screencapture-socure-identity-verification-solutions-2025-06-12-17_51_50

The Local Graph Has Arrived: Turning Data Silos into Connected Intelligence

web 8399661885 blog image for riskos launch 1 720 (1)

One Platform, Infinite Possibilities: The End of Fragmented Risk Management with RiskOS®

Transform Digital Onboarding with Socure Advanced Pre-Fill

WEB_Signals launch blog_thumbnail_2025-09 (2) (1)

Transparency and Control in the Age of AI and Complex Fraud

A login. A transaction. A password reset. Every touchpoint is a tiny glimpse into how an identity interacts with your brand. But identity trust — arguably the most valuable digital currency — isn’t built on a single moment. It’s built through understanding how each moment is connected to the ones that came before it.
Even the most sophisticated organizations struggle to see the full picture within their own walls. Without connected intelligence across user journeys and lines of business, teams spend valuable time piecing together insights that should be easy to find, and use to make identity risk decisions at scale.
That’s why we’re excited to introduce the Local Graph. Much like Socure’s Identity Graph, the Local Graph connects every part of an identity to its associated activities, signals, and outcomes from across your entire organization into a single, time-aware framework. Think of it as your custom intelligence hub — showing how an identity appears in your ecosystem today, how it has behaved in the past, and how all the individual elements connect over time.
And to turn that intelligence into action, we’re also launching two powerful new capabilities in <a href="https://www.socure.com/solutions/riskos">RiskOS®</a>: Persistent Profiles and Connected Rule Writing. These features bring the Local Graph to life, giving teams the ability to explore historical activity, uncover cross-journey connections, and build automated, data-driven rules that act on those insights in real time.
<h3>Connecting the Dots: Persistent Profiles</h3>
Imagine you’re an analyst investigating a potential fraud case. You pull up a user’s profile, and instead of a static snapshot, you see their entire journey unfold — every known interaction, associated identity element, and outcome, all in one dynamic, persistent view.
That’s a Persistent Profile. And it’s not centered around just a user — it could be any identity element such as a device, email, phone, address, IP, or even a custom entity. Each profile captures its full history: every activity, linkage, and signal your organization has historically seen.
The experience feels like tracing a story rather than sifting through data. Using the timeline view, you can watch that story unfold chronologically, seeing exactly when a user opened an account, logged in, made a transaction, or filed a dispute. 
When you need to dig deeper, the table view table lets you filter and compare those moments side-by-side, uncovering subtle changes or emerging patterns across time, workflows, or lines of business.
You can even view “one-hop” relationships or connections — like a single device linked to multiple users — to uncover anomalous or risky relationships that might otherwise go unnoticed. These linkages are listed clearly at the top of each profile for quick, easy access.
<iframe loading="lazy" title="Persistent Profiles" src="https://player.vimeo.com/video/1144878896?dnt=1&amp;app_id=122963" width="500" height="311" frameborder="0" allow="autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe>
Persistent Profiles were built specifically to help eliminate blind spots, so your teams can understand the full context when making risk decisions.
However, we know that most risk decisions happen long before a human ever gets involved. That’s where Connected Rule Writing comes in.
<h3>Making Smarter Risk Decisions at Scale: Connected Rule Writing</h3>
Until now, automated decisions have been made based only on the data available at that moment. Connected Rule Writing brings past events and context into the equation.
This means your automated rules can now reference previous activity, velocity patterns, and relationships across identities and identity elements to make smarter decisions at scale.
For example, you can create rules that trigger if a device appears across multiple accounts in minutes, if a phone number is tied to repeat disputes, or if a user’s login velocity suddenly spikes. Rules can also draw from events in other journeys — referencing what happened at account opening, during a password reset, or in prior transactions.
<iframe loading="lazy" title="Connected Rule Writing" src="https://player.vimeo.com/video/1144878881?dnt=1&amp;app_id=122963" width="500" height="311" frameborder="0" allow="autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe>
By connecting current behavior with historical signals, Connected Rule Writing helps teams spot emerging risk earlier, adapt to new attack patterns faster, and automate smarter trust decisions at scale.
The best part? You can build and deploy these rules in seconds, with no engineering or technical resources required.
<h3>The Local Graph In-Action</h3>
<h4>Scenario 1: Account Takeover Prevention</h4>
A prepaid debit card provider has a simple rule in place to protect against <a href="https://www.socure.com/glossary/account-takeover">Account Takeover</a> (ATO): block any device after five failed login attempts. 
So when a fraud analyst receives an ATO claim and pulls up the customer’s User ID in RiskOS, he’s surprised to see the last login was completely clean (correct password on the first try). Curious, the analyst clicks into the Device Profile associated with that login. That’s where the hidden pattern reveals itself.
This single device had successfully logged into four different customer accounts in the last two hours.
Unfortunately, the fraudster knew exactly how to beat the system. They weren&#8217;t guessing passwords; they were using stolen credentials to access multiple victim accounts, one by one. And because they never hit the failure limit on any single account, they got away with it.
With Connected Rule Writing, the team can now close this loophole across their entire organization. For example:
<ul>
<li style="font-weight: 400;" aria-level="1">IF a Device ID is associated with more than two (2) unique User IDs within 24 hours THEN flag for &#8220;Account Takeover.&#8221;</li>
</ul>
Now they can stop account takeovers earlier and prevent both major losses and unhappy customers.
<h4>Scenario 2: Marketplace Collusion</h4>
Let’s take a home-services marketplace where users can be both service requesters and providers. Over time, the fraud team starts noticing that certain providers have an unusually high number of five-star reviews.
The fraud analyst copy/pastes one particular service provider’s email ID in the search bar, and pulls up the profile. The analyst begins scanning the timeline of activities associated with the email — onboarding, service listings, and completed jobs.
Curious, the analyst clicks into the linked device profile. That’s where the pattern reveals itself. This single device ID is tied to 64 different emails — and all but one are listed as homeowners. It’s the tell-tale sign of a coordinated scheme: the provider is using a single device to create fake customer accounts, submit requests to their own business, and post glowing reviews to inflate their reputation.
To confirm the behavior, the analyst checks a few other flagged providers and finds similar overlap — one device associated with dozens of supposed homeowners. What looked like independent activity is actually a network of self-dealing accounts.
With Connected Rule Writing, the team can now automate detection of this behavior across the entire marketplace. For example: 
<ul>
<li style="font-weight: 400;" aria-level="1">IF a device or IP appears in both service provider AND requester workflows within a 24 hours THEN flag for review.</li>
<li style="font-weight: 400;" aria-level="1">IF a single device is linked to more than three (3) accounts THEN tag as potential collusion.</li>
</ul>
Those conditions can be created directly in the RiskOS Workflow Builder, automatically tagging patterns like “Potential Collusion” or “Shared Device.” 
Previously, this kind of collusion would have taken weeks to confirm and required heavy engineering support. Now, teams can see the full story instantly and build rules that stop the next instance before it happens — in minutes.
<h3>Where to Find These New Features</h3>
Both features will be available in late January 2026 within RiskOS.
<h4>Persistent Profiles</h4>
There are three simple ways to access a profile: 
<ul>
<li style="font-weight: 400;" aria-level="1">Use the search bar at the top to look up any internal UserID, email, device, phone, or IP, and open its full profile.</li>
<li style="font-weight: 400;" aria-level="1">Click the Profiles tab in the left sidebar to browse and filter by type.</li>
<li style="font-weight: 400;" aria-level="1">Within a Case, click any linked profile to view its full history and relationships.</li>
</ul>
<h4>Connected Rule Writing</h4>
Build smarter rules directly in the RiskOS Workflow Builder. When creating or editing a rule, look for the new Aggregation inputs — these let you reference historical events, cross-journey attributes, and velocity patterns directly in your logic, no engineering needed.
<h3>Smarter Risk Decisions Start Here</h3>
Every decision, whether automated or human, gets stronger with context. RiskOS empowers your team with context, control, and the confidence to make the right decision across every moment that matters. 
Ready to see the Local Graph in action?
<a href="https://www.socure.com/talk-to-an-expert">Get started now</a> »

The Local Graph Has Arrived: Turning Data Silos into Connected Intelligence

Related Posts

Emma Griffin