Asterisk

Name: Asterisk
Brand: Asterisk
Rating: 4.5 (127 reviews)

AI Native

ai-native security for mission critical codebases.

Est 2024|Raised $500K

LinkedIn 1K|Website|FTEs 2|HQ San Francisco, California, United States

MarketsApplication Security Testing (AST)Code Security

Published Oct 2, 2026

01Common complaints

1. Enterprise compliance gating is non-negotiable - If procurement requires SOC 2 Type II or ISO 27001 documentation up front and the vendor cannot provide it, select a vendor with clearly documented compliance artifacts (for example, established enterprise AppSec vendors). 2. Requirement for a mature, widely-reviewed platform - If procurement decisions rely on extensive third-party reviews, analyst coverage, and large-customer references, more mature vendors provide stronger evidence by volume. 3. Large-scale repository coverage needed immediately - Organizations with hundreds or thousands of repositories may find per-repository setup fees and rollout complexity problematic. 4. SDLC cannot accept automated patch pull requests operationally - If an organization's SDLC lacks sufficient automated testing or has high regression risk, automated patch suggestions may introduce operational overhead. 5. Primary need is classic SCA/IaC/secrets coverage - Some security modules are documented as forthcoming in specific tiers; organizations needing mature SCA, IaC, or secrets scanning should consider vendors with established modules for those use cases.

Deal disqualifiers (poor fit)

Procurement processes that require immediate availability of SOC 2 Type II or ISO 27001 documentation.
Very large repository portfolios where per-repository setup fees create budget or rollout friction.
Organizations that cannot tolerate automated patch suggestions without extensive pre-deployment validation and testing.

Limitations acknowledged or implied by vendor materials

Roadmap references an alpha release in late 2025 and general availability as TBD, implying ongoing product development and evolving capabilities.
Some security modules (for example, supply-chain analysis and infrastructure-as-code scanning) are indicated as forthcoming depending on the tier.

Public documentation gaps (buyer due diligence items)

SOC 2 and ISO certificates are not publicly accessible.
Detailed data handling specifics (encryption, key management, code retention policies, sandbox isolation) are not fully documented.
Provisioning integrations (SCIM), audit logging capabilities, and a detailed RBAC model are not clearly documented.

02Why they buy

Unique selling points supported by vendor evidence

Exploit-backed verification and PoC generation are central to the vendor's positioning and are reflected in public disclosure pages.
Automated patch suggestion generation (patch files or PRs) is presented as a core workflow.
The product emphasizes reporting fewer, higher-assurance issues rather than broad noisy rule sets.

Where competitors have clear advantages

Compliance transparency: competitors may publish SOC 2 Type II and ISO documentation publicly.
Breadth of features: established vendors may provide mature SAST + SCA + IaC + secrets + governance capabilities under a single platform.

03Field reports

Reality check: review-platform coverage for this product

Asterisk/winfunc appears to be an early-stage startup with limited presence on major B2B review platforms under the Asterisk/winfunc identity. There is substantial review volume for an unrelated open-source PBX product with a similar name, which requires care to avoid conflation. This section is separated into: - A) Testimonials published on the vendor's own website (vendor-selected). - B) Community discussion and external commentary about winfunc/Asterisk (limited public signals).

A) Vendor-published testimonials (vendor-selected)

On the winfunc homepage, multiple customer testimonials are displayed referencing named customers on the site. These vendor-curated testimonials include statements such as: - Initial runs surfaced exploitable vulnerabilities. - The product identified complex bypasses that other tools had not flagged. - Rapid onboarding and an initial scan within a short timeframe. Critical caveat: These are curated testimonials and the sampling methodology is not provided (for example, the number of customers surveyed or aggregate success rates are not disclosed).

B) Community/social signals (limited direct reviews)

Accelerator launch pages provide product claims and positioning but are not user review platforms.
Alternative listing sites include general descriptions but do not provide substantial user-review volume specific to this vendor.
Forum and social mentions are limited compared with more mature AppSec vendors.

Common themes (from vendor content and limited external signals)

Observed positive themes from vendor content: - Findings described as having higher assurance through exploit verification. - Reduced noise compared with classic scanners (as claimed by the vendor). - Rapid onboarding and initial scanning in some reported cases. Observed risk themes (based on gaps in public evidence): - The claim of "zero false positives" is strong and lacks independent verification. - Compliance posture and supporting documentation (SOC 2, ISO certifications) are not clearly documented publicly, which can impede enterprise procurement. - Early-stage product risks: indications of pre-GA status suggest potential feature gaps and evolving behavior.

Public disclosures and vulnerability writeups

Winfunc publishes a disclosure feed that lists vulnerabilities it reports to have discovered and addressed. These technical writeups can be a positive credibility signal, but:

Public writeups vary in severity and exploit preconditions; reading the technical details is necessary to evaluate actual impact.
The disclosure feed contains only items that were publicly disclosable and therefore may not be representative of typical customer outcomes.

Vendor process descriptions

The vendor describes a multi-step technical approach that includes codebase indexing, automated scanning and exploit generation, and patch suggestion generation as patch files. The vendor also references internal refinement techniques and tree-sitter-based indexing. Critical evaluation: - The technical description is vendor-authored and omits some implementation details as proprietary. - Prospective customers should request reproducibility metrics, time-to-exploit distributions, patch acceptance rates, and integration documentation for CI processes.

04Best fit

Company size

Likely best-fit:

Small to mid-sized engineering organizations where a limited number of repositories contain high-value logic and rapid remediation matters.

The pricing page references small repository counts and team sizes, suggesting a focus on startup and growth-stage organizations, though an Enterprise tier is present.

Industries / verticals

Industries that may derive outsized value include SaaS, fintech, infrastructure and developer tools, and marketplaces—contexts where business-logic vulnerabilities are high-impact.

Roles and personas

Economic buyer: VP Engineering, CTO, Head of Security/AppSec.
Champions/users: security engineers, staff engineers, platform engineers, and developers with security responsibilities.

Qualification criteria (good fit)

The organization can grant repository access and is comfortable with third-party code scanning.
The organization seeks higher-assurance findings and can operationalize patch pull requests.
The organization values continuous scanning over one-time penetration tests.

05The pitch

What the product does (objective value proposition)

Asterisk is presented as an automated tool for analyzing codebases that identifies, verifies (via exploitability), and suggests patches for security vulnerabilities in software repositories. The publicly visible product experience is currently presented primarily as winfunc. Vendor materials describe a workflow of connecting Git repositories, running an automated audit that produces proof-of-concept evidence for findings, and generating patch pull requests or patch files for fixes. Key capability claims include: - Claims of "zero false positives" through exploit verification and references to formal verification techniques. - Identification of business-logic vulnerabilities (authorization bypass, financial logic manipulation) in addition to traditional SAST coverage. - Automated patch suggestion generation and CI/CD integration. Important naming/brand note: The vendor materials present Asterisk as an underlying agent or process and the public product experience is presented under the winfunc brand; this report treats Asterisk and winfunc as the same commercial offering based on those vendor signals.

Target market and positioning

Asterisk/winfunc targets: - Security-conscious engineering organizations (startups through enterprise) seeking continuous scanning and actionable remediation. - Teams that consider classic SAST/SCA tooling to be noisy and that seek higher-assurance findings with exploit verification. - Organizations with limited security headcount seeking automated AppSec coverage. Market positioning is adjacent to: - Developer-focused application security platforms (examples include Snyk, Semgrep, GitHub Advanced Security). - Startups and vendors marketing AI-enabled application security capabilities and agentic workflows. - Red team / penetration-test style outcomes (validated exploits) delivered via a productized SaaS model.

Get a comprehensive analysis of Asterisk including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Oct 2, 2026

01Common complaints

Enterprise compliance gating is non-negotiable
- If procurement requires SOC 2 Type II or ISO 27001 documentation up front and the vendor cannot provide it, select a vendor with clearly documented compliance artifacts (for example, established enterprise AppSec vendors).
Requirement for a mature, widely-reviewed platform
- If procurement decisions rely on extensive third-party reviews, analyst coverage, and large-customer references, more mature vendors provide stronger evidence by volume.
Large-scale repository coverage needed immediately
- Organizations with hundreds or thousands of repositories may find per-repository setup fees and rollout complexity problematic.
SDLC cannot accept automated patch pull requests operationally
- If an organization's SDLC lacks sufficient automated testing or has high regression risk, automated patch suggestions may introduce operational overhead.
Primary need is classic SCA/IaC/secrets coverage
- Some security modules are documented as forthcoming in specific tiers; organizations needing mature SCA, IaC, or secrets scanning should consider vendors with established modules for those use cases.

Deal disqualifiers (poor fit)

Procurement processes that require immediate availability of SOC 2 Type II or ISO 27001 documentation.
Very large repository portfolios where per-repository setup fees create budget or rollout friction.
Organizations that cannot tolerate automated patch suggestions without extensive pre-deployment validation and testing.

Limitations acknowledged or implied by vendor materials

Roadmap references an alpha release in late 2025 and general availability as TBD, implying ongoing product development and evolving capabilities.
Some security modules (for example, supply-chain analysis and infrastructure-as-code scanning) are indicated as forthcoming depending on the tier.

Public documentation gaps (buyer due diligence items)

SOC 2 and ISO certificates are not publicly accessible.
Detailed data handling specifics (encryption, key management, code retention policies, sandbox isolation) are not fully documented.
Provisioning integrations (SCIM), audit logging capabilities, and a detailed RBAC model are not clearly documented.

02Why they buy

Unique selling points supported by vendor evidence

Exploit-backed verification and PoC generation are central to the vendor's positioning and are reflected in public disclosure pages.
Automated patch suggestion generation (patch files or PRs) is presented as a core workflow.
The product emphasizes reporting fewer, higher-assurance issues rather than broad noisy rule sets.

Where competitors have clear advantages

Compliance transparency: competitors may publish SOC 2 Type II and ISO documentation publicly.
Breadth of features: established vendors may provide mature SAST + SCA + IaC + secrets + governance capabilities under a single platform.

03Field reports

Reality check: review-platform coverage for this product

This section is separated into:

A) Testimonials published on the vendor's own website (vendor-selected).
B) Community discussion and external commentary about winfunc/Asterisk (limited public signals).

A) Vendor-published testimonials (vendor-selected)

On the winfunc homepage, multiple customer testimonials are displayed referencing named customers on the site. These vendor-curated testimonials include statements such as:

Initial runs surfaced exploitable vulnerabilities.
The product identified complex bypasses that other tools had not flagged.
Rapid onboarding and an initial scan within a short timeframe.

Critical caveat: These are curated testimonials and the sampling methodology is not provided (for example, the number of customers surveyed or aggregate success rates are not disclosed).

B) Community/social signals (limited direct reviews)

Accelerator launch pages provide product claims and positioning but are not user review platforms.
Alternative listing sites include general descriptions but do not provide substantial user-review volume specific to this vendor.
Forum and social mentions are limited compared with more mature AppSec vendors.

Common themes (from vendor content and limited external signals)

Observed positive themes from vendor content:

Findings described as having higher assurance through exploit verification.
Reduced noise compared with classic scanners (as claimed by the vendor).
Rapid onboarding and initial scanning in some reported cases.

Observed risk themes (based on gaps in public evidence):

The claim of "zero false positives" is strong and lacks independent verification.
Compliance posture and supporting documentation (SOC 2, ISO certifications) are not clearly documented publicly, which can impede enterprise procurement.
Early-stage product risks: indications of pre-GA status suggest potential feature gaps and evolving behavior.

Public disclosures and vulnerability writeups

Winfunc publishes a disclosure feed that lists vulnerabilities it reports to have discovered and addressed. These technical writeups can be a positive credibility signal, but:

Public writeups vary in severity and exploit preconditions; reading the technical details is necessary to evaluate actual impact.
The disclosure feed contains only items that were publicly disclosable and therefore may not be representative of typical customer outcomes.

Vendor process descriptions

Critical evaluation:

The technical description is vendor-authored and omits some implementation details as proprietary.
Prospective customers should request reproducibility metrics, time-to-exploit distributions, patch acceptance rates, and integration documentation for CI processes.

04Best fit

Company size

Likely best-fit:

Small to mid-sized engineering organizations where a limited number of repositories contain high-value logic and rapid remediation matters.

The pricing page references small repository counts and team sizes, suggesting a focus on startup and growth-stage organizations, though an Enterprise tier is present.

Industries / verticals

Industries that may derive outsized value include SaaS, fintech, infrastructure and developer tools, and marketplaces—contexts where business-logic vulnerabilities are high-impact.

Roles and personas

Economic buyer: VP Engineering, CTO, Head of Security/AppSec.
Champions/users: security engineers, staff engineers, platform engineers, and developers with security responsibilities.

Qualification criteria (good fit)

The organization can grant repository access and is comfortable with third-party code scanning.
The organization seeks higher-assurance findings and can operationalize patch pull requests.
The organization values continuous scanning over one-time penetration tests.

05The pitch

What the product does (objective value proposition)

Key capability claims include:

Claims of "zero false positives" through exploit verification and references to formal verification techniques.
Identification of business-logic vulnerabilities (authorization bypass, financial logic manipulation) in addition to traditional SAST coverage.
Automated patch suggestion generation and CI/CD integration.

Important naming/brand note: The vendor materials present Asterisk as an underlying agent or process and the public product experience is presented under the winfunc brand; this report treats Asterisk and winfunc as the same commercial offering based on those vendor signals.

Target market and positioning

Asterisk/winfunc targets:

Security-conscious engineering organizations (startups through enterprise) seeking continuous scanning and actionable remediation.
Teams that consider classic SAST/SCA tooling to be noisy and that seek higher-assurance findings with exploit verification.
Organizations with limited security headcount seeking automated AppSec coverage.

Market positioning is adjacent to:

Developer-focused application security platforms (examples include Snyk, Semgrep, GitHub Advanced Security).
Startups and vendors marketing AI-enabled application security capabilities and agentic workflows.
Red team / penetration-test style outcomes (validated exploits) delivered via a productized SaaS model.

Get a comprehensive analysis of Asterisk including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →