Okay, thank you. Everybody, I'm Andrew Sherman, Software Analyst at TD Cowen. Pleased to have Jeff Schreiner, Head of IR at JFrog. Thank you for being here.
Thank you for having us.
A quick mention for Exel II. We appreciate your vote if you think we've earned it. Thank you very much. It's been a busy past year for JFrog. Let's just recap the quarter, which was a good one, and some new, interesting stuff going on. The overconsumption, I think, was probably the most interesting thing to see. What kind of drove that? It sounded like there was some developer activity that picked up, some AI benefit contributions starting to maybe kick in. I know we're not extrapolating that, but maybe just talk about what drove that overconsumption and can that continue.
Sure. So you're right. In the first quarter, we saw good usage amongst our customers. It was broad-based and linear in the quarter. It was something that certainly Ed and myself had not expected to occur. It also occurred in one of our, I would say, more seasonally weak quarters. That was a surprise as well. What we believe, or what we've been able to attribute to so far, is that this was likely experimentation by developers trying to become more innovative, starting to look at AI and MLOps or large language models. Why do we say that? On a quarter-to-quarter basis, again, coming from a small base, the largest package increase that we saw as it contributed to the overages were Hugging Face, Python, and Docker.
If you triangulate those three, and you can always come to a lot of assumptions through triangulation, you could assume that that was, in fact, what they were doing, was experimenting with AI and LLMs. Now, does this continue? We will have to see. We do not think it is a trend yet. It has only been one quarter. Certainly, the procurement and finance departments have not equaled that type of enthusiasm seen by the developer. Thus, we are cautious given the fact that this could easily see a spike in usage and then have, because of the procurement and finance organizations, a move back to the committed level for the rest of the year. We will have to see how things play out in Q2, but that is what we saw in Q1.
That's great. Kind of the last year, there was kind of a thesis that, oh, more code generated by machines would mean more binaries by default and more data transfer. When can this start to show up in the model? When do you think we kind of, is this potentially the start of that, or are we not quite there yet? Is this more?
I don't think we're there yet. I think everyone may have their own opinion. My own personal opinion, this is Jeff Schreiner's opinion, is that that thesis that was kind of created on the street that you generate code, you generate binaries, more code, more binaries, I think that that's something that more occurs when the machines move left and start generating more of the source code, because you can believe that a machine is going to be inherently more productive than a human. I do think that the human developer is going to become more effective and maybe more productive, but maybe not to the same level that you would see the volume throughput of source code with a machine doing that.
Okay, great. The other interesting dynamic in the quarter was a large AI-native customer win to manage all of their AI models and potentially another use case as well. Maybe just talk about what drove that win. What are they using right now and what could they use eventually?
Yeah, so we were happy to announce that we had won one of the top three native AI companies that you guys are all very familiar with. It was a displacement. They had been using kind of a hodgepodge of three smaller private solutions to try to make the management of their binaries work. They, in fact, approached us and had come to us and asked us to help start managing their binaries in a more effective, more scalable way. In that sense, they landed with what was a six-figure contract. A land for us of that nature is unique. It is something we've been trying to point you guys to, that the new lands we're targeting are of higher quality than maybe we would have seen in the past. What they're doing today is that they're utilizing Artifactory in a way that we would all expect.
They're typically bringing in just various packages, scanning those packages, storing them. Down the road, this could be very meaningful if we're able to continue to retain and win at this customer and the fact that they are starting to do things with Artifactory that we had never thought of yet, given AI. One of those things that they're considering is creating a data center and hosting models and training models and building models and creating a new business model called a model as a service. Company A would have an agent at their organization, and Company A could say, I want model X, I want model Y, I want model Z. They could download those, and they'd be continuously updated, continuously secured.
That would be something that they're looking to do that would be of great benefit to JFrog if we're able to accomplish that with them.
Wow, very exciting. Since last year, new guidance philosophy after Q2, more conservative approach versus the past. Your guidance this year was 18%. You just did 22%. You seem to have built this kind of track record the past three quarters. Talk about how you construct guidance now versus the past and why that's more conservative.
Yeah, so I think it's more so of the fact that we felt some pain. It was brought on about by something that occurred that we had not expected to occur. When I joined the company back 3+ years , a mega deal was a six-figure deal. Those could be pushed and pulled and maybe moved around if something happened. Typically, we'd always had that when contracts had been signed and approved, things went into the process as they were expected. Last year in Q2, we had an incident where we acquired a company. We reiterated our guidance for the quarter at the end of the quarter with a few days left.
Because of that, we had a customer at the time who was going to be our largest customer kind of use that against us and come to us and say, hey, we would like price caps if you'd like this to close in June, knowing that that was going to be an important contract. Obviously, we were not going to bend the knee. We closed that contract a few weeks later at a higher value, but that caused us some distress with investors because of the issuance of guidance and the fact that then we had to lower afterwards. Thus, what we wanted to do was better protect the investors given the change of the business. We're now seeing much larger deals. Deals that we call mega deals could be eight figures in size in some cases. We're dealing with cloud migration, security, broader adoption of JFrog.
What we want to do with those are continue to build those and let those organically develop and become ready when they're ready, not necessarily when we think they're going to be ready. What that does is it takes it out of the guidance, those types of deals, and they will hit opportunistically as they hit so that we do not have the same type of experience of having a customer say that they're going to do something in Q3, macro changes, they move it to Q4. No real change for JFrog overall, but obviously that changes the dynamics of Wall Street and how the street looks at the business.
Yeah, perfect. Maybe you have more visibility now because of some of these multi-year deals and your cloud revenue, I think 80% is on annual deals. It is not pure usage, it is eradicable.
Correct. We're different than other usage companies in that they are pure usage, meaning what I use that month is what I'm going to pay you for. Whereas we offer something different and we think it's unique in the sense that we'll give you the benefit for a pricing aspect if you're willing to commit to us the amount of usage that you will use on a use-it-or-lose-it basis. Those contracts now have been evolved, as you said, Andrew, 80% + or more are now annual, but they also have a monthly aspect to them in terms of the use-it-or-lose-it. That's how we've changed and evolved to bring more visibility not only to JFrog, but also to the customer and what value they're extracting right away by utilizing JFrog.
Yeah, wow. The big deals last year kind of showed, and you just mentioned some eight-figure deals. It is an important point that certainly in the time you have been with the company, but even longer than that, you are knocking down some really big deals now. What has kind of driven those deal sizes up over time? A lot of it is with existing customers. Maybe they are adding security. A lot of it sounds like last year security was a big part of some of those deals. Maybe talk about how you are kind of penetrating the CIO and CISO office and budget more so.
Yeah, I mean, if you think about it, you could see deals in the past. We had seven-figure type deals that were pretty much DevOps only, meaning I'm migrating over, I'm expanding, taking on more Artifactory, migrating to the cloud, thus monetizing immediately when I start to utilize the data transfers. I think that what's changed, to your point, Andrew, is security. Security in itself can be a seven-figure or larger type deal given how much they maybe adopt in year one. Then there's step-ups in adoption in those multi-year contracts that you talked about. I think that security has been the big change in terms of the deal size for us. That's a new opportunity that just came around in 2024.
Yeah, wow. In that security theme, you gave us numbers last Q4, 5% of ARR, 12% of RPO, 250 customers. Great start. Great to have those numbers. Talk about how that pipeline can kind of build this year. There's a lot of customers that are maybe using it, but on intro pricing. Maybe talk about how those renewals can go this year and kind of drive that line higher.
Yeah, certainly. I mean, we have, as you said, 250 customers. We have some we've already moved. Some of those, obviously, you saw last year, a handful of those guys moved and some of those large deals. We think other of those customers are going to start analyzing and looking at their assessment of the introductory pricing, whether JAS or Curation or both, if they're utilizing both of those solutions or something that they want to expand upon.
I don't know exactly off the top of my head exactly how many of those are due this year, but certainly I think as we move through the year, because a lot of this was rolled out at the end of 2023, early 2024, you can think about the fact that as guys came on and started layering this in for introductory prices, that you're going to see that similar type of layering and build as we move through this year and into next.
Great. You guys have talked about security kind of adds this holy grail of the software supply chain, and it was obviously a crucial piece to have. Tying security in with Artifactory as the system of record for the binaries is a big differentiator and allowing you to displace other point tools. Talk about that kind of competitive set, the sales cycle itself and all that.
Yeah, I think that one thing that benefited us in security, I mean, if we were to step back and go back to 2021 when the company acquired Vidoo, there was a lot of pushback. A lot of people were saying, you're a DevOps company. Stick to DevOps. They're security companies. Shlomi and the executive team saw something different. They saw that security was going to be needed on top of DevOps to really bring value to the customer. Thus we created that security product, brought it on board, and basically that value that it brings in terms of the overall customer is that you're basically going to be able to displace all of these different point solutions, all of which may be using different databases. You don't know.
A lot of CISOs are frozen in inaction right now because they don't know what security tool to trust. The consolidation of point tools is something that we think we can benefit from. Curation being kind of outside the developer, allowing a centralized policy of what packages you may bring in, that's kind of protecting the castle. Inside the castle, you have JFrog Advanced Security, which covers the whole software supply chain. You are seeing this secular trend of consolidation of security tools happen, and you are seeing it with the Forrester and Gartners even, where they are talking about no longer doing an AppSec report going forward because they recognize the industry is moving towards platforms. That is what we saw when we acquired Vidoo back in 2021 was more of a platform strategy. I think that that's now starting to unfold.
Excellent. A lot of the other competitor, the point solutions in that market are private equity owned. Who do you kind of see?
They're pretty much all private. The only one that was public had been Black Duck being owned through Synopsys, but they were sold to private equity. You're talking about guys that had great valuations three, four years ago, a lot of cash. We're talking about robust roadmaps and what they were going to do. We hit this funding air pocket. Now a lot of these companies are focused only on one solution. They haven't been able to really expand. There's not a platform there. They've also then just tried to keep cash without burning it given the inability to raise additional funding. I think that that's hampered some of those private companies as it relates to competing against us. That's where a lot of them stand today.
That makes a lot of sense. The go-to-market change over the last few years, moving from bottom-up developer-led sale to top-down enterprise, you've done very well. Clearly, you can see that in the numbers. You report the enterprise plus percent of revenue, which is now well over 50%, I think. Some of that security, but there's also net new logos. I think you have half of the Fortune 500, 83% of the Fortune 100. Is there a big opportunity left on the net new side as well, or the mix of expansion versus net new in that kind of large enterprise and anything else in the enterprise go-to-market motion that you want to call out?
Yeah, I think you're right. It's a difficult shift to move from a bottoms-up developer-led type of sale to moving to the top of the food chain and the C-suite and selling to the CISOs and CIOs of the world. I think we've made that adjustment over the last few years, creating a strategic team in which to go in and work with our customers to help with the expansion. I think that expansion is still a very large driver. It's land and expand is more of the growth. Now, down the road, could there be a difference in that? The new logo opportunity, I think, is there, but I think it's more downstream in SMB and smaller companies who have typically in the past found JFrog to be overkill at the initial stages of their company, moved to JFrog later in life, but maybe not initially.
We think that if there's an ability to come down the road sometime with maybe Artifactory Lite, for lack of a better word, something that could target the SMB market along with the relationship we now have with GitHub, I think that that opens the door for a lot of net new logos that maybe we just weren't exposed to before. That is still on the come and still nothing that's going to drive 2025.
Yeah. Yeah, that makes a lot of sense. Within that half of the Fortune 500 you do not have, what are they using for binary?
Yeah, a lot of them are probably using, some may be using Sonatype, a private competitor that people have chosen in lieu of going to JFrog initially. They have problems, unfortunately, though, being primarily self-hosted based. If you want to go to the cloud, you're not really able to do that with them. There are some other small cloud players and smaller open-source solutions that only support maybe one or two languages. If that's all you need, that may be good enough. There is also kind of a homegrown, as we saw at this large native AI customer, of guys trying to piece work this together and make kind of a solution internally that manages the binaries for them. Those often work to a certain level and then hit scalability issues. Binaries are still very new.
I think that what I've seen in the three years I've been here, the importance of binaries have grown. I think the reason for that is that the sophistication of software development across all organizations is starting to become greater. I think the greater the sophistication you have in your software development, the more important binaries become.
Right. Right. You've given examples in the past, like at your last analyst day, which was a few years ago, a couple of years ago, but companies that release software potentially thousands of times a day or a week and have tens of thousands of developers, that's where you really need an enterprise scalable platform like.
Certainly. Yeah. I mean, at that level, right, you're talking about when monolithic software was created, I always go back to my days on the sell side. You look at Cisco's ASR 9000, their flagship router. They updated that once a year. Basically the whole year I could sit around, you and I, Andrew, could sit at a table, I could say, "All right, it's time to compile the binaries, Andrew. Grab them from File Store, bring them on." We did one release. That release ended up probably needing patches even after it was released. Now, as you said, we have customers that are releasing thousands of updates a day. To do that speed and scale and still have the security needed to do that and trust that, that's what JFrog brings to organizations.
Wow. You mentioned the GitHub partnership, which was really interesting last year, probably about a year ago this time, roughly. You have 70% customer overlap. There's now a seamless integration that GitHub customer can kind of just add on JFrog kind of thing. Have you seen that? Kind of talk about what that meant for you strategically and over the past year, kind of how that has driven more new customers. What's the feedback been? Where does this partnership go over the next couple of years?
Yeah. This partnership with GitHub was created actually by a push by our customers saying, "Look, we've invested in both JFrog and GitHub for probably the next 3+ more years. We'd like to see you guys get closer together and create some additional value through integration." Some of that integration has been at the API level. Some of that integration now is at the security level to where you could essentially take a GitHub Advanced Security for source code, a JFrog Advanced Security for software supply chain, replace maybe up to eight tools in that whole process, but then you'll run it on one screen as if it's only one tool. All vulnerabilities, all remediation will be done as one tool.
I think one thing that the team would point to that's changed is the discussions we have with investors and analysts like yourself, Andrew, in the sense that no longer are people talking about the Git guys moving right and taking out JFrog and that that would be very easy. They're talking about the importance of best of breed with the best of breed of source code in GitHub and the best of breed of JFrog and combining. I think today it's hard for us to point exactly at something and say, "That's a dollar from GitHub." I think as I talked about earlier, if we're able to move downstream and bring on a lot more new logos of earlier stage companies, that might be able to better equate dollars to.
I think there probably will be some opportunity to call out to you guys that, "Hey, some security wins here and there." They were tied to the fact that the customer liked the integration of GitHub and JFrog. I think overall it's just been a very strategic partnership among Shlomi and Thomas to show that there's a core commitment between the two companies to drive their future roadmaps.
Right. Could this kind of have a joint go-to-market sell at some point, or is it not quite there yet?
We're not quite there yet. Why aren't we there yet? Shlomi is the head of a company. Thomas is the head of an organization inside a company. This close CEO relationship that they have, and they spend a lot of time talking to each other regularly, is more so what Thomas can do with GitHub. That today is co-marketing and co-engineering. To the extent that this was to take the next step, which would be a co-sell and open up the thousands of sellers that are within the Microsoft organization, that would be a decision for Satya to make. What we're going to need to do is really demonstrate a value created that would get up to the level of Satya to say, "I'm missing something here and my reps really need to take notice of this.
Okay. Interesting. Enterprise plus tier, now 55% of revenue. That's grown from 35% two years ago. It's really gone up a lot over the past five years. How have you managed to get customers to continue to upgrade tiers and kind of what's the right ballpark level for that at the end state? Yeah, talk about how those customers have expanded.
Sure. You know that's 55% of our revenues from roughly 10% or less of our customer base. Now, I don't think I'm not going to sit here and tell you, Andrew, that every JFrog customer could be E plus. They may not need that. They may go to Enterprise X. That may be enough for them in the enterprise solution. What we're seeing is that the driver today of why I moved to enterprise plus is distribution, primarily internal distribution amongst campuses, data centers, what have you. I think, however, there's new pull, right? There's the pull of security. There's the pull of MLOps that may make you move up the overall supply chain. I think what we're trying to do is continually go out and evolve and change the strategy.
You've seen us change the offerings recently in terms of basically starting now every basic package has Xray. So you're starting to take security in right away when you sign up with JFrog. And I think we're looking at those aspects of ways to drive maybe kind of the upsell of a higher subscription tier.
Yeah. That's great. Cloud migrations. You have 7,000 customers. About half are in the cloud. How big of a driver is cloud migrations and what have you seen lately on those trends? I know you're not assuming a lot of big migrations in guidance, but talk about the trends over the past couple of years for the migrations themselves and how enterprises are managing that.
Yeah. Within cloud, I think there are two kind of key growth drivers for us. It could be either consumption or it could be migration. And 2022 was probably the last year that consumption was the real driver of those two. It has been much more migration. One being that in the first year that you migrate with us, there is a 20%-80% average uplift. Some of that is from taking on more JFrog. Some of that is also from the fact that you are now moving to the cloud and the monetization there is more immediate than it would be in the self-hosted side. I think that we feel that there is still a large portion of our large, meaning that 60% of our revenue is still coming from self-hosted. We think that a lot of that revenue could move over to cloud eventually.
There will be some people, I think, due to regulations and other factors that will stay self-hosted and always remain certain parts of their business in self-hosted. We think a lot of that self-hosted business over time can shift and migrate to the cloud.
Right. That brings with it higher net retention.
It brings with it, I think, better economics in terms of the thing I always like to use for people to help them understand that kind of uplift and why it can be so variable is that if I was a customer of JFrog using self-hosted and I utilized a server from 20% - 80%, that's a lot of value pull that I took. JFrog, if you didn't buy the next server, wouldn't necessarily see that. If I move it over to the cloud, JFrog sees that immediate monetization. Now the customer benefits from having us manage their software. They can focus on what they're doing. They're removing the TCO of having the internal team managing the cloud and all the aspects of the software development. There are benefits for us as JFrog as the provider of the technology, but certainly the user benefits as well.
The speed and the ability to globally connect all of your development organizations benefits much more on the cloud.
Right. The go-to-market and sales organization itself has felt fairly stable, both the people and just kind of your level of hiring over time. There just has not been that many changes, which is generally a good thing. How do you feel about where you stand? The sales capacity you have, are you growing that or is it just stable? Anything else on the go-to-market front that you are kind of tweaking or improving?
I think that where we're seeing probably on the sales organization a need and where we're focusing is probably on the support side, solutions engineering support. I think as you noted, the kind of core sales team within that strategic sales group that we created has been doing a great job of continuing to move upstream, upsizing the deal. I think a lot of the key aspect of retaining customers and what we do well there is the support aspect. Our support structure is very strong. I think that's an area that we're looking to add. I think maybe to some extent, making investments today for the future, nothing in 2025, maybe not even in 2026, but looking at ways as well to start targeting the S&B as budgets maybe return there over the coming years.
Yeah. That's great. Your long-term 2027 targets were issued years ago, I think.
2023.
2023. Yeah. Maybe just talk about those and kind of where we stand today and what I think there might be an update later this year. Anything you want to talk about on those?
Yeah. Since we released the model in May of 2023, we've met or exceeded all the metrics on that. We're now in the third year of the five-year kind of kegger that we talked about. We've done well on some of the metrics such as EBIT margin and free cash flow margin. We've stayed within line on the revenue side. As you noted, we would like to possibly provide an update to the investment community with two years left in that kind of strategic model as to where we see it, where it may have been updated since its original issuance. That's something we may do at swampUP. However, we'll have to see how this year plays out as well because I think this year we have a conservative guidance stance, but we still grew in line with the model in Q1 in terms of the revenue growth rate.
It is something that we feel has really helped focus investors on what we are driving, which is profitable growth and Rule of 40 being a kind of North Star for the company. Yeah, as you noted, we will try to provide an update maybe either later this year or at some point.
That's great. Anything in the near-term macro that you've noticed among your customer base? It's been a turbulent few months, but maybe there's a disconnect between what corporate America and Wall Street sees or thinks. What have you seen just from a macro kind of high-level budget perspective and willingness for customers to actually sign deals in the quarter? Certainly, I don't think you said there was much of an impact, but.
I haven't seen it yet, but we think that it's certainly out there. There was obviously in our mind incremental uncertainty from when we guided you guys originally in February, and we took additional caution in the full-year guidance by not flowing through the full beat in Q1. Look, in the last eight to nine months, I think there's been a big disconnect between how corporate America feels and maybe how people on Wall Street and in the markets feel. I think it's still a very tough environment, very focused on budgets right now. That is why, going back to the original commentary and the first question about overages, we feel that budgets may not be there yet to continue this trend. It's still an environment. We're not back into 2020 to 2022 where it was, "Hey, I burned through this $500,000.
I need another $500,000. It's much more of a, "Here's your $1,000,000. Don't call me again." They've kind of been forced to find this religion in terms of discipline and spending and what have you. I think that that's changed and that hasn't really changed. I think that there's just a continued focus right now on the spending side and how they're allocating their budgets.
Yeah. Maybe just touch on the ROI from JFrog. I do not think I have ever heard from a customer partner that JFrog is viewed as overly expensive for what it is, which is a good place to be. Maybe just talk about any examples of the ROI a customer can get with it.
I think we ran a, I think it was a Forrester study. I believe it might be on our side or you can find it a year or two back that talked about a 300%+ ROI over a certain timeframe and utilizing JFrog. I know others have talked about that as well. I think it depends on your customer. I think a lot of customers feel that they are getting a great value from JFrog, especially on the self-hosted side, certainly feel that they're getting a lot of value for what they're ending up paying JFrog. I think that what customers see is that the efficiency that the Artifactory can bring as a single source of truth in the organization creates opportunity to drive that ROI.
Yeah. That's great. Any questions from the audience? One thing that was interesting that you've talked about over the years is just how the importance of binaries has grown and is kind of your core competitive advantage and how difficult that was to build and that those are where they're being attacked in a lot of these high-profile hacks. Just talk about that dynamic and the perception of your core competitive advantage over time and how you've kind of proven that that is the case.
Yeah. I think that binaries have become important to your point, Andrew, because they're now the center of the attack vector. Ten years ago, Vlad would sit in Eastern Europe and spend a year, 18 months, try to hack my firewall, get to my source code. Now all he needs to do is put in a malicious package in an NPM repository, have you download that, put it out into production, and now he's in. Because it's become a new attack vector and a vector that's much easier to penetrate the organization, that's why binaries have become the focus and even more so to your point, the security of binaries.
Given that an LLM is just another form of a binary, that security aspect is a key, I think, gatekeeper that in monetization that will need to be addressed and secured in order to see the adoption of MLOps really take off across the enterprise.
Perfect. With that, we're out of time. Thank you, Jeff.
Thank you.
Thank you, everybody.