TITAN: Graph-Executable Reasoning for Cyber Threat Intelligence

TITAN (Threat Intelligence Through Automated Navigation) is a framework that connects natural-language cyber-threat queries with executable reasoning over a structured knowledge graph. It integrates a path-planner model, which predicts logical relation chains from text, and a graph executor that traverses the TITAN Ontology to retrieve factual answers and supporting evidence. Unlike traditional retrieval systems, TITAN operates on a typed, bidirectional graph derived from MITRE ATT&CK, allowing reasoning to move clearly and reversibly between threats, behaviors, and defenses. To support training and evaluation, we introduce the TITAN Dataset, a corpus of 88,209 examples (Train: 74,258; Test: 13,951) pairing natural-language questions with executable reasoning paths and step-by-step Chain-of-Thought explanations. Empirical evaluations show that TITAN enables models to generate syntactically valid and semantically coherent reasoning paths that can be deterministically executed on the underlying graph.