DryRun Security vs DepthFirst

Capability	DryRun Security	DepthFirst	Verdict
Detection Categories1
What this tool covers	ℹ SAST, PR Reviews, SCA, Secrets, IaC.	ℹ SAST, SCA, Secrets, DAST. Partial: IaC, Container.	—
AI & Intelligence9
AI-Native Architecture	✓ Built AI-native in 2023. Model-independent verification layer. Uses a fleet of specialized agents (Code Review, DeepScan, Custom Policy, Codebase Insight) rather than one general model.	✓ Vendor-trained model inside an AI scanning pipeline. Marketed as model-agnostic.	Tie
Agentic / Multi-Agent System	✓ Code Review Agent, Custom Policy Agent, DeepScan Agent, Codebase Insight Agent + specialized sub-agents; AGENTS.md support (Linux Foundation)	~ Claims multi-agent; implementation details not public	DryRun leads
Natural Language Policies	✓ Natural Language Code Policies (NLCP); Policy Library with 16+ pre-built policies; Custom Policy Agent enforces on every PR	✗ Not offered. Platform uses AI reasoning, not policy-driven rules.	DryRun leads
Model-Independent Verification	✓ Separates code generation from code verification; works regardless of which AI model or human generates code	✓ Claims dynamic exploit verification is model-independent	Tie
Code Security Knowledge Graph	✓ Accumulates organizational knowledge across PRs; cross-repo intelligence; learns risk tolerance from dismissal patterns (nitpicks, FPs, accepted risks); FP fingerprinting improves decision quality over time	✓ Component Graph across code, dependencies, and infra	Tie
Cross-repo Analysis	✓ Accumulates security knowledge across all repos in an org for org-wide pattern detection.	✗ —	DryRun leads
Code Security Memory	✓ Persistent memory of FP fingerprints, dismissed findings, and accepted risk decisions across reviews.	✗ —	DryRun leads
Custom DryRun Cyber Models	✓ Purpose-built models trained for code security, not general-purpose foundation models.	✓ Vendor-trained model purpose-built for AppSec	Tie
Multi-model Architecture	✓ Routes each task to the best-fit model rather than relying on a single LLM.	✗ —	DryRun leads
AI Coding Agent Security6
Securing AI-Generated Code	✓ Reviews every PR regardless of who whether the author was human or AI, DryRun is especially effective at identifying the types of flaws AI coding tools are prone to create.	~ Scans AI-generated code; no dedicated AI-code-review workflow.	DryRun leads
AI Coding Visibility / Observability	✓ Code Insights with AI Assistance (beta): NL queries for risk, trends, exposure; org-wide visibility; per-repo drill-down; file-level security history	✗ Scan results only; no AI-coding observability.	DryRun leads
Malicious AI Agent Skill Detection	✓ Policy Library includes Malicious AI Agent Skills Detection: flags skills/plugins that could enable data theft, backdoors, or code execution	✗ No dedicated AI-agent skill scanning.	DryRun leads
MCP Integration	✓ DryRun Insights MCP server: security summaries, PR analysis, trend monitoring, file-level history; connects via Direct HTTP, Claude Shortcuts, or mcp-remote	✗ Not offered.	DryRun leads
Continuous Enforcement Layer	✓ Runs on every PR automatically. Policies enforced at the merge gate. Always on — not invoked per-task.	✓ PR-time scanning with auto-fix.	Tie
Per-Review Economics (predictable vs. usage-metered)	✓ Flat subscription pricing based on team size. Usage pricing applies to DeepScan product.	✓ Subscription pricing.	Tie
Code Security Intelligence3
Business Logic Flaw Detection	✓ Covers all logic flaws, BOLA, IDOR, broken auth, multi-tenant isolation, mass assignment, privilege escalation, OAuth, WebSocket auth bypass, and more. See docs.dryrun.security for more.	~ Marketed as attacker-style reasoning for IDOR and auth bypass	DryRun leads
Git Behavioral Analysis	✓ Git Behavioral Graphs: code churn, temporal coupling, knowledge decay, temporal anomalies, intent mining	✗ Not available	DryRun leads
Continuous Baseline & Risk Trending	✓ Risk Register with Critical/High/Medium/Low severity; AI Assistance for Insights with NL queries, trend monitoring, and 30-day window analysis	~ Security analytics; burn-down tracking; time-to-remediate	DryRun leads
Workflow & Supply Chain2
SCM Support	✓ GitHub and GitLab (native apps with OAuth)	~ GitHub (primary); limited other SCM support	DryRun leads
SBOM / AI-BOM Generation	✓ DeepScan generates SBOM with SCA agent providing dependency inventory and license checking (Dependency License Check policy). Plus AI-BOM and runtime context — not just a static dependency graph.	✗ Not offered.	DryRun leads
Reporting & Compliance1
Compliance Framework Mapping (SOC 2, PCI, NIST, OWASP, MISRA, STIG)	~ Findings tagged with OWASP Top 10 and CWE. Dedicated SOC 2 / PCI / STIG report templates are on the roadmap, not shipped.	✗ No dedicated compliance reporting.	DryRun leads
Market Feedback (G2)4
G2 Rating / Review Count	ℹ 4.9/5 (19 reviews) — g2.com/products/dryrun-security/reviews	ℹ No G2 reviews	—
Notable G2 Praise (Attributed)	ℹ "DryRun goes far beyond what rule-based SAST tools offer. It catches things other tools completely miss — like middleware that's defined but never mounted, or trust boundary misalignments." — Jabez A., Director, Product Security Architecture, Enterprise (g2.com/products/dryrun-security/reviews)	ℹ No G2 reviews available	—
Notable G2 Criticisms (Attributed)	ℹ "I do somewhat wish there were more customization options for tuning the analyzers, but that seems to be in the works." — Kyle R. (g2.com/products/dryrun-security/reviews)	ℹ No G2 reviews available	—
Common G2 Complaint Themes	ℹ UI/portal speed; desire for more analyzer customization (g2.com/products/dryrun-security/reviews)	ℹ Too new for G2 feedback	—

Ready to see DryRun Security in action?