A new AI agent framework can track a security incident from the first alert to the final fix, and it just posted the best score yet on an academic benchmark.
Researchers built STAIR, an "agentic" AI system that keeps a running record of an incident's evidence, every response action taken, and the results of each action, all stored in a structure the paper calls Graph-as-State. STAIR uses that record to figure out what stage the response is in and what the immediate goal should be, then pulls up similar past cases that are known to have worked before picking its next move. A component called the Execution Harness actually carries out the chosen actions and feeds the outcome back into the shared record. On a new benchmark of 44 Docker-based simulated breaches, STAIR hit a defense score of 0.95, about 10.47 percent better than the next-best system tested, and it cut cumulative penalties by roughly 28.8 percent in a separate ongoing-attack simulation called CAGE4.
Most automated incident-response tools are good at one step at a time: spot the fault, suggest a fix, maybe adjust based on feedback. What they tend to lose is the thread connecting those steps as an incident drags on and the attacker's behavior shifts. STAIR's bet is that giving planning and execution a single shared memory, rather than treating each action as its own isolated decision, is what actually closes that gap.
Still, this is a lab result. Forty-four scripted Docker scenarios are not the same as a live breach with an on-call engineer screaming into Slack, and the 0.95 score comes from the paper's own authors grading their own system.