Picture two records.
One shows “Robert Miller,” born 03/04/1982, at an address in Manchester. The other shows “Rob Miller,” born 1982-04-03, at an address in Salford, a few miles away.
Nothing about either record looks wrong. But they’re the same person, and right now, nothing in your systems has told anyone that.
This happens more than most organisations realise, and it isn’t always accidental. Sometimes it’s simply what happens whenever information is entered more than once, by more than one person, in more than one place. But sometimes it’s deliberate: someone giving a slightly different name or date of birth specifically because they know a system without proper entity resolution won’t catch it.
Entity resolution is about making that connection by recognising that multiple records, however different they look on the surface, actually refer to the same real-world person, organisation, location, or thing.
In this article, we’re going to introduce the basics of entity resolution and why it’s a critical component of any connected intelligence picture. GraphAware Hume isn’t an entity resolution engine itself, but it’s built to support the entity resolution workflows that mission-critical investigations demand.
Later in this series, we’ll look at how GraphAware Hume works alongside dedicated entity resolution engines to bring that connected picture to life.
Why does entity resolution matter for intelligence analysis?
The Robert Miller example isn’t a one-off. It often happens within a single system: one officer books someone one way, another books the same person a slightly different way months later. Neither is wrong; they just didn’t know they were describing someone already on file.
Now bring a second database into the picture: a different agency, a financial institution, a border system, whatever your organisation is trying to combine into one view. That same individual might exist there too, under yet another spelling, or with a phone number the first system never captured. Bring the sources together without a robust entity resolution process, and instead of one clear picture, you get several disconnected fragments, each holding information the others don’t.
For an analyst, that has real costs. Weeks can go into working on what looks like several separate, lower-priority leads, without realising it’s one high-priority target hiding across them all. A link between two unrelated-looking cases can go entirely unnoticed because the person connecting them is filed under two different identities, one per case.
Even when analysts do reach a conclusion, they often can’t be fully confident in it. They know the picture in front of them was built from records that might not all have been properly connected, but they have no way of knowing which pieces are missing or how much of a difference those missing pieces would make.
None of this is a shortage of information. It’s a failure to recognise that the information already points to the same thing.
Why is it essential for a graph-powered approach?
Some of what makes matching records difficult is fairly mechanical. Today’s date alone could be written in many different ways: 27 July 2026, 27/07/2026, 2026-07-27, and so on, but a date is still a date, and rules can normalise that kind of variation reasonably easily.
Other attributes are intrinsically ambiguous, rather than just inconsistently formatted. The harder problem is names, addresses, and free text, where the difference isn’t a formatting quirk. It’s simply how people write, abbreviate, misspell, or describe the same thing, and no simple rule catches all of it.
That problem gets bigger, not smaller, once you’re building a knowledge graph. A graph’s value comes from the connections it can show you: who’s linked to who, which cases share a common thread, which network a person is part of. If one person exists as two separate, unresolved nodes, the graph doesn’t just hold a small inconsistency. It quietly loses every connection that person actually has, splitting their real network into two smaller, less useful ones.
Get it wrong and analysis that is run on top, such as who’s connected to who and which entities matter most, inherits the same blind spots.
Why entity resolution is never really finished
Running entity resolution once and considering the job done doesn’t hold up in practice. Three things keep moving underneath it.
People and organisations don’t stay still. Someone moves address, gets a new phone, is issued a new passport. A company brings on a new director, or a criminal network forms a new connection. None of that is a data problem so much as it’s just life continuing as normal, but every one of those changes could break a match that used to be correct, or create one that didn’t exist before.
Data moves faster than investigations can keep up with it. New records, transactions, and communications arrive constantly, and an analyst might only later uncover an unexplained asset, a new phone number, or a previously unknown alias, buried in data that arrived long before anyone had time to properly connect it. On top of that, the rules used to match records rarely stay fixed either; teams refine them as they learn more, which changes what gets caught going forward, not just what’s caught the next time the process runs.
And the data sources themselves aren’t static. Systems get updated, new sources get connected, and evidence that simply wasn’t available before suddenly is, evidence that might confirm, contradict, or completely reshape a match made months earlier.
None of this is a flaw in the process. It’s just why entity resolution has to run continuously, not as a single pass before the “real” analysis begins.
What happens when entity resolution goes wrong?
The stakes are especially high in law enforcement, financial crime, and national security. These are domains where a single missed connection isn’t just an inconvenience; it can mean a threat goes unseen, a case stalls, or a network stays hidden behind records that were never joined up.
Law enforcement
A suspect uses different aliases, sometimes deliberately, sometimes simply due to inconsistent records over time. If those aliases are never linked, analysts end up treating what appear to be several minor, unconnected individuals as separate concerns. The high-priority subject they should have been investigating never gets flagged as one, and the case against them stays too thin to act on.
Financial crime
Identifying the ultimate beneficial owner of a company isn’t just about establishing who’s listed as a director or shareholder. It’s about understanding who actually controls it, and what that reveals about the wider network behind it. That means combining company registries across jurisdictions with property and land records, vehicle data, telecoms, sanctions and watchlists, and open source intelligence, each of which might record the same individual slightly differently. Without resolving those records together, the real structure of control behind a shell company stays hidden, and the people benefiting from it stay protected by the gap between records that were never connected.
National security and cross-border crime
The same individuals often appear across customs records, shipping manifests, airline passenger data, and intelligence reports, each system built independently, each recording that person slightly differently. When those sources are combined without entity resolution, the picture doesn’t get clearer; it gets more fragmented, at exactly the point where missing a connection carries the highest possible cost.
Across all three, the pattern is the same. The information needed to prevent harm already exists. It’s just scattered across records.
Why is an entity-resolved graph such a powerful intelligence analysis resource?
If entity resolution is done properly, a graph stops being a collection of records and starts being what it was always meant to be: a connected picture of everything an organisation knows. That shift matters for three reasons.
Connected intelligence
A graph is only as useful as the connections it reveals. Whenever a single real-world entity is split across two disconnected nodes, connections go unrecognised. A path between two people goes missing, a shared network splits into two smaller, less significant ones, an indirect link that should have raised a flag never appears at all.
Two investigations can look entirely unrelated on the surface, with different suspects, different offences, and different teams, right up until resolution reveals that a device in one case belongs to someone who also controls a company at the centre of the other.
Individually, neither investigation shows much. Connected, they reveal a single network operating across both. That kind of discovery isn’t possible if the entities involved were never recognised as the same, or as connected, in the first place. Resolve them properly, and connections that were always there, just invisible, become something analysts can actually act on.
Provenance, security and explainability
Some approaches to entity resolution merge matched records into a “golden record”: a single, canonical representation of an entity. That can be appropriate in some scenarios. But in law enforcement, security, defence, and financial crime, it creates three big problems.
Provenance: Different sources carry different levels of reliability and accuracy. A record from a verified government database isn’t equivalent to one pulled from open source intelligence, and analysts need to treat them differently, which is only possible if each piece of information still shows where it came from.
Security: Teams on the same investigation often hold different clearance levels, and some datasets are only accessible to certain analysts. Merge everything into one record, and there’s no way to show one analyst a picture built without a classified source while showing another the full picture, without either hiding the entity entirely or exposing data to someone who shouldn’t see it.
Explainability: Analysts can’t simply conclude “this is the same person.” They have to explain how they reached that conclusion and where each thread of evidence came from, which is only possible if it’s still clear which source each fact originated from.
Better AI
Increasingly, AI tools are being used to help analysts work through this data faster. But AI has the same limitation as a human analyst: it can only reason over what it’s given. Point it at a graph fragmented by unresolved entities, and it doesn’t just inherit the blind spots; it can fill the gaps with confident-sounding guesses that aren’t grounded in anything real.
That risk matters more in these use cases than almost anywhere else, since a connection an analyst acts on might later be challenged in court or reviewed by an oversight body. The provenance built into a properly resolved graph is exactly what keeps AI accountable in that setting, meaning every connection it surfaces can still be traced to the evidence behind it, which turns AI from a source of unverified guesses into a genuinely useful part of the analyst’s process.
How GraphAware Hume approaches this
GraphAware Hume is designed to support the entity resolution workflows that mission-critical investigations demand. Instead of merging matched records into one, it creates a resolved entity that sits above the source records and links to each one, keeping every original intact. Here’s what that looks like for our earlier example: the same person, appearing under a slightly different name and date-of-birth format across a police database, a border crossing, a watchlist, and a driving licence.
A match that later turns out to be wrong is a link that can be undone, not a merge that’s already erased what it was based on.
Analysts can then query and explore across resolved entities without needing to think about the underlying data model, working with the graph as if it were already one clean, connected picture. But because nothing has actually been merged, every connection can still be traced back to its original records and sources, so the simplicity on the surface never comes at the cost of the data underneath it.
The real question to ask
Entity resolution isn’t about creating perfect data. It’s about giving analysts the clearest possible picture of the people, organisations, and assets they’re investigating, while preserving the evidence behind every conclusion.
In mission-critical environments, identities change, new information arrives, and today’s uncertain match may become tomorrow’s confirmed connection. That’s why entity resolution needs to be treated as an ongoing analytical capability rather than a one-off data quality exercise.
Whether you’re investigating organised crime, sanctions evasion, fraud, or national security threats, the question isn’t simply “How clean is our data?” It’s “Can we recognise when two records represent the same real-world entity, and can we explain why we believe that?”
That’s ultimately what entity resolution is for: helping analysts build a more complete, more accurate, and more defensible picture of the world they’re trying to understand.
If that challenge is worth taking seriously in your own organisation, get in touch. We’d be happy to talk through where the gaps in your data might be hiding connections you haven’t made yet.
