Pricing

Virtual Tour Get a Demo

One price per asset. Everything included.

We price per asset, not by storage, searches, or investigations.

No storage charges / No data caps 
No metered searches / No per-investigation fees

Seven capabilities. One plan.

No upsell tiers, no add-on modules to negotiate later. All included with every license.

Backstory

An agentic investigator that runs on your own evidence. Running it on every alert costs nothing extra.

AITriage

Continuous file collection from every asset, the platform's ground truth. We keep the evidence.

Variant discovery& run to ground

Full-content retention with no storage charges and no expiry.

PrivateVault

Full-content retention with no storage charges and no expiry.

UnlimitedYARA

Every new file is scanned against your rules automatically. You can also re-run any rule against every file we've ever collected, no matter how far back.

FilePrevalence

Precomputed rarity on every file, fleet-local and global. Rarity is the single strongest hunting signal, and it comes with every license.

Forwarder

LLM verdicts grounded in the file's real scan results, prevalence, and intel context. A structured report per file, not a chatbot summary.

Priced on the fleet you protect,

not on how much of the evidence you can afford to keep.

1.3TB

DNS resolutionsobserved

1.6B

Files carryinga reputation verdict

Daily

Every domain we've seen,re-resolved

We built the storage economics so you're never renting your own evidence back to us by the month. Flat pricing means the platform gets more valuable the longer you run it, not more expensive.

Pricing questions

One price per asset, billed annually, with every capability included. There are no separate editions, add-on modules, or usage meters. The rate depends on the size of your fleet, so we quote it directly. Contact us with your approximate number of assets to get a quote.

No. Retention in your Private Vault, YARA hunts across your full history, and Backstory investigations are all included in the per-asset price. There are no storage charges, data caps, metered searches, or per-investigation fees.

Every license includes the Forwarder, AI Triage, Backstory, Private Vault, File Prevalence, Unlimited YARA, and Variant Discovery with Run to Ground. There is no other edition.

Any endpoint running the Forwarder: laptop, server, or workload. For most organizations that tracks closely with employee count, since Stairwell’s technology identifies executables on physical or virtual assets. However many software or AI agents run on top of one asset, the asset count doesn’t change.

Fleets with unusually high file-write volume per asset, such as build servers and CI runners, may be quoted differently. Ask us whether any part of your fleet qualifies.

Recommended actions

Yes. Multi-year terms are available. Contact us for details.

It’s all about having that peace of mind. For hunting malware, Stairwell is the best way  to do it. It’s our second set of eyes.

Michael Francess

Cybersecurity Advanced Threat and Response

Automatically identifying variants of a malicious file in a matter of seconds – instead of the months it could take to do it manually – is truly groundbreaking.

Dean Perrine

Deputy CISO, FOX

AI triage is great. Unlike other vendors, it explains the analysis in simple natural language and delivers a clear summary of what the file is about. Very quick and helpful.

ISAC member

Deputy CISO, FOX

ENGINEERED FOR

PLANET-SCALE

Built by Google and intelligence veterans. Web-scale indexing, YARA at ludicrous speed, and structured AI reasoning turn raw artifacts into instant understanding across everything you’ve ever seen.