What Asterisk does

Winfunc (formerly Asterisk) is a Y Combinator-backed developer security startup founded in 2024 and headquartered in San Francisco. The company builds autonomous AI agents that audit codebases, prove vulnerabilities through executable proof-of-concept exploits, triage findings, and deliver ready-to-ship patches via pull requests. Its core platform, Winfunc Scanner, is composed of modules for Vulnerability Detection, Dependency Scanning, Autofix, AI Triager, PR Security, Analytics, Infrastructure & Cloud, and CI Integration. Winfunc also ships Winfunc MCP, a Model Context Protocol integration that embeds real-time vulnerability scanning directly into AI-assisted code editors including Cursor, Claude Desktop, Windsurf, and Cline, plus a separate Dome product line.

The company's go-to-market is sales-led and enterprise-focused, targeting DevSecOps and application security teams at organizations whose codebases underpin production traffic. Its top-of-funnel acquisition strategy centers on a 'Book a free audit' CTA that demonstrates autonomous capability before sales engagement, complemented by a content-led marketing engine built on a public research blog, a findings repository with CVE references, and the monthly N-Day-Bench benchmark for LLM vulnerability discovery. Notable documented outcomes include 13 patched bugs autonomously discovered across nine major open-source projects (Node.js, React, NGINX, Mattermost, Supabase, Bun, Gumroad, Anthropic's MCP SDK, and Better-Auth) and a SOC 2 Type II certification supporting enterprise procurement.

The business model is a SaaS subscription whose pricing is not publicly disclosed but is described as scaled to codebase size or usage. The company has not disclosed customer counts, ARR, or detailed paying-customer rosters; publicly displayed logos include Google, Microsoft, NVIDIA, Anthropic, Supabase, Sentry, Brave, the New York Times, and others, the majority of which appear to reflect research targets rather than confirmed commercial accounts. The founding team is CEO Mufeed VH, COO Asjid Kalam, and CTO Vivek R., with total disclosed funding of $500,000 in a September 2024 seed round led by Y Combinator with participation from Pioneer Fund.

Name

Asterisk

Legal name

winfunc

Website

https://asterisk.so

Company type

Private

Founded year

2024

Operating status

Operating

Headcount range

1–10 employees

Short description

Winfunc (formerly Asterisk) is an AI-native developer security platform whose autonomous agents find, prove, and patch codebase vulnerabilities for DevSecOps and application security teams at enterprises.

Ownership category

akta.pro rank

Product category

Application Security Software

NAICS

Computer Systems Design and Related Services (5415)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC)

Keywords

• AI security platform
• Vulnerability detection
• Codebase auditing
• DevSecOps automation
• Autonomous security agents

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Marketing or Sales, Infrastructure

Revenue model

1. SaaS Security Platform Subscription: Winfunc operates as a SaaS platform offering security scanning and vulnerability management services on a subscription basis, with enterprise pricing based on codebase size or usage

Go-to-market motion1 record

Distribution channels2 records

Marketing channels4 records

Core offering

Asterisk (operating as winfunc) builds an autonomous AI security platform that audits codebases, detects security vulnerabilities, generates executable proof-of-concept exploits to prove exploitability, triages findings, and delivers automated patches via pull requests. The core product, Winfunc Scanner, is offered as a SaaS subscription with modules for vulnerability detection, dependency scanning, autofix, AI triage, PR security, analytics, infrastructure/cloud scanning, and CI integration. A Model Context Protocol (MCP) extension brings real-time scanning into AI code editors such as Cursor, Claude Desktop, Windsurf, and Cline.

Product overview

WinFunc is a unified autonomous AI security platform designed to find, triage, and patch codebase vulnerabilities in hours. The core product is Winfunc Scanner, which provides autonomous AI security agents that audit codebases, prove exploitable vulnerabilities, and deliver fixes. Winfunc Scanner is available as a comprehensive platform with multiple integrated modules including Vulnerability Detection, Dependency Scanning, Autofix, AI Triager, PR Security, Analytics, Infrastructure & Cloud, and CI Integration. Additionally, Winfunc MCP extends security capabilities directly into AI code editors (Cursor, Claude Desktop, Windsurf, Cline) via the Model Context Protocol, enabling real-time vulnerability scanning within developer workflows. Dome represents an additional product in the portfolio.

Differentiator

Problem solved

Functional benefit

Quantifiable outcome

• Found 13 patched bugs across 9 major projects including Node.js, React, NGINX, Mattermost, Supabase, Bun, Gumroad, Anthropic's MCP SDK, and Better-Auth

Named customers5 records

Segments6 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration4 records

AI capability5 records

Feature7 records

Scale indicators3 records

Recent moves6 records

Expansion highlights5 records

Emerging players

• Aikido Security: Aikido Security is a newer all-in-one application security platform combining SAST, SCA, DAST, and cloud security aimed at SMB and mid-market. It competes with winfunc in the modern, AI-augmented AppSec category for fast-growing tech companies.
• Cycode: Cycode is an application security posture management (ASPM) and code security platform covering SAST, SCA, secrets, and IaC. It competes with winfunc in the broader application security platform category for enterprise DevSecOps buyers.
• StackHawk: StackHawk focuses on dynamic application security testing (DAST) and API security, integrated into CI/CD for engineering teams. It is comparable to winfunc as a developer-first security testing tool with automation and CI integration.

Direct peers

• Sonar (SonarQube / SonarCloud): Sonar provides code quality and security analysis (SAST) integrated into developer workflows and CI pipelines. It competes directly with winfunc's PR Security and CI Integration modules for engineering team adoption.
• Snyk: Snyk is a leading developer security platform offering SAST, SCA, container, and IaC scanning. It is the most direct competitor to winfunc in the application and code vulnerability scanning market, with overlapping enterprise buyers and a similar DevSecOps positioning.
• Semgrep: Semgrep provides open-source and managed static analysis for code security, with custom rule authoring and an AppSec platform aimed at engineering teams. It competes head-on with winfunc's Scanner in the SAST category for developer-led adoption.
• Veracode: Veracode is an established application security testing vendor covering SAST, DAST, and software composition analysis for large enterprises. It targets the same AppSec buyer and competes on accuracy and coverage of vulnerability detection.
• Checkmarx: Checkmarx offers SAST, SCA, and IaC security scanning focused on enterprise AppSec programs. It overlaps with winfunc on static analysis of source code and serves a similar enterprise security audience.
• Mend (formerly WhiteSource): Mend provides application security with strong SCA and SAST capabilities for open-source dependency and code security. It competes with winfunc's Dependency Scanning and Vulnerability Detection modules.

Broad incumbents

• GitHub Advanced Security: GitHub Advanced Security (CodeQL, Dependabot, secret scanning) is bundled into the dominant developer platform, offering code scanning for millions of repositories. It is a broad incumbent competitor with significant distribution advantages over winfunc.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/getAsterisk

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds2 records

Investors3 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Asterisk