How Stairwell Differs from VirusTotal
One answers whether the world has seen a file. The other answers whether your environment has. Most teams use both, in that order.
Both are used to analyze files, and they answer different questions. The distinction is worth having straight, because it decides which one to open first and what a clean result from either actually means.
VirusTotal answers "has the world seen this file, and does anything flag it?" It is a public lookup service aggregating many antivirus engines, and it is the industry standard for a fast reputation check.
Stairwell answers "is this in my environment, was it ever, and what else looks like it?" It collects the executables and scripts across your fleet, keeps them, and applies analysis, YARA rules, and variant discovery against that whole history.
Neither substitutes for the other. A file can be unknown to the world and present on nine of your machines, which is exactly the shape targeted tooling takes.
The differences that matter
| VirusTotal | Stairwell | |
|---|---|---|
| Privacy | Public. Uploaded files and results are shared with the community | Private. Files stay in your organization's vault and are never exposed |
| Analysis | Multi-engine signature scanning | Multiple engines, machine learning, and analyst opinion combined into one verdict, plus continuous YARA evaluation |
| History | Point-in-time lookups, limited to what has been submitted | Your full environment history, every file on every asset, queryable retroactively |
| Variants | Not available | Structural similarity across your files and the global malware corpus |
| YARA | Available on paid tiers | Live and retroactive rules against your entire corpus |
| Model | You submit hashes or files | Files are collected automatically by a forwarder |
Two rows carry most of the practical weight.
Privacy. Submitting a file to a public service publishes it. For a file from your own environment, that can disclose more than the file: internal hostnames, build paths, configuration, and the fact that you are looking. Stairwell holds the file privately and does not share it.
History. VirusTotal knows what has been submitted to it. Stairwell knows what has been on your machines, including before anyone had a reason to care. That is what makes a rule written this morning able to answer a question about last spring.
Which do I use, and when?
VirusTotal, for a fast reputation check on an unknown hash, or to see how the wider industry treats a sample.
Stairwell, to establish whether a threat or anything resembling it is in your environment now or was previously, when the file must not be exposed, or when you want new intelligence applied to your whole history.
Both, in the usual order: check community intelligence during triage, then pivot to Stairwell for internal exposure, variants, and the spread across assets over time. Most of the Playbooks on this site start at that pivot.
One honest limit worth pairing with this: Stairwell is not inline and is not a network enforcement point. It tells you what was where and when, and what it resembles. It does not block anything.
What should I read next?
- What Is Stairwell, for the fuller version of the second column.
- Prevalence, which is the local answer a public service cannot give.
- An EDR Alert Just Fired, for the pivot in practice.
Updated 19 days ago