DryRun Security vs Microsoft MDASH vs Semgrep vs ZeroPath
A side-by-side look at scores, pricing and features — with RECATOOLS' ASEAN-aware verdict for each.
DryRun Security
AI-native contextual security for every pull request — catch exploitab...
Visit
|
Microsoft MDASH
Microsoft's multi-model AI agents for finding code vulnerabilities
Visit
|
Semgrep
Static analysis for code, dependencies and secrets, with AI triage
Visit
|
ZeroPath
AI code scanner that hunts logic and auth flaws, then writes the patch
Visit
|
|
|---|---|---|---|---|
| RECATOOLS Score | 8.1 / 10 | 7 / 10 | 8.2 / 10 | 7.8 / 10 |
| Capability | ||||
| Value for money | ||||
| Ease of use | ||||
| ASEAN readiness | ||||
| API quality | ||||
| Pricing | Enterprise | Contact | Freemium | Subscription |
| Free tier | Free trial and free security assessment | None. Private/expanded preview for eligible organisations via sign-up or Microsoft account team; scans use the customer's own Azure model deployments | Free Edition: up to 10 contributors and 10 private repos, Code + Supply Chain, 60 AI credits; Community Edition CLI free (LGPL-2.1) | — |
| Paid from | Seat-based contracts; AWS Marketplace lists $85,000 a year for 100 developer seats | Not published, models run in your own Azure Foundry, billed at Azure $ rates | Teams from $30/contributor/mo (Code or Supply Chain); Secrets $15 | $1,000/month base + $60/developer/month (Team, sold through a demo) |
| Has API | ✓ | ✗ | ✓ | ✓ |
| Open source | ✗ | ✗ | ✓ | ✗ |
| Free to use | ✗ | ✗ | ✓ | ✗ |
| Users | Customers ran 250,000+ code reviews/month as of early 2025; customer count undisclosed | — | — | 1,000+ organisations, 200k+ scans/month (Mar 2026) |
| Founded | 2023 | 2026 | 2017 | 2024 |
| Maker | James Wickett (CEO) and Ken Johnson (CTO) | Microsoft | — | Dean Valentine (CEO), Raphael Karger (CTO), Nathan Hrncirik (CIO), Etienne Lunetta (COO) |
| Verdict | DryRun Security's pitch — trace actual data flow instead of matching regex patterns — is backed so far by its own testing: its 2025 SAST Accuracy Report says it caught 23 of 26 seeded vulnerabilities across four intentio... |
MDASH is a serious demonstration of AI agents finding real vulnerabilities, credited with 16 Patch Tuesday fixes and strong CyberGym results, and it fits naturally into Microsoft Defender and developer pipelines. But it... |
Semgrep is one of the most practical code-security scanners: fast, easy to extend with custom rules, and backed by reachability-aware dependency scanning and secrets detection. Its AI triage, now called Multimodal, is in... |
ZeroPath is one of the few AI code scanners with outside evidence behind it: curl's maintainer credited its reports, alongside another tool's, with a batch of confirmed fixes in 2025, and its focus on business-logic and... |
| Directory listing → | Full review → | Full review → | Directory listing → |
Comparisons cover up to 4 tools. Scores are RECATOOLS editorial assessments; verify current pricing on each vendor's site.