Skip to content

Stairwell

Threat & Vulnerability Management

A Palo Alto threat-hunting platform built by Chronicle's former CSO, continuously indexing every file for retroactive 'ground truth' threat hunting.

Visit Website ↗ + Add to Compare Claim This Company
65/100Incremental Innovator

Overview

Stairwell, founded in 2019 and headquartered in Palo Alto, gives security teams a continuously indexed ‘ground truth’ of every file across their environment, letting them retroactively hunt for threats that evaded detection at the time of compromise rather than relying solely on real-time alerts. The company was built by former Chronicle (Google’s security moonshot) CSO Mike Wiacek around comprehensive file inspection and historical searchability, a different architecture than point-in-time EDR or antivirus tools that only flag what they catch in the moment.

Stairwell has raised a Series B with strong early investor backing from Sequoia and Accel, reflecting real confidence in its technically credible team and differentiated approach. Public evidence of named enterprise customers and recent funding momentum is limited, though, making it a promising but still thinly-documented architecture bet as of this writing.

Innovation Matrix Assessment

Innovation Velocity 8/10

Built around a 'ground truth' file/telemetry inspection engine designed to detect threats attackers can't see or evade, founded by the former Chronicle (Google) CSO -- a genuinely novel architectural bet on continuous file inspection rather than signature/behavior-only detection.

Operational Value 6/10

Public customer names and deployment scale are not detailed in the sources reviewed, limiting visibility into breadth of production use despite a credible founding team.

Market Momentum 5/10

$69.5M total raised, with a $20M Series A co-led by Sequoia Capital and Accel; no larger round has been publicly reported since 2021, suggesting momentum has cooled relative to more recently-funded peers.

Category Disruption 7/10

Rethinking endpoint/threat-hunting architecture around comprehensive, queryable file 'ground truth' is a meaningfully different approach versus traditional EDR, though it remains a technical refinement within the broader detection-and-response category.

Real-World Efficacy 5/10

Efficacy claims rest primarily on founder pedigree (ex-Chronicle/Google CSO) and investor quality rather than published independent test results or named customer outcomes.

Enduring Relevance 8/10

Threat hunting and retrospective compromise detection remain durable needs as attackers increasingly evade real-time detection.

Why CISOs Should Care

Stairwell gives security teams a continuously indexed 'ground truth' of every file across their environment, so they can retroactively hunt for threats that evaded detection at the time of compromise rather than relying solely on real-time alerts.

What Makes It Different

Built by former Chronicle (Google's security moonshot) CSO Mike Wiacek around comprehensive file inspection and historical searchability, differentiating from point-in-time EDR/AV tools that only flag what they catch in the moment.

The Matrix Verdict

65/100 — INCREMENTAL INNOVATOR

A technically credible team with strong early investor backing (Sequoia, Accel) pursuing a genuinely different architecture for threat hunting, but public evidence of named enterprise customers and recent funding momentum is limited.

Editorial Note: Claims vs. Verified Findings

Public information on named customers and independent efficacy testing is limited; claims rely substantially on founder pedigree and investor backing.

Sources

Alternatives to Stairwell

80 /100

Synack Inc

A penetration-testing-as-a-service platform pairing a vetted researcher community with AI-driven attack surface discovery for continuous security validation.

Meaningful Innovator Threat & Vulnerability Management
80 /100

Horizon3.ai

Autonomous penetration testing company whose NodeZero platform self-attacks networks without persistent agents, aiming to replace annual manual pentests…

Meaningful Innovator Threat & Vulnerability Management
78 /100

Unknown Cyber Inc.

CISO Reviewed

Malware genomics platform using automated deep static analysis and code-lineage comparison to identify unseen malware, variants, and supply-chain…

Meaningful Innovator Threat & Vulnerability Management
77 /100

Cogent Security

Agentic AI platform that autonomously triages, investigates, and remediates vulnerabilities as a force multiplier for security teams.

Meaningful Innovator Threat & Vulnerability Management
77 /100

Airlock Digital

Application allowlisting (deny-by-default) platform that blocks unapproved executables, scripts, and processes to prevent ransomware and malware execution.

Meaningful Innovator Threat & Vulnerability Management
75 /100

Pentera

Automated security validation platform that safely runs real attack techniques against production environments to prove which exposures are…

Meaningful Innovator Threat & Vulnerability Management