Well, thanks everyone for attending. I'm Jeff Hickey. I work on the UBS Software Equity Research team, and today I have Jacob Shulman, CFO of JFrog. And we also have Ed, who will be taking over, on January first. Just for a quick reminder for people tuning in online, you can feel free to submit questions, and we'll have them on the iPad come up here, so you know, we can ask those as we go. Maybe just kicking things off, I'd love to just get kind of an overview of JFrog and the story, and where things stand today, maybe for those in the audience who are less familiar with you.
Yes, absolutely. First of all, thank you for having us at the conference. For those who are not familiar with JFrog, JFrog is a company in DevOps space. Pretty much every company in this world becoming, became software company. You know very well what it, what software did to the financial world, but it's transforming pretty much every industry. And to survive and be competitive, you have to develop software. But the software development process is very complex. People know software engineers writing the code, and people know software running on the machines. What in between? Not many know, but it's a huge industry full of manual, siloed, inefficient, and vulnerable processes. So JFrog came to this world to streamline this process and to enable fast and secure software release, all the way from developer keyboard to pretty much any edge.
Got it. That's super helpful. And maybe, you know, top of mind this time of year, too, for investors, is just maybe thoughts on macro. We're now in late November, early December. Would love to get a read, just how your conversations with customers are kind of trending right now as they're thinking about 2024. We're coming out of a year where there's, you know, some hesitancy, just more broadly in IT spend. How are those conversations trending, and how is JFrog positioned in that?
Yes. Our product is mission-critical for our customers. Again, we support the overall digital transformation of these customers, and again, it's very mission-critical, important for customers. And that's why we see once the budget's allocated, people continue to execute on those budgets. We infrastructure play, therefore, people cannot stop investing in infrastructure if they're serious about software development. And that's why we continue to execute very nicely throughout 2023, despite having kind of a macro environment. Our products could be deployed either on-prem, kind of self-managed, or deployed on SaaS. And, as other SaaS-based companies, we did go through this optimization. Headwinds that we experienced, we started experiencing in Q3 of last year, more pronounced in Q4, and even entering this year, we did experience some headwinds.
But then in March of this year, we saw the reversal of trend. We start seeing more usage for our SaaS products. That usage increased in Q2 and continued to grow in Q3. Actually, Q3, we did see acceleration of our SaaS revenue growth. So we believe those micro headwinds relate to optimization behind us. How it would look in 2024, it's too soon to tell. Again, the secular trend of, SaaS migration, the security of software releases, the overall digital transformation, they mission critical and top of mind for CIOs. But, many of our customers today going through planning exercises, so it's too soon to tell how the budget, would look like. We'll have more visibility when we report our annual reports.
Got it. It's, it's great to see the acceleration. In terms of optimizations, it's a hot topic, not for... just for you, but a lot of software companies and infrastructure names in particular. Do you have any sense of, you know, how much more optimizations organizations might be able to do? Or, you know, do you view optimizations as more of a, a one-time exercise or more of an ongoing journey that customers will always continuously be looking to squeeze as much as they can?
I would divide it into two parts. One is like one-time effort to bring sanity to the system, and we did experience those headwinds, as I said, Q3, Q4 of last year, and even the beginning of this year. Going forward, we believe people will just be more mindful for efficiencies and growing in more efficient manner. That's why it's going to be probably ongoing exercise, going forward, but less impactful as a one-time event that we experienced at the beginning of the year.
Got it. Generative AI is this little topic some people ask about. You know, the DevOps space is interesting. A lot of chatter about GitHub Copilot, how that's, you know, potentially revolutionizing how software is developed. And would love to get kind of your sense and take on how the advancements over the last year impact JFrog, in terms of the amount of software people are writing, or if there's, you know, any ideas in the roadmap on the, whether it's the security side or the binary repository side.
Yes. We believe, first of all, the adoption of generative AI will be a tailwind for our business. Again, generative AI comes to make development organizations very efficient. Therefore, velocity of software creation will increase, and therefore, we believe it's going to be tailwind for us, providing kind of platform for software release processes. The more code means more binaries, means better business for us because it's not just important to make your R&D organization efficient. What's really important is how fast you take software to the market. The software release process will become the next bottleneck, and therefore more automation will be required, means the better business for us. There is another aspect of AI adoption is we identified opportunities to support ML processes, MLOps processes for our customers.
We see that many customers would want to host AI models, and they use Artifactory, our flagship product, to do that. They also, many times, host the training data. In Artifactory, what is M-ML, AI model is another form of binary. What it means to train AI model, it means another software update. This is bread and butter of what we've been doing for years, and therefore, we believe that it's a great opportunity for us, and we want to enable our customers to build efficient MLOps processes, and that's where we currently focus on, how to do that, and our R&D is focused on enabling this opportunity.
Got it. I'm curious, you know, JFrog's positioning is interesting, as also with the IoT angle-
Right.
which sometimes doesn't get talked about a lot. You know, how should we assess the momentum of, you know, the increasing number of devices, and do you think AI impacts maybe how many more devices there will be to connect to, and additional tailwinds to JFrog through that angle, as opposed to just the, security and repository side?
Yes. Even today, IoT world is, is huge, right? Billions of devices that needs to be updated, and yet it's another form of a silent process that where your R&D organization releases the product to your operation group, that takes it, uses manually to update certain hubs and et cetera, and that goes to the devices. So our platform comprised of three cores: DevOps core, security core, and IoT core. And the purpose of the IoT core is really this last mile from the hub to the devices. And we already have some large projects around that capability. Specifically, about a year ago, we announced a very large deal with one of the militaries in Europe to update their military vehicles.
As you can imagine, in today's world, military vehicles cannot drive, they cannot shoot without software updates, and yet the soldiers, with helmets go with, USB drives to update software. So but the IoT world is very complex. Updating software on tank is different from updating software on manufacturing robot or medical device, and therefore a lot of verticals and, with different protocols, different security requirements, et cetera. So for us, right now, we're kind of in the exploring phase, where we could go direct, where we could go with partners, what technical capabilities we should have. Therefore, believe for us, IoT core prime time will come two years from now.
Got it. Got it. It'd be helpful to get an update on just go-to-market, you know, traditionally selling to developers, typically kind of a bottoms-up, groundswell motion. If you have an open source version of Artifactory, whereas you've made more recent investments into a top-down approach, focusing on a broader platform. Where are we in that kind of transition, and those two models kind of working hand in hand together?
Yes, you're absolutely right. Historically, we've been growing through bottom-up. Artifactory, our flagship product, has become de facto standard in this space, loved by developers, and this is how we got a foot in the door, even in the largest organizations, through bottom-up developers adopting Artifactory. Over time, our product capabilities evolved. We launched a full platform for DevOps. We added security capabilities, DevSecOps, our security core. We just talked about our IoT core. So it became a full platform touching multiple persona within enterprise. Not just developers, but also DevOps managers, security engineers, CISOs, operation managers, those who are responsible for software updates on the customer side. So it became more holistic digital transformation project for organizations, and therefore, top-down go-to-market capabilities required. It's selling Artifactory to developer is very different from selling full platform to the enterprise.
Therefore, about two years ago, we started building the top-down capabilities, which not just includes hiring different sales persona. Absolutely, yes. But it's also different marketing collateral. Marketing developer product to developer is very different from marketing digital transformation platform to the C-level. It also requires different solution engineering capabilities, it requires different support engineering capabilities, and this is what we've been building for a little bit over two years by now. We started seeing first success. You could track that either by number of largest deal, that pretty much every quarter we report bigger deals, bigger competitive displacements, more holistic deals. For example, last quarter, we report our largest deal so far, eight-figure ACV, customer in telecom space. Overall number of over $1 million customers was six, the highest ever.
So we started seeing this approach. Second, as we develop and launch our security core, that again, touching, security persona, CISOs, it's not a bottom-up sell, it's primarily top-down sell. So therefore, enabling these capabilities, will also help to drive our security product.
Got it. Maybe unpacking that, be curious, you know, historically, JFrog has been a lot about expansion of spend-
Right
among your existing customers. How do you think about, you know, the runway left of your existing customer base, and maybe that cross-sell motion, how much more opportunity there is, given you keep increasing capabilities onto the platform?
Right. We believe we just, we're just starting because, we got first step in the door with Artifactory, and today, our, our customers, ninety percent of Fortune 100, majority of Fortune 500, over a third of Global 2000, but we see significant expansion opportunities in this customer base. We believe we have not penetrated more than 20% even in the, our largest, largest customers. It's adoption of these capabilities, it's a long-term project for our customers, and that's where we see that it's platform adoption is going to be one of the long-term drivers for us. Even today, we have customers that pay $10,000.
Global 2000 company will pay $10,000 just because they're just starting adoption of these capabilities, and we believe each of these customers could be a multimillion-dollar customer, so big opportunity still in front of us.
Got it. Also just maybe thinking about whether it's bottoms up, or, you know, gross retention rates, very high at JFrog. You have free offerings out there.
Mm-hmm.
Would be curious what you're seeing in a free to paid pipeline conversion, your rates internally, are those, you know, contracting a bit? Other players in the DevOps space have called out headwinds for many quarters now on, on that. I'm just curious what-
Yes
you guys are seeing.
Free-to-paid specifically also evolved. As our products evolved, also our funnel, top of the funnel evolved. We started with open source Artifactory when we were just a developer tool company, Artifactory, so selling primarily Artifactory. And we still have open source Artifactory. It's a product that supports only one technology, so you can't really do any commercial work on that. It's great for to learn about capabilities or for kind of a student project, but you cannot do any commercial stuff on that. Then initially, we had, like, free tier but as our products evolved and we're now offering more of the platform play, it's really hard to adopt platform on a free tier. So we transitioned that more to kind of cloud trial, and we see nice adoption.
Overall, I absolutely agree that macro headwinds have impact on new customer acquisition, similar to other companies in the space, because of the budget headwinds or sometime headcount headwinds of those customers. Many customers decide to just or reduce the level of innovation or adoption new- adopting new capabilities, and more focus on keep the lights on. Historically, JFrog has been the story of expansion. Obviously, our customers lend very small and grow to multimillion-dollar arrangements. It's all expansion story, and therefore, we continue to have very attractive net dollar retention rates. We reported our last quarter, 119 net dollar retention rate, which is very attractive. Our gross retention rate are also very attractive, 97%. JFrog continues to execute on expansion of existing customers.
One angle a lot of companies are doing, I'd be curious what the, you know, magnitude of uplift from moving from, you know, self-managed to SaaS gives someone like JFrog. It's interesting, you've got multiple monetization models around those two different areas. But curious, like, how difficult it is to walk customers from, you know, effectively on-prem or self-hosted to cloud?
Yeah. I just have to qualify when we say on-prem, it's really self-managed-
Yeah
... because customers would buy server licenses and could deploy them either in their data centers or even could deploy in public clouds or private clouds. They would just manage it themselves. Or they could use us as a service, our, our services. So we... The two different monetizations, we monetize our self-managed by number of servers, and number of servers will be dependent on your size of the organization, geographic footprint, number of different projects, or number of different technologies that you use, because many times people prefer to have separate servers for certain project or certain technology.... Our service SaaS capabilities monetized by data transfer and storage. So the more you use our products, the more data transfer and storage you generate, and therefore we charge more.
Secular trend of transition from on-prem to SaaS is driven by several kind of reasons. Specifically for us, DevOps is a very complex area, and if you have geographic footprint in multiple geographies, you may not have same in-house capabilities in all of these geographies. You may run different versions of the product. It's really hard to find skilled DevOps engineers. Retention is an issue, so you don't want to be dependent on certain employees to maintain your kind of backbone of your software release process. And that's why you want to partner with someone like JFrog to manage this for you. So that's the reasons. And obviously, TCO is much cheaper to use us on SaaS than maintain the infrastructure and people who maintain the infrastructure.
So those are the reasons to transition to SaaS. We also see that many times people utilize this transition to adopt new capabilities. That's another thing. On average, we see uplift in ASPs 20%-80% when people migrate from self-managed to SaaS. We also have exceptions. Sometimes people get aggressive in adopting SaaS, and we've seen that customers migrated from entry-level self-managed platform, $120,000 to over a $1 million contract. But that's very aggressive. But on average, we see 20%-80%, and that's why we believe that the migration to SaaS is not just immediate uplift on ASP, but also much better expansion because of more direct monetization methodology.
SaaS is a growing mix of the pie.
Right.
You report the corporate average, 119% NDR. Any sense on... I'd assume SaaS is even higher than that, what the expansion for SaaS looks like?
Yeah. So obviously, the overall SaaS is higher than corporate. Expansion of our SaaS business comprised of two components: expansion of existing SaaS customers and the pace of migration from self-managed to SaaS. We talked about kind of cloud rebounding, the usage of the cloud-
Mm-hmm
Rebounding during this year. That kind of indicates better expansion for, existing customers. The pace of migrations in 2023 is still slower than in 2022, because it's... A lot of that is multiyear projects driven by budget decisions, and we talked about tough micro, macro environment, that impacted the pace of migrations. We're happy to see that once customers make decision to go to SaaS, they don't reverse those decisions, even despite the macro. Obviously, it's secular trend for them. They may be doing it slower than initially expected, but they don't reverse decision. And therefore, we believe that, SaaS migration and SaaS growth will be yet another secular driver for us for long term.
Talk a bit about competition. I talk to a lot of investors in the DevOps space sometimes, and they ask about, you know, GitLab and GitHub, also pitching someone like GitLab, a broader platform, touching everything. You know, how do you compete with them? And maybe touch a bit on how you differentiate from them and-
Yes. So first of all, we believe that the entire DevOps loop will be split or is split into three kind of areas of expertise. Obviously, one of them is monitoring tools. There are a lot of companies in, in monitoring tool space. We believe the second area of expertise to the left of us is developer tools, and GitHub and GitLab part of that category. And in between is the software supply chain, where we believe we're leaders. There are a variety of tools that will always be loved by developers, and there used to be days where developers would write on their resume, "I'm a C++ developer.
I'm a Java developer." No one does that anymore because there are tons of different technologies evolved, and developers today are full-stack developers doing many more things, and they will be using tons of different technologies to achieve those tasks. So developers would always want variety of different tools. Enterprises don't want variety of different tools. Enterprises want standardized framework, secure framework for software releases. This is what we offer to them. Therefore, our strategy is to integrate with as many developer tools as possible on the left of us, and provide a standardized framework for software releases that will be later monitored by the guys from the right of us. So what we see is that our customers use GitHub or GitLab as coexisting tools. Obviously, managing source code is a very complex area, and they solve different pain from ours.
Managing source code is different from managing binaries. We tackle different problems, and we deal with completely different issues. Therefore, we believe that we will be coexisting with source code players. Specifically, GitHub and GitLab expressed in the past their desire to develop capabilities in software supply chain, but frankly, we don't see them. We continue to believe that we are the leaders in this space. And the number two guys who are coming up with the pre-sale calls primarily called company called Sonatype. It's a private company owned by one of the private equity.
Got it. Final one from me, and then I can open it up to the floor if anyone has any questions. Would just be, you know, pace of uptick on the newer security offerings, Advanced Security, as well as Curate, and maybe you can talk a bit about that, what, what opportunities that opens up for JFrog.
Yes, definitely, it's a new core that we're introducing these days. What industry realized, it's not just important to be very fast, efficient, and efficient. You also need to be secure in pretty much every gate of the software release process. And DevSecOps area is very fragmented area, comprised of very wide umbrella, comprised of set of different capabilities. And there are multiple point solutions that exist to tackle that specific area of capabilities, which ended up or resulted in the big enterprises deploying five, 10 different point solutions, which provide inconsistent results, false positives or inactionable alerts. So definitely there is a trend for consolidation in this space and more platform approach.
All of these point solutions integrate with Artifactory, because Artifactory became your single source of record for your, for your software supply chain, and we believe that our new capabilities that we launched, specifically JFrog Advanced Security and Curation, have a very good opportunity there. The dynamic slightly different. JFrog Advanced Security is a combined set of six to seven different capabilities, and the primary goal is to replace those point solutions with a platform approach. On curation, it's a new set of capabilities, different competitive environment, only a much smaller number of competitors in this space, and pretty much selling these capabilities to the same persona. Today, 80%-90% of your application comes from open source.
So what historically people have been doing, they're bringing the open source into the organization, developing, and only then checking for vulnerabilities. Basically, Curation allows you to perform those checks even before you bring open source component into your organization and enforce security policies at, as a firewall. So we see a very nice pipeline developing from curation, although it's a very young product, just launched three months ago. Already have customers who have made purchasing decisions, and we have very high hopes for, for this security product. We believe it's going to be material to our, kind of, business in 2024.
That's great to hear. Well, we've got a couple minutes left. I want to give an opportunity to anybody in the audience, if anyone has any questions. Question there.
Yeah. So, I'll just repeat the question.
Yeah.
I think the question was about opportunities in AI development, and what kind of revenue we could capture in this space. So we see two different aspects how AI could impact our business. First of all, generative AI today is primarily making developer organization more efficient by using generative AI, creating code faster. More code means more binaries to be created. The software release process is the next bottleneck, and therefore more automation will be required, and this is the value that we provide. Therefore, we believe more code equals more binaries, equals better business for JFrog. Second aspect of that is how we enable our customers to build efficient MLOps processes, helping our customers to train their models, to develop their models in efficient manner. That's the second aspect.
Today, it's too soon to talk about revenue impact because we don't see yet massive adoption of these capabilities in large enterprises. We do hear about success stories at the individual developer level, but don't yet see that as a massive adoption by big enterprises because of the security concerns, IP infringement concerns, and entire legal framework kind of to be built. So therefore, we believe that it's more future opportunity for us. Today, we're developing capabilities to support those opportunities, but we don't see a significant revenue today coming from these initiatives.
Got it. More to come?
Absolutely.
Well, Jacob, we're unfortunately out of time, but thank you so much for attending-
Thank you very much.
... UBS Tech Conference this year.
Thank you, Jeff.
Yeah. Yeah. Great.
Thank you, guys.
Thank you.