Longbow

Name: Longbow
Brand: Longbow

Longbow (now Veracode Risk Manager) is an Application Security Posture Management platform that aggregates and normalizes findings from multiple AppSec and cloud security tools, performs automated investigation and root-cause analysis, and recommends prioritized remediation actions to reduce application risk.

Est 2019|Raised $10.5M

LinkedIn 1K|Website|FTEs 30|HQ Austin, Texas, US

MarketsApplication Security Testing (AST)Cloud-Native Application Protection Platform (CNAPP)Code Security

01Competitive Landscape

Narrative analysis

Veracode Risk Manager differentiates through correlation, root cause analysis, ownership identification, and prioritized remediation as described in vendor materials.
Legit Security emphasizes supply chain posture and ASPM features according to vendor materials.
DefectDojo Pro positions itself as emphasizing flexible ingestion and a vendor-neutral approach.

Where alternatives may excel:

If the required scope includes broad vulnerability management across AppSec, infrastructure, penetration testing, and bug bounty programs, a unified vulnerability management approach may be more appropriate than an ASPM-focused product.
If buyers require an ASPM vendor that is independent of a single AST provider, an ASPM specialist may be preferable.

- Veracode Risk Manager differentiates through correlation, root cause analysis, ownership identification, and prioritized remediation as described in vendor materials. - Legit Security emphasizes supply chain posture and ASPM features according to vendor materials. - DefectDojo Pro positions itself as emphasizing flexible ingestion and a vendor-neutral approach. Where alternatives may excel: - If the required scope includes broad vulnerability management across AppSec, infrastructure, penetration testing, and bug bounty programs, a unified vulnerability management approach may be more appropriate than an ASPM-focused product. - If buyers require an ASPM vendor that is independent of a single AST provider, an ASPM specialist may be preferable.

	Veracode Risk Manager (formerly Longbow)	Legit Security (ASPM)	DefectDojo Pro (UVM adjacent)
Starting Price	Not publicly listed (enterprise quote)	Not publicly listed (demo/quote)	Not publicly listed (vendor-led)
Appropriate fit	Organizations seeking code-to-cloud risk unification and prioritized remediation, particularly those using or willing to use other Veracode modules	ASPM-focused buyers seeking discovery, prioritization, and supply chain posture features (vendor positioning)	Teams prioritizing flexible ingestion and vendor neutrality across vulnerability sources
Key capabilities	Correlation, root cause analysis, ownership identification, prioritization across multiple tools (vendor-described)	ASPM-first features and supply chain posture capabilities (vendor-described)	Flexible ingestion and parsing approaches to unify diverse vulnerability data
Key considerations	Potential integration mapping effort; offered within Veracode ecosystem	Limited independent outcomes in public research; pricing opaque	Competitor-authored positioning highlights vendor neutrality and ingestion flexibility; buyer validation required