- Home
- Infrastructure as Code Security Software
- DryRun Security IaC Security
DryRun Security IaC Security
Austin, Texas, United States
What it is
DryRun Security IaC Security scans infrastructure-as-code changes in pull requests, examining Terraform, Kubernetes, and other configurations alongside application code. Its contextual checks focus on misconfigurations that expose actual data or workloads, including permissive IAM policies, public resources, insecure defaults, and subdomain takeover risks. Findings can appear as pull-request comments and Risk Register entries with affected resources, risk explanations, and remediation guidance. Teams can write natural-language guardrails for public access, cloud regions, approved resource types, and organization-specific requirements; the Custom Policy Agent enforces those policies on changes. The SaaS service integrates with GitHub, GitLab, Claude Code, Claude Desktop, Codex, Cursor, and Slack. It supports GitHub.com repositories and GitLab SaaS, while custom instances or other source-control systems require contacting DryRun. DryRun says it uses private models, stores minimal metadata, and offers a free trial.
For and against
For
- Scans Terraform and Kubernetes configurations
- Analyzes infrastructure with application-code context
- Natural-language custom policies
- Pull-request comments and Risk Register findings
- Free trial available
Against
- Pricing is available only on request
- Custom source-control instances require contacting DryRun
- SaaS deployment only
The verdict
DryRun focuses IaC review on contextual risks and enforceable policies rather than broad theoretical alerts. Its repository coverage is specific, so teams using other source-control systems must coordinate with the provider.
Who it suits
It suits engineering and security teams reviewing infrastructure changes in pull requests and requiring organization-specific IaC guardrails.
Plans and prices
Team pricing
Pricing aligned with engineering and security team size; number of developers, security team members, and owners requiring codebase visibility
Read 5 Oct 2026 · dryrun.security
On the record
- Company founding
- DryRun Security was founded by James Wickett and Ken Johnson and publicly emerged from stealth in May 2023.dryrun.security · read 5 Oct 2026
- Compliance support
- DryRun says it supports SOC 2, ISO 27001, PCI, and HIPAA by generating SDLC control artifacts.dryrun.security · read 4 Oct 2026
- Contextual analysis
- The product analyzes infrastructure and application code together to flag misconfigurations that expose real data and workloads.dryrun.security · read 5 Oct 2026
- Custom coverage
- Custom Code Policies can enforce additional infrastructure requirements, including approved resource types and organization-specific rules.docs.dryrun.security · read 5 Oct 2026
- Custom guardrails
- Teams can write natural-language policies for cloud and platform guardrails, which the Custom Policy Agent enforces on changes.dryrun.security · read 4 Oct 2026
- Data handling
- DryRun says it uses a private LLM and allows customers to revoke code access through GitHub or GitLab permissions.dryrun.security · read 5 Oct 2026
- Data protection
- DryRun says it uses private models, does not send data to public AI systems, and stores minimal metadata and findings rather than cloned repositories.dryrun.security · read 4 Oct 2026
- Deployment
- DryRun is delivered as SaaS.dryrun.security · read 4 Oct 2026
- Detected risks
- Built-in IaC checks identify overly permissive IAM policies, publicly exposed resources, insecure defaults, and subdomain takeover risks.docs.dryrun.security · read 5 Oct 2026
- Detection
- Its IaC checks identify misconfigurations that expose real data and workloads, rather than flagging every theoretical issue.dryrun.security · read 4 Oct 2026
- Findings
- The documentation says Terraform findings appear as pull request comments and Risk Register entries, with the affected resource, risk description, and remediation guidance.docs.dryrun.security · read 4 Oct 2026
- Free trial
- DryRun advertises a two-week free trial, and its FAQ describes installation followed by a 15-minute call with an AppSec expert.dryrun.security · read 5 Oct 2026
- IaC coverage
- DryRun scans Terraform, Kubernetes, and other infrastructure as code using contextual analysis across infrastructure and application code.dryrun.security · read 4 Oct 2026
- IaC scanning
- DryRun scans Terraform configuration changes in pull requests for security misconfigurations and insecure defaults.docs.dryrun.security · read 5 Oct 2026
- Integrations
- The product page lists Claude Code, Claude Desktop, Codex, Cursor, GitHub, GitLab, and Slack integrations.dryrun.security · read 5 Oct 2026
- Policy guardrails
- Teams can define natural-language code policies for requirements such as public access and permitted cloud regions, enforced on changes by the Custom Policy Agent.dryrun.security · read 5 Oct 2026
- Pricing basis
- Pricing is based on team size, including developers, security team members, and owners who need codebase visibility; public prices are not listed on the FAQ page.dryrun.security · read 5 Oct 2026
- Pull request workflow
- IaC findings appear as pull request comments and Risk Register entries, with the affected resource, risk description, and remediation guidance.docs.dryrun.security · read 5 Oct 2026
