Join our Newsletter — 33% off our NHI Course

Sankey Diagram

A Sankey diagram is a flow diagram that shows quantities moving between stages or categories, with line width representing volume. In IT and security work, it is used to visualise data flows, energy use or process paths, making bottlenecks, branching and loss points easier to inspect.

How Sankey Diagrams Work

A Sankey diagram represents movement through a system by linking stages or categories with flows whose widths are proportional to quantity. The visual emphasis is on relative volume, so readers can quickly see where material accumulates, narrows, branches, or disappears.

This makes the chart especially useful when the question is not simply “what happened,” but “how did the amount move through each step?” In security and IT contexts, that can include event counts, traffic volume, processing load, or data movement across stages of a workflow.

What Sankey Diagrams Help You See

The main strength of a Sankey diagram is pattern recognition. It highlights dominant paths, secondary branches, and losses that may be hard to spot in tables or bar charts. When the widths are read carefully, a viewer can compare stages without inspecting every individual record.

That also means the diagram is only as good as the grouping behind it. If categories are too coarse, important detail disappears; if they are too granular, the flow becomes visually noisy and harder to interpret. The diagram is best used when the audience needs a compact summary of movement across a process, pipeline, or lifecycle.

Why Sankey Diagrams Matter in Security and IT Analysis

In security work, Sankey diagrams are often used to visualise authentication journeys, alert routing, access paths, data transfers, or security tool pipelines. They help teams identify concentration points, unexpected branch-offs, and places where volume is lost, delayed, or transformed.

That makes them useful for operational review, architecture discussions, and investigation support. A Sankey diagram does not prove cause on its own, but it can quickly show where to focus deeper analysis, especially when a system has many stages and the primary challenge is understanding movement through them.

Best-Practice Interpretation and Common Limits

Sankey diagrams are descriptive, not diagnostic. They show quantity and direction, but not intent, root cause, or correctness. A wide flow may be normal business activity, a retry loop, or a control gap, depending on the underlying data and the time window used.

They also depend heavily on consistent measurement. If the source data is incomplete, filtered differently at each stage, or collected across mismatched time periods, the diagram can look persuasive while still being misleading. For that reason, the labels, units, and aggregation rules should be read alongside the graphic, not after it.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST CSF 2.0 ID.AM-01 — Physical devices and systems within the organization are inventoried Sankey diagrams can visualise how assets or events move across stages in an inventory or process map.
DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events Sankey diagrams can represent monitored network traffic paths and relative volume shifts.
Recommendation — Use Sankey flows to map inventory movement patterns and spot concentration points or missing transitions. Visualise network flow changes to highlight abnormal routing, spikes, or drop-offs.
NIST SP 800-53 Rev 5 AU-6 — Audit Review, Analysis, and Reporting Sankey diagrams help analyse logged event flows and spotlight unusual routing or volume shifts.
CA-7 — Continuous Monitoring Sankey visualisations support ongoing monitoring of process and traffic flows across systems.
Recommendation — Correlate audit data into flow paths and review anomalies where volumes diverge unexpectedly. Use flow visualisations to monitor changes in system behaviour and investigate new bottlenecks.
CIS Controls v8 CIS-8 — Audit Log Management Sankey diagrams can summarise how log events move through collection, filtering, and analysis stages.
Recommendation — Model log pipelines as flows and inspect where telemetry volume drops or concentrates.