Stairwell has launched Backstory, an agentic investigation platform that maps malware blast radius in seconds. The platform traces related malware variants, identifies affected systems, and shows the full scope of incidents to help enterprises contain threats quickly. The launch follows Stairwell's Hidden Malware Report, which analysed 1,085 public threat reports and found that every published malware hash represents an average of 2.4 additional malicious variants — uncovering over 46,000 related files not included in original research. Backstory is powered by Stairwell's architecture, which continuously collects and preserves executable files from customer endpoints. The platform is built on a corpus of over 1.5 billion executable files, AI trained on more than 110,000 detection rules, intelligence from over 20 threat sources, and more than 8.7 billion historical rule matches. Stairwell will showcase Backstory at Black Hat USA.

Stairwell launches Backstory, the first agentic investigation platform for malware blast radius. Stairwell analysis finds 2.4 related malware variants for each sample named in public threat reports; confirms security teams lack true depth of malicious files across their environment. SUNNYVALE, Calif., July 29, 2026 (GLOBE NEWSWIRE) - Stairwell, the AI SOC that stops breaches no one else can, today announced the availability of Backstory, an agentic investigation platform that traces related malware variants, identifies affected systems, and maps the full blast radius of an incident in seconds, so enterprises know what happened, where it spread, and what needs to be contained before precious time is lost. AI-generated malware is making it easier for attackers to create new variants, and legacy alert-based tools are struggling to keep up. Many AI security operations tools focus on reducing noise and speeding up triage. Backstory focuses on reducing risk by showing what actually exists within the environment, where it spread, and exactly what needs to be contained. The launch comes as Stairwell's new Hidden Malware Report finds malware families are far larger than public reporting suggests. Across 1,085 public threat reports, Stairwell found that every published malware hash represents an average of 2.4 additional malicious variants, uncovering more than 46,000 related malicious files that were not included in the original research. The data suggests defenders routinely investigate only a fraction of an attack. While public reporting typically focuses on a single malware sample, Stairwell uncovered an average of 2.4 related variants connected to every published sample. Because these variants often differ just enough to evade traditional hash- and signature-based detection, enterprises may unknowingly leave related malware active inside their environments. "Closing tickets faster does not mean you contained the threat," said Mike Wiacek, founder and CTO of Stairwell. "When a team finds something malicious, the real question is not just, 'Can I close this alert?' It's, 'What else looks like it, where did it land, how long has it been here, and what do I need to do to contain it?' Backstory gives every team that level of investigation, regardless of headcount." "Attackers can test against global threat intel, EDR, and every common Yara rule on the internet," said Jeff Moore, Chief Security Officer, H&M Group. "What they can't test against is your environment because they've never seen it. That's the whole game. Stop asking 'what's bad out there?' an infinite question you will always lose and start asking 'what changed in here?' It's not a new idea. It's just the honest one." "Backstory gives us visibility beyond the first alert," said Michael Francess, Director Cybersecurity, at a Global Hotel Brand. "We get the full blast radius of an incident: are we affected, how far did it spread, and have we actually contained it? Because Stairwell retains all of our executable files, every new piece of intelligence is a question we can answer definitively in minutes instead of an investigation we have to start from scratch." Backstory is powered by Stairwell's ground-truth architecture, which continuously collects all executable files from customer endpoints and preserves them in a private customer corpus. Unlike tools that reason primarily over alerts, Stairwell reasons over facts: the actual files that have touched an environment, preserved indefinitely and continuously re-examined as new intelligence arrives. Backstory's foundation is built on: * A continuously preserved corpus of more than 1.5 billion executable files * AI trained on more than 110,000 detection rules * Intelligence from more than 20 public threat sources * More than 8.7 billion historical rule matches This gives Backstory all the historical context needed to find related variants that no other tools can see. Stairwell will showcase Backstory at Black Hat USA at booth 5006. About Stairwell Stairwell is the AI SOC built on ground truth. It reasons through every executable file that has touched an enterprise environment to find threats others miss, investigate them end-to-end, close the loop, and prove what has been contained or remediated. Stairwell preserves file history over time, enabling organizations to re-evaluate their entire environment as new intelligence arrives. Founded by Mike Wiacek, founder of Google's Threat Analysis Group and Alphabet's Chronicle, Stairwell is backed by Sequoia, Accel, and S32, with enterprise customers across financial services, healthcare, fintech, AI, media, and gaming. Learn more at www.stairwell.com.