Very pleased to introduce Ed Grabscheid, who's the CFO of JFrog. We're gonna go through some slides, and then we'll have time for Q&A. Before we begin, required to inform you that a complete list of research disclosures or potential conflicts of interest is available on our website at williamblair.com. And by the way, I'm Jason Ader. For those of you that don't know me, I've been covering JFrog since the IPO, and it's been a fun stock to cover. So, I will pass it over to Ed, and we will hear his spiel. Go ahead, Ed.
All right. Okay, I think I got this one down, but thank you for the introduction, and I know you've been covering the stock since IPO. I've been with the company since the IPO. I've been the CFO for six months now, but I've been with the company for five years and actually took the company through the IPO process, so I know it very, very well. And similar to what Jason said, I'm not gonna walk you through all the disclaimers, but you can see here on the screen the disclaimer and everything that Jason said, I'm gonna reiterate, and that's what's here in the disclaimer. So let me go ahead and start with JFrog and give you a glance of the company and how we've done.
We've got over 7,400 customers today, and this is as of the end of 2023. We report our customers on an annual basis, so over 7,400 customers. Of those customers, 83% of those customers are from Fortune 100, so we've penetrated a very large percentage of the Fortune 100, not to mention the Fortune 500, where we have over 50% of the Fortune 500 companies as well. We have more than 1,500 employees, on a TAM of $40 billion in terms of the DevSecOps space. On a four-quarter trailing basis, we've done revenues of $370 million, and if you see the growth, 25%, very durable growth, 25%. We're a mid-20s growth company.
In the software universe, it's fairly impressive, considering this environment. More importantly, free cash flow over $90 million. This is a record for the company, over $90 million in terms of our free cash flow, in terms of four-quarter trailing, and 118% in our net dollar retention. We've stabilized in the high teens in terms of our net dollar retention, continuing to generate very nice growth and expansion of those existing customers. So JFrog, as a company, our mission is to create the world where software is delivered without friction, from the developers' keyboards all the way to the device. You may remember back in the days when you would write code, it was monolithic code. Today, we do hundreds of updates. JFrog is here in order to allow these updates to happen.
We call this liquid software. It's like turning the pipes or turning the faucet on, having water run through the pipes. Same thing in terms of the development of your software. This goes very frictionless from the point of writing the code to the end device. And what we do as a company is we manage the binaries. Source code is written, binaries then become a machine-readable language of ones and zeros. This is what we do. We're in the center of the universe in terms of the software from monitoring, observability between the developer and the operations, and we automate that process. 80%-90% of your asset today is a binary. Open source, very different than what it was maybe two decades ago, a decade ago, where code was being written at source and maybe one to two updates a year.
Now, it's based on open source. It's increased the velocity of the business, and we're at the center of that, and this is what we do as a company. We manage the flow of binaries through your software supply chain. I won't go through everything here, but you can see it's a very complex process. It starts with Artifactory, which is our, this is our primary product, flagship product, bringing in to the storage of the binaries and then bringing those through your software supply chain, through the security of that software supply, of that binary, all the way to the end device. Many different products, and the full platform, our Enterprise + platform, provides all of these products, and delivering secure software, automated, in a way that is with, high velocity and speed, from the developer to your device.
You may have heard of Generative AI. I think it's a topic that has kind of reached a lot, a lot of people in the investment community recently. MLOps, and in terms of large language models, large language models are a package. A package is a binary. We manage the binary. Large language models are now coming to Artifactory, being stored in Artifactory, managed in Artifactory. It's natural. It's a natural fit. We've done recently a proxy with Hugging Face, with SageMaker, OpenAI. Models are being hosted in Artifactory. They're secured through Artifactory, and then they can be cached in Artifactory. This is a natural fit for JFrog, and we're seeing that there could be some long-term value and tailwinds being generated through large language models in the MLOps. I'll quickly go through a few customer success cases here.
These are very recognizable names. Box, obviously a name that you recognize. They secure your most sensitive documents. They also had a situation where they were not able to generate updates as quickly as they would like. They used JFrog in terms of their platform, the Enterprise X platform, to automate processes. This automation increased productivity by 90 x in terms of doing updates. It also allowed for return on investment as they were able to generate new products, drive up adoption of their products, increase revenues. You also have the case with Cisco. Cisco is our first customer. Cisco had, I think, over 1,600 repositories. They were able to consolidate those repositories, create a very efficient environment. This is now being managed with over 8 million.
I believe now we have 10 million software packages with just 12 administrators managing that. It shows the efficiency of what JFrog can do, the scalability across your organization, and huge value in terms of the full platform and the adoption of the platform with Enterprise +. Third customer here in the example, and what we're showing in use cases, is Nokia. Nokia had a very fragmented process where there was many gates. There was no control across the organization. Software updates in a critical infrastructure took 52 days to do an update. So if you had Nokia going down, the cell network going down, patches were taking up to 52 days. They used JFrog with the full Enterprise + platform, through automation, through improving of control. And across their organization, they were able to reduce that from 52 days down to six minutes.
Incredible return, incredible, efficiency gain in terms of software updates, huge value for the organization, and they continue to use JFrog for their most critical updates. In terms of the company, last year, we delivered 25% growth on a total revenue basis for the full year. We're guiding in 2024 to 22% growth, in an environment where there's still some challenges in terms of the macro environment, still delivering into the low 20s in terms of our year-over-year growth. On the right-hand side, you can see in terms of our quarterly revenue, very durable in terms of the predictability and durability. We don't have seasonality in terms of our revenue. We don't have big swings in terms of our revenue. It's very predictable.
We're continuing to see strong return in terms of our investment and what that's driving in terms of our revenue growth. We exceeded $100 million in Q1 in terms of revenue, and we're continuing to grow from there with a very durable growth. I'll start with the right-hand side. JFrog is critical infrastructure, as evidenced by the gross retention rate, 97% in terms of our gross retention rate. Once customers adopt on JFrog, they do not churn. We do not see churn. It is considered critical infrastructure for JFrog, for the customers, and they continue to use JFrog for their software releases. Again, 97% on a gross dollar retention basis. Net dollar retention, as I said, we stabilized in the high teens in terms of our net dollar retention rates. This is obviously the expansion of those existing customers.
We're continuing to see good growth on those customers, maintaining Net Dollar Retention rates between 117 and 120, in this environment, very, very strong Net Dollar Retention. Lastly, our long-term model and what we've published in terms of our long-term model. Let me start with the left-hand side in terms of 2023. We saw significant improvement in terms of our operating margin, 10.5 % point improvement in terms of operating margin, delivering over 11% operating margin in 2023. Now, as we go into 2024, as I said, we have top-line growth in the low 20s, 22% in terms of our top-line growth.
Still very strong gross margins between 83%-84%, and then maintaining operating margin, where we see the operating margin improvement of anywhere between 250 basis points-400 basis points in order to track into our long-term model. Free cash flow remains exceptionally strong between $74 million-$76 million, which would generate between 17%-18% in terms of our free cash flow margin. When we move over to the long-term model, we're targeting for $800 million in terms of our long-term model by 2027, in terms of our top-line revenue, with gross margins of 80%. Gross margins decline as the percentage of revenue is shifting from self-hosted to cloud. Today, cloud represents approximately 37% of our revenue. That would be more significant in terms of contribution from cloud.
In the long-term model, we would expect our gross margins to come down because of the mix change. But operating margin, as I said, between 21% and 23%, 22% at the midpoint. So going from where we are today, we would need to track to the long-term model between, let's say, 250 basis points - 400 basis points improvement on a year-over-year basis, and free cash flow between $200 million and $240 million, which would represent 26% - 29%, in terms of free cash flow margin. So very, very strong position in terms of our free cash flow margin. Okay, thank you. And as we say at JFrog, may the frog be with you.
All right. I wanted to just quick housekeeping note, mention that these guys need to get to the airport, so there will be no breakout session. What we're gonna do is run a little bit over. I think the next session is at two o'clock here, so we're gonna, you know, we'll go as close to two o'clock as possible. I have a bunch of questions, and then feel free to kind of chime in if you, if you've got some questions from the audience. Just to start out, Ed, can you give us a quick overview of the, the history of the company and what problem the founders-
Yeah.
- originally aimed to solve?
Yeah. So first of all, thank you for having us. It's been a really, really good event, good discussions and good meetings. For those of you that are not familiar with JFrog, JFrog is in the DevSecOps space. What people do know is that developers write the code, machines read the code. What happens in between is a very complex, fragmented, very large market, but inefficient market. JFrog was founded to solve the pain of the developer and make sure that the developer, with the velocity of updates, it was pain-free. And so JFrog came to this world specifically for that: automation, fast software delivery, and from the developer's keyboard all the way to the end device. Now Artifactory is our flagship product. Artifactory is the binary repository.
We can deliver that through both the cloud as well as self-hosted. Our cloud is about 37% of our revenues today. In 2023, we also, through our security core, delivered Advanced Securities as well as Curation. Today, we have tens of customers, but we have a very, very strong pipeline that would be delivered in our enterprise-level subscriptions. At the end of the year, we'll disclose the revenue, that contribution that we're getting from those customers. 7,400 customers -7,500 customers, that's broken down between Fortune 100, more than 80% penetration in Fortune 100, more than 50% penetration in the Fortune 500. We also penetrated more than 40% in the Global 2000.
Every customer today, any company, I should say, today is a software company, and infrastructure like JFrog is critical for their survival as they continue to require software updates, and they're adopting JFrog as critical infrastructure.
So what were customers doing before JFrog for their binaries?
Yeah. Yeah, so there's a couple things. First of all, if-- I'm kinda aging myself here. Back in the day, they would monolithic code. They would write code. There would be one to two updates. It wasn't as critical to have a company like JFrog because we managed the binary, and binary is a machine language that the machines read. It's not the code, and so you could write the code, and you could manage the update. You can do that through a homegrown system, and that's what we typically see. We see homegrown systems that have been built over time, and as organizations scale, as the velocity of software updates increase, then they need JFrog to be able to manage that. It becomes a control mechanism. It becomes security. Binaries are being pulled. They're open-source packages being pulled from repositories like npm.
They come into your organization. They need to be. Make sure they're secure. They need to be managed, and JFrog does that.
Good. Can we talk about the supply chain, the securing the supply chain strategy? I know you guys have brought to market some new products. Can you talk about those specific products, what they do, and what the customer reception has been so far?
Yeah. So JFrog is known, obviously, as the binary management tool, the most important asset, the binary. So it makes sense that JFrog would secure those binaries. Today, the way that binaries are being secured, multiple point solutions, anywhere from seven to ten different solutions, many of those companies are privately held companies with previously high valuations, burning cash. What customers want is one vendor. They want somebody to consolidate, have one vendor, and manage their software supply chain and secure the software supply chain. This is what JFrog is doing. This is what the expectation is from our customers, and this is what we're delivering in terms of the product. The feedback has been very, very good, and we have tens of customers, which I've explained.
We will report on our revenue contribution of those customers and those that we're landing in 2024, at the end of the fiscal year. But the reception has been good. The pipeline that we're building and what we have visibility into is has been very good. Those discussions are becoming much more strategic in terms of you must have Artifactory, and you must have Enterprise as your subscription in order to have advanced security. So you're talking about a longer duration in terms of the contract. As you bring security into the discussion, it also brings in multiple personnel. You're bringing in the CIO, the CISO. You're bringing in the developer personnel. You're also bringing in the CFO because you're replacing many budgets and consolidating that into one budget.
Within the Advanced Security SKU, what are the different elements of that? And then also, can you explain to the audience what Curation does?
Sure. Yeah. So today, first, Advanced Security offers seven different solutions within the platform: static analysis, dynamic analysis, container registry, secrets detection, infrastructure as code. There's many different solutions that are offered within that platform, which sits on top of Artifactory and replaces those point solutions. That's number one, one unified platform sitting on top of Artifactory. Then you have Curation. Curation is outside of Artifactory, and that protects what you're bringing into your organization. So you set the rules. You are able to then define what can come into your organization. We describe it as Artifactory being the house. You have the alarm system inside of the house, which is Advanced Security, but then you need to put a fence around your house, and this is what Curation does.
It then allows you to set those parameters, set the rules, and tell the developers what can and can't be brought into your organization.
Great. And then just switching gears a little bit to the earnings call. I think in-- you know, we talked about this, but investors were harping on some of the comments you made-
Yeah.
particularly around digestion. Can you clarify what you meant by this and whether-
Yeah
... this is something that, you know, is more normal in a Q1 or something more abnormal-
Yeah
... maybe tied to sort of a macro, the broader macro backdrop?
Yeah. Yeah. Well, first of all, thanks for bringing that up. It was something I was hoping to forget about. And, yeah, the word digestion has apparently given a lot of people indigestion, especially in the analyst community. I think really what the intent is here is around seasonality. Q4, we came off of a very, very strong Q4 with cloud revenues generating 53% growth after you take the one-time benefit that we saw during Q4. And then we stepped into Q1, which Q1 historically has been a planning quarter for our customers. And so what we were trying to explain during this digestion is the foot is on the pedal. We see a lot of customers kind of accelerating based on the projects and what they've committed to towards the end of the year.
It's seasonably high renewal quarter for us. And then as they get into Q1, and this is similar across the software universe, you start to then see planning efforts, and Q1 becomes a planning quarter. There's a lot of distraction that happens in Q1 from what we can see in terms of business kickoffs, sales kickoffs, et cetera. This is a normal behavior. It's something that I would expect. It's no different than what we saw the prior year. We had, in 2022, 53% growth year over year in terms of the cloud. We did the same thing, in, 2023, and then we had 49% growth in Q1 of 2023. We did 47% on a larger base during Q1 of 2024. So very similar behavior, something that I would expect going forward.
Okay. And then just from a broader macro standpoint, I think you mentioned earlier, you know, that you know, there's some pressures out there. We've seen some pretty high-profile Enterprise software misses over the last couple of weeks.
Mm.
Any commentary on the environment right now? Is it about the same? Is it getting any worse? What's your perspective on that?
Yeah. You know, we were one of the first companies to report during Q1, and I think we were trying to be very transparent, in terms of what we saw in, in the environment. First off, when we look at the cloud growth, we said mid-forties growth. This is what we have visibility to. This is what our commitments are. Anything above that would be additional usage. I think there was maybe some gap between the expectations and, and what we delivered, but we felt that it was a very strong quarter, considering what we know.
Now, we also said that we don't know that we're fully out of the woods yet, and what we're seeing is, the migrations, the secular trend of cloud migrations from self-hosted to cloud, is similar to what we saw in 2023, which was a dip from what we saw in 2022. We're also starting to see more back end 2024, where many of the larger deals are kind of pushing towards the back end. Again, the conversations are becoming more strategic, the duration of the contract's much larger, more people involved in the discussions, and this is what we communicated. There's definitely a softening in Q1, and I think people are starting to see that as more customers are... I'm sorry, more companies are reporting.
I think what ended up happening was when JFrog went out, the hyperscalers went out, and there was this sense, Datadog went out, there was this sense that we're back. I don't know that that's necessarily the case. The way that we structure our cloud business, we have line of sight to commitment. We're not 100% consumption-based, so I know where we're committed in terms of our cloud growth. I don't know in terms of where I am in, on my data consumption, that there's a lot of variability in there, but I do know that I'm committed, and it shouldn't fall below the mid-40s.
Okay. And do you - One sec. I'll get to you. I'll get to you in a sec. I wanted to know, just to follow up on the macro. One of the theories out there is that AI is causing customers to kind of take a step back and strategize, think about, you know, how they can implement it, where they can implement it.
Mm-hmm.
Maybe that's creating some just overall kind of slowdown in the velocity of decision-making.
Mm.
Does that sound reasonable to you, that that could be a factor here?
You know, we've heard that. We've certainly... That narrative is coming across the wire, coming across our desk. If it's impactful, it would be more impactful in new infrastructure purchases and new customers that are being acquired. We're not seeing it necessarily in expansion. Expansion is continuing to grow at the same pace. We're not impacted by anything from an AI perspective. Commits are still very strong in the cloud. Again, we didn't hear about AI as much during 2023. We guided to the mid-40s. We're continuing to guide our cloud business at the mid-40s. So we don't see budgets necessarily being shifted in our world, but it may impact maybe some new purchases.
And just as an additional follow-up to that, when you start to bundle in things like security and try to offer the full, like, the full platform-
Yeah
... with Artifactory, let's say it's a mid-year renewal for a large customer, and you're pitching security. Is there a risk that because now you're putting more things into that pot, that the deal, like that deal... I mean, maybe it's a bigger, I mean, it's definitely a bigger deal.
Yeah.
Does it mean that that deal could take longer because now there's more sort of?
Yeah
... signatures that are needed?
Yeah. So we start the conversation early. It's not that the customer, July thirty-first, the expiration of the annual agreement. We start those conversations obviously early-
Right
... a few quarters, at least 6 months, and you start to especially those that are Enterprise and platform, or those that we know that are gonna move from a Pro subscription to Enterprise. Those customers that are using Xray today, we know have a good probability of taking on Advanced Security. And those discussions around Advanced Security, as I said, typically involve multiple functions, multiple people to be involved. And so those conversations take a long time. The duration of the contract are increasing. Typically, we would see somewhere between, let's say, 6-9 months of planning and discussions in order to get those larger deals. And we've talked about this, and I believe we talked about this on the call.
We could take a very simple one-year security, at a very, let's say, introductory pricing with a low number of developer, or we could have a more strategic discussion where we're doing multiple years, and we're talking about growth over those multiple years and replacement of those point solutions, adopting on two of the seven, then another two the following year, and then full adoption by year three. Those obviously become, larger in scale, much more strategic and will take longer.
With OpenAI, what do they gain by having?
Repeat the question. Yeah, can you, can you repeat the question? I'm sorry.
First, with OpenAI-
Yep
... and other things.
Yeah.
What do they gain by having the binaries in your company?
Yeah.
What do they gain? And it's not the way you do it.
Yeah. Yeah.
Sorry.
Yeah. In terms of gaining for them, I don't know that there's anything that they gain because the data scientist is gonna pull those open packages from those repositories. So those sit in the repositories. What they do is, if they have Artifactory already in their organization, they're able to pull those and store those in Artifactory, organize them, store them, and manage those within Artifactory. Now, those are very, very large packages, and as you move those through the software supply chain, that will generate, if they're a cloud customer, data consumption, and data consumption then would be an opportunity revenue growth driver for JFrog. It may be a tailwind. It's very nascent, very early. At this point, we don't see any benefit yet from large language models and what developers and data scientists are bringing into their organizations.
I think we have, you know, tens of customers that we've been able to highlight that have brought large language models into their organization, but there's not a lot of movement at this point that's driving revenues.
Can you talk about just Gen AI more broadly in terms of how you-
Yeah
... feel it could impact your business?
Yeah. So we see two avenues of opportunity. One we can control, one we can't. The first is generative AI. Generative AI is obviously gonna make the developer more efficient. It will allow them to write more source code. More source, source code becomes more binaries. More binaries is good for JFrog because that's going to drive opportunity. We don't have control over that today. I know there's a lot of companies that are dabbling in Generative AI. We're unable to track what the real value is in terms of an uptick for JFrog at this point. And again, it's very early in the Generative AI story. The second piece is the MLOps.
So we do think there's some value here in MLOps, that bringing large language models into the organization, a package which is a binary, and managing that package through the software supply chain, similar to a CI/CD, you manage that through your software supply chain, that will drive data consumption, that will drive usage, which will be value. We can control that, we can get in front of that, and we believe that will be a tailwind at some point for JFrog.
We've already seen the pretty strong uptake of GitHub Copilot, though.
Mm-hmm.
So I mean, it seems like there's already evidence that this is driving productivity for developers, right?
Yes. Yes, I would agree with that. But again, I don't know how much of that is actually coming from Enterprise, which are freaking out about what they're bringing into their organization through OpenAI and through this generative AI, and then bringing those to their binaries. It's still very difficult for us to track that, and it's hard to know if there's - if we're seeing value in terms of our growth and data consumption that's directly correlated with any code that's being written by Copilot.
Gotcha. So, so you're saying a lot of the Copilot adoption now is probably from, like, smaller teams and-
Yeah
... not larger enterprises, which is your base of customers right now?
Yes, that is correct.
Okay. All right.
Yes.
Yeah, back there.
So, we have to make sure, how does JFrog solve, right, from the traditional change management software, you know, thereby, you know, offered by BMCs of the world? Is it the evolving technologies, the new languages, the new paradigms, or we need to take the higher level and,
Yeah
For the newer... Is it because of the newer architectures?
Yeah, I think if I understand, JFrog is really focused on the binaries. So to the left of it, you have the source code, to the right, you have observability. Right in the middle is JFrog with the binaries, and again, that's the machine language. Now, it's the universality of this being able to pool multiple languages into JFrog, okay, and having those stored as a binary. This is essentially a differentiator. This was non-existent previously, and this is something that was created specifically to manage the binaries done by JFrog.
But wasn't that always done by other applications before in, let's say, different environments?
It was.
Change management, as you put different versions of software into a, to Enterprise.
No, in terms of binary, no, it was always done through homegrown tools. There's one other company that was founded around the same time as JFrog in 2008. It's a privately held company called Sonatype. But in terms of the change management and management of the software creation and the binary, this is relatively new technology.
Other questions? I want to ask you on competition.
Yeah.
So that, that's a good segue.
Yeah.
And that's, I think, Sonatype probably was your most direct competitor, but they've sort of almost exited. You don't see them very much anymore. But I think the bigger fear that people have from a competitive standpoint, and I remember at the time of the IPO, this was the main question I was getting-
Yeah
... which is like, if you're running, kinda to that gentleman's question earlier, like, the version control system, which is for the, for the source code, that's managing the source code. It's a repository for the source code. Wouldn't that be a natural adjacency for, you know, a GitLab or a GitHub in particular to kinda move into the binaries-
Yeah
... the binary repository?
Yeah.
I guess two questions. One, why hasn't that happened?
Mm-hmm
... I mean, in a significant way, where you guys have been encroached upon?
Yeah.
And then secondly, what's to stop it from happening in the future?
Yeah. Yeah, that... Wow, that's a really, really good question. So the way that we see it and what we're hearing from the market and from our customers, there will be a best-of-breed platform for the source code, for the binaries, and for observability. You may have seen recently, we just did an announcement, technology announcement with GitHub. GitHub, and what's great about this announcement, it's technology co-marketing announcement. This really creates the delineation between best of breed and source code, best of breed and binary. So together, JFrog and GitHub will be best of breed in terms of providing the platform for both of those, the separation between the source code and the binary. It's difficult if you're an expert in one area, to come in and try and be an expert in the other area.
Now, from a competition perspective, we talked about, you mentioned it, Sonatype was a competitor, the homegrown tools. Hyperscalers could be somebody that, that we're concerned with, in terms of competitor, and we hear that often, and those hyperscalers, typically go after lower, end subscriptions where there's not a lot of deep technology need, typically just repository services, small organization, not over multiple, organizations, not over multiple developers. So from a competitor perspective, that may be something that we're concerned with. But in the announcement that we made with GitHub and, and together with JFrog, that doesn't necessarily mean that, Azure, is something that we're concerned with, that, that GitHub is now looking at Azure potentially as their repository. It is clearly now defined that best of breed and source code being GitHub and JFrog being the binary leader.
How are we doing on time? A few minutes. Okay, well, we have maybe time for one more question. Yeah.
Is the conflict in Israel affecting your operations, the fact that you've got a lot of your staff in Israel? I mean, any take on that?
Yeah. Yeah. So first of all, thank you for asking that. We have approximately 50% of our employees based in Israel. The company was founded in Israel. You know, obviously, October seventh was a terrible situation and what's happened there. It has not disrupted the business. It hasn't disrupted the company in terms of renewals, and we don't hear it at all. And in fact, we haven't lost any customers because we're Israeli, by any means. The other thing is we have a business continuity plan. We released that immediately after the situation in October, and we're continuing to build on top of that continuity plan. We have duplication of our R&D services if we need to, outside of Israel and Europe.
Our servers are outside of Israel, so we don't have any concern in terms of cybersecurity or the servers going down. Development is still happening with R&D. Business as usual. It's kind of a resilient group of people. It's interesting to see how it operates, but they're continuing to move forward.
Great. Well, with that, we'll wrap it up. Thank you, everybody, for coming.
Thank you.
Thank you, guys.
Thank you.