graph data science! -Run GFQL Cypher on polars, polars-gpu dataframes GFQL can now run property queries directly on Polars CPU/GPU dataframes, no database required! It also now beats most engines on both OLTP low-latency and OLAP scale. 100% open source. -The Graphistry 100X Initiative Our first milestone is a new rendering engine that is the first to handle 20M+ edge interactive graphs in the browser today, and even more scaling ahead. -BSides Las Vegas Talks & Trainings: Our team will be sharing our 2+ year research on handling adversarial AI evaluations - the same issue that led to OpenAI agents autonomously hacking Huggingface – plus two free hands-on trainings covering agentic AI investigations and turning logs into graphs. Several years of engineering and research came together into our week of announcements, and we're excited to finally start getting these capabilities into everyone's hands. If you're heading to Las Vegas next week, come say hello. Look below for links to the videos and articles for each of these announcements

One of the biggest lessons from our AI investigation research is that agents must be master mapmakers: When the Louie.ai research team became the first to not only beat the Splunk Boss of the SOC CTF with AI agents, but fully clear it, one of the biggest “aha!”’s was around agents building and reusing investigation timelines. Task completion rates rose from 70% to 96% and investigations ran roughly 3x faster and with 3x fewer tokens. Today's announcement is bringing that capability to Louie.ai through agentic timelining, and as we’ll discuss in later posts, organizationally-structured long-term memory. The video shows Louie creating a live timeline while investigating across connected databases and APIs. Instead of repeatedly searching the same evidence, agents continuously build a structured understanding of what happened. The result is enabling both you and the agent to explore findings through timelines, visualizations, linked evidence, and follow-on questions. Check out the article below for more on how we think about timelining and long-term memory as key layers in the AI era that make agents run better and help tame how organizations approach investigations. If you're at Black Hat or AI4 week in Las Vegas, say hello and see it in action. We'd love to hear how your team is approaching this problem today.

Say hello to the generative era of graph investigations Years in the making, our Louie.ai investigation agent harness and GFQL GPU graph query language are landing into Graphistry to make investigations smarter, easier, and more automatable Our new video shows an analyst easily automating their investigation with plain natural language as they pull up a real graph of 2 weeks of network + device alerts and run commands like: "”” Hey Louie, - describe the bigger clusters - visually highlight the central accounts in each - assemble a background report on the accounts using our standard operating procedure and talking to Splunk, Kusto, and Databricks as needed - link findings to databricks queries "”” No graph database required: The agent can go beyond the initial visualization to reach across outside data silos, pulling in context on-the-fly from every Louie-connected database We’re rolling out generative graph investigations to Hub and self-hosted users over the next few weeks, including the free tiers. With Louie.ai and GFQL topping leaderboards, Graphistry is the only place that can handle generative graph investigations at this quality and visual scale What would you investigate if you never had to write a query? Reply and tell us, it'll help shape where this goes next! See everyone at Black Hat in BSides Las Vegas & AI4 - message us if you want to catch up in person. @JohnLaTwC @daveherrald