Stairwell has launched Backstory, an AI-powered investigation platform designed to automatically map the full blast radius of malware campaigns by identifying hidden variants across enterprise endpoint environments.

Key Points

• Backstory uses "Variant Discovery" technology to identify structurally related malicious files that often evade traditional signature-based detection.
• Research by Stairwell found that every published malware sample hides an average of 2.4 undocumented variants.
• The platform maintains "ground truth" by permanently archiving every executable file, including binaries and DLLs, that runs on customer endpoints.
• Unlike log-based systems, Backstory allows security teams to re-examine historical files whenever new threat intelligence becomes available.
• The tool automates investigative pivots, connecting disparate data points like file rarity, shared infrastructure, and code reuse to uncover complete attack campaigns.

Why it Matters

This platform addresses the growing challenge of AI-generated malware, which allows attackers to create unique, low-cost variants that bypass traditional security defenses. By shifting the focus from reactive alert triage to proactive, evidence-based investigation, organizations can better identify the full scope of a breach rather than just individual incidents.