Hey, everybody. My name is Koji Ikeda. I am one of the software analysts here at Bank of America. Welcome to day three of our technology conference. I am absolutely thrilled to have JFrog doing a fireside chat with us. We have the CFO, Ed Grabscheid, and we also have IR, Jeff Schreiner, here. Thank you so much for being here. We appreciate it. I always ask the obligatory introductory comment or question of, you know, what is JFrog? What do you guys do? What problems are you addressing today? What problems are you addressing for the future?
First of all, thank you for having us. It's great to be back here in San Francisco. I see some new faces in the audience here, so I'll give a background of JFrog. JFrog was brought to this world to make developers more efficient. As code, source code becomes a machine language, that's a binary. JFrog manages the binary. Today, we are the only company in the world that has binary and Artifactory as a platform. We also have DevSecOps, which is our security product, and now JFrog ML. Three applications and a platform, only company in the world to be able to do that. We're focused today primarily on managing those assets, ensuring that they are brought into your organization, they are secure, and then they are delivered in the form of an update.
We also will start working in the future with large language models. It's very nascent technology today, but the focus is on delivering value for the AI and large language model world in the future.
You guys dub yourselves as one of the disruptors and protectors of the supply chain of software. What exactly does that mean for being the supply chain of software?
Yeah, the supply chain of software is really the motion of taking a language that's written in source code in English or Spanish or German and putting that into machine language. What is different today than what we saw maybe a decade or two decades ago was the pace of updates. If you recall, maybe if you used Microsoft and you did an update in Microsoft, you would do that once a year or every other year. They would do an update. They can manage that update. Somebody would write the code. They would turn it into a language. They would test it. They'd bring it to market. There might be an error that's found. They would fix that. Maybe six months down the road, they would update that again. Today, updates are being done 10, 20, even 100 times per day.
The pace of those updates, because of open source packages coming into your organization today, source code, let's say 80-90% of that is an open source package. You're only writing 10-20% of your code, but it has to convert into a binary. Software supply chain and the management of that binary was brought to this world because of these open source packages. This is what JFrog does. It manages the process of taking those binaries, those updates, and bringing them through your organization, testing them, securing them, and distributing those binaries, those updates.
When I was preparing for the conference and I was kind of looking at the first quarter, my first quarter result notes, I was kind of reviewing them. I'm like, man, you guys had a pretty good quarter. Tell me a little bit about the quarter. What was kind of the highlights of the quarters? What have investors been kind of asking about the quarter that they've been pointing to from a bull case?
Yeah, Q1 was a culmination of not just one quarter. It was a culmination of many quarters that we built to the results that you saw during Q1. We really saw this transformation that was happening early on where we wanted to penetrate at the C-suite. We saw there was an opportunity to move from a developer sale into the enterprise. We invested heavily two to three years ago with secure, I'm sorry, with enterprise, with strategic sales, with building the infrastructure around that, architects and solution engineers. Now, Q1 is a result of those efforts, the efforts of the acquisition of Vdoo, where we have security and security going from a point solution to a platform and adding that on top of Artifactory. In Q3 of last year, closing three of the largest deals in the history of the company.
Three or four years ago, if we did a $500,000 deal, that was considered a mega deal within JFrog. Today, we've closed deals that are eight figures. We have a customer that's over $30 million on an ACV value. When you say Q1 was a great result, that wasn't because it was just one quarter. These were multiple quarter efforts. We really started to see that momentum happening in Q3 of last year with these large wins with security. If you recall, at the end of 2024, we disclosed the metrics in security. We delivered more than, or we delivered 3% revenue, 5% of ARR, and 12% of our RPO, which is coming from security, where we had essentially zero in the year before. We've really started to penetrate the security budgets as well.
The last piece of what we saw during Q1, which was a bit of a surprise to us, was the amount of usage in our cloud. We have customers that commit to JFrog minimum commitments in data consumption. They may commit to 2 PB, 10 PB, 15 PB, whatever that usage is. We take that revenue radically. When the customer exceeds those minimum commitments in usage, then we have an overage. In 2024, the vast majority of our customers were not spending or using above the minimum commits. In Q1, we had this robust usage across a diverse set of our customers in our portfolio, across multiple geographies, and distributed linearly across all three months of the quarter. This was something that was not expected. It is historically a slow quarter, Q1, as many budgets are being built, as sales kickoffs are happening.
It was a bit of a surprise to us, but it ended up being a great result for JFrog.
I want to focus on the large deals for a second. Just a point of clarification, make sure I heard it right. You said 30, you have customers that are $30 million in size on an ACV basis?
We have one customer that's $30 million in size on an ACV basis.
Wow. Okay. Okay. And then on the cloud usage front, got to ask the question, right?
Yes.
I'm sure you've been getting the question a lot. AI coming into play with that? I mean, is there any sort of, you know, you guys should be a beneficiary of AI driving more binaries, good for JFrog? I mean, I don't want to get ahead of my skis here, but it does feel like, you know, is AI playing into that just a little bit?
We're just, we're going through the circuit this, we were telling you before the fireside chat, how many of the fireside chats we've had. You're not getting ahead of your skis because this is the third question. We typically get it on the first or the second around AI.
I waited a little bit.
Yeah. Let me tell you a little bit about the usage. First off, AI, what we believe and why we're so excited about this opportunity, when you bring a large language model into your organization, it's a binary. We are the company that manages the binaries. We believe we should win this market. We made an acquisition at the end of Q2. We acquired a company called Qwak AI. That is the platform that manages large language models to bring those models into your organization to train, to secure, and distribute large language models. We released the first phase of the product, which is on the cloud in Q1. We're planning to release the self-hosted version at the end of this quarter. Now, what are we seeing? I'll be honest, we're not a company that's going to deliver a message of fluffiness. It's very early.
If we talk about a baseball game, we're singing the national anthem at this point. We're not even exiting the dugout to start playing the game. We see some things that would lead us to believe that there could be a tailwind. The thesis around it is that more binaries means more code means more binaries, and more binaries is going to be beneficial to JFrog. Now, in Q1, during this overusage period, we did track the packages that were being used by the customers. We saw three packages that seemed to have the most significant usage on a sequential basis. That was Docker, Hugging Face, and Python, PyPI. When you think about what the developers are using, you could make some assumptions that there's experimentation that's going on right now with AI.
You mentioned Hugging Face. I believe that's a customer or a relationship that you highlighted on the last quarter call. You mentioned it right there. What's going on with Hugging Face? Why did you guys talk about it so much on the call?
Yeah, sure. I'll take that question, Koji. I think the Hugging Face relationship is unique in the sense that it's a repository for large language models, much in the same fashion that you would garner a repository for NPM Maven on the package side that we've already been doing with Artifactory today. When you look at what we've been doing here, and what was the, I apologize, what was the topic again?
It was the Hugging Face.
Hugging Face. Sorry, I apologize. Guys, long week. I apologize. Hugging Face is a relationship in which they came to us, Koji. They had had another company that was reviewing the repository and securing that repository, but that company had told them that 80+% of the models were malicious. Okay? They asked JFrog to come in and scan those models, and we said that those were false positives. In essence, maybe some of that Hugging Face traffic that Ed had alluded to could be that JFrog customers felt that this was a more secure repository from which they could pull from. The Hugging Face relationship is us supporting the community today and supporting that repository. Obviously, there could be indirect benefits as customers start to utilize that Hugging Face repository and use the proxy function that's within JFrog Artifactory today.
We view that as kind of the first motion of what you're seeing, where the repository is more focused on an LLM than it is on an individual package technology.
I think there's, I'm going to just jump in real quick. I think there was something very important that Jeff mentioned, was that Hugging Face came to us, JFrog, to scan and ensure the confidence that the models that are being stored in Hugging Face to pull into your organization are secure. That brings a lot of confidence to the community that JFrog is the system of record in terms of the scanning and the level of confidence that these models are secure. Even if you're not a customer today of JFrog, you know that JFrog is going to be the system of record in terms of the scanning capabilities.
Therefore, if you're going to bring a large language model, and this is where the intangible benefit that Jeff talked about, and you're going to bring that as a data scientist into your organization, it makes sense to store that in JFrog. We believe that there could be some opportunity coming from that. Today, it's not a monetized relationship. It's a matter of a proxy between similar, like Jeff said, let's say Maven or NPM, but it's a relationship of bringing large language models into your organization through a proxy. We do believe it could create some intangible benefit for us.
Got it. Let's talk about the guidance for a second.
Sure.
You guys, you know, we just talked about big deals. We talked about cloud usage. How does that, I mean, I know. Let's talk about it. We know it's not incorporated into the guide, right? You guys are not including big self-managed migrations to the cloud in the guide, and you're not including usage, upside usage in the guide. Why is that not included in the guide this year?
Yeah. First, let me explain why we chose to do this. I talked a little bit about the transformation of the company four or five years ago when we went public to where it is today. A deal of $500,000, if that deal pushed out, I could pull two or three deals from an out quarter into the quarter, and it did not have a significant impact on my revenue. Today, when I take an eight-figure deal, and that deal, because of the complexity of the deal, if I forecast for that deal to happen in a quarter and it pushes out, I do not have tens of deals that I can pull into the quarter to backfill that push.
What we see with these large complex deals that you're talking about that are a migration, that have security elements on top of it, it's not a matter of if, but a matter of when. We must be patient. We saw this in Q2 of last year, where we had forecasted a deal that was 99% of the time would close. It did not. It had a significant impact to our ability to overachieve on the revenue side. Therefore, we took a very cautious approach by de-risking those deals and allowing those deals to mature and then come in as upside potential. The second piece is the usage. Why do we not include the usage? We saw this in Q1. The usage created a tailwind for us.
It created a significant outperformance in our revenue, but they can turn it off as well very quickly because it is not a commitment. Today, we have a bit of a disconnect between the developer that's been pushed to innovate, to bring in new technology, and the other side, my office of the CFO and procurement that's saying, "Hold on, I don't necessarily have the budget yet. Let's maybe ratchet down the usage until we can secure the budget." Those discussions right now are a bit of a tug of war. Innovation that's happening, budgets, and a very tight, rigid purchasing environment that's pushing back. It doesn't make sense for us to put that type of assumption into our guidance. We exclude that. The last piece is, as we stepped into Q2, coming off of our guidance in February, it became incrementally uncertain.
The market changed. You had tariffs on, tariffs not, the Liberation Day. There were all kinds of things that were happening. We had to take a more cautious approach, and we balanced the overperformance in Q1 with our prudence. This is why we took a more conservative approach going forward. We believe that that's the best approach, not only for us, but for investors and shareholders.
I'm going to try. It is June. You know, it's been a while since you guys reported any sort of update in the demand environment you could share with us.
It's worth the effort to try because you will never know unless you try. No, I will provide an update after we close Q2.
I tried.
Yeah.
Competition, wanted to ask you a bit about that. You guys are, we consider you guys next generation. But JFrog is not new. You guys were made last year, year before, you know, five years. You've been around. Whenever we do our checks, it seems like the pool of competition is quite small for you guys. You guys are one of the disruptors and leaders there. Why hasn't another competitor emerged? What is it about the category that is difficult?
Yeah. That's a great question. Let me give the competitor landscape first, and then we can talk about the differentiators. We are the only publicly traded company in that DevOps binary management tool infrastructure space. The closest competitor is a private company, PE-backed company called Sonatype. We also compete with a very, very small startup that is a cloud-native tool. We do not see them often, not even worth mentioning the name, but they are sub $10 million. We have seen them kind of pop up. We are not naive to think that, you know, somebody could come into that market. We also have the hyperscalers. They offer some type of container registry, very basic container registry technology as well. What is the differentiator for JFrog and how have we built the moat and actually probably widened the moat is through our technology and the number of languages we support.
We have a very deep technology stack in terms of the languages that we support, the security elements. At the end of the day, when you own the most critical asset, which is the binary, so JFrog owns that binary, it's being stored with Artifactory, you are the company that can secure that asset as well. Now we've created a differentiator with our platform in security. Point solutions today cannot operate on the security of binaries without having a proxy to JFrog. We want to please the community and continue to delight the community. Therefore, you maintain those relationships, but essentially you could cut them off. You could cut the oxygen off to these point solutions. We choose not to do that, but most customers see advantage to two things: consolidation and to secure the most critical asset, which is your binary.
As we continue to add more technology like MLOps, that moat becomes deeper and wider.
Can I just add quickly, Koji, I think on your question about why there haven't been more, this is a fairly new technology. I think the, you know, in the time that I've been at JFrog now almost, you know, over three years, I think the importance of the binary has grown. I think part of that is that it's taken time to get to a level of sophistication in software development where individuals that are working on this technology are realizing the importance of the binary asset. I think that's the unique part because I think binaries are the newest form of the software development, software supply chain. Git's been there. Observability production environments have been there. This is kind of a new aspect to the whole development process.
You mentioned two things in your answer there that I wanted to touch upon. One, MLOps. But two, you mentioned the hyperscalers and container registry. And so, you know, maybe good knowledge for me. I just kind of want to understand when we think about the hyperscalers, do customers sometimes start with the hyperscaler option and then eventually graduate to JFrog, or do they start with JFrog from the beginning and the ones that are on that container registry from an AWS or a hyperscaler, they just kind of stick with it over time?
Yeah. Yeah, we do not necessarily see migrations coming from the hyperscalers to JFrog. What we would typically see, if they are sophisticated, they are coming either from a competitor like Sonatype that have scalability issues or want to migrate to the cloud and are unable to do that, or they are coming from a homegrown tool where they have built something to manage their binaries and distribute the binaries. They have a large organization. They are unable to scale on the homegrown tool. They come to an automated tool like JFrog provides. You probably have smaller organizations that are using the hyperscalers for container registry that maybe want to operate on one or two languages. Those are not necessarily the right customers for JFrog.
We'd happily take them, but because of the depth of our technology, the number of languages that we support, the complexities that we support, less sophisticated organizations typically go to the hyperscalers. They have different metrics than us. They're looking at trying to generate as much traffic as possible. By the way, we operate and work on the marketplaces of all three of the hyperscalers, and we work very closely in a partnership with those hyperscalers. They're really looking for traffic. They're not looking to take the business from us, but they would happily bring a customer into their container registry solution if it's a very simple, basic case.
Okay. What's the opportunity with MLOps for you guys? Tell us a little bit about that.
Yeah. I'll start and then Jeff, you can talk about the technology piece.
Sure.
As I mentioned in the beginning, we acquired Qwak AI in Q3 of last year. We saw this as a huge opportunity for JFrog at that time because we said, as this market is shifting more towards large language models, we're creating, there's a new buyer here in the data scientists. The data scientist is now creating these large language models. In order to deploy those large language models, they become a binary. They have to train them, they have to secure them, and they have to deploy them as a binary. We wanted to win that market. We saw it shifting, and we made that acquisition in Q2 of last year. We also saw that we wanted to get ahead of it because we were worried that valuations could change very, very quickly, which they have.
When we did the acquisition, maybe there were questions around it. Why are you doing the acquisition now? We did not get questioned at all around valuation, around the decision to acquire JFrog, I'm sorry, Qwak AI. The last piece of that is we saw an opportunity here with a product that we can integrate into our platform very quickly. Unlike the acquisition we did with Vdoo on the security side, where it took a significant investment in terms of building the application to be a platform and integrate with JFrog, this was a product that we could add to our platform very quickly. As you saw, we released the cloud-native version in Q1, and we're getting ready to release the self-hosted version this quarter. It was the right decision from us, and we believe we should win that based on the binaries.
Yeah. To Ed's point, when we talked about, you know, singing the national anthem as a comparison to the baseball game of where we're at, you know, what we have right now is that a lot of companies are tinkering and experimenting with ML in their organization. Perhaps we think that's some of what we saw in the overusage in Q1. What they would really like to do is look at the various platforms that they could use within their organization. To Ed's point, I think another key aspect there is that within six months, we were able to take this technology and meet the market when it's ready to start utilizing and bringing this into organizations. I would say that we view that there are two gating factors right now before we see mass adoption of this technology across, you know, many enterprises.
That is within the industry determining what the monetization will be, how will JFrog be compensated for the value we provide, and what is the buyer willing to pay for that value. On top of that, given the rapid change, the speed of innovation that you're seeing on the MLSecOps side and what AI can allow that hacker to try to do and bring into the organization, that will be another gating factor to a much more broader adoption. We think that there's people that are working within this today, but I don't think that we're really at a mass scale yet until some of these other broader gating factors are really relieved.
Got it. Maybe a question here on the M&A strategy going forward. I mean, you guys did buy Qwak last year, you bought Vdoo a couple of years ago. I think there's a couple of other acquisitions in between. Keep me honest there. I can't remember. Yeah. How do we think about your M&A strategy going forward?
You know, even before I talk about the M&A strategy, one of the strategies that we have is to focus on delivering free cash flow so that we have the capability of being able to react quickly. We deliver 26% free cash flow margin in Q1. We continue to generate a significant amount of cash. This gives us that flexibility as when to a shift in the market that we can react very quickly and do a transformational or even a tuck-in.
Type M&A acquisition. We continue to focus on that to ensure that we're nimble and agile. We're always looking at the market. I don't know that we'll do something transformational per se, but as we release JFrog ML and customers begin to use the platform, feedback will start to come back to our engineering team. We'll identify if there's holes in the platform and see how we would go and address that. That could be with the tuck-in. Most of the focus today would be on ML and AI, not so much on the security side. We believe we're well positioned in the security side. We've invested heavily in that domain over the last three plus years, and the focus will really be about delivering AI technology.
Let's talk about security for a second. You guys have delivered good revenue from security from essentially zero, right? How do we think about security as a growth vector over the next 12 to 24 months?
It's a big opportunity for us. There's big budgets in security, and we want to continue to penetrate that, but we're still at the early stages of penetration. We have thousands of customers, over 7,000 customers today. We've got more than half of those customers using JFrog Xray, which is our tier zero security product. We have an opportunity to penetrate through those customers that we know today are using Xray. You need to use Xray to be able to use our advanced security products. You know, our focus is on that. We believe we have a long runway. It should be a huge growth driver for us going forward, and we continue to see that as a big piece of our business in the future.
Okay. How do we think about how you're selling security? One of the things that we have often debated within DevOps is the ability for a dev tool to sell into ops or security, a security tool to sell the other way, ops. You get where I'm going with this. How are you selling security?
Yeah, you know, it's interesting. Three years ago, when we started to build our security team, we built a security overlay team. We brought security-based architecture and solution engineers, and we've integrated those into our process. So we have that overlay team. We also saw a shift in the way that the customer is buying. Before you had the DevOps side, you had the CISO and the CIO, two separate budgets. You're now starting to see that come together as a panel. When we sell, it's a matter of selling to a panel. You've got the developer that you're selling to. You've got the CIO and the CISO budget. Those are coming together to make a decision. You have one point of contact in terms of your sales now that is selling an opportunity, the value proposition of JFrog.
The DevOps side, the DevSecOps side brought together as one value.
Got it. Got it. Got about a minute and a half here, and we briefly touched upon free cash flow margins. You talked about how you guys think about free cash flow and M&A, but how do we think about free cash flow overall? I mean, you guys just did 26%. You know, your targets are 26-29%, right? So you're kind of there. How do we think about free cash flow generation and balancing that against growth, growth potential?
Yeah. That's a great point. Balance. I'm going to focus on that word. We've always had a focus on profitability and free cash flow. This was not something that all of a sudden we, you know, this year or last year, we said, "Hey, the shift is going to be now on profitability and free cash flow." That's always been part of our DNA. In fact, you know, three or four years ago, when the focus was around profitable growth and durable growth, we were being questioned about that. Today, there is no question. Companies are focused on profitability. We continue to balance innovation with profitability. I'm not going to spend $3 to earn $1. That's never been part of the way that we operate as a company.
I've been with the company for six years, CFO for one and a half, but that will remain part of my DNA, and we will continue to look at generating value through free cash flow and profitability.
Yeah. I would just add quickly, Koji, we think that as a Rule of 40 that is driving what Ed and I and the management team at JFrog are trying to do, that now that portion of the Rule of 40, a greater portion of that is coming from the free cash flow margin. Thus, that was something that we thought would happen over time a few years back and the focus that we've put on that metric.
Got it. Jeff, Ed, we are all out of time. Thank you so much for doing this. This has been great, fun conversation. Thanks so much for being here.
Thank you.
Thank you for.