STAIR Replaces Static Incident-Response Playbooks With Graph-as-State Planning, Scoring 0.94 Across 100 Docker Cyber Ranges

arXiv 2608.09524·medium signalXBlueskyLinkedInCopy link

Published 2026-08-10, STAIR is an end-to-end agentic incident-response framework that maintains the live incident as Graph-as-State, routes planning to stage-specialized agents via a Stage Router, and retrieves historical experiences to guide action selection. An Execution Harness runs actions, feeds results back to update incident state, and validates effects so they can be reused as experience. Across 100 Docker-based cyber ranges it reaches a normalized defense score of 0.94, a 9.5% improvement over the strongest baseline — a concrete architecture pattern for long-horizon agent loops where state drift, not tool access, is the failure mode.