# DryRun Security > DryRun Security provides Adversarial Code Assurance. Your paved road to trusting AI code. DryRun Security helps CISOs, AppSec teams, and developers secure code written by people and AI coding agents throughout the AI development lifecycle (AIDLC). It connects to source control and automatically reviews repositories and proposed changes from an adversary’s perspective, using application context and the customer’s security policies. AppSec controls merge decisions; developers and AI coding agents receive context for remediation. The customer owns the AppSec program; DryRun Security provides the platform and practitioner expertise. AI SAST refers to AI-powered static application security testing. Contextual Security Analysis is DryRun Security's approach to analyzing code in application context. DeepScan analyzes full repositories. Dependency Exploit Validation examines vulnerable packages in the context of the application and the conditions needed to exploit them. Customers are seeing a ~92% reduction in dependency findings to review. In one customer example, Dependency Exploit Validation narrowed 4,000 SCA findings to 397 actionable, high-priority findings. AppSec teams get evidence to prioritize risk, while developers and connected coding agents get context to address it. The documentation covers setup, supported languages, configuration, and integrations. The AI Software Security Maturity Model (AISSMM) V0.8 field guide gives security leaders a roadmap for assessing their AppSec program and advancing through four maturity phases. ## Start here - [DryRun Security Platform: Adversarial Code Assurance](https://www.dryrun.security/): Platform overview, source-control workflow, policy enforcement, and remediation for AI software security. - [Technical documentation](https://docs.dryrun.security/): Setup, scanning, administration, and integrations. - [Documentation index for agents](https://docs.dryrun.security/llms.txt): Detailed map of the documentation, including supported languages, findings, policies, and APIs. - [Frequently asked questions](https://www.dryrun.security/faqs): Product and evaluation questions. ## Code analysis and security policies - [AI SAST and Contextual Security Analysis](https://www.dryrun.security/product/sast): Static application security testing with application context. - [Pull request security reviews](https://www.dryrun.security/product/pr-code-reviews): Security analysis of proposed code changes in the development workflow. - [DeepScan full-repository analysis](https://www.dryrun.security/product/sast-deepscan-full-repository-security-scan): Analysis of an existing codebase beyond individual pull requests. - [Natural Language Code Policies](https://www.dryrun.security/product/custom-code-policies): Organization-specific security policies expressed in natural language. - [Codebase intelligence](https://www.dryrun.security/product/codebase-intelligence): Security questions and insights grounded in repository context. - [Dependency Exploit Validation](https://www.dryrun.security/product/advanced-verification): AI-native SCA that evaluates vulnerable packages against application context and exploit conditions. - [Secrets scanning](https://www.dryrun.security/product/application-security-secrets): Detection of exposed credentials in code. - [Infrastructure as code security](https://www.dryrun.security/product/infrastructure-as-code-iac-security): Security analysis of infrastructure configuration. ## AI coding agents and technical evaluation - [DryRun Skill](https://docs.dryrun.security/dryrun-skill): Security context for AI coding assistants. - [Remediation](https://docs.dryrun.security/remediation): Documented remediation workflows and configuration. - [MCP integration](https://docs.dryrun.security/mcp): Access to DryRun Security data through the Model Context Protocol. - [Language and framework support](https://docs.dryrun.security/language-support): Current supported languages, frameworks, and package ecosystems. - [Vulnerability coverage](https://docs.dryrun.security/vulnerability-coverage-matrix): Documented finding types and CWE mappings. - [Source code safety and SOC 2 Type II](https://www.dryrun.security/code-safety): SOC 2 Type II compliance maintained for three years, three completed independent audits, and how DryRun Security protects enterprise source code. ## Research and customer evidence - [SAST Accuracy Report](https://www.dryrun.security/sast-accuracy-report): DryRun Security's 2025 comparison using 26 seeded vulnerabilities across four public applications and default scanner configurations, with the test methodology and results. - [The Agentic Coding Security Report](https://www.dryrun.security/the-agentic-coding-security-report): Security analysis of real applications built with Claude, Codex, and Gemini. - [Commerce case study](https://www.dryrun.security/case-studies/cutting-sast-noise-and-giving-developers-pr-ready-security-context-at-commerce): Customer account of reducing SAST noise and supplying security context in pull requests. - [Lean AppSec team case study](https://www.dryrun.security/case-studies/turning-a-lean-appsec-team-into-a-force-multiplier-for-ai-generated-code): Customer account of reviewing AI-generated code with a small AppSec team. - [Practitioner articles](https://www.dryrun.security/blog): Dated technical articles, research, and product announcements. ## AppSec program maturity and evaluation - [AI Software Security Maturity Model (AISSMM)](https://www.dryrun.security/AISSMM): V0.8 field guide covering four maturity phases, practice assessment, agent remediation, organizational memory, and references. - [AI code security: build vs. buy](https://www.dryrun.security/ai-code-security-build-vs-buy): The engineering and operational work required to build and maintain an independent code security verification layer. - [Contextual Security Analysis guide](https://www.dryrun.security/resources/csa-guide): Introduction and guide access for the analysis approach. - [Building Secure AI Applications](https://www.dryrun.security/resources/owasp-top-10-llm-building-secure-applications): OWASP Top 10 for LLM Applications guide overview, reference architecture, and control checklist; guide access uses the page's form. ## Optional - [About DryRun Security](https://www.dryrun.security/about): Practitioner background and company information. - [Book a demo](https://www.dryrun.security/get-a-demo): See DryRun Security in a 15-minute personal demo with an AppSec expert. - [Privacy policy](https://www.dryrun.security/privacy-policy): Published privacy policy.