Winfunc Infrastructure Scanner
Winfunc Infrastructure Scanner analyzes infrastructure-as-code, cloud configurations, and container definitions before production.
What Winfunc Infrastructure Scanner is
Winfunc Infrastructure Scanner analyzes infrastructure-as-code, cloud configurations, and container definitions before production. It supports Terraform, CloudFormation, Pulumi, Kubernetes manifests, and Dockerfiles. Cloud checks review IAM policies, network exposure, storage settings, and drift between declared infrastructure and actual cloud state. The scanner maps CIS Benchmark requirements for AWS, GCP, and Azure through provider APIs. Dockerfile and image analysis identifies known CVEs, permission problems, and insecure base images, with CI pre-deploy gates. Findings receive severity and business context, suggested fixes, and generated IaC patches. Reports map issues to CIS, SOC 2, ISO 27001, PCI DSS, and HIPAA, including evidence and remediation guidance. Integrations include code hosts, CI systems, Jira, Slack, Microsoft Teams, and listed developer assistants. Deployment can be self-hosted on premises or in a private cloud. One-time scans cost $500, paid once; other plans use credits or custom terms.
Good
- Terraform, Kubernetes, and CloudFormation analysis
- Detects exposed secrets and configuration drift
- Container CVE and permission scanning
- Compliance reports include evidence
- Self-hosted deployment keeps data within perimeter
Watch out
- No free plan
- One-time scan costs $500, paid once
- Deep scans are priced by scope
- Some plans require a pricing call
Who it suits
It suits teams managing cloud infrastructure, containers, and compliance requirements. Regulated organizations can choose enterprise terms with customer-controlled hosting and named support.
Verdict
Winfunc combines infrastructure, cloud, container, and compliance checks in one scanner. Its self-hosted option and enterprise controls fit organizations with strict data and policy requirements.
Plans and prices
From Winfunc Infrastructure Scanner's own pricing page, checked 21 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| One-time | $500, paid once | one surface or deep scan · findings workspace and report · prioritized findings · suggested remediation · no subscription · from $500 per surface scan; deep scan priced by scope |
| Enterprise | Priced on request | customer-controlled hosting · isolated tenants · bring-your-own model keys · organization policies · named support · committed usage; terms set in agreement |
| Pay as you go | Priced on request | incremental, scheduled and pull-request review · reproduction evidence where feasible · patch pull requests · AI triage · MCP · team access · Slack alerts · analytics · credits bought as needed |
| Recurring | — | everything in Pay as you go · allowance renews monthly · reconciled usage per scan · monthly credit allowance; discounted annual billing |
The facts
Each one read from Winfunc Infrastructure Scanner's own pages, with the date it was checked.
What it does
- Access model
- The web security console is invite-only and requires signing in with an invited GitHub account.checked 21 Oct 2026
- API and keys
- Enterprise documentation says API and MCP keys are stored as SHA-256 hashes and can be revoked.checked 21 Oct 2026
- Cloud analysis
- Reviews cloud IAM policies, detects network exposure and storage misconfigurations, and checks for drift between declared infrastructure and actual cloud state.checked 7 Oct 2026
- Cloud integrations
- Cloud-provider API connections provide real-time posture assessment for AWS, GCP and Azure.checked 21 Oct 2026
- Cloud posture
- Continuous cloud assessment compares environments with CIS benchmarks and detects drift from declared infrastructure.checked 21 Oct 2026
- Cloud providers
- Maps CIS Benchmark compliance for AWS, GCP, and Azure and uses cloud provider APIs for real-time posture assessment.checked 7 Oct 2026
- Code retention
- The Trust Center says source code is processed in memory and discarded after analysis, retaining only finding metadata.checked 7 Oct 2026
- Compliance frameworks
- Maps findings to CIS, SOC 2, ISO 27001, PCI DSS, and HIPAA and offers audit-ready reports with evidence and remediation guidance.checked 7 Oct 2026
- Containers
- Scans Dockerfiles and container images for known CVEs, misconfigured permissions, and insecure base images, with CI pre-deploy gates.checked 7 Oct 2026
- Container scanning
- Dockerfiles and Docker images are checked for CVEs, permission problems and insecure base images.checked 21 Oct 2026
- Data retention
- The security terms state that source code is analyzed in ephemeral workspaces and deleted after each scan while findings are retained.checked 21 Oct 2026
- Deployment
- The Trust Center describes self-hosted deployment on premises or in a private cloud, with data remaining within the customer’s perimeter.checked 7 Oct 2026
- Documentation depth
- Product pages link to documentation, but no public API or SDK reference with endpoint details is presented on the reviewed pages.checked 21 Oct 2026
- Hypothesis scans
- A hypothesis scan turns a bounded security question into a repository-scoped investigation with traces, supporting evidence, conclusions and limitations.checked 21 Oct 2026
- IaC support
- The infrastructure scanner supports Terraform, CloudFormation and Pulumi templates.checked 21 Oct 2026
- IAM review
- Cloud IAM analysis identifies overly permissive roles and unused credentials.checked 21 Oct 2026
- Independent employee fact
- LinkedIn names Vivek R and Mufeed VH among the employees shown for winfunc.checked 21 Oct 2026
- Independent founders fact
- Y Combinator lists Mufeed VH as founder/CEO and Vivek R as founder/CTO.checked 21 Oct 2026
- Independent news
- LinkedIn reports that Winfunc-associated research found two NGINX CVEs while scans cost under $100 and generated $4,500 in Chrome VRP bounties.checked 21 Oct 2026
- Independent size fact
- LinkedIn lists winfunc as privately held with 2–10 employees.checked 21 Oct 2026
The company
- Company backing
- The maker says it is backed by Y Combinator's Summer 2024 batch.checked 21 Oct 2026
- Company founding
- Stition, Inc. was incorporated in Delaware in 2024.checked 21 Oct 2026
- Independent company profile
- Y Combinator describes Winfunc as an active San Francisco SaaS, B2B security and AI company.checked 21 Oct 2026
Where it runs
- Compliance mapping
- Findings can be mapped to CIS, SOC 2, ISO 27001, PCI DSS and HIPAA with evidence-based reports.checked 21 Oct 2026
Alternatives to Winfunc Infrastructure Scanner
- 1
Kubescape
Free planOpen sourceAPILinuxmacOSSelf-hosted8.2From $30 a month - 2
Aikido CSPM
Free planWebAPILinuxmacOS7.9From $300 a month - 3
AWS CloudFormation
Free planiOSWebAPILinux7.7Free plan - 4
Kyverno
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 5
CFRipper
Free planOpen sourceWebLinuxmacOSSelf-hosted7.5Free plan - 6
audytx
Free planWebAPI7.2From $20 a month