Stairwell Analyze is a cloud-based malware analysis and threat intelligence platform that operates within a private vault, meaning file data is never shared externally. It continuously reanalyzes an enterprise's executable file history as new intelligence arrives, rather than performing only point-in-time assessments. Core capabilities include: - Private hash lookup: checks whether a file is malicious by hash without exposing data publicly - Variant discovery: maps an entire malware family from a single hash using a malware corpus, without requiring YARA rules - YARA at scale: continuously runs YARA rules against both the enterprise file set and a shared malware corpus, with no per-rule or per-scan cost - Run-to-Ground: automated forensic investigation that builds a malware family tree within the environment and generates an infection timeline across endpoints - Prevalence analysis: calculates local and global file prevalence to help SOC teams prioritize alerts and reduce false positives - AI Triage: analyzes file behavior using enriched threat intelligence context to explain what a file is designed to do, replacing generic AV pass/fail checks - Threat report health check: ingests published threat reports and automatically checks whether any included IOCs exist in the environment - File signal aggregation: consolidates hashes, IOCs, IPs, DNS history, hostnames, YARA matches, and variant data into a single view The platform is designed so that scanning occurs in the cloud without executing anything on endpoints. It was built by engineers from Google and the intelligence community.