STAIR: Effective Incident Response Using an End-to-End Agentic Planning Framework
2026-08-10 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors developed a system called STAIR to help fix computer systems after cyberattacks. Unlike traditional fixed plans, STAIR adapts by keeping track of the attack using a graph, sending tasks to specialized helpers, and learning from past experiences. It also checks if each action worked and updates its plan accordingly. Their tests showed STAIR did better than previous methods when handling simulated attacks.
incident responsecyberattackLLM-based plannersGraph-as-StateStage Routerexecution feedbackagentic planningDockercyber rangedefense score
Authors
Hanlin Jiang, Jionghao Huang, Shaofei Li, Bojia Yu, Peng Jiang, Yuxin Ren, Ning Jia, Yao Guo, Ding Li
Abstract
Incident response planning is critical for restoring compromised software systems after cyberattacks. Common practice relies on expert-driven playbooks that encode fixed response procedures, but these static workflows struggle to adapt to evolving incident states, changing recovery objectives, and execution feedback. Recent LLM-based planners and tool-using agents improve automation, yet they remain unstable in long-horizon response because they lack a unified basis for maintaining incident state, aligning actions with the current recovery stage, and reusing historical experience. We present STAIR, an end-to-end agentic planning framework for incident response. The framework maintains the current incident as Graph-as-State, uses a Stage Router to dispatch planning to stage-specialized agents, and retrieves historical experiences to guide action selection. An Execution Harness executes actions, returns feedback to update the incident state, and validates action effects for future experience reuse. Across 100 Docker-based cyber ranges, our framework achieves a normalized defense score of 0.94 and improves over the strongest baseline by 9.5%.