Phoenix Security is a threat-centric ASPM platform that connects vulnerability findings across the SDLC with ownership attribution, exploitability validation, and AI-generated remediation pull requests.
What is Phoenix Security?
Most ASPM tools stop at producing a prioritized list. Phoenix Security explicitly positions itself one step further — closing the loop between “this is risky” and “here is the pull request that fixes it.”
The platform’s tagline captures the angle: “Security from generation to remediation.” The implicit critique of the rest of the category is sharp — Phoenix’s marketing line “Prioritization without attribution & remediation is just a nicer spreadsheet” tells you exactly which problem the team is trying to solve.
Three pillars
Vulnerability intelligence sources
Phoenix layers in vulnerability intelligence beyond scanner outputs:
| Source | What it adds |
|---|---|
| CISA KEV | Vulnerabilities with confirmed in-the-wild exploitation |
| EPSS | Exploit Prediction Scoring System — probability of exploitation in the next 30 days |
| OWASP Top 10 | Web application risk taxonomy alignment |
| CWE | Weakness categorisation for grouping similar issues |
| Zero-day tracking | Active monitoring of disclosed but unpatched issues |
| Reachability data | Whether vulnerable code is actually called from production entry points |
Leadership and advisory
| Role | Person | Background |
|---|---|---|
| CEO | Francesco Cipollone | Long-time AppSec entrepreneur |
| CTO | Alfonso Eusebio | International engineering leadership across Telefónica, IBM, and Vodafone |
| Advisor | Jim Manico | Original author of the OWASP Top 10 |
| Advisors (board) | Engineers from Qualys, Oracle, Skyscanner, AWS | — |
The Manico advisory presence is notable for AppSec credibility — there are not many ASPM vendors with a genuine OWASP-Top-10 author on the board.
When to use Phoenix Security
Phoenix is a strong fit for security teams that already have multiple scanners and a backlog problem caused by either weak prioritization or unclear ownership. The two recurring issues Phoenix targets — “everything is critical so nothing gets fixed” and “no one knows whose ticket this is” — are exactly the issues that ASPM exists to solve, and Phoenix is opinionated about both.
If you are evaluating Phoenix against the rest of the field, the closest direct competitors on prioritization are Apiiro and OX Security; on ownership and developer routing, Cycode and Jit overlap; on agentic remediation specifically, ArmorCode is the larger competitor.
Pricing requires a sales conversation. The platform does not publicly publish pricing tiers.
