Longbow (now Veracode Risk Manager) is an Application Security Posture Management platform that aggregates and normalizes findings from multiple AppSec and cloud security tools, performs automated investigation and root-cause analysis, and recommends prioritized remediation actions to reduce application risk.
Published Sep 26, 2026
Veracode rebranded Longbow as Veracode Risk Manager and positioned it as part of its ASPM offerings, indicating active development; specific roadmap items and dates were not captured in the sources reviewed.
Verified Longbow-specific reviews were limited in the sources accessed. Most available buyer feedback pertains to Veracode more generally rather than the Longbow product or Veracode Risk Manager specifically.
Community commentary and vendor reviews suggest potential churn drivers include:
These comments may pre-date the VRM integration and do not isolate VRM-specific factors.
No detailed, third-party-verified case studies specific to Longbow pre-acquisition were identified in the sources accessed. Vendor collateral includes customer outcome claims for Veracode Risk Manager but lacks third-party verification in the public excerpts.
Based on vendor positioning, the target market appears to be:
Get a comprehensive analysis of Longbow including market position, competitive landscape, adoption trends, and peer benchmarks.
Download full report →If you require a vendor-neutral hub that consolidates AppSec, infrastructure, penetration testing, and bug bounty findings in a single platform, consider unified vulnerability management platforms instead.
If your environment relies heavily on bespoke tooling requiring plug-and-play ingestion of arbitrary formats, validate ingestion capabilities in a proof of concept before committing.
If engineering adoption is fragile and the organization already experiences UX or integration friction with similar tools, adding another aggregation layer may not deliver value unless workflow integration is prioritized.
If you require publicly accessible, vendor-published compliance attestations before engaging with sales, and transparency is a procurement requirement, consider vendors with more explicit public trust documentation.
Unique selling points reflected in vendor and analyst descriptions (not independently validated):
Where competitors may differentiate:
Inferred reasons for adoption (based on vendor positioning and common enterprise buying patterns):
Independent, Longbow-specific, verified customer testimonials confirming these outcomes were not commonly found in the sources reviewed.
Community posts and reviews about Veracode contain a mix of critical and neutral observations. These largely pre-date or do not isolate Veracode Risk Manager and therefore should be interpreted cautiously when assessing VRM-specific outcomes.
Examples of negative community sentiment cited in public community forums include concerns about product reliability, perceived support issues, and user experience. Other community discussions note trade-offs such as lower finding volume under certain configurations or pipeline complexity for some languages.
Vendor collateral cites substantial remediation improvements for some customers. Public materials reviewed do not include measurement methodology, cohort definitions, or sustained outcomes beyond initial engagement.
Critical evaluation:
Recommendation: request named references in your industry, before/after metrics with definitions, and evidence that measured improvements persist beyond initial setup.
Longbow (vendor website) was described as an Application Security Posture Management (ASPM) and application risk management platform that aggregates findings from multiple security tools, normalizes and deduplicates results, adds contextual information, performs automated investigation and root-cause analysis, and recommends prioritized remediation actions intended to reduce risk efficiently. Source vendor materials note these capabilities.
As of 2026, Longbow has been acquired by Veracode and rebranded as Veracode Risk Manager. Buyers should note the product is now offered within Veracode's portfolio and roadmap.