DryRun Security

What do you like best about the product?

DryRun Security helps solve the problem of noisy and time-consuming security reviews by providing contextual, high-signal findings directly in the developer workflow. Instead of spending unnecessary time sorting through false positives or trying to determine which issues are actually exploitable, the platform uses AI-driven analysis to help identify the risks that actually matter and explain them in a way developers can act on. Its performance has also been a benefit, as it fits well into the pull request process without creating unnecessary friction or slowing down development.

It also helps bridge the gap between security and development teams. By providing AI-powered remediation guidance, pull request context, and policy-based guardrails, DryRun Security makes it easier to maintain security standards while still allowing teams to move quickly. The support experience has been another positive, with helpful guidance when questions come up or when we need assistance getting more value from the platform. Overall, DryRun Security supports faster, more confident development while giving security teams better visibility into code risk across repositories.

What do you dislike about the product?

The main thing I would like to see improved is broader integration with external workflow and ticket management platforms, especially Jira. While DryRun Security provides useful findings and guidance in the developer workflow, having a more seamless way to create, track, and manage security tickets in Jira would make it easier for teams that rely heavily on Jira for vulnerability management, sprint planning, and remediation tracking. Stronger integrations with external platforms would help security and engineering teams operationalize findings more effectively across their existing processes.

What problems is the product solving and how is that benefiting you?

DryRun Security helps solve the problem of noisy and time-consuming security reviews by providing contextual, high-signal findings directly in the developer workflow. Instead of spending unnecessary time sorting through false positives or trying to determine which issues are actually exploitable, the platform uses AI-driven analysis to help identify the risks that actually matter and explain them in a way developers can act on. Its performance has also been a benefit, as it fits well into the pull request process without creating unnecessary friction or slowing down development.

It also helps bridge the gap between security and development teams. By providing AI-powered remediation guidance, pull request context, and policy-based guardrails, DryRun Security makes it easier to maintain security standards while still allowing teams to move quickly. The support experience has been another positive, with helpful guidance when questions come up or when we need assistance getting more value from the platform. Overall, DryRun Security supports faster, more confident development while giving security teams better visibility into code risk across repositories.

What do you like best about the product?

Since its agentic and doesn't depend on rules, theres good coverage across any language, framework, or tool out of the box. It's been particularly helpful providing feedback to engineers on changes to infra level concerns like terraform or helm.

What do you dislike about the product?

No major downsides, just needs some refinement as it grows. Slack alerts can be a bit noisy, for example. Thus far the team has sought feedback frequently and eventually comes up with solutions.

What problems is the product solving and how is that benefiting you?

Scaling rich, contextual security feedback for engineers without slowing down our velocity. Critical issues are rare to start with in our environment, but it has flagged a few at the PR stage before they get merged, which is also great.

What do you like best about the product?

DryRun is better than any static code analyzer we’ve used. It consistently surfaces real security concerns in PRs, provides helpful context, and makes the findings actionable.

What do you dislike about the product?

The scans can be a little slower compared to a static analyzer which is expected and acceptable.

What problems is the product solving and how is that benefiting you?

Shorting security reviews for our team as we are moving to more AI assisted development and shipping more code per engineer.

What do you like best about the product?

Very easy to set up and has takes in Github permissions making me worry less about what people have permission on. This SAST tool is a cutting edge and utilizes AI in a proper way allowing us to plug and play the tool into repo and get findings on it consistently across the repos we worry about. Chatting with the sec team + dev team we can see it provides value that other SAST tools haven't provided but also isn't noisy and high accurate letting find very critical bugs that have been missed in the past.

What do you dislike about the product?

Nothing really. Had minor issues with missing common SAST features (dismissal, long PR comments) but Dry Run's team really steps up their game and take in customer feedback to consistently improve and make the product suit the customer as much as possible.

What problems is the product solving and how is that benefiting you?

Better experience with SAST and a lot more accurate allowing for a pleasant experience.

What do you like best about the product?

DryRun security gives us a ton of context and intelligence around our code security that typical scanners don't give us.

What do you dislike about the product?

Nothing comes to mind. We use this for internal security and customer security facing reports.

What problems is the product solving and how is that benefiting you?

DryRun is adding another layer of intelligence to our security assessment capabilities. We use this for internal security enhancements, and we package some of this data up for customer facing reports.