Stairwell launches Backstory, pioneering agentic investigation for malware blast radius

Stairwell, the AI SOC that stops breaches no one else can, today announced the availability of Backstory, an agentic investigation platform that traces related malware variants, identifies affected systems, and maps the full blast radius of an incident in seconds, so enterprises know what happened, where it spread, and what needs to be contained before precious time is lost.

AI-generated malware is making it easier for attackers to create new variants, and legacy alert-based tools are struggling to keep up. Many AI security operations tools focus on reducing noise and speeding up triage. Backstory focuses on reducing risk by showing what actually exists within the environment, where it spread, and exactly what needs to be contained.

The launch comes as Stairwell’s Hidden Malware Report finds malware families are far larger than public reporting suggests. Across 1,085 public threat reports, Stairwell found that every published malware hash represents an average of 2.4 additional malicious variants, uncovering more than 46,000 related malicious files that were not included in the original research.

The data suggests defenders routinely investigate only a fraction of an attack. While public reporting typically focuses on a single malware sample, Stairwell uncovered an average of 2.4 related variants connected to every published sample. Because these variants often differ just enough to evade traditional hash- and signature-based detection, enterprises may unknowingly leave related malware active inside their environments.

“Closing tickets faster does not mean you contained the threat,” said Mike Wiacek, founder and CTO of Stairwell. “When a team finds something malicious, the real question is not just, ‘Can I close this alert?’ It’s, ‘What else looks like it, where did it land, how long has it been here, and what do I need to do to contain it?’ Backstory gives every team that level of investigation, regardless of headcount.”

“Attackers can test against global threat intel, EDR, and every common Yara rule on the internet,” said Jeff Moore, CSO, H&M Group. What they can’t test against is your environment because they’ve never seen it. That’s the whole game. Stop asking ‘what’s bad out there?’ an infinite question you will always lose and start asking ‘what changed in here?’ It’s not a new idea. It’s just the honest one.”

“Backstory gives us visibility beyond the first alert”, said Michael Francess, Director Cybersecurity, at a Global Hotel Brand. “We get the full blast radius of an incident: are we affected, how far did it spread, and have we actually contained it? Because Stairwell retains all of our executable files, every new piece of intelligence is a question we can answer definitively in minutes instead of an investigation we have to start from scratch.”

Backstory is powered by Stairwell’s ground-truth architecture, which continuously collects all executable files from customer endpoints and preserves them in a private customer corpus. Unlike tools that reason primarily over alerts, Stairwell reasons over facts: the actual files that have touched an environment, preserved indefinitely and continuously re-examined as new intelligence arrives.

Backstory’s foundation is built on:

• A continuously preserved corpus of more than 1.5 billion executable files
• AI trained on more than 110,000 detection rules
• Intelligence from more than 20 public threat sources
• More than 8.7 billion historical rule matches

This gives Backstory all the historical context needed to find related variants that no other tools can see.

Stairwell will showcase Backstory at Black Hat USA at booth 5006.