Freedom251 › Infrastructure as Code Security Software
DryRun Security IaC Security
What DryRun Security IaC Security is
DryRun Security IaC Security reviews infrastructure-as-code changes in pull requests, examining infrastructure and application code together to find configuration risks that could expose real data or workloads. It scans Terraform, Kubernetes, and other IaC, with built-in checks for overly broad IAM permissions, publicly reachable resources, unsafe defaults, and subdomain takeover risks. Teams can set cloud and platform guardrails in natural language, such as rules for public access or permitted regions; the Custom Policy Agent applies them to changes. Additional policies can cover approved resource types and organization-specific requirements. Terraform results can appear in pull request comments and Risk Register entries, with the affected resource, risk explanation, and remediation guidance. The SaaS service lists Claude Code, Claude Desktop, Codex, Cursor, GitHub, GitLab, and Slack integrations. It supports personal, organization, and Enterprise Cloud repositories on GitHub.com, as well as GitLab SaaS; custom instances and other source control systems require contacting DryRun. The maker says it uses private models, does not send data to public AI systems, and retains minimal metadata and findings instead of cloned repositories. Pricing is on request, with a free trial available.
Who it suits
It suits engineering and security teams that want IaC checks and policy guardrails in pull requests, including teams working with Terraform or Kubernetes. It may also fit organizations that need SDLC control artifacts for SOC 2, ISO 27001, PCI, or HIPAA support.
What it does well
- Scans Terraform, Kubernetes, and other infrastructure-as-code.
- Uses application and infrastructure context to identify exposed real data and workloads.
- Natural-language policies cover cloud and platform guardrails.
- Pull request findings include affected resources and remediation guidance.
- Integrates with GitHub, GitLab, Slack, and listed coding assistants.
What to know first
- Pricing is available on request rather than published.
- Custom repository instances and other source control systems require contacting DryRun.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Team pricing | Pricing aligned with engineering and security team size; number of developers, security team members, and owners requiring codebase visibility | On request |
As dryrun.security lists them, read 5 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the DryRun IaC Security website.
- Request pricing or a free trial.
- Install the service; the FAQ describes installation taking less than five minutes.
- Use a supported GitHub.com or GitLab SaaS repository.
- Attend the 15-minute call with an AppSec expert described in the FAQ.
Verdict
Choose DryRun Security IaC Security if your team wants contextual IaC checks and customizable guardrails within pull requests. Look elsewhere if you need a published price or support for a source control system beyond GitHub.com and GitLab SaaS without contacting the company.
Questions
How much does DryRun Security IaC Security cost?
Pricing is on request and is aligned with engineering and security team size, including developers, security staff, and owners who need codebase visibility.
Is there a free trial?
Yes. The FAQ describes testing the service after an installation taking less than five minutes, followed by a 15-minute call with an AppSec expert. It does not state a trial duration.
Which repositories are supported?
DryRun supports GitHub.com personal, organization, and Enterprise Cloud repositories, plus GitLab SaaS. Custom instances and other source control systems require contacting DryRun.
What integrations are listed?
The product page lists Claude Code, Claude Desktop, Codex, Cursor, GitHub, GitLab, and Slack.
How does DryRun handle code and data?
The maker says it uses private models and does not send data to public AI systems. It says it stores minimal metadata and findings rather than cloned repositories, and customers can revoke code access through GitHub or GitLab permissions.
What compliance support does it offer?
The maker says the platform supports SOC 2, ISO 27001, PCI, and HIPAA by generating SDLC control artifacts. It also says DryRun Security is SOC 2 Type II certified.
Facts from DryRun Security IaC Security's own pages
- Company founding
- DryRun Security was founded by James Wickett and Ken Johnson and publicly emerged from stealth in May 2023. · dryrun.security, 5 Oct 2026
- Compliance support
- DryRun says it supports SOC 2, ISO 27001, PCI, and HIPAA by generating SDLC control artifacts. · dryrun.security, 4 Oct 2026
- Contextual analysis
- The product analyzes infrastructure and application code together to flag misconfigurations that expose real data and workloads. · dryrun.security, 5 Oct 2026
- Custom coverage
- Custom Code Policies can enforce additional infrastructure requirements, including approved resource types and organization-specific rules. · docs.dryrun.security, 5 Oct 2026
- Custom guardrails
- Teams can write natural-language policies for cloud and platform guardrails, which the Custom Policy Agent enforces on changes. · dryrun.security, 4 Oct 2026
- Data handling
- DryRun says it uses a private LLM and allows customers to revoke code access through GitHub or GitLab permissions. · dryrun.security, 5 Oct 2026
- Data protection
- DryRun says it uses private models, does not send data to public AI systems, and stores minimal metadata and findings rather than cloned repositories. · dryrun.security, 4 Oct 2026
- Deployment
- DryRun is delivered as SaaS. · dryrun.security, 4 Oct 2026
- Detected risks
- Built-in IaC checks identify overly permissive IAM policies, publicly exposed resources, insecure defaults, and subdomain takeover risks. · docs.dryrun.security, 5 Oct 2026
- Detection
- Its IaC checks identify misconfigurations that expose real data and workloads, rather than flagging every theoretical issue. · dryrun.security, 4 Oct 2026
- Findings
- The documentation says Terraform findings appear as pull request comments and Risk Register entries, with the affected resource, risk description, and remediation guidance. · docs.dryrun.security, 4 Oct 2026
- Founded
- 2023 · dryrun.security, 28 Sept 2026
- Free trial
- DryRun advertises a two-week free trial, and its FAQ describes installation followed by a 15-minute call with an AppSec expert. · dryrun.security, 5 Oct 2026
- Headquarters
- Austin, Texas, United States · dryrun.security, 28 Sept 2026
- IaC coverage
- DryRun scans Terraform, Kubernetes, and other infrastructure as code using contextual analysis across infrastructure and application code. · dryrun.security, 4 Oct 2026
- IaC scanning
- DryRun scans Terraform configuration changes in pull requests for security misconfigurations and insecure defaults. · docs.dryrun.security, 5 Oct 2026
- Integrations
- The product page lists Claude Code, Claude Desktop, Codex, Cursor, GitHub, GitLab, and Slack integrations. · dryrun.security, 5 Oct 2026
- Policy guardrails
- Teams can define natural-language code policies for requirements such as public access and permitted cloud regions, enforced on changes by the Custom Policy Agent. · dryrun.security, 5 Oct 2026
- Pricing basis
- Pricing is based on team size, including developers, security team members, and owners who need codebase visibility; public prices are not listed on the FAQ page. · dryrun.security, 5 Oct 2026
- Pull request workflow
- IaC findings appear as pull request comments and Risk Register entries, with the affected resource, risk description, and remediation guidance. · docs.dryrun.security, 5 Oct 2026
- Repository support
- DryRun currently supports GitHub.com personal, organization, and Enterprise Cloud repositories, plus GitLab SaaS; custom instances or other source control systems require contacting DryRun. · dryrun.security, 4 Oct 2026
- Security and compliance
- DryRun Security is SOC 2 Type II certified, with the platform independently audited for security, availability, and confidentiality controls. · docs.dryrun.security, 5 Oct 2026
- Security audits
- DryRun says its infrastructure undergoes quarterly third-party security assessments. · dryrun.security, 4 Oct 2026
- Supported SCM
- DryRun currently supports repositories on GitHub.com and GitLab SaaS, with custom instances and other source code managers handled through support options. · dryrun.security, 5 Oct 2026