Aikido CSPM From $300/mo · Free plan 9.5 Visit 
DryRun Security IaC Security
dryrun.security
What it is
DryRun Security IaC Security scans infrastructure-as-code changes for security risks by analyzing infrastructure and application code together. It covers Terraform, Kubernetes, and other IaC, with checks for overly permissive IAM policies, publicly exposed resources, insecure defaults, and subdomain takeover risks. Scans run in pull requests and provide guidance during infrastructure design. Teams can write natural-language guardrails for public access, permitted cloud regions, approved resource types, and organization-specific requirements; the Custom Policy Agent enforces them on changes. Terraform findings can appear as pull-request comments and Risk Register entries containing the affected resource, risk description, and remediation guidance. Listed integrations include Claude Code, Claude Desktop, Codex, Cursor, GitHub, GitLab, and Slack. The SaaS service supports GitHub.com personal, organization, and Enterprise Cloud repositories, plus GitLab SaaS; custom instances and other source-control systems require contacting DryRun. DryRun says it uses private models, sends no data to public AI systems, stores minimal metadata and findings, and allows code-access revocation through repository permissions. Pricing is on request, aligned with team size, and a free trial is available.
Spec sheet
- Deployment
- DryRun is delivered as SaaS.Read 4 Oct 2026 · dryrun.security
- Integrations
- The product page lists Claude Code, Claude Desktop, Codex, Cursor, GitHub, GitLab, and Slack integrations.Read 5 Oct 2026 · dryrun.security
- Headquarters
- Austin, Texas, United StatesRead 28 Sep 2026 · dryrun.security
- Founded
- 2023Read 28 Sep 2026 · dryrun.security
- Company founding
- DryRun Security was founded by James Wickett and Ken Johnson and publicly emerged from stealth in May 2023.Read 5 Oct 2026 · dryrun.security
- Compliance support
- DryRun says it supports SOC 2, ISO 27001, PCI, and HIPAA by generating SDLC control artifacts.Read 4 Oct 2026 · dryrun.security
- Contextual analysis
- The product analyzes infrastructure and application code together to flag misconfigurations that expose real data and workloads.Read 5 Oct 2026 · dryrun.security
- Custom coverage
- Custom Code Policies can enforce additional infrastructure requirements, including approved resource types and organization-specific rules.Read 5 Oct 2026 · docs.dryrun.security
- Custom guardrails
- Teams can write natural-language policies for cloud and platform guardrails, which the Custom Policy Agent enforces on changes.Read 4 Oct 2026 · dryrun.security
- Data handling
- DryRun says it uses a private LLM and allows customers to revoke code access through GitHub or GitLab permissions.Read 5 Oct 2026 · dryrun.security
- Data protection
- DryRun says it uses private models, does not send data to public AI systems, and stores minimal metadata and findings rather than cloned repositories.Read 4 Oct 2026 · dryrun.security
- Detected risks
- Built-in IaC checks identify overly permissive IAM policies, publicly exposed resources, insecure defaults, and subdomain takeover risks.Read 5 Oct 2026 · docs.dryrun.security
- Detection
- Its IaC checks identify misconfigurations that expose real data and workloads, rather than flagging every theoretical issue.Read 4 Oct 2026 · dryrun.security
- Findings
- The documentation says Terraform findings appear as pull request comments and Risk Register entries, with the affected resource, risk description, and remediation guidance.Read 4 Oct 2026 · docs.dryrun.security
- Free trial
- DryRun advertises a two-week free trial, and its FAQ describes installation followed by a 15-minute call with an AppSec expert.Read 5 Oct 2026 · dryrun.security
- IaC coverage
- DryRun scans Terraform, Kubernetes, and other infrastructure as code using contextual analysis across infrastructure and application code.Read 4 Oct 2026 · dryrun.security
- IaC scanning
- DryRun scans Terraform configuration changes in pull requests for security misconfigurations and insecure defaults.Read 5 Oct 2026 · docs.dryrun.security
- Policy guardrails
- Teams can define natural-language code policies for requirements such as public access and permitted cloud regions, enforced on changes by the Custom Policy Agent.Read 5 Oct 2026 · dryrun.security
- Pricing basis
- Pricing is based on team size, including developers, security team members, and owners who need codebase visibility; public prices are not listed on the FAQ page.Read 5 Oct 2026 · dryrun.security
- Pull request workflow
- IaC findings appear as pull request comments and Risk Register entries, with the affected resource, risk description, and remediation guidance.Read 5 Oct 2026 · docs.dryrun.security
- Repository support
- DryRun currently supports GitHub.com personal, organization, and Enterprise Cloud repositories, plus GitLab SaaS; custom instances or other source control systems require contacting DryRun.Read 4 Oct 2026 · dryrun.security
- Security and compliance
- DryRun Security is SOC 2 Type II certified, with the platform independently audited for security, availability, and confidentiality controls.Read 5 Oct 2026 · docs.dryrun.security
- Security audits
- DryRun says its infrastructure undergoes quarterly third-party security assessments.Read 4 Oct 2026 · dryrun.security
- Supported SCM
- DryRun currently supports repositories on GitHub.com and GitLab SaaS, with custom instances and other source code managers handled through support options.Read 5 Oct 2026 · dryrun.security
- Trial and onboarding
- The FAQ says users can test DryRun Security with an installation taking less than five minutes followed by a 15-minute call with an AppSec expert; it does not state a trial duration.Read 4 Oct 2026 · dryrun.security
Plans and prices
Team pricing Priced on request Pricing aligned with engineering and security team size; number of developers, security team members, and owners requiring codebase visibility Read 5 Oct 2026 · dryrun.security
Strong points and limits
Strong points
- Terraform and Kubernetes analysis
- Natural-language custom policy guardrails
- Pull-request findings with remediation guidance
- Private models and minimal stored data
- GitHub and GitLab SaaS support
Limits
- Pricing is available only on request
- Custom source-control instances require contacting DryRun
- SaaS deployment only
Who it suits
DryRun suits engineering and security teams that want IaC checks inside pull-request workflows. It is relevant to organizations defining custom cloud guardrails and producing SOC 2, ISO 27001, PCI, or HIPAA control artifacts.
Verdict
DryRun connects IaC scanning with application context, repository workflows, and organization-specific policies. Its supported repository list is defined, but teams using other source-control systems or seeking a stated trial length must contact the maker.
Where Specifiction places it
- Infrastructure as Code Security Software#9 of 228.3
