A method for policy-based analytics includes retrieving, from a graph database, first data representing a first entity in a computing environment, a second entity in the computing environment, and an event associated with the first entity and the second entity; predicting, according to a risk indicator model, a risk associated with the first entity based at least in part on the event; and updating the graph database to include second data representing the risk and a risk indicator. The first and second entities are stored as properties of a first vertex and a second vertex, respectively, and the event is stored as a property of an edge between the first vertex and the second vertex. The risk indicator is stored as a property of a third vertex. The risk is stored as a property of an edge between the first vertex and the third vertex.