DryRun SecurityGet a Demo

AppSec expertise, shared

Stay Informed and Secure Check Out Our Latest Security Insights and News!

Stay Informed and Secure: Check Out Our Latest Security Insights and News!

79 resources

AI in AppSec

AppSec The Next Generation

AI is rebuilding the security market tool by tool. DryRun Security CTO Ken Johnson argues that this misses the point entirely, and that the real opportunity is to rethink what AppSec is for. If you've ever felt like a bug janitor buried in scanner output, Ken makes the case that AI can finally free practitioners to do what the discipline was always meant to do: eliminate whole categories of risk instead of closing tickets faster.

AI in AppSec

More Findings ≠ More Security

Why more security findings do not necessarily mean better security, and how AppSec teams can focus on meaningful risk instead of alert volume.

AI in AppSec

Anthropic Reimagined the SDLC. AppSec Got Markdown Files

Anthropic reimagined the software development lifecycle with AI, but its vision for application security doesn’t go far enough. Discover why the future of AppSec requires autonomous security agents, continuous assurance, and a shift from managing vulnerabilities to managing risk.

AI in AppSec

Forget Mythos-Ready. Build Something Better.

Mythos represents a real change in what AI can accomplish in offensive security, and security organizations need to respond. But becoming as capable as the attacker is only parity. Defenders have source access, architectural intent, business context, institutional memory, and a place inside the process that creates the software. We should build something better than Mythos-ready.

AI in AppSec

The Two Biggest Problems We See in AI Code Aren’t New

Across 24,514 AI-specific findings in real customer codebases, prompt injection and excessive privileges dominate. The surprise? Four other risk categories are already appearing and many teams aren’t ready for them.

Security

What Your Git History Knows That Your Wiki Doesn’t

Old code isn’t automatically dangerous, but when critical security logic outlives the people who understood it, teams can quietly lose the context they need to change it safely. In this post, you’ll see how Git history can expose that hidden “knowledge decay” and why signals like code age, ownership concentration, and maintainer inactivity are becoming essential for reviewing human- and AI-written code with confidence.

Security

What Your Git History Knows That Your Call Graph Doesn’t

Most security tools analyze code as a snapshot, but this post makes the case that some of the most valuable risk signals live in how software changes over time, including hidden dependencies, undocumented relationships, and the behavioral patterns buried in Git history. It is worth reading if you want a sharper view of where modern security risk actually hides and why understanding system evolution may matter just as much as understanding the code itself.

Security

What Your Git History Knows That Your Threat Model Doesn’t

Some of the most important security signals are not in the code itself, but in its history: years of churn, fragmented ownership, and repeated rewrites can quietly reveal where risk is building long before a traditional scanner ever will. This post shows why Git history may be one of the most overlooked sources of security insight, and why it is worth reading if you want a better way to spot hidden risk in fast-moving codebases.

AI in AppSec

The AI Security Industry Has a Measurement Problem

AI can find vulnerabilities. The harder question is whether you can measure, validate, and trust the system finding them. This blog explores why proof, repeatability, and evaluation matter more than a compelling demo.

AI in AppSec

What is DryRun Security?

DryRun Security gives AppSec teams an independent security layer between code generation and production, using contextual analysis to catch exploitable risk that traditional pattern-based tools miss while reducing false positives. If your team is trying to keep up with faster AI-assisted development without drowning in noise, this blog is worth reading for a clear look at why modern software needs code security intelligence, not just more SAST alerts.

AI in AppSec

Build vs. Buy for AI AppSec Why AI Security Requires Independent Verification

As AI-assisted development accelerates and pull request volume grows, security teams can no longer rely on developer-triggered model calls to protect production code. They need an independent verification layer that runs consistently across every pull request as an org-owned control. This post breaks down the real build-vs.-buy decision for AI AppSec, showing why production-grade security requires not just a model integration, but a full system of enforcement, multi-model evaluation, auditability, and governance that most internal builds underestimate or never finish.

AI in AppSec

Securing Agent Skills in Agentic Development

In this post you’ll learn why agent skills create a new application security attack surface, how those attacks work in practice, and why traditional pattern-based SAST often misses them. It also lays out concrete ways teams can secure skill-based development today.

DryRun Security News

DryRun Security Q1 2026 Everything We Shipped and Why It Matters

This quarter, we went above and beyond our goals! Our Q1 updates help AppSec teams find systemic code risk faster, prioritize what actually matters, and reduce false positives without slowing development. Check out all of our new capabilities.

Features

Security That Listens Introducing PR Feedback in DryRun Security

Announcing PR Feedback that lets developers respond to DryRun Security findings directly inside the pull request to mark false positives or “nitpicks,” instantly removing the finding and regenerating the PR summary without tickets, dashboards, or delays. Each dismissal is logged and fed back into DryRun Security so scans get progressively calibrated to your codebase over time, with an attributable audit trail for AppSec and leadership.

AI in AppSec

Disruption, Not Deletion How AI Is Rewiring Application Security

Anthropic’s Claude Code Security didn’t make AppSec obsolete, it exposed how outdated the last decade’s “tool salad” (SAST, DAST, SCA, etc.) has become now that models can reason about code behavior and intent. AppSec still has to exist for separation of duties, continuous risk over fast-moving codebases, and business-context decisions, but the future shifts from noisy event aggregation to Code Security Intelligence that evaluates real risk in context.

DryRun Security News

Welcoming Andrew Peterson to the DryRun Security Board

We welcome Andrew Peterson to the DryRun Security Board of Directors, formalizing a long-standing relationship with CEO James Wickett. Andrew’s leadership and experience defining security categories will help guide DryRun Security as we build one of the most cutting-edge, AI-era application security tools available.

DryRun Security News

Introducing Risk Register

DryRun Security helps teams reduce risk in two key moments: PR scans provide fast feedback in code review and DeepScans which provide deeper repository analysis to surface issues beyond a single PR. Risk Register brings those worlds together with one place to track, understand, and prioritize risk across the entire organization. Read on for more details on Risk Register.

DryRun Security News

Announcing DeepScan Agent Fast, Full-Repository Code Security Intelligence

Announcing the DryRun Security DeepScan Agent: it turns full-repository code reviews from a 2 to 4 week fire drill into an on-demand assessment in about an hour, delivering a prioritized, high-signal report by reasoning about your code like a senior security engineer. Read on to see how DryRun Security expands code security intelligence from pull requests to the entire repo so you can spend less time triaging and more time fixing.

DryRun Security News

Why I Joined DryRun Security

Dr. Justin Collins, former CISO at Gusto and creator of the Brakeman Rails scanner, joins DryRun Security as Principal AI Security Researcher to help AppSec teams keep up with accelerating code velocity and AI-assisted development. He shares why he joined DryRun Security and what his focus will be at the company.

DryRun Security News

DryRun Security Builds Momentum With Breakthroughs in AI-Native Code Security Intelligence

DryRun Security capped its first year out of stealth with strong traction. Built on its AI-native Contextual Security Analysis engine, new capabilities like Natural Language Code Policies, the Custom Policy Agent, and Code Insights MCP embed exploitability-aware, agent-ready security directly into developer workflows. Read more about how we doubled down on product innovation to address a growing gap in traditional application security tools.

AI in AppSec

The Half Life (and Decay) of Static Rules in a Modern Codebase

Static rules feel comforting until your codebase moves on and they quietly stop pulling their weight. This piece breaks down why pattern-based controls decay, how Goodhart’s law and concept drift show up in PRs, and practical ways to design security programs with the half life of controls in mind. If you care about real risk over green dashboards, this is for you.

AI in AppSec

7 Mistakes Teams Make When Building AI Applications

This post distills the seven security mistakes teams keep making when they move LLMs out of prototypes and into production, plus exactly how to avoid them. If you still treat models like trusted compute or stash policy in prompts, you’re already exposed. Read it to upgrade your threat model, protect tokens and data, and ship AI features without creating tomorrow’s incident.

AI in AppSec

Introducing the LLM App Risk White Paper

This post gives a synopsis of our newly released whitepaper, “Building Secure AI Applications.” The whitepaper provides a practical guide and architecture for building AI-enabled apps and systems securely with the OWASP Top 10 for LLM Applications.

AI in AppSec

If Your Code Changes, Your Rules Should, Too

We’re way past determinism. Modern software is probabilistic: shaped by humans, AI assistants, and ever-shifting architectures. Teams today need AI-native, adaptive security that evaluates exploitability in context and evolves with every code change. Read more about why many are making the shift and why you should, too.

Contextual Security Analysis

Beyond Reachability The Exploitability Advantage in AppSec

We're beyond the SCA focus on reachability. Exploitability is the next evolution of accuracy in code security. While reachability asks whether a code path can be hit or a function is used, exploitability asks whether an attacker could actually misuse the behavior in the real world. Read on to see why modern AppSec winners don’t just flag reachable code paths.

AI in AppSec

Why LLM Vendors Aren’t the Same as Code Security Intelligence

Frontier LLM assistants are great for writing code, but also using them to secure said code sets you up for failure. They’re not a substitute for independent code security intelligence. Read on to see how DryRun Security fills that gap with an AI-native, agentic engine that provides cross-repo context, enforceable policies, governance, and audit-ready evidence.

AI in AppSec

How We Turned Natural Language Into a Scalable Agentic AppSec Engine

We’ve learned a lot during our journey to the Custom Policy Agent. It started as a YAML prompt and a simple question. Now it’s an intelligent, adaptive layer that turns natural language into consistent, context-aware enforcement on every PR, helping AppSec teams enforce code policy with developers. Read more about where we are now.

Features

Meet Code Insights MCP, Your Secure Code Concierge

Many critical security changes slip past reviews unnoticed, leaving teams exposed until issues surface externally. DryRun Security’s Code Insights MCP redefines visibility, giving teams the intelligence to prioritize risk without slowing innovation.

AI in AppSec

Constructing a Trustworthy Evaluation Methodology for Contextual Security Analysis

Deterministic scanners miss the logic flaws that matter. This post shows our evaluation methodology and how our agentic Contextual Security Analysis engine is able to deliver accuracy as a continuous service. Dive in to see how we bound hallucinations, lock down instruction compliance, and deliver context-aware security you can trust.

AI in AppSec

AI wrote the bug. AI missed the bug. DryRun Security found it.

A leading AI code assistant declared the DryRun Security MCP server “enterprise-grade secure,” yet missed a catastrophic JWT algorithm-confusion backdoor and an insecure OIDC TLS flaw that DryRun Security flagged instantly. The case study proves that generic AI reviews lack attacker context and underscores the need for specialized, context-aware tooling to keep hidden bugs from detonating in production.

Contextual Security Analysis

For DevSecOps, SAST Is Table Stakes

Static AppSec Testing (SAST) is now just the entry fee. Pattern-matching scanners flag surface bugs but miss the intent behind your code. Our latest post shows how DryRun Security and Contextual Security Analysis adds intent-aware, policy-driven checks that catch silent PII leaks, logic-flaw exploits, and other risks before they ship.

Contextual Security Analysis

Natural Language Code Policies in Action Real‑World Lessons

In this post, you’ll see real examples of DryRun Security Natural Language Code Policies (NLCPs) at work. Discover how context can give your AppSec team faster, deeper, and more accurate findings right when they matter most.

Contextual Security Analysis

Determinism vs. Probabilism Rethinking Accuracy in Static Application Security Testing

Deterministic SAST tools are like following a strict recipe—precise, repeatable, but easily thrown off by unexpected ingredients. A probabilistic, AI-native approach works more like a skilled chef—adapting to the context, sensing what matters, and delivering security insights that truly reflect the complexity of modern code.

AI in AppSec

The Rise of AI‑Native SAST

AI-native SAST tools, like DryRun Security, are fundamentally changing code security by analyzing developer intent and architectural context in real time—catching deep logic flaws that retrofitted tools miss. This blog explains why bolting AI onto legacy scanners is no match for platforms built from the ground up with AI at their core.

Contextual Security Analysis

MTTR 2.0 Mean Time To Regex and the Hidden Cost of Rule Inflation

Traditional SAST tools trap AppSec teams in a cycle of “Mean Time To Regex”—a costly loop of writing brittle patterns to suppress false positives while missing real vulnerabilities. DryRun Security’s Contextual Security Analysis replaces this toil with actionable insights in seconds, slashing false positives and reclaiming developer hours.

Contextual Security Analysis

Beyond Pattern Matching Why Context Is the Future of Application Security

Traditional SAST tools are built to catch Known Knowns—obvious, well-documented vulnerabilities—but they consistently miss the Known Unknowns like logic flaws and broken auth that vary by context and stack. In this post, DryRun Security CEO James Wickett breaks down why Unknown Unknowns—the security issues we haven’t imagined yet—require a new approach. Contextual Security Analysis (CSA) goes beyond signatures to reason about risk in real code, helping teams detect what pattern-matching tools never will.

AI in AppSec

Vibe Coding with AI Speedy Dev, Sneaky Vulnerabilities

AI-assisted coding is fast, fun, and undeniably powerful—but without proper review, it can quietly introduce serious vulnerabilities like SQL injection, IDOR, and auth bypasses. At RSA 2025’s AppSec Village, DryRun Security is hosting a hands-on demo, “Vibe Coding Gone Wrong,” where you’ll hunt down real flaws in AI-generated pull requests and learn how to keep your secure coding instincts sharp—even when the vibes are strong.

Contextual Security Analysis

SAST Accuracy The Metric That Matters

Most SAST tools struggle with what matters most: accuracy in real-world, context-heavy code. In the 2025 SAST Accuracy Report, we benchmarked five leading tools across four languages—and revealed just how often legacy scanners miss critical flaws like IDOR, broken auth, and user enumeration.

Contextual Security Analysis

Java Spring Security Analysis Showdown

In our latest SAST showdown, DryRun Security outperformed traditional tools like Snyk, CodeQL, SonarQube, and Semgrep by catching both classic vulnerabilities and critical logic flaws in a vulnerable Java Spring Boot app. While other scanners flagged the obvious issues (like XSS and SQLi), only DryRun detected deeper risks like IDOR and broken authentication—without custom tuning.

Security

DryRun Security vs. Traditional SAST Vendors in Ruby on Rails

See us go head-to-head with some of the best SAST tools on the market today. In this post, we use intentionally vulnerable code in RailsGoat to compare 6 categories across 6 different vulnerability classes including SQLi, Auth flaws/IDOR, and Hardcoded Tokens.

Product Updates

Introducing Natural Language Code Policies in DryRun Security

Announcing Natural Language Code Policies (NLCP), our latest breakthrough in context-aware AppSec. Natural Language Code Policies (NLCP) empower AppSec teams to spot the issues that truly matter without drowning in irrelevant warnings. Now you can ask the bigger, more contextual questions—literally in plain English making security more intuitive and efficient.

AI in AppSec

How AI and LLMs Will Shape AppSec in 2025

DryRun Security Co-founder & CTO Ken Johnson teamed up with Redpoint Security Founder & President Seth Law to give us four predictions for AppSec in 2025. Their forecast includes everything from whether AppSec will embrace LLMs to the rise of agentic security orchestration.

DryRun Security News

DryRun Security Announces SOC2 Type II Certification

We’re excited to announce that we have received our SOC2 Type 2 attestation report! By building robust controls early on in our product, we show our commitment to maintaining consistently reliable systems, where your data is protected and workflows remain uninterrupted. This is an important step in our journey to exceeding expectations and empowering teams to build secure software faster.

AI in AppSec

Next-Level Application Security Leveraging LLMs in Practice

Building on Ken’s previous insights into using Large Language Models (LLMs) for application security, this post delves into how LLMs can address persistent challenges in the field. Vulnerabilities are only one marker of risk and, unlike traditional security tools, LLMs can analyze a piece of code and ask additional questions if necessary. This article gives you direction on how to use LLMs to take your AppSec program to the next level, illustrating the transformative potential of LLMs to scale your team, identify risks in code changes, empower developers, or highlight significant security-impacting modifications.

AI in AppSec

One Year of Using LLMs for Application Security What We Learned

After a year of immersing ourselves in LLM exploration for Application Security, we’re sharing our journey with you. We’ve learned much about what works and what doesn’t work—and overall we have found that LLMs can be well-suited for summarizing code behavior and improving security outcomes.

Contextual Security Analysis

From BlackHat 2024 The AI Transformation in AppSec

While DevOps emerged to handle the scale of cloud operations, security was left behind. Some in the security industry sought to bring security into DevOps under the banner of DevSecOps or shift left, but this has often added more gates and slowed production. In this post, DryRun Security CEO & Co-founder James Wickett shows how AI and Large Language Models (LLMs) are well-suited to address the unique challenges faced by security teams and will soon become indispensable in application security.

AI in AppSec

How We Harnessed LLMs for Security and Why Testing is Our Secret Weapon

Large language models (LLMs) are potent tools, however, their default configurations often fall short in providing the accuracy and consistency required for reliable, critical analysis. In this post, Ken Johnson reveals how testing is the secret weapon for DryRun Security when it comes to using LLMs in a way that provides consistently optimal performance.

DryRun Security News

DryRun Security Named Finalist for 2024 BlackHat Startup Spotlight Competition

"We are thrilled to be recognized as a finalist among such remarkable companies," said James Wickett, CEO & Co-founder of DryRun Security. "Our approach using context and behavior to perform automated, seamless code reviews is making a significant impact, and we are excited to showcase our technology at BlackHat."

Product Updates

Announcing the SSRF and IDOR Analyzers at DryRun Security

We're excited to announce the addition of two new analyzers to our suite of analyzers. The addition of the SSRF and IDOR analyzers significantly enhances our ability to detect more of the critical vulnerabilities organizations care about and is a first step in honing our detection around access control and authorization.

Product Updates

Say Goodbye to SQLi in Go and Python

Introducing an exciting update: We’ve integrated SQLi analysis into our automated secure code reviews. Now, the GitHub app will analyze your code for SQLi vulnerabilities for Python Django and Golang Object-Relational Mapping (GORM) in seconds using the DryRun Security AppSec Analyzer, with support for more languages and frameworks coming soon.

Product Updates

Announcing the Secrets Analyzer for DryRun Security

DryRun Security is proud to announce an addition to our arsenal of analyzers: the Secrets Analyzer. This new feature is designed to assist against the accidental exposure of secrets within GitHub commits, providing an essential layer of security to your application development lifecycle.

Product Updates

How We Keep Your Code Safe at DryRun Security

DryRun Security utilizes Contextual Security Analysis and LLMs for near real-time insights into code changes. As a Contextual Application Security Testing (CAST) tool, it catches things that traditional SAST tools miss. We realize the integration of LLMs may evoke discomfort for some which is why this post details what our team is doing to ensure your code safety.

Features

Finding Risky Code Changes Inside Auth Functions

Authn/z modifications are a very good indicator that the changes being introduced in your code require careful consideration. We’re excited to show you a new analyzer in our product that assists in the code review process by finding changes to sensitive functions, with a heavy emphasis on authn/z. Now you can quickly identify authn/z risks as code is introduced for review.

DryRun Security News

A Developer's Perspective On The Future of Application Security

We're excited to announce that we're now in the GitHub Marketplace and open beta! In this post, Ken Johnson talks about the challenges and growth throughout his career and his vision of the future of AppSec from a developers perspective. Ken also gives a rundown of how DryRun Security performs risk reduction and details some of our newest features: Sensitive Codepaths, Sensitive Functions, and Sensitive Files.

DryRun Security News

A Conversation on Easing the Friction Between Security and Developers

Misalignment in incentives, staffing ratio of security to developer, and the shift left movement are all causes of friction between security and developers. In this post, we give a summary of DryRun Security CEO James Wickett’s and Tromzo Chief Innovation Officer Eric Sheridan’s discussion on this friction as well as a solution in the form of Contextual Security Analysis (CSA).

DryRun Security News

Notes from the Best OWASP Global AppSec Event Yet

This year's OWASP Global AppSec was the best one yet and resonated with where we see the industry moving here at DryRun Security. In this post, James gives his thoughts on the event plus a list of great talks to watch once the recordings are ready!

Contextual Security Analysis

The Next Generation of AppSec is Upon Us Part II

Discover the next generation of AppSec: an approach that leverages context to enhance detection and response models for developers and security teams for more positive security outcomes.

Contextual Security Analysis

Context Over Control Security's New Path from DeveloperWeek

We're excited about Contextual Security Analysis and how it is a positive change for the industry which is why I was happy to join the fine folks at DeveloperWeek in San Mateo to talk about how the security industry finds a new path forward with developers.

DryRun Security News

Developers and Security are Friends Day

We’re thrilled to be part of the very first Developers and Security are Friends Day! It’s happening in Austin, TX on Tuesday, September 5, 2023 at Hotel Van Zandt.

DryRun Security News

Techstrong.tv Interview on DryRun Security Launch

Co-founder and CEO James Wickett recently chatted with Mitch Ashley of Techstrong.tv about the launch of DryRun Security. The interview focuses on how Co-founders James Wickett and Ken Johnson are shaking up the security industry with their new security analysis tool that is specifically for developers and finds potential security issues faster than other security solutions on the market.‍

Contextual Security Analysis

Security as Control, Composition, or Context

“Security as Control” is more than the tautological statement it appears on the surface. In the early days of application security, the focus was primarily on control. Developers had to follow strict rules and use mandated tools, such as Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST). While these tools can be useful in some cases, they often slow down development and force developers to run scanners or tools they may not fully understand. As a result, security becomes a bottleneck, increases cycle time, and incentivizes developers to make batching decisions.

DryRun Security News

Technology Veterans James Wickett and Ken Johnson Launch DryRun Security to Bring Security to Developers

AUSTIN, TEXAS, May 23, 2023 – DryRun Security emerged from stealth with the mission to fix the disconnect between security and developers, with the premise that all developers fundamentally care about security. The company, founded by technology veterans James Wickett and Ken Johnson, is creating a new security analysis tool to find potential bugs sooner than any other security solution on the market while being better aligned with how developers actually work.

DryRun Security News

Welcome to the DryRun Security Blog

Welcome to the DryRun Security Blog. Thanks for joining us on the journey! Our mission is to reshape the landscape of developer tooling, and to put a powerful, effective, and practical security solution in the hands of developers.