Prevalence

Prevalence is how common a file is. Stairwell reports it from two directions: locally, meaning the share of your own assets that have seen the file, and globally, meaning how widely it appears across the customer environments Stairwell observes. A file on two of your laptops and nowhere else on the planet reads very differently from a file that shows up in most environments on the platform, and prevalence is that difference expressed as a number you can sort on.

Why does prevalence matter?

Prevalence matters because rarity is the closest thing to a free signal in file triage. An analyst holding an unknown executable has to decide, before spending an hour on it, whether it is worth an hour. Without prevalence that decision is guesswork dressed up as research: search the hash externally, find nothing, and be unable to tell whether "nothing" means the file is novel and targeted or means it is an internal build that no public source ever had a reason to index.

Prevalence answers the question the analyst actually has, which is not "what is this file" but "is this file normal here". Ubiquitous files are almost always infrastructure: operating system components, agents, browsers, the software your own IT team deployed. Rare files are where novel and targeted tooling has to live, because tooling written for one target is by definition not widely deployed.

The two figures together surface a pattern that neither one shows alone. Something common in your fleet and absent everywhere else is the fingerprint of software built for you: sometimes your own in-house application, sometimes an intrusion that has already spread. That combination is worth looking at every time, and it is invisible to any tool that only knows what it has seen inside one organization.

Prevalence is also what keeps the rest of the platform usable. Capabilities that expand outward from a single file, such as Run-to-Ground, use rarity to cut routine system binaries out of their results, so what comes back is a short list instead of a haystack.

Two honest limits, because prevalence gets over-read. Rare does not mean malicious: a one-off installer, a freshly compiled internal tool, and a developer's test binary are all rare and all fine. Common does not mean safe: widely deployed software is exactly what an attacker wants to compromise or impersonate. Prevalence tells you where to spend attention. It does not tell you what a file is, which is what a verdict is for.

What do I do with prevalence?

• Sort a result set by it. After any search or hunt that returns more files than you can read, rarity is usually the right first sort. The rare end of the list is where the interesting files are.
• Read local against global. Rare in both places is an unknown worth triaging. Common locally and absent globally is bespoke software, yours or someone else's. Common in both is almost always infrastructure.
• Close things faster. A high-prevalence file with a clean automated verdict, and a Trusted opinion once your team has confirmed it, is a defensible fast close. That is a large share of day-to-day work, and prevalence is what makes it quick.
• Use it as a check on a match. A threat report match or a YARA hit on a file present in most environments deserves a second look before it becomes an incident. Broad rules and reused indicators find popular software.
• Rank a variant list. When a file's variants come back, the rare ones are usually the ones an attacker built. The common ones are usually shared libraries and packers.

Prevalence stays current as sightings arrive, including for files first seen in the last few days, so a file that landed this morning gets a present-tense rarity read rather than one from a stale snapshot.

Where do I see prevalence in Stairwell?

• The Sightings section of the object panel. For each environment that has seen the file, it shows the approximate number of assets, with the percentage of that environment's total assets on hover. Zero means no asset in that environment has reported it.
• The Variants section of the object panel. Every variant row carries a local and a global prevalence meter, and the list sorts by Prevalence as well as by Similarity, Maliciousness, and First seen.
• Search results and object lists. Add the Assets and Global Assets columns to see the per-environment and cross-environment asset counts alongside verdict, opinion, and first-seen date.
• Run-to-Ground results, where rarity has already been applied as a filter rather than shown as a column.

What should I read next?

• Variants, because rarity and similarity are the two lenses most investigations use together.
• Sightings, the individual observations prevalence is counted from.
• Run-to-Ground, the workflow that uses prevalence to turn one file into a scoped blast radius.