DryRun Security

DryRun Security, founded in Austin, Texas by application-security veterans James Wickett and Ken Johnson, builds what it calls Contextual Security Analysis (CSA) — a PR-native review engine that evaluates data flow, architecture, change history, and developer intent alongside the raw diff, rather than matching code against static rule patterns. The goal is to surface logic-heavy findings (missing authorization on new endpoints, IDOR, business-logic flaws, prompt injection in LLM-enabled code) that traditional SAST tools typically miss or bury in noise, and to post plain-language remediation guidance directly in the pull request before merge. The company has layered on Natural Language Code Policies (letting AppSec teams write policy in plain English), a Custom Policy Agent, secrets detection, IaC scanning, and a repo-wide “DeepScan” capability.

DryRun raised an $8.7M seed round (announced January 22, 2025) led by LiveOak Ventures and Work-Bench, with Cannage Capital participating — modest but credible early institutional backing. The company lists enterprise and mid-market customer logos including AIG, Cloudera, Flex, Dematic, Tines, Gusto, and Invisible Technologies, the last of which is on record with a named-executive testimonial (Patrick McKinney, VP of Security) describing the tool as supplementing their AppSec team’s capacity for Fortune 50 client work. DryRun’s own marketing claims 500,000+ code reviews per week, though this and an earlier-cited 88% seeded-vulnerability detection rate are vendor-published figures without independent benchmarking.

For a CISO, DryRun’s pitch is incremental AppSec capacity: catching the class of bugs that pattern-matching scanners structurally can’t see, in the workflow developers already use, without a dedicated logic-bug review headcount. It competes in an increasingly crowded “AI reviews AI-written code” field (Dam Secure, Staris, and general tools like CodeRabbit/Greptile adding security checks), so its durability will depend on proving detection accuracy at scale rather than on its current seed-stage funding or customer count.