DryRun Security IaC Security
DryRun Security IaC Security scans infrastructure-as-code changes for security risks, using context from infrastructure and application code.
What DryRun Security IaC Security is
DryRun Security IaC Security scans infrastructure-as-code changes for security risks, using context from infrastructure and application code. It covers Terraform, Kubernetes, and other IaC, and its checks run in pull requests to guide teams as they design infrastructure. Findings can identify issues such as overly permissive IAM policies, exposed resources, insecure defaults, and subdomain takeover risks. Teams can also define natural-language policies for requirements such as permitted cloud regions or public access; the Custom Policy Agent enforces those rules on changes. Terraform findings can appear as pull request comments and Risk Register entries with affected resources, risk descriptions, and remediation guidance. The service is delivered as SaaS and supports GitHub.com and GitLab SaaS repositories; other source control systems and custom instances require contacting DryRun. Listed integrations include Claude Code, Claude Desktop, Codex, Cursor, GitHub, GitLab, and Slack. Pricing is on request, and a free trial is available, though no trial duration is stated.
Good
- Scans Terraform, Kubernetes, and other IaC.
- Pull request checks provide design-time guidance.
- Natural-language custom policies enforce guardrails.
- Findings include remediation guidance.
- Private-model data handling is described.
Watch out
- Pricing is available on request.
- Custom source-control instances require contacting DryRun.
- Delivered as SaaS.
Who it suits
It suits engineering and security teams that want IaC checks and policy guardrails in pull requests. Teams using GitHub.com or GitLab SaaS can use the listed repository support.
Verdict
DryRun combines IaC scanning with configurable guardrails and pull request feedback. Its stated repository support centers on GitHub.com and GitLab SaaS, and pricing requires an inquiry.
Plans and prices
From DryRun Security IaC Security's own pricing page, checked 5 Oct 2001.
| Plan | Price | What it gives you |
|---|---|---|
| Team pricing | Priced on request | Pricing aligned with engineering and security team size; number of developers, security team members, and owners requiring codebase visibility |
The facts
Each one read from DryRun Security IaC Security's own pages, with the date it was checked.
The company
- Company founding
- DryRun Security was founded by James Wickett and Ken Johnson and publicly emerged from stealth in May 2023.checked 5 Oct 2001
- Founded
- 2023checked 28 Sep 2001
- Headquarters
- Austin, Texas, United Stateschecked 28 Sep 2001
What it does
- Compliance support
- DryRun says it supports SOC 2, ISO 27001, PCI, and HIPAA by generating SDLC control artifacts.checked 4 Oct 2001
- Contextual analysis
- The product analyzes infrastructure and application code together to flag misconfigurations that expose real data and workloads.checked 5 Oct 2001
- Custom coverage
- Custom Code Policies can enforce additional infrastructure requirements, including approved resource types and organization-specific rules.checked 5 Oct 2001
- Custom guardrails
- Teams can write natural-language policies for cloud and platform guardrails, which the Custom Policy Agent enforces on changes.checked 4 Oct 2001
- Data handling
- DryRun says it uses a private LLM and allows customers to revoke code access through GitHub or GitLab permissions.checked 5 Oct 2001
- Data protection
- DryRun says it uses private models, does not send data to public AI systems, and stores minimal metadata and findings rather than cloned repositories.checked 4 Oct 2001
- Deployment
- DryRun is delivered as SaaS.checked 4 Oct 2001
- Detected risks
- Built-in IaC checks identify overly permissive IAM policies, publicly exposed resources, insecure defaults, and subdomain takeover risks.checked 5 Oct 2001
- Detection
- Its IaC checks identify misconfigurations that expose real data and workloads, rather than flagging every theoretical issue.checked 4 Oct 2001
- Findings
- The documentation says Terraform findings appear as pull request comments and Risk Register entries, with the affected resource, risk description, and remediation guidance.checked 4 Oct 2001
- IaC coverage
- DryRun scans Terraform, Kubernetes, and other infrastructure as code using contextual analysis across infrastructure and application code.checked 4 Oct 2001
- IaC scanning
- DryRun scans Terraform configuration changes in pull requests for security misconfigurations and insecure defaults.checked 5 Oct 2001
- Integrations
- The product page lists Claude Code, Claude Desktop, Codex, Cursor, GitHub, GitLab, and Slack integrations.checked 5 Oct 2001
- Policy guardrails
- Teams can define natural-language code policies for requirements such as public access and permitted cloud regions, enforced on changes by the Custom Policy Agent.checked 5 Oct 2001
- Pricing basis
- Pricing is based on team size, including developers, security team members, and owners who need codebase visibility; public prices are not listed on the FAQ page.checked 5 Oct 2001
- Pull request workflow
- IaC findings appear as pull request comments and Risk Register entries, with the affected resource, risk description, and remediation guidance.checked 5 Oct 2001
- Repository support
- DryRun currently supports GitHub.com personal, organization, and Enterprise Cloud repositories, plus GitLab SaaS; custom instances or other source control systems require contacting DryRun.checked 4 Oct 2001
- Security and compliance
- DryRun Security is SOC 2 Type II certified, with the platform independently audited for security, availability, and confidentiality controls.checked 5 Oct 2001
- Security audits
- DryRun says its infrastructure undergoes quarterly third-party security assessments.checked 4 Oct 2001
- Supported SCM
- DryRun currently supports repositories on GitHub.com and GitLab SaaS, with custom instances and other source code managers handled through support options.checked 5 Oct 2001
Money
- Free trial
- DryRun advertises a two-week free trial, and its FAQ describes installation followed by a 15-minute call with an AppSec expert.checked 5 Oct 2001
Alternatives to DryRun Security IaC Security
- 1
Aikido CSPM
Free planWebAPILinuxmacOS7.9From $300 a month - 2
Kyverno
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 3
Snyk Open Source
Free planWebAPILinuxmacOS7.5From $25 a month - 4
Fairwinds Polaris
Free planWebLinuxmacOSSelf-hosted7.1Free plan - 5
KloudSec IaC Security
Free planWebAPILinuxmacOS7.0From $79 a month - 6
kube-score
Free planWebLinuxmacOSSelf-hosted6.9Free plan