Tech riderRev. 5 Oct 2026

DryRun Security IaC Security

Ch 117.0of 22 Infrastructure as Code Security Software

1Runs onAPI, Web
2Costsfree trial
3Terraform analysisYes
4Kubernetes analysisYes
5Custom policiesYes
6Secrets detectionYes
7Pull request scanningYes
8IDE integrationYes

8 lines stated Written from the maker's own pages: dryrun.security

Visit site Alternatives

The DryRun Security IaC Security homepage

Overview

DryRun Security IaC Security is ranked #11 of 22 in infrastructure as code security software on Specifiction. It runs on API, Web. A free trial is offered.

DryRun Security IaC Security plans and pricing

All plans

Team pricing Not published Pricing aligned with engineering and security team size; number of developers, security team members, and owners requiring codebase visibility dryrun.security · 5 Oct 2026

Compared on infrastructure as code security software

Terraform analysis: Yesdryrun.security
Kubernetes analysis: Yesdryrun.security
Custom policies: Yesdryrun.security
Secrets detection: Yesdryrun.security
Pull request scanning: Yesdryrun.security
IDE integration: Yesdryrun.security

Facts

IaC coverage: DryRun scans Terraform, Kubernetes, and other infrastructure as code using contextual analysis across infrastructure and application code.dryrun.security · 4 Oct 2026
Detection: Its IaC checks identify misconfigurations that expose real data and workloads, rather than flagging every theoretical issue.dryrun.security · 4 Oct 2026
Pull request workflow: IaC checks run in pull requests and provide guidance while teams are designing infrastructure.dryrun.security · 4 Oct 2026
Custom guardrails: Teams can write natural-language policies for cloud and platform guardrails, which the Custom Policy Agent enforces on changes.dryrun.security · 4 Oct 2026
Findings: The documentation says Terraform findings appear as pull request comments and Risk Register entries, with the affected resource, risk description, and remediation guidance.docs.dryrun.security · 4 Oct 2026
Integrations: The product page lists Claude Code, Claude Desktop, Codex, Cursor, GitHub, GitLab, and Slack as integrations.dryrun.security · 4 Oct 2026
Repository support: DryRun currently supports GitHub.com personal, organization, and Enterprise Cloud repositories, plus GitLab SaaS; custom instances or other source control systems require contacting DryRun.dryrun.security · 4 Oct 2026
Deployment: DryRun is delivered as SaaS.dryrun.security · 4 Oct 2026
Data protection: DryRun says it uses private models, does not send data to public AI systems, and stores minimal metadata and findings rather than cloned repositories.dryrun.security · 4 Oct 2026
Security audits: DryRun says its infrastructure undergoes quarterly third-party security assessments.dryrun.security · 4 Oct 2026
Compliance support: DryRun says it supports SOC 2, ISO 27001, PCI, and HIPAA by generating SDLC control artifacts.dryrun.security · 4 Oct 2026
Trial and onboarding: The FAQ says users can test DryRun Security with an installation taking less than five minutes followed by a 15-minute call with an AppSec expert; it does not state a trial duration.dryrun.security · 4 Oct 2026
Pricing basis: The FAQ says pricing is aligned with engineering and security team size, including developers, security team members, and owners needing codebase visibility; it does not list prices.dryrun.security · 4 Oct 2026
IaC scanning: DryRun scans Terraform configuration changes in pull requests for security misconfigurations and insecure defaults.docs.dryrun.security · 5 Oct 2026
Detected risks: Built-in IaC checks identify overly permissive IAM policies, publicly exposed resources, insecure defaults, and subdomain takeover risks.docs.dryrun.security · 5 Oct 2026
Contextual analysis: The product analyzes infrastructure and application code together to flag misconfigurations that expose real data and workloads.dryrun.security · 5 Oct 2026
Policy guardrails: Teams can define natural-language code policies for requirements such as public access and permitted cloud regions, enforced on changes by the Custom Policy Agent.dryrun.security · 5 Oct 2026
Custom coverage: Custom Code Policies can enforce additional infrastructure requirements, including approved resource types and organization-specific rules.docs.dryrun.security · 5 Oct 2026
Supported SCM: DryRun currently supports repositories on GitHub.com and GitLab SaaS, with custom instances and other source code managers handled through support options.dryrun.security · 5 Oct 2026
Security and compliance: DryRun Security is SOC 2 Type II certified, with the platform independently audited for security, availability, and confidentiality controls.docs.dryrun.security · 5 Oct 2026
Data handling: DryRun says it uses a private LLM and allows customers to revoke code access through GitHub or GitLab permissions.dryrun.security · 5 Oct 2026
Free trial: DryRun advertises a two-week free trial, and its FAQ describes installation followed by a 15-minute call with an AppSec expert.dryrun.security · 5 Oct 2026
Company founding: DryRun Security was founded by James Wickett and Ken Johnson and publicly emerged from stealth in May 2023.dryrun.security · 5 Oct 2026