Mike Wiacek

Founder & CTO Stairwell

Last Reviewed: September 18, 2026

Executive Summary

Mike Wiacek is founder and Chief Technology Officer of Stairwell, a cybersecurity company built on an argument about where detection has been going wrong. Conventional security tools decide at the moment a file appears whether it is malicious, and if they decide wrongly, that decision is never revisited. Stairwell instead retains every file an organisation has ever seen and continuously re-evaluates the whole archive as new intelligence arrives, so that a threat identified today can be searched for retroactively across years of history. That approach follows directly from Wiacek’s career: he founded Google’s Threat Analysis Group, the unit behind much of the company’s public nation-state threat research, and co-founded Chronicle, Alphabet’s attempt to apply Google-scale data infrastructure to security telemetry. He led Stairwell as chief executive until July 2025, when Emmy Linder was appointed CEO and he moved to the founder and CTO role to concentrate on the technology.

Career Highlights

• Founded Google’s Threat Analysis Group, the widely cited nation-state threat intelligence unit, while a principal engineer at the company.
• Co-founded Chronicle at Alphabet and served as its Chief Security Officer; Chronicle was later absorbed into Google Cloud’s security portfolio.
• Founded Stairwell and led it as Chief Executive Officer until July 2025.
• Moved to Founder and CTO in July 2025 on the appointment of Emmy Linder as chief executive.
• Grew Stairwell to processing more than 8 billion file sightings, built on Google Cloud Bigtable infrastructure.
• Led the 2026 launch of Backstory, Stairwell’s agentic AI investigation platform for determining the blast radius of a malware campaign.
• Began his career as a global network exploitation and vulnerability analyst for the U.S. Department of Defense.
• Received La Salle University’s 18th Annual IT Leadership Award in November 2022.

Professional Journey

Wiacek graduated from La Salle University in 2003 with degrees in computer science and mathematics, and went on to a master’s in computer science at the University of Maryland, Baltimore County. He began his professional career in government, working as a global network exploitation and vulnerability analyst for the U.S. Department of Defense — the kind of role that teaches offensive technique from the inside and tends to produce unusually sceptical defenders.

He joined Google as a principal engineer and founded the Threat Analysis Group, which became one of the most visible threat intelligence teams in the industry, responsible for tracking state-sponsored attackers and for the disclosures Google publishes about them. That work put him at the intersection of two things Google had in abundance and the security industry did not: enormous volumes of telemetry, and the infrastructure to search it.

Chronicle was the attempt to turn that into a product. Wiacek co-founded it within Alphabet and served as Chief Security Officer, building a platform designed to let organisations retain and query security telemetry at a scale that had previously been uneconomic. Chronicle was eventually folded into Google Cloud, and its capabilities now sit within Google’s security stack.

Stairwell is the next iteration of the same conviction, narrowed to files. Rather than logs or network telemetry, Stairwell collects and permanently retains executables and documents from across a customer’s estate, and re-runs analysis over the entire archive as new threat intelligence becomes available. The company reports processing more than 8 billion file sightings on Google Cloud Bigtable infrastructure — a deliberate echo of the architecture he first worked with at Google.

In July 2025 Stairwell appointed Emmy Linder, formerly chief operating officer at Cybereason, as chief executive, and Wiacek moved to Founder and CTO to focus on innovation and technical direction. Since then his most visible work has been Backstory, launched in 2026: an agentic AI investigation platform aimed at the question that follows every alert — how far the malware actually spread, and whether all of it has been found. He has described it as running investigations the way elite analysts do, but faster and across the whole environment. The name is one he has used before, at Chronicle, which is worth knowing when reading older coverage.

Education

La Salle University

Bachelor of Science, Computer Science and Mathematics, graduated 2003

University of Maryland, Baltimore County

Master of Science, Computer Science