Snapshot
Continue to About ↓- What it does
- Stairwell is a SaaS threat-intelligence and malware-analysis platform that continuously collects executables and scripts from endpoints, preserves every file indefinitely in a private vault, and re-examines that history whenever new intelligence arrives.
More detail
- Its agentic investigator, Backstory, finds related variants, maps affected hosts, reconstructs the campaign and returns evidence-backed remediation guidance for the customer's existing tools.
- A free public tool, Stairwell Intelligent Analysis (SIA), offers single-file verdicts.
- Best for
- SOC, threat-intelligence and incident-response teams that are losing evidence to retention windows and want retrospective hunting, variant discovery and blast-radius mapping on top of their existing EDR and SIEM.
More detail
- Also fits MSSPs running separate per-customer environments.
- Pricing
- One price per asset, billed annually, with all capabilities included: no storage charges, data caps, metered searches or per-investigation fees.
More detail
- The per-asset rate is not published and depends on fleet size, so it is quoted directly by sales
- multi-year terms are available and fleets with unusually
- Main limitation
- Teams looking for inline blocking, network enforcement, packet-level visibility or a full sandbox, or a drop-in EDR replacement.
More detail
- Buyers who need a published per-asset price before engaging sales will not find one.
- Record
- Living and monitored
- Reviewed
- Evidence
- Public web research
- Machine access
- Structured profile ↗
About
- Stairwell is a SaaS threat-intelligence and malware-analysis platform that continuously collects executables and scripts from endpoints, preserves every file indefinitely in a private vault, and re-examines that history whenever new intelligence arrives.
- Its agentic investigator, Backstory, finds related variants, maps affected hosts, reconstructs the campaign and returns evidence-backed remediation guidance for the customer's existing tools.
- A free public tool, Stairwell Intelligent Analysis (SIA), offers single-file verdicts.
What it helps with
- Alert and log evidence expires before new threat intelligence arrives, so late-arriving indicators cannot be applied to
- False negatives: malware that never triggered an alert sits in the environment undetected and unscoped
- One alert does not show how far a campaign spread across hosts and time
- Renamed, recompiled or mutated variants of a known threat are hard to find with signature-based tooling
- Answering single-file questions (is it malicious, how rare, where seen, what relatives) requires slow manual pivots and
- Threat-report indicators cannot be checked against a fleet's full file history on demand
Capabilities
A practical view of what is available and where limitations apply.
| Offering | Available | Detail |
|---|---|---|
| Continuous executable and script collection | Yes | Forwarder collects executables and scripts from endpoints, servers and workloads; default scope is about 65 file formats, with documents, spreadsheets and images excluded by default and tuning required |
| Private Vault retention | Yes | Full-content file retention with no storage charges and no expiry, per the vendor's published pricing page |
| Backstory agentic investigator | Yes | Runs on the customer's own evidence to find variants, scope hosts and reconstruct campaigns; included in the per-asset license with no per-investigation fee |
| Retro-hunt on new intelligence | Yes | New intelligence automatically re-scans the retained file history, so dormant threats can surface later |
| Unlimited YARA rules | Yes | New files are scanned against the customer's rules, and any rule can be re-run against the full collected history |
| File prevalence scoring | Yes | Precomputed fleet-local and global rarity for each file, included with every license |
| Variant discovery and blast-radius mapping | Yes | Locates renamed, recompiled and mutated copies and maps which hosts were affected and when |
| Inline blocking or network enforcement | No | Official documentation states Stairwell is not inline and is not a network enforcement point; remediation actions are directed at the customer's existing tools |
| Network visibility (packet capture, netflow) | No | Official documentation states there is no packet capture, netflow or traffic interception; network intelligence derives from files and public feeds |
| Full sandbox detonation | Limited | Official documentation describes some detonation but states it is not a full sandbox |
Bot trust
How confidently AI systems can verify this profile from public evidence.
—of 100
ChatGPT—/100
Claude—/100
This profile has not completed a Bot Score assessment yet.
Evidence
Where this record came from, when it was reviewed, and how confidently it can be used.
- Verification
- Scribble researched these facts from the linked public sources.
- The owner has not manually confirmed every field.
- Last reviewed
- Primary source
- stairwell.com
Technical profile details
Record ID
340b7847-223d-4315-9af2-29b252297fffCanonical URLhttps://profiles.scribble.network/listing/stairwell-340b7847