Can you hear us okay? Great. Well, hey, everyone. My name is Koji Ikeda. I am one of the software analysts here at Bank of America. I am absolutely thrilled to have Ed. What's your last name?
Grabscheid.
Grabscheid?
Yes.
The CFO of JFrog.
Yeah.
Thanks so much for doing this. Apologies on the last name there.
It's okay.
You know just a basic question here. For those on the webcast and in the room that are unfamiliar with JFrog, maybe just a couple of minutes on what is JFrog, what do you guys do, what's the opportunity you're going after?
Mm-hmm.
You're relatively new to the scene.
Yeah.
So tell us a little bit about yourself?
Oh, great. Well, first of all, my name is Ed Grabscheid. I'm the CFO at JFrog. I've been the CFO officially for about six months, but I've been at JFrog for five years now so I know the story very well. I know the company very well. I took the company through the IPO and helped kind of build, you know, everything that we've done in terms of the long-term model and the forecasting process and what we do. So, like I said, very familiar with the company. JFrog, w ell, first off, let me just say thank you for having us, by the way.
Yeah.
It's been a great day of meetings, and, you know, I got to see, a lot of people, a lot of familiar faces, and a lot of new faces, so it was a really good meeting so far. JFrog, founded in 2008. For those of you that are not familiar with the story, JFrog is a DevSecOps company. Most people know that developers write code, machines read the code. What happens in between is a very large market, fragmented, siloed, inefficient tools. JFrog came to this world and was founded simply just to improve the developer and fix the pain points for the developer. And this is done through automation. So when you have velocity, when you have scale, across your organization, JFrog is critical infrastructure.
What we see in terms of our opportunities, we started as a developer tool, and it was loved by developers. It was a bottoms-up strategy. We're now more of an enterprise solution, so we're now focused more from a go-to-market perspective as a tops-down. As I said, when you have velocity, when you have scale in your organization, when you have complex processes, where you have multiple developers, this is where JFrog becomes very valuable.
We have very large organizations such as Cisco, BofA, etc., that use JFrog to scale their organizations and deliver critical software updates at a high velocity and secure, which is very important, and this is where the value of JFrog comes into play. From a competitor perspective, you asked about where we differentiate. We have the ability to scale.
This is what we hear. In addition to that, we also operate in a hybrid mode, so you can have both an on-prem as well as a cloud deployment. In addition to that, we're agnostic. You can host on any of the hyperscalers. We do not require you to host on one single hyperscaler. You can choose, if it's AWS, GCP, Azure. So we're agnostic from that perspective, and that's a differentiator for us.
Thank you. I've been asking all the companies, the management teams, over the course of the last two days, the macro, the demand environment.
Mm-hmm.
It's been an interesting six months, I would say, but it did feel like to us that the JFrog first quarter results were pretty good. So can you tell us a little bit about the demand environment? How are you feeling about it today versus January, versus maybe a year ago?
Yeah. Yeah. Well, first of all, thank you for your continued support. I think, you were one of the ones that, at the end of Q1, really came back and said, "I appreciate what you guys did in terms of your print." We were kind of the canary in the coal mine. People thought maybe it's a JFrog problem. We had a very, very strong Q4. We came, off of probably sequentially, the strongest, quarter we've ever had in the history of the company. We did not back off of our, our philosophy in terms of our guidance. In the cloud, we guide to the mid-forties. We maintain that philosophy of only guiding to what we know.
I think there was some whisper numbers that expected something higher than what we had guided to, and we certainly - y ou know, we don't control that. What we can control is what we see, and we continue to guide to what we see. The macro environment for us hasn't changed, and we said that. What we saw during 2023 was very similar to the trends that we see in 2024. The difference is, in Q1 of last year, we saw optimization. We saw customers optimizing in terms of their workloads, in terms of their spend, in terms of their budget. What we're seeing now in Q1, what we saw is maybe more rationalization. So you start to see some more rationalization in terms of their budgets.
The great thing about JFrog, and maybe the misconception around JFrog, is that we were 100% consumption-based company. That's not necessarily the case. We have commitments from our annual customers. Those commitments give us visibility into the mid-40s growth, and this is what we continue to guide to. So it doesn't matter as prior priorities shift.
Maybe if a priority shifted from developer workloads to AI, for example, that doesn't impact my cloud growth. I have a commitment in the mid-40s, and I have visibility into that. So a shift in priority, for example, in Q1, which tends to be a planning quarter, and maybe there was some shift into other activities, that doesn't affect JFrog like it may affect other companies that are 100% consumption-based.
So what happens is, the customer can then ramp up their workloads throughout the year, and this is where we said from a macro environment, maybe we see some more kind of activity based on the pipeline of what we see towards the back end, back half of 2024, which would be similar to what we saw in 2023.
I wanted to dig in on something you just said about rationalization. And I think that with mid-cap companies specifically-
Yep.
Right? The number of products available and the number of users shrink, meaning you're not Microsoft. You don't sell 50 different lines and all that kind of stuff. You sell Artifactory and a security platform. And so help us understand how the end user uses JFrog, maybe from a January to December perspective or from a contract perspective. You know, rationalization sounds interesting, I would say.
Yeah.
But, what does that mean from the user perspective?
Mm-hmm. Yeah. Yeah, so the user has become much more sophisticated. They have lots of tools today to determine and have visibility into their usage patterns. So what we see today is this compression between what the user is committing to and their overages. So that's first off, and what we've seen, and that's kind of changed over the last couple of years, where a user, a customer, may have been willing to take an 80% commitment on their assumed usage and then been willing to have some overages, or overages obviously are priced much higher than what you would do from a commitment perspective. But that is now being a little bit more compressed.
The great news about that is when you look at the behavior of the customer, Q1 typically becomes a planning quarter for customers, and then they'll plan their workloads. This is not a linear business. This is a project-based business. So you may have Q1, where you plan, Q2, where there's an increase in that developer workload, then you may have a slight drop in one month, and then you may ramp that back up again. It's not linear, it's project-based.
But what we have now is a commitment from the customer over that annual contract of mid-forties growth. That gives the flexibility to the customer in terms of their workloads to plan appropriately. Maybe, and we hear this, maybe there was some attention being shifted to AI during Q1. It doesn't impact JFrog, though, because we have that commitment.
Got it. Got it. And you mentioned AI right there, and so good segue into the next question. I remember last year we were sitting on this stage, and Shlomi was kind of pumping his fist, that AI is gonna be a good driver for you guys in the future.
Yeah.
And here we are, fast-forward a year from that, I mean, really eighteen months post, you know, hyper-awareness of generative AI. And so the question really becomes: what, what has AI meant to JFrog? I totally appreciate that many of the AI-created binaries are coming-
Yeah
In the future, but what does it mean from the end users, you know, the high-level CIOs, CTOs, Head of DevSecOps? You know, how are they thinking about AI, and where does JFrog play into that?
You can't have conversations without a discussion around AI. That's just the way the world is going, and that's how software is kind of moving. I think there's gonna be a tailwind for JFrog at some point around AI. We certainly don't see anything today that would indicate that we're receiving benefit from AI. We're not the type of company that's gonna say, "I had mid-40s growth in my cloud. I delivered 47 in Q1, so, oh, those 2 points of growth must be AI-driven."
That's not how we operate. That's not necessarily what we see. We do see that there's potentially 2 avenues of opportunity. There's the Generative AI piece. Generative AI means that more source code, there's better efficiency, more improvement in source code, means more binaries, more binaries means more opportunity for JFrog. That will come at some point.
We're very, very early, and I'll use a baseball analogy here. We're just exiting the dugout. We haven't even thrown the first pitch on that. The second avenue of potential and opportunity is gonna be MLOps. MLOps has a opportunity for JFrog because you're pulling a package, a large language model, from a Hugging Face, a SageMaker, into your organization.
That package is a binary. Who manages the binary? Who owns that asset? JFrog. So there's an opportunity there in terms of bringing that into your organization, storing it, securing it, managing that. In addition to that, there may be an opportunity down the road to move that, train that package, and move that along your software supply chain.
This is where an MLOps company, we're partnering with Qwak, for example, that may have an opportunity to move those packages along your software supply chain, that could be of value to JFrog. That will be a potential tailwind for JFrog as you're driving data consumption in the cloud with these large language models.
When we think about AI workloads, and it does feel like JFrog gets thrown into the bucket of should be a beneficiary at some point in time, I do believe that.
Mm-hmm.
And other companies out there, there's other software companies that have given some sort of visibility into the AI participation. Whether, you know, it's a big company or a little company, some. They, they've talked about it. So how do you guys see AI-driven workloads within your revenue streams and pipelines? And I'm not gonna ask you to commit to a metric today, but it's, it's in the future, as you begin to see more and more of this and have that visibility and confidence, how do you think about talking about it qualitatively or quantitatively?
So there's a couple of things. First, let me tell you, we just turned on Copilot as a company. JFrog just turned that on, and the reason why is we want to do it in a very secure manner. We want to bring in Copilot, we want to understand it, we want to bring opportunity to improve efficiency, but we're not just going to allow packages coming into our organization without knowing, we're not infringing on any IP.
So if we're just turning it on, that means that most other enterprises, and especially those highly regulated enterprises like banks, government, et cetera, certainly are not turning that on yet, or maybe using it in its nascent in the technology, maybe limitation in terms of their usage.
So for me to say today, Koji, "I'm seeing this benefit coming from AI," would be, A, a false statement, and B, it's too soon for me to know really what is gonna be the impact. Maybe in a year from now, I can sit here the next year when we have this discussion and we're doing our fireside chat, I can tell you, "Okay, I see value in AI. I see a potential uplift of X%." But today, I cannot commit to a number, nor do I have the visibility. I don't know if code is being written by a human or if it's being written by a machine.
We don't have that technology yet, and once I have that technology then I can confidently sit here and say, "I see that machine is driving X amount of code, therefore, it should generate X amount of benefit going forward." Until I have that, I don't feel comfortable to even comment on that. I think it's too soon.
Got it. No, that makes sense. So we talked a little bit about cloud and how developers use it. Is it similar with self-managed, too, or is there any sort of differences in the way they consume self-managed, buying seasonality? I mean anything to comment on with self-managed?
Yeah. Yeah. So as you mentioned, cloud is monetized through data consumption. Okay, so you see growth as either your commits increase or your data consumption increases over your commit. Self-hosted is on a per-server basis. So regardless of my utilization and my server, I may have a customer that has three servers.
Two of those are 100% utilized, one of those is 20% utilized. If they increase the utilization of that server from 20%-80%, there is not necessarily a value in terms of my revenue uplift. I don't see value in that. Maybe down the road, there might be an opportunity to expand with an additional server, but at the time of that increase in the utilization of that server, I don't benefit from that. What we see in terms of our Self-Hosted business, it's stable.
We don't see it that being a significant growth driver. Where we do see some opportunity for growth in our Self-Hosted business is through Security. Security, historically, has been purchased with Self-Hosted customers. As we add on an additional SKU, so advanced security being an additional SKU for JFrog, that will sit on top of your self-hosted licenses, then you have opportunity for some expansion in the Self-Hosted, but really, that's gonna offset maybe some of the stabilization, or maybe even some of the limited growth that we have right now in Self-Hosted.
Most customers are looking, and it's not gonna ever be 100%, but the secular trend of moving from self-hosted to cloud, and as the macro environment improves, you'll start to see more customers moving from Self-Hosted into Cloud environments.
Just mentioned Security. So let's, let's touch on Security for a little bit. You guys have been talking about Security for a while now. You have the Advanced Security SKU. You've talked about, you know, broadly how to think about customers, you know, people that have been looking at security. When I look at security, I see a lot of different options out there, and you've had Security out there for some time now.
So tell me a little bit about the Security, what you've learned about your Security product, how those conversations are coming with customers, and what are they focused on, and how are you helping them with your Security products?
Yeah. So let me, let me first ask you a question. Who manages the binaries? Who is the one that is gonna manage the binary?
I don't know.
JFrog. So if JFrog is managing the binary, who are they gonna trust to manage and secure those binaries? It's JFrog.
Right.
When you bring in a platform that is securing your binary platform, Artifactory, then this is the differentiator. You have seven-point solutions, multiple-point solutions right now, and we see this. It's a very fragmented environment. There's maybe even inefficiencies between each of these point solutions, false positives, things of that nature.
You know, what we're hearing is vendor consolidation, one vendor to standardize on, platform, all of the things that JFrog offers, this resonates with our customers, and this is what's giving us the right to win. Now, what are we seeing so far? We delivered in the second half of 2023 the Advanced Security and Curation to the market. We had tens of customers. We talked a lot about 2023 security, our position in security, the advantages of security.
In 2024, this is a year of execution. At the end of the year, we'll disclose our revenue in terms of that contribution from Security. Today, we're building a very strong pipeline. What have we learned from this? We've learned that there are a lot of people involved in the decision-making practice of purchasing security.
This is not like a DevOps sale. It's not a developer in the room deciding that we need to take out our homegrown do-it-yourself tool or maybe Sonatype and replace that with JFrog. This is a situation where you're bringing cross-functionally the CIO, the CISO, even the CFO, legal, the developer, all involved in the decision-making process. It's becoming a large purchase. It's gonna be a longer duration in terms of the contract because you're replacing multiple point solutions.
It's not something that you can decide, "I'm going to rip out infrastructure. I'm gonna do this in one year." You may replace point solutions in year one, replace two more in year two, and then fully adopt in year three, and we're having those strategic discussions, and this is what we're learning, as we go, and have these conversations with our enterprise customers.
Keep me honest here, Ed. I think you've mentioned in the past that Security might represent 5% of revenue this year. Is that right? And how are you guys tracking today?
Yeah.
Yeah.
Yeah, so we said that Security will be a material piece of our revenue during 2024. We're still confident in delivering that number, and that's based off of what I see in my pipeline, that's based off of what I've seen so far. And those customers that we landed during the second half of 2023 that are coming up to renewal, so those that were on annual contracts, we're already starting those conversations, and we're seeing the size of those opportunities, which are relatively large opportunities for us. And so based on these factors, we're still very confident in delivering a material piece of our revenue during 2024.
When you say coming up to renewal, does that mean that when those customers that you talked about in 2023 that adopted Security, were they coming on as a, as more of a test and see, and now they're, you know, enterprise-
Yeah.
I mean, walk me through kind of that conversation.
Yeah. So in 2023, we did more proof of concept. We started with tens of customers, really to kinda drive, understand what the trends are gonna be. We would be naive to think that all of a sudden, as a DevOps company, to come in as a DevSecOps company, selling security, that we would be able to see this flywheel motion of purchases and security.
So we went specifically with tens of customers with proof of concept, and we did that during 2023. Now what we're looking at is, from those learnings, how do we take that to have more strategic discussions with enterprise customers on multi-year engagements? You know, overall, the feedback has been very good from those customers.
We're starting to see adoption increase in the number of users, so we monetize our security based on number of seats, which is different than what we do in our cloud business, which is on data consumption, and different, of course, from our self-hosted, which is on number of servers. And the reason is security at the number of seats, that's the common currency.
So we go as a like for like, so you understand exactly what you're spending with JFrog versus your other vendors. And we're starting to see some proof points that would say renewal, starting to see some increase in those seats coming off of those proof of concepts.
Got it. I'm gonna ask you one more question, then I do want to open it up to the floor to see if there's any questions from investors. So my question is gonna be about, I think, recent - it was last week or maybe the week before I saw an announcement, JFrog times GitHub. I thought that was pretty interesting.
Yeah.
So, tell me a little bit about that. What's kind of the key takeaway from the announcement?
Yeah, that's a really good announcement for us. I see this as there's three real pillars of the stool that we you know that we think about here, and this was a technology and co-marketing discussion and release. Number one is, I think there's a clear delineation in terms of best of breed on source code and best of breed in terms of software supply chain.
I think there might have been confusion from investment community, from our customers. Where does source code end? Where does the binary start? Now, it's clear. You have best of breed in GitHub, you have best of breed in JFrog, and you bring the two together. The second piece is this is not a one-time announcement.
This is a technology come together, work on, creating value on the technology side. So you have people from JFrog, you have a group from GitHub, you come together, you build, a single pane of glass that allows you now to track, which will come out in the second half of this year, your security.
So from source code all the way to the binary, so it gives you this traceability, and so exceptionally important. At some point down the road, there may be a co-sell opportunity. It's too soon to know. I'm not ready to come out and say from a long-term model, from a guidance perspective, that this is gonna drive, value, but it may, some point down the future, for us.
Got it. Any questions from the audience? Please raise your hand and we could, we can call on you. I got questions.
Yeah. Perfect.
I wanted to switch the conversation to go-to-market.
Yeah.
I think the go-to-market evolution for JFrog has been pretty interesting, and you've been with the company for a long time-
Yep
So you've seen it. So, maybe walk us through the evolution. You know you used to start bottoms- up, trying to get some sort of scale. I'll let you talk about it.
Yeah.
What, what does the go-to-market motion look like today? How do you balance bottom up versus top down, and what does it look like for the next three to five years?
Yeah. You know our story well. You've been with us for a while, and as I said, you know, JFrog came to this world to solve the pain points for the developer, and that started from the bottoms- up. So we got the foot in the door with the developer, and as they adopted within maybe one organization and, they saw the value, then it went to another organization, and it scales across the entire universe of the company. This is where we saw the shift.
Now this becomes an enterprise application, and you go after the enterprise, and you go after the platform. So with that being said, it's no longer a discussion around bottoms up. You're now working for tops down. You're selling to the C-level. So we've shifted in terms of our approach and our investment.
We brought in a strategic team. We invested in that about two years ago, and we spent a significant amount of resources to build out our strategic team. Secondly, Channels. Channels is an important piece of our business, and in order for us to get the scale, we now have a platform that channel partners can sell the platform, do the integration of the platform, and provide services and value for JFrog, through the reseller.
Additionally, we have the hyperscalers in the marketplaces, and we're using those. That gives us a little bit, less friction in terms of the selling cycle, and we're seeing a lot of these strategic deals. We did a significant number of strategic deals in the second half of 2023. You saw it in the number of million-dollar-plus customers, that we landed.
Many of those deals go through our marketplaces. So this investment that we've made over the last three years, we're starting to see the fruits of that. We really saw that starting to take where there's traction towards the second half of 2023. Now, how does it look over the next, you know, three to five years? We'll continue to invest in Channels.
We see value there. Channel today is a bigger piece, probably in Asia and Europe, where you have different languages, you have different selling practices. Channels will start to expand a little bit more here in North America. We also brought in Carahsoft. This gives us the ability now to sell more frictionless with our government-based customers.
So Carahsoft will be a partner for us in terms of the opportunity in the government. We're now looking to continue to invest there, in the government. So I can see that being an opportunity going forward as well.
How big, how big can a customer get with JFrog, theoretically, just from a core binary Artifactory perspective, and then Artifactory plus Advanced Security? Is there a broad way to think about, I don't know, Fortune 100 company to become six, seven, eight, nine bigger deal?
I'll give you two points here to kind of think about. Number one is, we're a little over 80% penetrated in the Fortune 100, 50% penetrated in Fortune 500, 40% in the Global 2000. We probably penetrated somewhere between a little over 20% of their IT spend, so there is a long runway there. The other point that I'll give you is AT&T.
We talked about this in our Q4 call, I believe it was. Yeah, Q4, Q1 call. AT&T, significant deal, eight-figure over three years, that had Artifactory, it had Security. So you can see the size and magnitude of the deal. They were a Sonatype customer that came over to JFrog. They had scalability issues. They wanted to be in the cloud.
They wanted to take security. They came to JFrog because the fact that they can scale with JFrog, the velocity that we offered, the fact that we can do that on cloud. So you see the potential there, that we had with AT&T.
So you mentioned some penetration rates among the Fortune 100 all the way to the G 2000, and one question I get is, and maybe you could help me answer right here, is how do you guys expand the penetration within these bigger customers? I assume with these bigger customers, you're already talking with the CISO, you know, the highest level buyers there. How do you expand that spend? What is that strategy?
Yeah. It's—there's two pieces. Just because they're in the Fortune 100, Fortune 500, doesn't necessarily mean that they're on the full platform. So we still have less than 10% of our customer base on the full platform, so there's opportunity in terms of the adoption of the platform. And secondly, it's Security and bringing in Security as a growth driver for those customers that are on the full platform. As Security is relatively new to JFrog, bringing Security on top of your Enterprise Plus subscription will drive incremental growth.
Okay. Okay. We're almost up on time, so I just wanted to ask you one last question that I've been asking most of my management team, but this is: as a CFO, what gets you most excited over the next 12 months?
Well, the opportunity in front of JFrog right now is incredible in terms of the platform adoption and what we saw in those million-dollar customers and the traction that we're getting there. The fact that the way we do our model from a cloud perspective, knowing that I have the visibility and the mid-40s growth is in this market, and being able to continue to commit to that when you're hearing a lot of these customers or companies that are 100% consumption-based, that don't have necessarily the visibility we do.
What also excites me is Security as a new opportunity for JFrog, as we continue to drive the security pipeline and execute on that. And lastly, I think at some point, as MLOps becomes more mature, I think that there is an opportunity for JFrog to really execute on MLOps and have that become a meaningful piece of business down the road, and that excites me.
We're all out of time. Ed, thank you so much.
Thank you.
This has been fun. Thanks so much for joining us today.
Thank you. Appreciate it.