DryRun Security
AI-native contextual security for every pull request — catch exploitable risks before they merge, not after.
Overview
DryRun Security is an AI-native AppSec platform whose Contextual Security Analysis engine traces cross-file data flow to catch exploitable risk, posting inline PR findings within seconds to minutes. Launched in Austin in 2023, it reported 250,000+ code reviews a month in January 2026, for customers including Gusto and BrightHR.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 28 Sep 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- GitHub or GitLab install
- Pull-request findings
- Seat-based pricing
- 12-month term
- Pricing via sales
Use cases
What you can produce with DryRun Security
- Inline PR security findings with precise code references, typically within seconds to minutes of the change
- Executive summary reports for AppSec teams alongside developer-facing remediation guidance
- Custom policy enforcement in pull requests via Natural Language Code Policies (launched January 2025) with no regex required
- Full-codebase DeepScan reports via the AI DeepScan Agent launched in February 2026
- Secrets detection on every pull request, with checks on whether each secret found is live
- Terraform infrastructure-as-code scanning integrated into the PR workflow
- Natural language codebase querying via Code Insights MCP for AI assistant integration
ASEAN Perspective
DryRun Security in Southeast Asia
DryRun Security has no confirmed APAC office, ASEAN customer references, or regional data residency commitments as of mid-2026. The platform is cloud-hosted and US-centric in its go-to-market, which raises data sovereignty considerations for regulated industries in Singapore (MAS TRM), Indonesia (OJK), and the broader region. That said, the GitHub and GitLab integration model means any ASEAN engineering team already on those platforms can onboard without geographic friction — the tool is usable today, but buyers should conduct their own due diligence on data processing jurisdiction and contractual obligations before deployment in regulated ASEAN environments.
DryRun Security's pitch — trace actual data flow instead of matching regex patterns — is backed so far by its own testing: its 2025 SAST Accuracy Report says it caught 23 of 26 seeded vulnerabilities across four intentionally vulnerable apps, against 12 for Semgrep and fewer for Snyk Code, CodeQL and SonarQube. That is the vendor's own benchmark, so treat it as a claim to test in a trial. A SOC 2 Type 2 attestation and Natural Language Code Policies — plain-English rules instead of regex maintenance — round out a credible package for a company barely three years old. The caveats track its stage: DryRun is a seed-funded startup ($8.7M raised January 2025), its G2 base is only 20 reviews, and its own site publishes no prices, though AWS Marketplace lists $85,000 a year for 100 developer seats. There's no confirmed APAC data-residency option, so teams in Singapore or Indonesia should confirm jurisdiction before signing.
What we found
23 of 26 seeded vulnerabilities — that's DryRun Security's own tally from its 2025 SAST Accuracy Report, run across four public benchmarks (RailsGoat, a vulnerable task manager, a C# API, and a Spring Boot app) against Semgrep, Snyk Code, GitHub Advanced Security, and SonarQube. None of the competitors cracked half. DryRun says G2 named it a High Performer in SAST for Spring 2026; its G2 rating is 4.9 out of 5, but from only 20 reviews, at least one of them invited by the seller.
Reviewers keep coming back to the same point: because DryRun traces how new code actually interacts with auth logic and data flow instead of pattern-matching, the noise-to-signal ratio drops sharply compared to older SAST tools. Setup is a one-time GitHub or GitLab install, findings show up inline on the pull request within seconds to minutes, depending on the size of the change, and Natural Language Code Policies (added in 2025) let security teams write enforcement rules in plain English instead of maintaining regex.
The company is young — founded in 2023 by former Signal Sciences and GitHub security engineers, running on an $8.7M seed round closed in January 2025 — and it shows in a few places. Its own site publishes no prices, though an AWS Marketplace listing puts a 12-month, 100-developer-seat contract at $85,000; the customer logos run from Gusto to Manchester-based BrightHR, Tines and Cloudera; and there's no confirmed APAC data-residency option. The company reported more than 250,000 code reviews a month in January 2026, and its homepage now claims more than 500,000 a week.
It reviews JavaScript, TypeScript, Python, Java, Go, Ruby, PHP, C#, Kotlin, Swift and Rust, can block a pull request and raise Jira tickets, and tries to validate any secret it finds to see whether it is live. Signal Sciences co-founder Andrew Peterson joined its board in February 2026.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
Notable facts
- DryRun Security won the OWASP Global DC 2023 Most Innovative Startup award in its very first year out of stealth.
- Co-founder Ken Johnson's path to AppSec began in the US Navy as an IT specialist, and his first civilian security role was at the Pentagon.
- The platform's Contextual Security Analysis engine can complete a full PR review and post inline findings in approximately one minute.
- DryRun Security's 2025 SAST Accuracy Report result — 88% of seeded vulnerabilities detected — beat five established static analysis tools that had been building rule libraries for years.
Frequently asked questions
About this listing
This entry was compiled from publicly available data including DryRun Security's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with DryRun Security unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to DryRun Security directly →
Spotted something out of date? Suggest an update →
Related reading
Alternatives to DryRun Security
More in Security & Safety
