Home / Articles / Ten questions, one graph / Versions / v1.1.0
Ten questions, one graph: what changed in v1.1.0
From v1.0.0 (2026-10-19, 24f88da2c) to v1.1.0 (2026-10-19, 3b0e7fd8c), paragraph by paragraph.
0 paragraphs added, 0 removed, 1 changed in place, 44 unchanged. About 0 words added and 0 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
1 unchanged paragraph
Summary: Phil Venables has written down ten questions a CISO's management tool should be able to answer, from where an extra £250k$250k would reduce the most risk to which 100 humans and 100 agents would do the most damage if they went bad. His point is that most tools cannot, and that answering them needs an enterprise knowledge graph, precise risk models and measured data, not an LLM wrapper with dashboards. I agree, and I think the questions show something more: every one of them is a graph question. None can be answered from one part of the company; all of them can be answered from the whole, once the connections are there, and then the answer becomes obvious, the way the end of a whodunit does. Our past work on risk acceptance already has half of this: every risk has a holder, every holder has a boss, every path ends at the board, and there is no deny button, only accept for an interval, fund or fix. So we built a twin of an invented retailer, put its board, risks, holders, processes, systems, suppliers, channels, controls, incidents and 100 humans and agents in one graph, and answered all ten questions on it, each with the part of the graph it came from, its evidence, and the decisions it proposes, traced to the board. It is in a vault you can open.
43 unchanged paragraphs, under In short {#in-short}, Ten questions a tool should answer {#questions}, Every question is a graph question {#graph}…