Thanks for being with us.
Thank you for having us.
So look, there's, there's been a mixed macro backdrop. Every company's feeling it. You've been executing really well. You reported your Q2 earnings last week. It included a modest cut to guidance. As we look towards the back half of the year, what's the state of the business in your own words?
Yeah. So certainly, we're kind of faced with this uncertain macro environment. We've been kind of, you know, I guess, slugging through the last maybe 4 or 6 quarters. We've had some of this uncertainty, but it really kind of hit us more towards the back end of Q2. We really felt it really in the final few days of Q2, and as we entered Q3, we felt that a little bit more, and it's really around large Enterprise deals. As we started to shift from more of a bottoms-up motion to a top-down, focusing on large deals, so significant deals, large TCV, multi-year deals, we really felt the impact of the macro environment.
The good news is, and what we're hearing from the customers, is that we're not cutting budgets necessarily, but we're delaying the purchases of those decisions, and most of that delay is being pushed out to further quarters. So from a macro perspective, a lot of uncertainty. From the overall purchasing environment, those decisions are being delayed, and this is what we're hearing from our customers. We're still very optimistic, and the reason we're optimistic is because we know that JFrog, in terms of the infrastructure that is required, is still very much a critical need for our customers. We're on their roadmap. These are customers that are currently in self-hosted instances, and those decisions are because they're large projects moving from self-hosted to cloud. The macro environment is delaying those decisions, and this is what we're hearing.
Great. That makes perfect sense. I think one of the things that has come up in conversations with investors over the past week has been that the tone felt like a lot was changing all at once, and then the guidance really was quite strong, and the results are still strong. So, and then if you look at the reaction in the stock, probably more of the former. So what would you say to those investors that are just feeling a little bit more uncertain coming out of the quarter?
Yeah , you know, I don't necessarily look at the stock itself and comment on the performance of the stock. I'm really focused on the execution and what we're doing as a company, and we feel really good, you know, from the inside and looking at the strategic decisions that we made, focused on the platform and seeing the adoption of the platform, and focused on movement from self-hosted to cloud instances, and more importantly, focused on security and investment in a decision that we made over two years ago and seeing how we're building the pipeline around large deals and security. We feel really good about those decisions. What we're focused on is executing against those strategic points, and as we continue to execute, the other fundamentals will start to fall in line, and I think the stock will follow. So as long as we're focused on those strategic drivers, I think everything else will kind of fall in place.
It's helpful. I think it's, that's, that's the right approach. So, Ed, you've been CFO since January 1. You've been with the company since 2019, 25 years of financial experience. I guess what surprised you? What hasn't? Can you just talk about the continuity that you've helped create in the transition?
Yeah. Yeah, so you're right. I just actually hit my five-year anniversary with JFrog, so been with the company through the phase of, you know, preparing for an IPO, taking the company through the IPO, building the beat and raise model. I was the person behind the scenes, now I'm the person here in the seat actually speaking to the investor. So a little bit of a transition. In terms of the continuity, nothing has changed. My philosophy is the philosophy that was being used with the prior CFO, and that we always are relatively conservative in our approach and how we guide the markets. Our beat and raise model is based off of, you know, ensuring that we're having a modest beat every quarter.
We're not the type of company that is gonna have a significant surprise at each quarter, and that's kind of the philosophy. Additionally, we're gonna remain focused on the strategic drivers. Again, going back to kind of the three pillars that we're looking at, driving growth and through our platform. Today, we have a little over 50% of our revenue coming from E +. Only 10% of our customers are on the E+ platform, so we have a long tail there, long runway. We're focused on driving cloud growth and of course, security. So those fundamentals remain in place, and strategically, from a continuity perspective, I'm very much focused on that.
Really helpful. So let's talk product. JFrog sometimes to the layperson, can be a little bit opaque in terms of what you do. Your platform is centered around binary package management. Ca n you just talk a little bit more about why the binary is so important to the software development process?
Yeah . So if you think back, like a decade or two ago, and, you know, probably aging myself here a little bit, but when you had an update that was maybe from Microsoft, you would get your disk and put it in your system, and that was done maybe once a year or once every other year. You would do updates, the code was being written at the source code by a developer, then the binary and open source packaging came into play. You saw an acceleration in the development of software, the importance of the binary. This created opportunity to do several updates. In some cases, we have customers that are doing thousands of updates a month, and it's all because of the binary. The binary that sits in the wild that you bring into your organization.
This is accelerated software development. It's become critical to the software development life cycle. So for us, this is the asset that we protect and what we manage, and this is where JFrog becomes critical as software development and the automation process, and as that scales across your organization, companies such as JFrog, and we're the leader in that binary management and package management is very critical. This is what's allowed software development to accelerate. This is what's allowed software development now to become automated, and we must secure that as well. So, the binary is critical. It's 80%-90% of the asset, and this is what we protect, and this is the importance of JFrog and why it's so critical to software development.
So how do you think about binary repository as an open source as a customer acquisition mechanism for the business? I mean, that's kind of evolved over the years for you. But yeah, how do you think about the conversion opportunity?
Yeah. So I think where the opportunity lies for JFrog is when the organizations are looking to standardize, and it becomes more of an opportunity around, not just open source, but making sure that you have standardized practices across your organization. This is where JFrog becomes much more relevant for the organization. This is where it's an opportunity where we see the opportunity. It's with these large organizations that are looking to standardize. Maybe if you wanna even jump in here, Jeff.
No, I think that, that you hit it fairly well, Ed. I think that what's changed, Kingsley, is that you're from an era, and you recognize that over the last few years, the developers were driving a lot of decisions, a lot of the processes. And I think within the large organizations, what you're starting to see is more of a top-down in terms of structure of how we will do things within the organization. And I think going back to part of your earlier question, I think why binaries have become maybe more important than they have in the past, is the fact that I think the attack mechanism.
T he attack vector that's being used against organizations today has changed. In the past, you would sit and have someone try to infiltrate your firewall or network security to get to your source code. Now that's fairly well protected, and all I need to do is get to the aspect of your security that's in the wild, which is the binary, by putting you know, malicious package in a repository, having you bring it into the organization, and then deploy it. So I think that organizations are becoming more aware of binaries and the importance of binaries.
I would still point to a study we did recently that stated that I think the C-level and the board feels that about 70%, that they're protected, when it comes to their security within their software development. But then if you ask the developer that's working on it, it's less than 40%. So I still think that there's probably some education to have. You've had incidents like Log4j. You know, CrowdStrike's not really necessarily a binary incident, but it brings attention to the, the risks that an organization can face.
Right. I definitely think that, that points to some of the benefits of, of an Enterprise platform, some of the top-down decision making. So I would just love to hear you walk us through maybe a customer journey from Artifactory expanding into the rest of the JFrog Platform.
Yeah. So we have two deployment mechanisms. We can do self-hosted, and we can do cloud. Our self-hosted, we monetize based on the number of servers, whereas on the cloud, we monetize based on data transfer and storage. Data transfer magnitude of order is much higher. Most of the decisions today coming in, either as new logos, or even expansion opportunities are gonna be cloud. So we're starting to see more opportunity coming in cloud. Cloud today is still about 37% of our business, so there's a big opportunity there in cloud. Typically, what we see from our customers is they'll start, in one organization with a lower package, typically, either in Pro or an entry-level Enterprise package. As they become standardized within that organization, that will scale across the company into multiple organizations.
This is where now you start to see, either in the self-hosted, more servers being added, or in the cloud, you start to see adoption across the organizations, with increases, not only in data consumption, but additional, packages being added on top of that, moving to an E +, where now you have the opportunity, or included in that package, distribution. And in addition to that, you will start to see, as we released in the second half of 2023, security will be added on top of that. So you have your platform for DevOps, and then on top of that, the inclusion of our platform for security.
So we talked a bit about you know the platform idea. How do you think about tool sprawl for customers? On the one hand, you can benefit, create a lot of business value by standardizing on a few platforms. You also have the developers that wanna use really whatever they can get their hands on. How does JFrog help customers with that?
Yeah. Yeah, we still stick with our philosophy of too integrated to fail, meaning that JFrog is the center of the binary management, and on top of that, you can proxy many, many different solutions. So we're agnostic to all of the languages, we're agnostic to the different packages. So the heart of your binary and software development life cycle is going to be JFrog with Artifactory. Now, there's also the full adoption of the platform, and as I mentioned before, 50% of our revenue is coming from E + platform, and only 10% of our customers today are using the full platform. So we're relatively agnostic. We know that at the end of the day, the primary asset is the binary. Therefore, JFrog will benefit regardless of what you're using. When it comes to management of the binary, JFrog will benefit from that.
This is kind of back to a cultural question, but, but how do you, how do you balance the appeal to the software developer, CIO, CISO, you know, both from a product standpoint and then how you go to market?
Yeah, you wanna take that one?
Yeah. I mean, I think the balance there is that JFrog started as part of the developer community. The uptake or the adoption was organically driven from our relationship with the developer community, and we still hold very tightly to that relationship with developers. However, as Ed noted, we've shifted from kind of this inbound, kind of bottoms-up motion to a much more top-down motion. And the reason being is there's a difference in customer that we're engaging with now. We're engaging with very large global organizations who, you know, to your, I think your earlier question there, Kingsley, that, you know, there has been this kind of back and forth, tug and pull between developers wanting the best tools that they think are best to, to test out.
And I think now this standardization process that much larger organizations are trying to go through to better protect themselves and to get better efficiency within their overall development. So I think the balance is that you still maintain the relationship with the developers. I think that's more of the top of the funnel, that you're building your champions within the developer world. We've now then evolved to take those champions with us to the CIO and to the CISO level, to then top down, bring a much broader adoption of JFrog within an organization.
Yep, that, that's really helpful. So if we just think about the binary and the cloud or binary repository management, you know, when would a customer opt for a simpler solution, maybe from an AWS or an Azure? And then, you know, as their needs mature over time, how often are they then coming to JFrog and looking for, you know, the platform?
Yeah. So first off, you know, the different approaches here, we have a much deeper technology stack than your basic repository. So there are instances where, you know, smaller organizations that are maybe using one, two, or three languages might look to the hyperscalers for a binary repository solution. We just don't compete in that area. Where we really find value is where you have a large organization that is using multiple languages, that needs to standardize across that organization, looking to automate and secure. Really, and I'm gonna emphasize secure, having the security product on top of our platform is critical.
The hyperscalers themselves don't have that level of security, and they don't have the deep technology stack that we have. So there might be some smaller customers that are looking to use a basic repository service, and in those cases, we don't necessarily compete. Although we don't see many of the hyperscalers today, and when we're going through the quoting process.
Yeah, I would say, I think Ed stated it well. The KPIs for the hyperscalers, particularly, Kingsley, are different. They, they want traffic, right? So the depth of their solution going into binaries is not gonna be that deep. They just want what binaries offer: very large data movements, and that's the KPI for them. I think to Ed's point, there is going to be a portion of the market that we just, at least today, we can't focus on because the need for automation may not be met by what the customer's doing. So if you're a smaller shop and you're programming on only a few, you know, core languages, you may not need us. An open source alternative may be better. Maybe you work first initially with a Sonatype as you're building up your muscle motion and your expertise and your software development.
However, over time, as these corporations and Enterprises grow, their expertise in software development grows, and the need for automation becomes greater. That's when JFrog is able to then deploy, you know, our solution and often replace a company like Sonatype, who's a competitor we see often at presale deals, in terms of solution that customers may turn to initially, before coming to JFrog.
So I want to return to the business momentum for a moment. You know, you talked about you're seeing sort of delays in terms of cloud transitions some pauses, and you're also seeing for some of those customers that are on-premise, that they're delaying spending more on-premise as they contemplate that eventual shift. So, just any more color on how those conversations go and, how much that tenor has changed over the past couple months?
Yeah. Yeah, so the conversations have actually gone relatively well, and what we saw actually towards the end of Q2 was that the decisions were being paused, basically because of some really rigid procurement processes. So we got through the technical gate, we got through the finance gate in terms of the pricing, we got through the legal gate in terms of those negotiations from a legal perspective, and 99% of the time, we know that we can close that deal. What happened during Q2 was we then saw this unique kind of procurement gate that we hadn't experienced before, where they're asking us to do or to accept some unreasonable terms, price caps, for example, that we hadn't seen before.
Now, what we know is that there is critical need for JFrog, and that we, we're still remain on the roadmap. The discussions have been very positive. It was the right decision for us to pause those discussions at the time, at the end of Q2. The decision to stay with JFrog, and if you look at our gross retention rate, we're at 97%, so we're not seeing customers necessarily leave. The other part of the discussion is that they're not reducing the budgets. What they are talking about is the decision around making the purchase, and today, t hese customers are with JFrog. They sit on self-hosted, as we talked about, so they're using JFrog. It's a matter of when and the timing of when they wanna move to those cloud instances.
It's a lot of resources to be able to move to the cloud, and also not only from a dollars perspective, but from a headcount perspective. So, there's a heavy lift in terms of the workload to be able to do that. Those decisions are easy to pause when you already are using JFrog. Now, the problem is, as they sit in self-hosted, we're calling this kind of a black kind of like a dead zone, they're not expanding in terms of their usage in self-hosted, so they're not buying additional servers. So you're seeing a kind of a twofold problem here.
You're not getting customers to move from self-hosted to cloud, which, when we see a movement from a self-hosted instance to cloud, we see anywhere from 20%-80% uplift in that spend during the first year, and then it continues to grow from there based on the monetization. But you're also seeing then, you know, no movement in terms of self-hosted server purchases as well. But the conversations are still going well. The need is still there. It's just, what we believe, a temporary pause, and then eventually when hopefully, market and some of these uncertain factors start to subside, we'll start to see those large projects moving back into the pipeline.
I f there's a case of you've passed three gates, you're at the final gate , and they're pausing, the idea is that, that that's a quick fix or it can be fixed quickly?
Absolutely. Absolutely. So what we've done in terms of our pipeline, our philosophy, as I mentioned, hasn't changed. We're still, you know, the way that we manage our beat and raise, the way that we manage our guidance still remains intact. The way that we're looking at our pipeline, in particular to the construct of the deals that we saw during the end of the quarter, has changed. So we've added an additional layer, and that is the procurement layer, making sure that we've got through that procurement type gate. And once we know that we've passed that gate, then we have a much higher level of confidence that those will come back in. And again, you know, to your point, Kingsley, we are seeing those deals, i t's just a matter of timing and a temporary pause t hose will come back to us eventually.
I'll just add quickly, Kingsley. I wanna emphasize some things that Ed said there. So in the four years as a public company that we operated, a technical win was the line in the sand for when the customer would then migrate when they stated they would. That changed for us in the last three days of the quarter. And now, maybe the change is because we're moving into a new league, moving into deal sizes we haven't seen before, and we're being taught a lesson about what the rules of the road are. We're stepping back to assess that and try to better understand what may be happening.
Maybe it's a one-off, maybe it's not, but I think that change has caused us to then reevaluate and de-risk going forward some of these similar types of deals, given that this is a change that we've not seen before, and I think it would be disingenuous and not prudent for us to then come up here and say, "Hey, we saw a change that's changed something the way the deals were done or handled. And don't worry, everything's still the same." I think right now, what we're trying to assess is: Have we moved into a new realm where there's going to have to be new segmentation of our pipeline?
Yeah. And just to reiterate as well, you feel good about where you've de-risked the numbers at this point?
Yeah, we feel very good about it.
Taking a conservative approach , that's great to hear.
Absolutely.
So look, there's been some takeout speculation for some other peers in developer software space. That's obviously not part of your business plan, but I think, as an analyst, it helps limit downside if you have great Rule of 40 plus metrics that PE sponsors love, and then you have these software supply chain capabilities that have so much strategic value in the tech ecosystem. So, I mean, how do you think about the strategic value that you have as JFrog?
Yeah, so first off, we don't speculate. You know, there's a lot, the DevOps landscape is certainly shifting, and we can't ignore that. We see this with HashiCorp. We're seeing it now with GitLab and some of the things that are being said around GitLab. I think that it's pretty clear Datadog is out of the picture in terms of the GitLab acquisition. They've partnered up, obviously, with 16% of the business being or 16% of their market cap is with Google, so I think that there's, you know, certainly some alignment there and maybe a takeout from Google. We'll see. Then again, it's all speculation. What I'm focused on right now is just around execution of our strategy, and I think everything else will kind of fall into place there. So I see the value that JFrog brings. Our customers tell us the value that JFrog brings, and as long as we continue to focus on execution, I think everything else will kind of fall into place.
Well said. So we have a couple of minutes left. I just wanna check to see if there's any questions in the audience? Sure.
Can you just put more color on the strategic value of your, of your positioning? What, what is it?
Yeah. You wanna start?
Let me try to help you with that. What's unique about it is that we protect a certain asset, okay? Historically, the main asset that was protected and that drove software development in the old type of development world was source code, and that's been where things started. The genesis of development started in source code, and so thus, a lot of the emphasis, investment, and technology has always been within the source code. I think that what we're trying to say is that software development has changed, and now speed and security are the key aspect of what you need. The strategic value of JFrog is that the source code is still very important, and you're gonna have leaders in that area, and that's a key aspect of the software development process. They will have a platform that will work in that area.
You're gonna have key leaders in the observability and the runtime, and they're going to have a platform, and they're going to help develop in that area. We then control the middle, which is the zeros and ones, the automation, the machine language of the binaries, which has been very much kind of not taken, I wouldn't say taken for granted, but if I was to do an old update, you know, dating me back as well with Ed, to, like, the ASR 9000 for Cisco, they did one update a year. So I could sit in a room with you guys and say: Hey, okay, I just did the source code. I'm about ready to hit compile, grab the binary from file store. You know, we're probably using one binary, and it was such a manual process. We are now at an automated process, and that's what JFrog has changed, is that the velocity of software development can increase dramatically with the use of open-source packages, and that becomes a strategic asset that we are managing.
Yeah. Last question. Look, you've been performing well in the face of macro challenges. You put out a long-term target, I think, around a year and a half ago. Some analysts have pointed out that there's a minor re-acceleration contemplated in the revenue guide, but I guess as we're evaluating, you know, the state of macro, and we head up to the Analyst Day , what should we expect from the Analyst Day, and, any thoughts on that, those targets?
Yeah. So I'll take the targets, and Jeff can talk about the Analyst Day that we're planning. But from a target perspective, what we see is that, you know, we had 25% year-over-year growth in 2023. With the current guide, we're at 21% for 2024. So I look at the compounded annual growth rate, I'm still right in the middle of my long-term model. I also see internally the proof points and some of the efforts that we're doing around the full platform and the amount of pipeline that we're building in terms of migrations to the cloud and, on top of that, security. These were the three legs of the stool that are driving our long-term model, and we're seeing momentum in that. We're very pleased with the steps that we've taken internally.
Now, we've got to give the proof points externally. But the third point also is that the tailwind that we're seeing potentially from AI and generative AI is not baked into this model, and we'll see what happens, right? At this point, we don't know. It's too early to see what type of benefit we'll get from AI, but the whole theory of, you know, driving more source code leads to the more binary, we believe that will be a tailwind for us, and it's not contemplated in our long-term model yet.
Just quickly, won't be an Analyst Day. It's going to be a Q&A recap of SwampUP, but we are going to likely have an Analyst Day in 2025 because I do think it's time that we sit back down with the Street. We owe some answers about where some things may develop and begin to emerge with our business, with various partnerships, acquisitions, and security. So I think we will be hosting more of a true Analyst Day as we move into 2025, but I would look at SwampUP as an opportunity to stop listening to Ed and myself, we're boring, and come talk to our customers and hear what they have to say about JFrog.