GraphRAG detection plans survive full IOC rotation where naive RAG collapses to 29%.

arXiv 2608.13050 fed the same CTI report, same instructions and same LLM to Microsoft GraphRAG versus vector-similarity RAG, then rotated every IP, domain and file hash. In an APT28 case study the GraphRAG plan kept 100% of its detections firing, the naive plan kept 29%. Replicates across nine real CTI reports from four vendors. The authors note prompt wording matters nearly as much as the retrieval backend, which is an honest caveat most papers skip.