Hey, everyone. Thanks for joining. I'm Kingsley Crane. I'm a Software Analyst here at Canaccord Genuity. With me today I have JFrog, I have the CFO Ed Grabscheid and VP of Investor Relations, Jeff Schreiner. Thanks for being here, guys.
Thank you for having us.
Thank you. Let's kick it off. I'd like to start with the recent quarter. You reported some really strong set of results last week. What were the key takeaways for you in terms of customer activity, product traction, macro signals?
Yeah, it was a very strong execution quarter by the team, and because of that we had great results. We saw three areas that really excelled. First is the cloud. Within the cloud, we saw an uptake in security. Many of our customers regarding security will land in the cloud, and we saw significant growth being driven by that activity. The second is usage. Usage was very strong. We saw usage in Q1 that was an acceleration above our minimum commits, and we weren't sure if that was going to be experimental and if that was going to carry forward. We saw a sustained usage carried over from the first quarter into the second quarter. The third piece is being able to convert those customers with usage over the minimum commits to larger annual contracts. We were able to accomplish that during the second quarter.
All of this contributing to a really nice quarter for us and a good setup going into the second half.
Let's talk some products that software development has really transformed over the past two years and continues to do so. Can you tell us why binaries are as important as ever?
Yeah, binary is the primary asset. Everything is becoming critically important because of the binary. What we see is that the way to bring in malicious packages is no longer through source code, it's through binaries. Putting a malicious package into a repository, bringing that through open source into your organization is a vector in which you can attack. We see significant opportunity from the security aspect. Also, models are a binary. The pace in which you do software updates because of the machine language as being a binary and the open source aspect of it is today you're doing the automation and many updates which is being done through the binaries. That's becoming very much an important factor. This is where JFrog excels and we see binaries critical to the software development life cycle.
Right. This is similar, but in terms of tools like GitHub Copilot and Cursor, it's changing how developers are writing code. Are you seeing different expectations for speed or automation within JFrog's platform? Have you just seen an acceleration in code creation in general, and how does that benefit you?
Yeah, yeah. There are a couple benefits that are coming from these code assistance tools. First off, the theme is that more code means more binaries, and more binaries would be a benefit to JFrog. We're still in the very early stages of this code assistance with these applications driving incremental production in terms of software, but we do see some benefit coming from that. As I mentioned during the beginning opening statements, we see some growth in certain packages like Python and Hugging Face, which could indicate at large language models and some experimentation around AI. The second piece is around security. As more code is being created and more packages are coming into your organization, there's an opportunity through curation to manage what is being brought into the organization.
We see curation as being critical to companies in the way that they secure and manage these code assistance tools and what they allow into their organization.
Yeah, just add quickly, Kingsley. I think that the setup now for developer is the IDE, a coding assistant, and a source code management, and the coding assistants are here to stay as part of that development architecture. I think as it relates to JFrog, what you're seeing is an opportunity, as Ed noted, to tie in not only to the system of record in JFrog Artifactory, but also an opportunity for us to help secure the organizations. When you look at curation and the integration of curation with some of these coding assistants, similar to the integration that we already have today with GitHub, I think that these are becoming critical in the overall development process and will certainly start to expedite the production of code over time.
Developers are notoriously finicky in terms of the products and the tools that they like to use. How can you help companies handle tool sprawl? How do you think about, I guess, focusing on different parts of your platform versus partnering with others in the ecosystem? I think you've recently really leaned into partnerships with the likes of GitHub and others.
Let me first start with security. We saw a big opportunity for consolidation and this is where the market was going. Consolidation of tools and minimizing tool sprawl, as he mentioned. We really saw that opportunity open up for security where we offer JFrog Advanced Security, a platform that consolidates seven or eight different technologies, allowing companies to consolidate vendors, eliminate the point solutions, and standardize on JFrog. That's first. In addition to that, you mentioned the partnerships. We see an opportunity to strategically partner with some of the really outstanding companies like GitHub. That's one of them where you now take the best of breed in terms of the source code and you build together with JFrog the best of breed in terms of the binary. You create a single pane of glass which creates visibility.
Being able to go from the source code all the way to production and have remediation all the way back to trace vulnerabilities. We see opportunity not only to develop internally, organically for tool sprawl, but also to do strategic partnerships.
I think Kingsley, you've written about this over the last few years in terms of developers do love their tools. I think in a different world you would have seen the likes of Cursor and Windsurf probably overtaken a lot more of the enterprise today than they have, really seeing a lot of enterprise adoption. Why is that? That's really due to the platformization, the standardization on a few vendors that the industry is now moving towards. That has changed the fact that the developers can love their tools and they certainly do, but the organizations are now much more top down in terms of here's the tools that we will allow you to use within our organization and within the platforms that we have chosen.
Right? Yeah. The good thing is that both can work together even in the enterprise potentially. You spoke into some of this. You have JFrog Advanced Security, you have JFrog Curation, you have MLOps. The platform has really expanded over the past couple years. How has it changed the customer adoption journey, and then how has the spend?
Ceiling grown over time? Yeah, so the platform has evolved quite a bit. I've been in the company six years. When we went public, we talked about creating a platform. We were Artifactory as a point solution, created the platform for Artifactory and we've done exceptionally well in terms of adoption of the platform. It represents 55% of our revenues. It's still around 10% of our customer base. That's the full adoption of the platform. In addition to that, we've expanded through Advanced Security. It's a little different motion today. What you're starting to see, and there was an inflection point in the second half of 2024, customers are looking to take a longer term position with JFrog where we would have annual sales in terms of selling our Artifactory platform. It might be one year with the renewal.
Now we're starting to see customers take a much longer position, two to three years because of security. What we're hearing is that from the CISOs there is no one willing to rip out tools that are working effectively in security, but they're willing to standardize on JFrog. It will take time. If they're going to choose JFrog as their security provider, they're going to do it over a period of time. This is why we're seeing the duration of the contracts going much longer than what we had historically done. That sale in terms of the size of the opportunity and the length of negotiations tends to be a little bit longer, but the outcome is very positive.
You see this in our RPO numbers and the CRPO numbers and in terms of the ASPs are growing because of the change in the go to market regarding the duration of the contract and security on top of that.
We've danced around this a bit in terms of partnerships. I want to just dive a bit deeper into the Hugging Face partnership. JFrog is known as a binary repository, completely synonymous with the market. There's this idea that that might be applicable as well to model registry and just ML artifacts. How early are we in that market life cycle and how well positioned do you think that you are?
Yeah, if we stick to the Hugging Face reference that you mentioned. Hugging Face is a model repository, the leading model repository with over 1.5 million models today. The relationship with JFrog has continued to expand in such a way that we've been trying to work with Hugging Face to help the community and help the community feel comfortable about using repositories. As you quite well listed, Kingsley, these model registries are going to be much like a Maven repository and said I'll be going and grabbing models from these. As it relates to Hugging Face, they had been working with another vendor who had gone through their models and scanned and stated that, sorry guys, about 90% of your models are vulnerable. It's tough. They came to JFrog and asked us to do similar types of scans with our Xray tools and some of our other security offerings.
We found that these were essentially not vulnerabilities that put the models at risk. I think what that did is it helped the community to feel more secure, certainly JFrog customers, knowing that JFrog was helping to secure Hugging Face in hopes to better the community and spur further adoption of the use of large language models and the adoption of repositories for large language models such as Hugging Face.
are some landmark AI partnerships, you also have some key AI customers. Anything else you're excited about either on the partnership front or you can tell us in terms of some of the progress with some of those larger spenders?
I think that on the partnership front, stay tuned. In a few weeks at our user conference, I think there's going to be a lot of new interesting announcements that tie into two of the key partnerships we've talked about. You've heard us talk about obviously GitHub and NVIDIA and where we may be able to go further with those partners. I think that we've always been a company that believes too integrated to fail has been our model, and thus partnerships in a way. Certainly, these more technical or co-marketing partnerships really fit well with JFrog because a lot of these technologies tend to integrate and utilize JFrog in some way.
With AI enabling smaller teams to ship faster, you see a world where JFrog's even more critical to smaller orgs.
Yeah. First of all, we're very much focused on enterprise, but that doesn't mean we ignore smaller companies. We see a lot of value obviously in landing the smaller company because we know that they could be the enterprise, the next enterprise, and grow. The model itself in terms of the platform is probably a little heavier for some of these companies that are small developer shops. With AI and the pace of innovation that will come from AI and having to manage a binary, it will be critically important to have a binary management tool. We believe that AI will open up an opportunity and maybe not all companies will require all the different languages that are being supported in our platform today.
We'll look at maybe like an Artifactory light or some type of product that will support a smaller company, but ensure that as we move into the era of AI, JFrog becomes critically important.
I think this helps us as well. Going back to your question earlier about the sales motion, Kingsley, and the fact that in the instant today, if I found JFrog to be overkill for my small shop, I may go to a competitive solution, but in two to three years find the need for JFrog. As my sophistication has grown, we see the opportunity now to close that gap, that two to three year gap, work with them originally and use that two to three years to hopefully build the relationship with security and MLOps and other products.
I think that to Ed's point, the fact that at some point if we can come in with a tool, Artifactory light for a better word, I think it helps open up a broader aspect of the enterprise market or the SMID market that we haven't had all of the resources to focus on given our focus on the enterprise.
To a generalist software investor, they may look at the business and not understand why there's a mix between self-managed and cloud. In the developer market it makes a ton of sense, and you want to be able to meet customers where they are. In addition to that, we've seen a pretty steady transition towards the cloud. We saw some headwinds in the past year, and now with some of these AI customers, maybe we're thinking that that might be deployed on-premises. Can you just tell us more about that balance between on-premises and cloud, and then just broader trends on the cloud transition?
Yeah, strategically we're focused on driving migrations to the cloud. Our self hosted customers, as we get to a point of renewal, we look at trying to migrate those customers to the cloud. We see better opportunity from a monetization perspective. We have an uplift of anywhere from 20%- 80% on a like for like subscription when you move from self hosted to cloud, and this remains a strategic focus for us. We also know that there's a secular trend and customers will eventually move to the cloud, and we help with different products to ensure that they move there. We don't force the hand, we let that kind of migrate. We know that the capabilities in the cloud and that the standardization across your organization makes a lot of sense and that we own the infrastructure. From a trending and market perspective, we see that shift.
As you alluded to, as you move into the era of AI, there's this potential uncertainty around where are the workloads going to sit. It's a heavy workload, and we're hearing this fit for purpose. These very large organizations that have data centers on site, as they start to figure out and learn about the cost structure and get to a point of predictability around budgets, we may see some customers choose to remain self hosted in this era of AI. The great thing about where we are and where we sit with JFrog is we're hybrid. You can deploy self hosted, but you can also do other capabilities in the cloud like security, for example, or other DevOps related workloads could move to the cloud while you still focus on AI type workloads, large language model workloads as self hosted.
This hybrid motion and this fit for purpose, we're ready for that. We don't know that that's necessarily the direction. We called it out during Q2. The point is, JFrog is ready for that.
We have seen this in prior cycles where the top 10, 15, 20 companies may act quite different than the rest of the market. Not every company is going to have the ability to build their own data center or to pursue that route. I think the cloud still makes a lot of sense for the vast majority of AI companies. I want to open it up to the audience just to make sure. If we have any questions, we'd be happy to take the mic around. Anyone has any. No worries, we can circle back at the end. Let's see. Really strong sequential growth in cloud over these past two quarters. Typically it's been pretty back and loaded, particularly in Q4. How should we expect seasonality to play out this year, especially looking at Q4?
Yeah, so we had a really strong first half. The first half was driven by, as I mentioned, an uptake in security. We saw a strong penetration of our security product. We also saw usage over minimum commit, something that we had not seen for a year. All of a sudden you had this significant usage. We called out specifically two packages, Hugging Face and PyPy Python, which off a small base grew. Now, going into the second half, when you think about my guidance philosophy, I de-risk for the largest deals that we typically see in the back half of the year. This is when budgets start to come together and some of the larger deals will tend to materialize in the second half. It has been de-risked out of my guidance and out of my pipeline.
These are deals that, as a definition, tend to be over $5 million. They have migration and possibly even security added on top of that. Those are being de-risked. Of course, I exclude any usage over minimum commit. I only forecast on what I have committed. I've raised my guidance in terms of cloud. I moved that 34- 36%. Increased our guidance on the cloud based on what we've committed or what we see committed from the customers. We have a good setup, a very responsible setup going into the second half when you start to take out these factors. I believe that as long as we can execute, it can be a strong second half.
It's nice when you can have a great, great first half and still feel comfortable heading into the second half.
Yeah, one thing, unlike maybe 2024, where I had three of the largest deals in the history of the company happen in the second half, and we needed those deals to really secure 2024, 2025 looks a little bit different. I don't have to have those really large deals in order to have a success. I think we've set up a really strong 2025 in the first half, which, you know, now if I was able to see those large deal wins, it's additive rather than needed.
This is a bigger picture financial question. On the one hand, AI talent is notoriously expensive and sometimes it makes me question, you know, what we're doing in our seats when you see those paychecks. On the other hand, software developers are becoming more productive, they're producing more code. You even have some of this digital workforce emerging at the GenAI. In terms of efficiency and R&D spend, how do you balance those within JFrog?
Yeah, yeah. You're talking about something that's happening in the market, this tsunami of innovation that's being driven by the era of AI. We as JFrog as a company see a huge opportunity that we want to win. It's binary, this is creating more binary, it's binary management. We're going to invest in this opportunity, but we're going to be responsible in the way that we invest. We always have. This is part of our DNA. We're going to balance growth, we're going to balance profitability, and we're going to do it in a responsible way. We understand talent is expensive. Investing in next generation technologies is expensive. I've had very attractive margin expansion. I generate significant free cash flow, 29% free cash flow generation over the past four quarters. This gives me the opportunity to reinvest responsibly.
This gives me the opportunity to deploy capital as needed as the market technology shifts are happening. We'll remain disciplined in our approach and we'll remain very operationally efficient. This is how we built the company and that will not change. We recognize that in order to win you have to invest and we'll continue to invest, but in a very responsible way.
The business has been performing really well. There were some headwinds, just general macro headwinds over the past couple years. I think there's a set of long term targets out there that may have been deemphasized. Are you planning to reevaluate those? Is that at the user conference or when could we maybe expect another look at that long term outcome?
Sure, yeah, we're looking at what we've done and especially over the first six months of 2025. I look at the growth, what we put as the growth drivers I've executed in cloud. It's becoming a significant piece of my revenue. I've expanded my platform in terms of the number of million dollar customers, $61 million customers now. Six or seven of those were added in Q2 alone. In terms of security, we broke into the security budgets, we gave the metrics at the end of 2024. We're continuing to see significant traction in security. My pipeline today, most of my large deals are being led by security. I see significant opportunity there in security. I've expanded my operating, I talked about the free cash flow and what we've done in the free cash flow. Right now the focus is on execution.
We have six months to go in 2025 and we'll see what we do from there.
Fair enough. Just to check, any last questions? We can keep going. Okay, thanks.
You mentioned you wanted to go more into security. Where exactly, what appeals to you in the security space?
We actually feel like we're very well- positioned in security. The approach that we're taking is a platform approach and consolidation of vendor sprawl, and we see an opportunity and it's resonating with our customers. Replacement solutions have one vendor to work with, and that vendor should be JFrog. We manage the binaries, therefore we should be securing the binaries. As I talked about in the beginning, there's no CISO in the world that's willing to rip out tools, so they're taking a multi-year approach with JFrog. They commit to us, at least for these large agreements, two to three years, start with a replacement of one set of tools. We typically see infrastructure as code or secrets detection, contextual analysis. These would be maybe the primary three that they start with, and then over time will replace the complete security stack. This is kind of the direction we're heading.
We feel like we've invested in security, we feel like we're well positioned in terms of the sales and go-to-market motion, and at this point it's around execution.
Yeah, I would just add, I think we've met security where the market is today. The team will tell you that the market is quickly evolving and that MLSecOps will be different than DevSecOps, and thus that will continue to need investment not only in the security knowledge we have, but in understanding the security market as it changes and as large language models move left. There's more machines, there's more automation brought into the process. We are certainly looking at MLSecOps as another opportunity to show our quote unquote chops within the security market. One of those was represented in the early discussion with Hugging Face and what we were able to demonstrate there with their repository in the large language models.
Thank you.
Yeah, tremendous growth in RPO and kind of long term deals, and you know, CRPO came in around 19. Is that CRPO number a better way to think about your long term growth rate, or how do we kind of look at those two?
Yeah, we had tremendous growth in RPO, 75% growth this quarter in RPO, and CRPO was actually 43% growth. It was again an outstanding quarter for us. How do we look at this? We also know that there's some timing in terms of the bookings. We're coming off of a relatively easy comp in the first half compared to 2024 where we had some headwinds around the recession. We really saw the inflection in the second half of 2024 where we started to land very large multi-year deals. We had three of the largest deals in the history of the company closed during the second half of 2024. Although we're very happy with the execution and very happy with the results, we also know that that number is impacted by timing.
I focus more on the revenue guide than I do on the RPO and CRPO, but it's certainly an indication of the health of the business and we're very pleased with the execution and where we're going right now with these large deals and security on top of that.
I'd love to have more time, but we have to keep this operation moving. Thanks again Ed and Jeff for your time.
Thank you very much.
Thank you, Kingsley.
Thank you. Thank you.
Appreciate it. Thanks.