Mapping the malware blast radius a single alert won’t show you

In this interview with Help Net Security, Mike Wiacek, founder and CTO of Stairwell, explains Backstory, an AI agent that takes a single alert and works outward to map how far a malware campaign spread. He walks through the research behind the claim that each published sample hides an average of 2.4 undocumented variants, describes what counts as a related variant, and explains why Stairwell keeps every executable that runs on customer endpoints.

Stairwell has just launched a product called Backstory and describes it as an “agentic investigation platform for malware blast radius,” which is a phrase most people will need unpacked. Can you explain, in plain terms, what Backstory does, who it’s for, and what a security team would use it to accomplish that they can’t do right now?

Today’s threat landscape has shifted significantly in favor of adversaries. Threat actors now leverage malicious LLMs to generate an onslaught of AI-generated malware that overwhelms traditional defenses across the stack. Where malicious campaigns were once crafted with meticulous precision and care, attackers can now create them in a fraction of the time and at far greater scale.

Backstory is an AI agent that runs investigations the way the world’s elite analysts do, only faster, at scale, and with a comprehensive understanding of your environment.

Most investigations begin with a single alert. Too often, that’s also where they end. Pressured by productivity metrics, SOC analysts triage alerts and close tickets. But what’s the blast radius? Is this a one-off or part of a larger campaign? Did we contain it? When did we first get compromised? There simply isn’t time to answer those questions for every alert.

Attackers rarely deploy just one piece of malware. They ship variants – slightly different builds of the same tool – so each one appears new and slips past detection. The file in front of you is rarely the whole story.

Backstory starts with the alert in front of you and works outward. It finds structurally related variants, traces shared infrastructure, and searches your full history to identify every place the threat appeared. Then it continues following the evidence across files, systems, and time until the full campaign comes into view, mapping the complete blast radius.

Today, analysts reconstruct that picture by moving between tools, searching one indicator at a time, and deciding which lead to follow next. Backstory performs those investigative pivots automatically while keeping the underlying evidence visible.

It’s built for SOC and incident response teams answering the question behind every alert: How far did this actually spread, and did we find it all?

The number driving this announcement is that every published malware sample represents an average of 2.4 additional variants that never made it into the public report, which, across your dataset, added up to 46,594 hidden malicious files. Walk me through how you arrived at that. What counts as a “related variant” in your methodology, what similarity threshold did you set, and how did you avoid inflating the count with benign files that share code or with simple recompilations of the same program?

We began with 1,085 publicly available threat reports from 32 security vendors and government organizations. Those reports gave us a corpus of 19,418 malware samples that had already been documented as part of known campaigns.

From there, we used Stairwell’s proprietary Variant Discovery technology to identify related files in our corpus. A related variant isn’t simply any file that shares a few pieces of code. We evaluate multiple technical signals, including shared signatures, import-table similarity, code reuse, and other proprietary indicators, to determine whether a file is meaningfully related to the original malware.

Using that methodology, we identified 46,594 malicious files associated with publicly reported malware samples that were never included in the original threat reports.

The broader takeaway is that the malware sample published in a threat report is often just one visible piece of a much larger campaign.

Your architecture rests on something you call “ground truth,” which, as I understand it, means continuously collecting and permanently keeping every executable file that runs on a customer’s endpoints, then re-examining that archive as new intelligence comes in. Can you explain how that works in practice, and what specifically it lets Backstory see that a tool reasoning over alerts and live telemetry would miss during the same investigation?

Stairwell collects every executable that runs on a customer’s endpoints, including binaries, scripts, and DLLs, preserving them in a dedicated environment forever.

It’s a completely different paradigm from the way every other security tool works. Most rely on logs, which are descriptions of what was seen happening. The cost of storing and searching logs grows as retention increases. When the logs are gone, your ability to investigate goes with them.

We call that “ground truth” because it preserves what actually existed on a device, not a secondhand account of what it was seen doing. Because everything is preserved, rarity becomes a strategic advantage adversaries can’t quantify or overcome. We can measure how uncommon a file is within your environment and across all environments, giving you a single measurable value. The rarity of a file, combined with the reputation of its variant neighborhood, quantifies risk in a way no other approach can match.

Here’s what lets Backstory see what tools reasoning over alerts and live telemetry can’t:

• First, if a threat never generates an alert, it remains hidden in the noise. This is the asymmetry that attackers rely on. Backstory can follow these files with ease. A payload may have landed but never executed. It may have run without matching a rule. It may have looked harmless at the time. Alert-driven systems have little to investigate if nothing ever fires. Backstory doesn’t have that limitation. Everything is always in scope.
• Second, and this is the part that’s hard to copy, time stops mattering. Because the files are always there, byte for byte, within Stairwell, Stairwell can re‑examine them every time new intelligence arrives. A file that looked clean six months ago gets re-evaluated. A tool that only has live telemetry can’t go back and re‑investigate something it never kept.

The timing of this launch leans heavily on the rise of AI-generated malware, the argument being that attackers can now spin up novel variants faster than signature-based tools can learn them. Are you seeing AI-authored malware in your customers’ environments at meaningful volume right now, or is this still a forecast about where the threat is heading? I’d like readers to know which it is.

We are not claiming that a measurable percentage of malware in customer environments is AI-authored. You cannot reliably examine a binary and prove that a model wrote it. Anyone offering a precise percentage today is selling certainty that data does not support.

What is already real is the change in attacker economics. AI reduces the time and cost required to modify, test, and personalize malware. Attackers no longer need to reuse the same sample across thousands of victims.

They can produce many distinct versions of the same tool, test them against common defenses, and deploy the one that gets through.

That puts pressure on defenses that depend on seeing the same file or behavior somewhere else first.

Stairwell starts from the opposite assumption: the first sample may be unfamiliar. Backstory can ask and reason about what that file is structurally related to, where related files have existed, what appeared around them, and how far the campaign reached. That changes the dynamic. Knowledge of your own environment becomes a security control in its own right.

So the honest answer is that no one can reliably quantify AI-authored malware in customer environments today. But cheap uniqueness is already here. The problem is not that every new sample will be brilliant. It is that variation no longer has to be expensive.

One of your advisory board members reframes the whole philosophy as “stop asking what’s bad out there, start asking what changed in here.” It’s a memorable line, but “what changed” inside a large enterprise is itself an enormous and noisy signal, with software updating and configurations shifting constantly. How does Backstory keep that question answerable instead of handing teams a different flood to drown in?

You’re right! An alert on every new file would only drown teams in a different kind of flood.

A Chrome update appearing on thousands of machines and across the broader Stairwell corpus looks ordinary. A new executable appearing on a single finance workstation and nowhere else looks very different.

Prevalence helps us see that difference, but rarity alone is not a verdict. Internal software can be rare. Malware can become common.

But Backstory does not stop at prevalence analysis. It combines prevalence with structural similarity, file analysis, asset sightings, timing, related artifacts, cyber threat intelligence, and shared infrastructure.

From there, it follows the evidence, asking and answering questions like:

• Is this related to known malware?
• Where else did it appear?
• What arrived before or after it?
• What other systems and infrastructure are connected?

The point is not to hand the analyst a longer list of unusual things. It is to take one meaningful difference and follow the evidence autonomously until the full story comes into view. That is the difference between finding an anomaly and understanding an incident.

Stairwell will showcase Backstory at Black Hat USA at booth #5006.