Stairwell, which scans companies' data to detect if they are currently compromised or were in the past, raises $20M Series A led by Sequoia and Accel
Carly Page / TechCrunch :
Context & Ripple Effects
Stairwell sells a different premise than most security vendors: rather than blocking intrusions at the perimeter, it scans a company's own data to determine whether it is compromised now or was in the past — a forensics-first approach. The $20M Series A from Sequoia and Accel puts two of the sector's most active backers behind that thesis at the Series A stage.
The round sits inside a busy funding lane: Wing Security's $20M Series A for SaaS security monitoring landed the same funding window, and Stairwell's own arc validates the category — within about a year it followed this round with a $45M Series B led by Section 32, more than doubling its raised total.
First-order effects
- Stairwell gains the capital and the Sequoia-Accel imprimatur to scale its compromise-detection scanning beyond early customers, with both firms' security portfolios as a built-in buyer network.
- Enterprise security buyers immediately get a funded alternative to prevention-only tooling — a product whose core promise is telling them about breaches they may not have detected.
Second-order effects
- Adjacent detection startups like Wing Security, which monitors SaaS tool risk, now compete for the same security budget line, pushing vendors to differentiate on coverage of where compromises actually hide.
- Rival detection vendors face pressure to add retrospective search over historical data, since Stairwell's 'were you compromised in the past' pitch reframes the buying question from 'are we protected' to 'are we already breached'.
Third-order effects
- If the pattern holds, enterprise security budgets shift structurally from perimeter prevention toward post-compromise forensics, with investors — Sequoia and Accel here, Section 32 at the next round — treating assume-breach tooling as a durable category rather than a niche.
The trend: Security is moving from preventing breaches to assuming they happened, with top-tier venture capital now funding tools that mine a company's own data for evidence of past and present compromise.