Let's go.
Good.
Awesome. I think we'll get started. Thank you, everyone, for being here today at the UBS Global Technology and AI Conference. My name is Radi Sultan. I cover the mid-cap infrastructure software stocks here at UBS. Next up we have JFrog, Ed, CFO, Jeff Schreiner, IR. First of all, thank you very much for being here today.
Yeah.
Absolutely.
Absolutely. Thank you for having us.
Awesome. Maybe just to kick it off, you guys have seen one of the strongest accelerations in the software group over the past few quarters, you know, six-point accel to 26% in the most recent quarter. Maybe just to level set, what's changed? What have been the biggest growth drivers, you know, behind that acceleration?
Yeah. So first of all, nothing's really changed in our strategy. We've seen tremendous execution during 2025. What we've seen, which is different than what we saw in 2024, is usage over minimum commit. So we had very strong and robust cloud growth, 50% year- over- year in the cloud. Much of that, again, is being driven by the fact that we saw usage over the minimum commit. Unlike 2024, where we had three of the largest deals in the history of the company, what we're seeing this year is more large deals. We see an increase in our ASPs. We see more velocity of those large deals. We're seeing expansion also in the enterprise. We have robust growth in the enterprise, which is leading to higher commitments. Lastly, security. We're seeing security being a driver of the ASPs as well.
Taking all of those into consideration, we've had very robust, very strong growth, and you see it in the results.
Yeah. Awesome. Maybe just on that point, you reported, I believe it was the strongest top-line beat ever, in the most recent quarter, a little over 6% above the high end. You've been vocal. Your guidance excludes large deals and usage over minimum commit. Maybe just walk through.
Mm-hmm.
Those two variables, how those have been trending, and sort of which of those two has sort of been the biggest driver lately?
Yeah. You said something very important, variable. You said that. That's exactly it. The responsible guide that we do is eliminating that variable. The fact that we have usage that we can't predict, that's over the minimum commit. We de-risk from that usage, and we also de-risk these large deals. It's not a matter of if these deals are gonna happen, but rather when they're going to happen. It's a very responsible guidance. Understanding that first is what's very important. What we're seeing today is strong demands. That demand is being driven by security. That demand is being driven by some of the events that are taking place, like npm, where it's driving pipeline and strong opportunity to execute. We're still waiting to see if budgets will align for that demand. We're also seeing, again, robust usage.
This emerging technology that's taking place, with AI models and AI-driven code, we've seen an increase, although on a very, very small base, which is driving demand. Part of that is excluding that, and letting that evolve over time. Hopefully, if we can continue to execute, it should be open for a very, very good outcome for the remainder of the year.
Awesome. Maybe just on that point, you know, as we think about the outlook for Q4, a common question I got was sort of the, the full-year cloud guide does imply a pretty steep deceleration in Q4. Maybe just, is there any way to talk about sort of the, the puts and takes on the Q4 guide, specifically understanding there probably is some conservatism in there, but maybe just anything over and above that when you think about puts and takes for Q4 specifically?
Yeah. Yeah. Sure. Absolutely. Again, I think there's been a lot of discussion around that, is that the fact that, you know, the cloud, the way that we guide and understanding how our guidance philosophy is built, it's very responsible, excluding usage over minimum commits, only guiding on the commitments. Secondly, excluding the largest deals, eight-figure deals that include migrations from self-hosted to cloud, security on top of that, excluding those. Again, only, only guiding on the commit. I wanna remind everybody that last year at this time, we had three of the largest deals in the history of the company that closed. Those were cloud deals. They included migration from self-hosted to cloud, or expansion in the cloud. We knew going into the second half of 2025 that it would be an increasingly more difficult compare, and we called that out.
What we expect as we head into 2020, into Q4 of 2025, is that, again, we set it up for a very responsible guide, assuming that we can continue, continue to execute on the momentum that we're seeing in the pipeline, it could be a, a very nice and attractive setup.
Awesome. Maybe just on that cloud migration point specifically, is there any way to think about sort of the pace of those cloud migrations, how that's changed? Maybe.
Mm-hmm.
When you think about, like, what has been the biggest catalyst behind those cloud migrations? Is it the functionality, features, etc.?
Yeah. Yeah. There is the secular trend to move from self-hosted to cloud, and we saw this robust migration taking place maybe in 2022.
2022.
Yeah. Before that, you had a bit of that pause, as there was some optimization that's going on. Then we started to see that pick up a little bit during 2024, although not at the same pace that we saw previously. Today, what we're seeing is customers, specifically the largest, most sophisticated customers, are pausing on their decisions to migrate to the cloud. This is being driven by maybe the concerns around what AI will do in terms of cost predictability and governance around the control, of the amount of code that's coming into the organization. There is a bit of a pause right now. We call this fit for purpose. We're hearing this more often. We're working very closely with customers. We're continuing to expand those customers in self-hosted and maybe taking other capabilities into the cloud, like security.
For the moment, there seems to be a bit of a pause until there's this understanding around what is the cost predictability, how am I going to manage the compliance and governance of the, the, AI-driven code and, and large language models. Until we get past that gate, we believe that a full adoption into the cloud will probably be somewhat delayed.
Got it. Got it. Got it. I guess, you know, maybe when you think about, like, next year, understanding you're not giving guidance, but maybe just as you think about the biggest growth drivers for next year, you know, we talked about security, cloud migrations, usage, AI, etc. Like, how do you think about sort of ranking the biggest growth drivers for next year?
Yeah. Typically, a migration is gonna drive the biggest benefit. When you move a workload from self-hosted to cloud, you have anywhere from 20%-80% uplift in that same subscription type. This is gonna be the biggest driver. If I was to look at where we head into, to 2026, there are two things that I'm focused on. Number one is, can I continue to see this momentum of usage over minimum commit, or for that usage where I have today over the minimum commit, expanding that to a larger minimum commit? Having that expansion. Security is gonna be a continuation of what we see in terms of the performance in the cloud.
If I land and see uptake in security with what we're building in the pipeline today and converting that demand into, an expanding opportunity, then I think that 2026 could be a very strong year for JFrog.
Got it. Maybe just dovetailing off that, at swamp UP this year, you had a heavy list of product announcements, really attacking, like, a bunch of different growth vectors: App Trust, AI Catalog, Fly, among others. I guess, which of these are you most excited about near-term and long-term, and maybe why?
Yeah. This was one of our best swamp UPs, since I've been at JFrog. I've been here almost seven years, and they've been doing this for 11 or 12 years now. The amount of innovation that we delivered and the expansion from a technology perspective to the platform, a lot of great products that we delivered. You mentioned App Trust. App Trust is one that there's a lot of buzz and excitement in the community right now and in the market, with our customers. This really addresses a pain point for our customers where today it's a manual process to govern the compliance of software delivery. We see an opportunity with App Trust. We just released it. We're building the pipeline right now, and we're seeing good success in our pipeline.
I don't know that it's going to drive any particular benefit during Q4. We'll see what happens during 2026 if we can execute on that demand that's being built in the pipeline. Certainly, there's buzz around App Trust and governance, this DevGovOps category that we're creating today. Secondly is going to be the AI Catalog. AI Catalog addresses the need in security for large language models. We talked about, in the public call, how we're starting to see an emerging use case for large language models, in particular with Hugging Face. Hugging Face models that are being pulled into the organization. We've seen a 100% increase since Q1 in the amount of models that are being pulled into Artifactory. You have to be able to secure that. AI Catalog will be the way to secure your large language models. And then Fly.
Fly was another product that we introduced during swamp UP. Fly addresses the need for very small teams. There's a select group of customers that we're going after. This addresses the need that tend to adopt technologies quickly, agentic capabilities. They want to use maybe a lighter version of Artifactory. We're building that group of select customers today. We will learn from that. I think that's probably more long-term. It's more of an R&D-related product. It will give us the learnings that we need in order to build the agentic capabilities into the enterprise platform in the future.
Got it. Got it. Yeah. I get the question a lot that, like, can Fly longer-term recatalyze sort of new customer growth and really start introducing that as a growth lever longer-term? I mean, I'm curious if you have any thoughts on that.
Yeah. The intent is not necessarily to be a significant revenue growth driver. I think it's to make sure that we are bringing the small customer that is using advanced technologies or emerging technologies today. We want them to come to JFrog, and we want them to be aware of JFrog as an SMB opportunity, not go somewhere else where then we have to wait until they become sophisticated enough to come to JFrog. We are addressing the need. We don't see it necessarily as a revenue driver today. We see it more as an awareness and an ability to build top of funnel and ensure that all new customers, small customers that could be the largest customers in the future, are coming to JFrog.
I mean, I think to your point is that you're gonna be working now with a new level of sophistication in startups. No longer are you gonna have a team of 50 or 60 developers, most likely, in an agentic world. That same team that used to be 50 or 60 developers may be three now. And so those guys are going to have a different type of profile in how they develop software, how they utilize AI, how various parts of the development pipeline are interfacing. I think for us, we wanna be able to serve at some point down the road that type of customer.
At the same time, I think that there's a lot that can be learned to Ed's point in terms of maybe extracting R&D and knowledge out of this with Fly to take to the larger enterprises and say, "Look, we've already executed it this way. Look at this implementation of, of XYZ, and that may be a better choice for you.
Got it. Got it. Got it. I guess maybe just, you know, drilling on, onto the AI growth drivers. I mean, one thing that came through in my own work was, like, there's a lot of AI tailwinds sort of impacting your business today. You have sort of the AI developer tool impact on sort of usage. You have model registry, AI Governance, you know, the actual binaries that are used in AI application development. So there's a lot of different growth drivers here. Maybe you could just sort of dissect those, you know, as you think about high level, which of those sort of AI growth drivers you think will be most impactful, and then maybe how you think that sort of evolves.
Yeah. Yeah. It's a very good question, and we're excited about this shift and the era of AI. We think it creates a big opportunity for JFrog. Clearly, when you have code being generated by machines and the pace of code that will be generated, that means more binaries, and that's exciting for JFrog. That's what we manage, and we believe thematically, as you have more code being written and more binaries, that this will be a benefit to JFrog. What we're really excited about too is the pace of code that's being written. You have to secure that.
We see a huge opportunity in terms of security, and we're doubling down on that because organizations are going to freak out with the amount of code that's coming into their, into the, or companies are gonna be freaking out with the amount of code coming into the organization. They need to be able to secure that. There's a big opportunity from a security perspective. Again, we will double down on that to ensure that we win that market.
Got it. Maybe just drilling down into that, I mean, how much of, when you think about sort of the revenue benefit from those AI code gen tools is sort of that security angle versus just sort of core usage of, "Hey, I need more binaries to support, you know, 20%-30% improved developer productivity"?
Yeah. It's probably too soon to call that out and to see that. You know, there's multiple avenues here. You're gonna have, obviously, Artifactory will grow with the amount of code. You will have the AI, ML, direction as well as you bring models. Models are binaries, and you bring those into your organization. You'll need to train, secure, and deploy those models. That's why we have JFrog ML. We did the acquisition of Qwak a year ago, and we already embedded that into our platform for the enterprise. That's another avenue of opportunity for JFrog. We're very, very early. We're probably in the first couple innings right now, and it's really difficult for us to say definitively it's gonna be ML or it's gonna be security or it's gonna be AI workloads.
It's still something that we wanna be able to capture the market. We'll continue to invest in all of those technologies to make sure that JFrog's in the forefront of winning those opportunities.
Got it. Maybe just on the model registry side, you know, you guys have talked about being the model registry of choice. Maybe you could just talk through the competitive landscape there, how that may be different from sort of the core artifact management business, but then sort of how that, you know, maybe how your sort of mode around Artifactory translates into competitive edge there.
We saw in, more than a year ago, maybe even two years ago, we started to see the data scientists bringing models into the organization and storing those in Artifactory. We knew that there's an opportunity there because these models were starting to come into Artifactory. What was missing was the ability to bring those models in and work them through the software supply chain, develop those models, train those models, and deploy those models. That is why we did the acquisition of Qwak a year ago. This gave us the capability to do those three steps and ensure that models are being deployed in the most secure and compliant manner. This is a differentiator for us. We know that large language model is a binary, and you can store those in any repository.
What differentiates us is the ability to take those models through the development life cycle and then go through and deploy those models. That gives us a competitive advantage at this stage.
Yeah. I think at this stage you do not see or hear yet, and I say yet, but no one is coming at the problem that you are discussing in the way that JFrog does.
Yeah.
We're coming at it from protecting a core asset in the binary, and that's the value add that we bring to you as the organization. I think that there certainly will be probably evolving emerging competitors for the ML landscape. It's just so nascent yet that we haven't necessarily seen, even in presale activities that are somewhat still nascent for us with JFrog ML, we're not seeing a lot of alternatives being brought up as, as, "Hey, I've got you versus company X." It's not there today, but neither is AI and ML. I think as that starts to explode and take off, I think we'll see a shift in competitive landscape from what we've seen in the traditional DevOps or security, you know, type offerings.
Got it. Actually, one growth driver you did call out on the most recent call was sort of supporting the binaries used in AI application development like Docker and npm. They're sort of getting pulled along as well. Maybe you could just talk through what you're seeing there, how much usage today is actually associated with those binaries to support AI application development.
Yeah. What we actually see today, and Jeff, feel free to jump in after this. What we see today is there's a lot of experimentation. What we called out specifically around the usage, coming from packages like Hugging Face, Python, which we know specifically are being used for AI workloads. We see those going into this, coming into JFrog and doing some experimentation. What we don't see is a correlation between those package types and Docker, meaning that it's going into production. We haven't seen that yet. Now, what we're seeing in terms of the robust growth that we had in the cloud during Q3 was specifically around our conventional package types, Docker, also Maven and npm. Yeah.
Yeah. I would just say, I think that it, it's a, it's a twofold answer to Ed's point. We're benefiting, you know, certainly Q1 was benefiting from experimentation in which we believe in AI and ML. I think that some of that's probably continued to go on. In Q3, we certainly saw the benefit, albeit maybe for a few weeks, but the first npm incident happened at our swampUP event, ironically, right? Customers were obviously having to do a lot of scanning of traditional packages of npm to do updates and find the updates from the repositories and make sure that all the packages that they were using were in fact the correct updates for the npm language.
Got it. Got it. Got it. I guess, maybe just switching gears, you mentioned the Hugging Face integration. I mean, could you just talk to that relationship? I do get quite a bit of questions sort of how that works, what the dynamic is there, and sort of how that pulls through to your business.
Yeah. I mean, the Hugging Face partnership is very unique in the sense that we look at the Hugging Face organization as similar to an npm repository. They are just a repository for large language models. Now, that relationship, I think, has been around. I think we've been working with them for about a year and a half, but it's evolved even in that time. Initially, it was having the interface to bring in the open models, you know, like a Facebook Llama 4 or such from Hugging Face into my organization and start to make it proprietary. The problem being about a year ago, Hugging Face had some other vendors doing some security work for that repository, and that particular vendor told them, "Whoa, 90% of these models are vulnerable.
You're gonna have to shut this, you know, we're gonna have to pump the brakes here." They asked us to come in and secure that repository, and we said, "No, that's not the case. Everything's okay," you know? That would also correlate, I would think, to what Ed and I have talked about, that around the time that we began to secure the repository and say, "Hey, no, guys, it's safe," you started to see an increase in the downloads of Hugging Face packages. I don't know if there's a correlation, but there's some, some tying in there in terms of the timing and such. For us, it's not a revenue generator per se.
It's a community engagement in the large language community, and we allow for the securing of that repository so you know that what you're working with from that repository is secure. The interface allows you to move back and forth updates of those models as you bring in and out of the organization.
Yeah. I think it's a very important point that Jeff brought up. This is not a revenue-generating partnership. It is a community, trust. And so once you have that trust that the models are secure, then they feel comfortable to pull those into JFrog. It's an intangible benefit. Once you pull these models in, these models are very large models, and as you move those through your software supply chain, that's generating traffic for JFrog, and we should benefit, off of that traffic over time.
You know, as Ed said earlier, I mean, it just ties back into the two gating factors. I think we're all waiting for when the floodgates open, and I think the floodgates are still holding back right now due to cost predictability and security.
Yeah.
Security of large language models and what I'm bringing in the organization, or if I'm even advanced enough to be using MCP servers to interface with other companies and share data to help train their models as well. I think that those are two remaining gating factors, I think, that are holding back this kind of flood of adoption of AI development.
Got it. Got it. Maybe just a related topic on a different integration you announced was the ServiceNow integration. That kind of stood out to me as an interesting growth angle. I do not think we like investors traditionally think about you guys as being sort of partners or sort of integrated. Maybe you could just talk through sort of maybe any early ones there, the dynamic behind that integration.
Okay. Yeah. We love to use the phrase "too integrated to fail," that we are integrated with almost all the tools in the software, software supply chain. I think as it relates to the ServiceNow announcement, and it relates primarily to AppTrust, it's us helping the ops organization do their job, as Ed had alluded to earlier, something that's being done on a spreadsheet today or I just sign DocuSign and say it's safe. Now I can interface with JFrog Artifactory through the ServiceNow platform and know that each of the gates that needed to be achieved has in fact been achieved. I have a record of that. When things go sideways, I can go back and find that information quickly through my interface with the ServiceNow and Artifactory platforms. We do think that there could be, you know, more to come from that.
We're very excited about working with ServiceNow, but we think what it does is it helps to continue because where we've sat, obviously, is between developers and operations. We're now continuing to serve the operation side and bringing more integration into the platform for the operation side of software development.
Got it. Got it. I guess maybe just shifting gears to sort of the, the dynamic between GitHub and GitLab and you guys and sort of where you sit within the ecosystem. I mean, how, how has that relationship evolved? I know you guys have invested heavily in the GitHub integration. You guys deprecated pipelines, right? I think that's kind of brought you closer to GitHub. Maybe you could just talk through sort of the, the competitive dynamic or the relationship there.
Yeah. I think that, you know, when I got here, over four years ago, it was, you know, the GITs are gonna walk right and just mudstomp JFrog because binaries are just something you do and everybody can do it. What we've seen is that there's actually been a change to where we're seeing the machines move left now. I think that what has changed for us, and I think Shlomi would say the same thing, is that when we first announced the integration with GitHub, it started to change the dynamics not only in industry, but I think amongst investors as well, that there were defined lines within software development and that GitHub was the best of breed in source code. JFrog's the best of breed in binaries, and those are two separate parts of software development.
You know, there's gonna be a best of breed in observability at some point. Who that may be, don't know, but that seems likely as well. I think that there's always a misconception that we were competing directly with those guys. Realistically, we really don't see them in presale activity at all. That wasn't a competitive alternative that customers were really using in a, in a, you know, enterprise-level deployment. We're looking at, let's say, a Git versus JFrog for binary management. That wasn't the case. I think that the competitive differentiation has been illuminated since we've been working closer with GitHub, and you continue to see more and more engineering coming out of that relationship, even at swampUP , as we announced here, in early September.
Yeah. No, I mean, it seems like this sort of fear that GitHub one day is gonna wake up and try and build an artifact repository just isn't, you know, that's been a sort of, you know, fear for a long time. It hasn't, hasn't come to fruition.
It hasn't come yet. I'm not gonna sit here on a stage and say that if Microsoft somehow integrates GitHub and they decide one day, woke up and say, "Satya says, today's the day we're taking binaries," I mean, it's a big, it's a big budget to fight. I think that they've seen, you know, I think if you were just at GitHub Universe about a month or so ago, you know, they're not raising a white flag and saying binaries are JFrog by any means. I think the overall, you know, topic that was being discussed amongst GitHub employees was that we realized that JFrog does binaries very well, and that allows us to focus on our core market source code.
Got it. Maybe just shifting gears to security, at least in my own customer conversations, curation has sort of been the biggest standout where I, where I've heard the most traction. Maybe you could just speak to sort of where within the security suite you're seeing the most pull through, where you think there's still room to grow and sort of the biggest growth vectors there.
Yeah. Historically, we've seen about a 50/50 split between Advanced Security, JFrog Advanced Security, and curation. That's kind of how the pipeline was built over the last four or five quarters since we've really gone pedal to the metal with security. Over the last quarter or so, we're starting to see this groundswell being driven by the npm events, and it's really around curation. There's no competitive alternative when it comes to curation. We're very well positioned, and I think customers are now recognizing that they need to protect the castle, and the best way to do that is through curation. This allows you to curate what comes into your organization. The npm events certainly opened the eyes of the customer, and we're starting to see demand being driven there in the pipeline.
I also wanna highlight, though, that this demand, we're still trying to see if the budgets are available. We're saying, we're hearing, "Yeah, this is a very cool product. We want this," but we're getting a little bit of the straight arm saying, "I don't have the budget yet, so I need to work with the office of the CFO, procurement, make sure that I can align the budget." Assuming that we can, you know, get prioritization around budget, I think curation could be a really good growth driver for JFrog in the future.
Yeah. I guess when you think about sort of the, you know, where that growth is actually coming from, like how much is sort of consolidation of standalone devs that got vendors? Because it does seem like, at least in my own customer conversations, those guys run a little bit of pressure to sort of consolidate away from them towards, you know, a platform like, like JFrog. So maybe how much is coming from sort of platform consolidation versus, you know, maybe a different growth driver?
Yeah. Yeah. The platform consolidation or vendor consolidation is really, it's been in discussion for the last two years, and we see it as an opportunity. This is the reason why we brought Advanced Security into the market because it's consolidating six, seven point solutions. We also know that you have a budget today that you're utilizing on these point solutions. We need to take that budget, and we need to consolidate that onto JFrog. That's not always the easiest thing to do. You have tools that are working. You have an organization that tends to be very conservative, the CISO, and the CIO. To rip and replace a tool or multiple tools is not always easy. This is why we're seeing customers take three-year opportunities in security.
They build a roadmap to replace maybe one or two point solutions in year one, then a few more in year two, and, hopefully, replace all of them in year three. Today we see one or two point solutions being replaced. Typically, it's infrastructure as code, secrets detection. Those tend to be the two, and contextual analysis as well, maybe three, that we see customers adopting on the JFrog Advanced Security and replacing right now on the point solutions.
Got it. Got it. Maybe just switching gears to Go-To-Market. When we think about sort of the usage above minimum commit, which has sort of been a key part of how you guys guide and a key part of the Go-To-Market strategy, right, is attacking those customers that have, you know, usage over their minimum commit. Maybe you could just talk through sort of the trend you're seeing there in that, you know, usage above minimum commit. What has been the biggest driver, and how are you architecting the Go-To-Market to go and get those guys on longer-term commits?
Yeah. Again, I'll say that, you know, the driver of the usage over the minimum commit is conventional package types. This is gonna be your Dockers, your npm, and your Maven. It's not necessarily AI workloads yet. We're all waiting for that to happen. I know everybody here in the room, and it's great to see a packed room, is excited about what's happening in AI. We're still very, very early, and we're not a company that's gonna give you a bunch of fluff saying, "I have, you know, a huge amount of growth coming from AI." We're prepared to take that market. There's no doubt about it. Again, we see this from conventional package types. We work very, very closely with the customer. We align their demand with, and their needs with, long-term commitments.
Now we're seeing multi-year commitments and making sure that they have the opportunity to flex up and down as they need by taking a minimum commitment with JFrog. We also know that the sales organization, they're motivated to ensure that they're landing the biggest and best opportunity for both JFrog and the customer. We also know that we don't wanna put them in a package that's gonna be too large, and then we start to see churn. Having usage over the minimum commit is not bad for JFrog. We actually see this as an opportunity to go back to the customer and further expand their opportunities in the future. Our sales organization is not incentivized based on usage over the minimum commit. They're incentivized on commitment.
They have an opportunity to go there based on driving usage over the minimum commit and converting that to a higher commitment in the future, and they'll be incentivized based on doing that.
Got it. Maybe just one, to wrap it up, high-level question. You know, I think I, I've been surprised, and I think most investors have been surprised at the durability of the competitive moat around the core Artifactory business as the DevOps space in general has gotten more competitive. Maybe just longer term, as you think out over the next several years, how do you think about sort of the investments you're making to maintain that competitive moat over the next couple of years?
Yeah. It's a very good question. You know, we're always looking around the corner and who's coming after our market because binaries, you know, several years ago, there wasn't as much interest. Today, everybody's recognizing that binary is the key to software updates. For us, it's continuation of expanding the platform. DevGovOps is one example, the JFrog ML opportunity, and as well as security. Having all of those, we're the only company in the world today that offers not only DevOps, but DevSecOps, MLOps, and now DevGovOps. As long as you continue to widen that moat and continue to add new technology to the platform, we believe we'll have a competitive advantage over anybody.
Yeah. I know we're at time. I'll keep it quick, keep it tight. It's a Lego strategy, right? DevOps is your first Lego. Then you start stacking value on top of that to retain the customer because you continue to add value as their infrastructure layer solution.
Awesome. Thank you guys so much for being here.
Thank you.
Yep.
For having us.