DryRun Security vs ZeroPath

Capability	DryRun Security	ZeroPath	Verdict
Detection Categories1
What this tool covers	ℹ SAST, PR Reviews, SCA, Secrets, IaC.	ℹ SAST, SCA, Secrets, IaC. Partial: Container.	—
AI & Intelligence9
AI-Native Architecture	✓ Built AI-native in 2023. Model-independent verification layer. Uses a fleet of specialized agents (Code Review, DeepScan, Custom Policy, Codebase Insight) rather than one general model.	✓ LLM + AST engine. Positioning is AI-native from the ground up.	Tie
Agentic / Multi-Agent System	✓ Code Review Agent, Custom Policy Agent, DeepScan Agent, Codebase Insight Agent + specialized sub-agents; AGENTS.md support (Linux Foundation)	✓ Multi-agent scan pipeline	Tie
Natural Language Policies	✓ Natural Language Code Policies (NLCP); Policy Library with 16+ pre-built policies; Custom Policy Agent enforces on every PR	~ Custom rules can be expressed in plain English; depth and policy enforcement maturity unclear	DryRun leads
Model-Independent Verification	✓ Separates code generation from code verification; works regardless of which AI model or human generates code	✗ Findings come from ZeroPath's own pipeline; no model-independent verification step.	DryRun leads
Code Security Knowledge Graph	✓ Accumulates organizational knowledge across PRs; cross-repo intelligence; learns risk tolerance from dismissal patterns (nitpicks, FPs, accepted risks); FP fingerprinting improves decision quality over time	✓ AST call graph with annotations	Tie
Cross-repo Analysis	✓ Accumulates security knowledge across all repos in an org for org-wide pattern detection.	✗ —	DryRun leads
Code Security Memory	✓ Persistent memory of FP fingerprints, dismissed findings, and accepted risk decisions across reviews.	✗ —	DryRun leads
Custom DryRun Cyber Models	✓ Purpose-built models trained for code security, not general-purpose foundation models.	✓ Custom LLMs trained on real vulnerabilities; AST + LLM hybrid	Tie
Multi-model Architecture	✓ Routes each task to the best-fit model rather than relying on a single LLM.	✗ —	DryRun leads
AI Coding Agent Security6
Securing AI-Generated Code	✓ Reviews every PR regardless of who whether the author was human or AI, DryRun is especially effective at identifying the types of flaws AI coding tools are prone to create.	~ Positioned for AI-generated code review; scope is scanning output, not live guardrails.	DryRun leads
AI Coding Visibility / Observability	✓ Code Insights with AI Assistance (beta): NL queries for risk, trends, exposure; org-wide visibility; per-repo drill-down; file-level security history	✗ Findings dashboard only; no AI-coding observability product.	DryRun leads
Malicious AI Agent Skill Detection	✓ Policy Library includes Malicious AI Agent Skills Detection: flags skills/plugins that could enable data theft, backdoors, or code execution	✗ No dedicated AI-agent skill scanning.	DryRun leads
MCP Integration	✓ DryRun Insights MCP server: security summaries, PR analysis, trend monitoring, file-level history; connects via Direct HTTP, Claude Shortcuts, or mcp-remote	✓ Open-source MCP server (2025)	Tie
Continuous Enforcement Layer	✓ Runs on every PR automatically. Policies enforced at the merge gate. Always on — not invoked per-task.	✓ Continuous scanning across commits.	Tie
Per-Review Economics (predictable vs. usage-metered)	✓ Flat subscription pricing based on team size. Usage pricing applies to DeepScan product.	✓ Subscription pricing.	Tie
Code Security Intelligence3
Business Logic Flaw Detection	✓ Covers all logic flaws, BOLA, IDOR, broken auth, multi-tenant isolation, mass assignment, privilege escalation, OAuth, WebSocket auth bypass, and more. See docs.dryrun.security for more.	~ Vendor claims 50%+ of critical findings are business logic; unverified	DryRun leads
Git Behavioral Analysis	✓ Git Behavioral Graphs: code churn, temporal coupling, knowledge decay, temporal anomalies, intent mining	✗ Not available	DryRun leads
Continuous Baseline & Risk Trending	✓ Risk Register with Critical/High/Medium/Low severity; AI Assistance for Insights with NL queries, trend monitoring, and 30-day window analysis	~ Risk management view; continuous monitoring across 300K+ scans/month	DryRun leads
Workflow & Supply Chain2
SCM Support	✓ GitHub and GitLab (native apps with OAuth)	✓ GitHub, GitLab, Bitbucket, Azure DevOps	Tie
SBOM / AI-BOM Generation	✓ DeepScan generates SBOM with SCA agent providing dependency inventory and license checking (Dependency License Check policy). Plus AI-BOM and runtime context — not just a static dependency graph.	✓ SBOM generation; SCA dependency inventory	Tie
Reporting & Compliance1
Compliance Framework Mapping (SOC 2, PCI, NIST, OWASP, MISRA, STIG)	~ Findings tagged with OWASP Top 10 and CWE. Dedicated SOC 2 / PCI / STIG report templates are on the roadmap, not shipped.	✓ Compliance reports across SOC 2, HIPAA, PCI.	Competitor leads
Market Feedback (G2)4
G2 Rating / Review Count	ℹ 4.9/5 (19 reviews) — g2.com/products/dryrun-security/reviews	ℹ 4.5/5 (11 reviews) — g2.com/products/zeropath/reviews	—
Notable G2 Praise (Attributed)	ℹ "DryRun goes far beyond what rule-based SAST tools offer. It catches things other tools completely miss — like middleware that's defined but never mounted, or trust boundary misalignments." — Jabez A., Director, Product Security Architecture, Enterprise (g2.com/products/dryrun-security/reviews)	ℹ "Finds serious security vulnerabilities including business logic bugs that other scanners miss." — Yaacov T., CTO, Small-Business (g2.com/products/zeropath/reviews)	—
Notable G2 Criticisms (Attributed)	ℹ "I do somewhat wish there were more customization options for tuning the analyzers, but that seems to be in the works." — Kyle R. (g2.com/products/dryrun-security/reviews)	ℹ "UI keeps changing very fast since the product is changing rapidly." — Manisha A., Relationship Manager, Small-Business (g2.com/products/zeropath/reviews)	—
Common G2 Complaint Themes	ℹ UI/portal speed; desire for more analyzer customization (g2.com/products/dryrun-security/reviews)	ℹ No G2 reviews to cite — zero public customer validation on G2 despite claiming enterprise customers	—

Ready to see DryRun Security in action?