The SOC funnel is a graph problem — and Meta just published the blueprint

Meta's ads team published how they optimize for conversions that almost never happen. Swap "conversion" for "confirmed incident" and they have described the AI-SOC's core problem — with worse label scarcity on our side.

In July, Meta's engineering blog published a piece with a title only an ads-ranking engineer could love: Exploring hierarchical interest representation for Meta Ads deep funnel optimization. It is about showing better ads. It is also, unintentionally, one of the clearest public validations yet of how a security operations platform should be built — and we want to walk through why, because the mapping is close enough to be uncomfortable.

Meta's problem decomposes into three parts. Signal scarcity: the events they most care about — deep-funnel conversions, someone actually buying the thing — are vanishingly rare relative to impressions. Scale complexity: billions of users, millions of advertisers and ads, woven into a graph too large to reason about directly. Long-range relationships: the pattern that matters often connects entities that are barely connected, several hops apart, across different node types.

Now read that back as a defender. The events you most care about — confirmed compromises — are vanishingly rare relative to the telemetry. Your estate is a heterogeneous graph of identities, hosts, applications, service accounts, documents, and findings, too large to reason about directly. And the pattern that matters — an attack campaign — is precisely a long-range relationship across barely connected entities: a phished contractor account, three hops later, touching a backup server it has never touched before.

The security funnel is events → alerts → incidents → breaches, and it is deeper and sparser than any purchase funnel. A mid-size enterprise emits billions of events a year and confirms perhaps a few dozen real incidents. If Meta considers their conversion signal too sparse to train on directly, security's is hopeless — which is exactly the right conclusion, and the industry keeps refusing to draw it. Every vendor promising a detection model trained on "confirmed incidents" is promising a model trained on the emptiest label set in enterprise software.

Meta's answer is not more labels. It is architecture. Three pieces of it transfer almost verbatim to security.

Piece one: the hierarchy is the insight

The core observation in Meta's post is a tradeoff most graph practitioners learn the hard way: dense, stable relationships imply a coarse abstraction; sparse, specific connections live at a fine one. Raw user-ad interactions are sparse and noisy. So Meta projects the raw graph upward into what they call a primitive interest graph — a learned, denser, more stationary layer — and then cascades further into coarser super-graph levels, each level serving different downstream applications.

Security operations has been groping toward the same ladder for a decade without naming it:

This is not an analogy we are stretching to fit. It is literally how Setu is built. Raw OCSF events are projected into an entity graph — typed, weighted, time-decayed, exactly the substrate Meta describes. Entity-level activity is clustered into operations: our Attack Dispatches, where a bipartite clustering pass groups alerts that share identities and infrastructure into a single narrated campaign. And recurring operations are abstracted once more into playbook prescriptions — the shapes of response that a SOC should stop performing manually.

Each level is denser and more stationary than the one below, and each level answers a different question. The raw level answers "what happened at 03:47." The entity level answers "what is this identity's blast radius." The operation level answers "is this one attack or forty alerts." The playbook level answers "what should we automate." Meta's point — and ours — is that no single representation serves all four questions, and systems that try to answer campaign-level questions from event-level representations are doing archaeology with tweezers.

The honest caveat: today, our topmost layer is curated. Our playbook archetypes are a fixed vocabulary we chose, informed by what recurs across real SOCs. Meta's most interesting contribution is making that layer learned — which brings us to the second piece.

Piece two: a learned vocabulary of meaning

Meta's system emits two outputs. Continuous embeddings, for ranking and similarity — everyone does that. And something rarer: Bag-of-Meaning tokens — discrete interest concepts, produced by quantizing the learned space, that support inverted-index retrieval, set operations, and, critically, interpretability. A discrete concept can be named, audited, counted, and argued with. An embedding cannot.

Security's equivalent of a concept vocabulary already exists — it is called MITRE ATT&CK — but it was written by humans, top-down, and every SOC knows the gap between the taxonomy and what their estate actually does. The Meta result points at the alternative: learn the behavior vocabulary from the tenant's own graph, bottom-up, and let the human taxonomy be a labeling aid rather than the representation. The behaviors that recur in your estate — this shape of credential use, this pattern of service-account sprawl, this rhythm of data movement — become discrete, nameable tokens because they earned it statistically, not because a committee enumerated them.

We care about this for a specific reason: everything downstream of the graph gets sharper when the middle of the hierarchy is learned, and it is where our own roadmap points. Deception targeting goes from "put honeytokens near high-centrality nodes" to "this tenant has a credential-harvest behavior concentrated in this subgraph — recommend planting there." Playbook discovery stops being limited to the archetypes we shipped and starts surfacing shapes we did not anticipate. A learned vocabulary is also the honest answer to a question we get in every technical evaluation: how do you know your categories fit my environment? The only durable answer is: because your environment generated them.

Piece three: supervision without labels

Here is the part every security ML team should tattoo somewhere visible. Meta does not solve label scarcity by collecting more labels. They solve it with self-supervised cross-view distillation: sample a broad "teacher" view and a narrow "student" view of the same node's neighborhood, and train the student to predict the teacher's cluster assignment. No conversion required. The graph supervises itself, and the rare true conversions merely ground a representation that was already trained on structure. A second objective — predict whether an engagement edge exists, given the nodes, the edge type, and the time — anchors the whole thing in observed behavior. That one has a name older than deep learning: link prediction.

Translate it: the analyst-verdict problem. Every SOC vendor wants true-positive/false-positive labels; every SOC produces a trickle of them, biased toward whatever the queue surfaced last quarter. If your learning strategy needs analysts to label their way to a training set, you do not have a learning strategy — you have a wish. But an entity graph supervises itself the same way Meta's does. Does this identity touch this host, this week, given everything else? A model that learns your estate's edge structure has learned "normal" without a single verdict — and the edges it assigns low probability to, that then appear anyway, are the interesting ones. The handful of real verdicts you do collect become what they should have been all along: calibration, not curriculum.

One more Meta discipline worth stealing outright is the least glamorous one: temporal causality. They enforce hard cutoff timestamps everywhere in training so the model never sees the future. Security evaluations violate this constantly — replaying last month's incident against a graph that already contains the incident's own artifacts, then celebrating the detection rate. If your attack-replay numbers were computed against as-of-breach graph state, say so. If they were not, they are flattering you.

What does not transfer — and why that is the interesting part

We wrote previously about why pretrained security AI does not transfer across estates, and this research does not change that conclusion — it sharpens it.

Do not copy the machinery. Meta runs transformer encoders with structural attention biases, computing each bias term on the fly so the pairwise matrix is never materialized, because at billions of nodes nothing else fits in memory. An enterprise estate is thousands to low millions of entities. At that scale the classical toolkit — personalized PageRank, betweenness, influence-maximization placement — is not a compromise; it is the correct choice, auditable and cheap enough to run inside the customer's own boundary. Cargo-culting hyperscaler machinery onto tenant-scale graphs is how security products end up needing a GPU cluster to answer questions a well-indexed graph answers in milliseconds. Take the objectives and the hierarchy. Leave the kernels.

And do not copy the pooling. Meta's advantage is one graph containing everyone, and the tempting security translation is "pool all customers' graphs and pretrain across them." We think that instinct is wrong for this industry — not because it would not help the model, but because whose data trains whose model is becoming a sovereignty question customers ask explicitly, and "your telemetry improves your competitor's detection" is a sentence no CISO should have to say out loud. The self-supervision result is what makes the sovereign path viable: if the graph supervises itself, each tenant's model can be trained inside each tenant's boundary, and scarcity is solved by structure rather than by pooling.

The quiet part: representation beats plumbing

Step back from the mechanics and the post makes one strategic claim that matters more than any of them. This system is an upstream representation layer — one learned artifact that feeds retrieval, ranking, and personalization downstream. The value did not concentrate in the pipes that move impression data around Meta. It concentrated in the layer that turns the graph into meaning.

Security is mid-way through a "data fabric" wave: normalize everything, route everything, query everything, federate everything. Necessary — and not where this ends. A fabric with no topology can tell you what it ingested. It cannot tell you what is connected to what, which is the only question an attacker is asking. Meta just made its bet public, in a neutral domain with more engineering resources than the entire security industry: when signals are sparse and entities are heterogeneous, the durable asset is the representation layer over the graph — the pipes are what you build so the layer has something to learn from.

The SOC funnel is a graph problem. The conversions are rare, the entities are heterogeneous, the relationships are long-range, and the labels will never come in volume. That is not a lament; as of this month there is a public blueprint for it, drawn at the largest scale on earth. The remaining question for security vendors is the one Meta's post answers by existing: is your graph a diagram in the pitch deck, or is it the thing the product actually computes on?

Ours computes.