Okay, we're going to go ahead and get started here. Thanks, everybody, for joining. My name is Adam Tyndall, covering security and infrastructure software and supply chain here at Raymond James. Very happy to have Jeff Schreiner from JFrog here today. We're going to do a fireside chat. I am subbing in on our team. Mark Cash from my team directly covers this one. He's the better looking of us two, so you'll have to put up with me. Due to travel logistics, he's getting here a little bit later. We're going to do a dinner tonight with Jeff and have some more face time. So really appreciate you being here, Jeff. Fantastic story, obviously, for investors in the room who are involved. A lot of happy faces, as we've seen throughout today.
But for those that are a little bit newer to the story, maybe we could just touch on the background of the company, market opportunity, and JFrog's key value proposition.
Yeah, thanks, Adam. Thanks for having us here today as well. It's a great conference, a great opportunity. So JFrog, in essence, for the elevator pitch about what we do and why we were created. The company was created in 2010 during a period when software was still created monolithically. Pretty much all of the software was created internally within an organization and then utilized and deployed in various functions. But at that time, our founders saw a need to start managing what was called open source packages or binaries, as individuals within organizations were starting to build software in a new way, a way in which they were bringing outside packages into the organization to help automate and accelerate the development of updates and application building.
JFrog was developed to be the manager of that asset, the binary, to have a repository, which was the first product we created, an Artifactory. Artifactory is the source of truth for your organization related to software development and knows of all the binaries, the environments, the deployments, and when things go sideways, it's where you go to figure out what you need to do to quickly remediate and win that race versus the hacker that typically is the ongoing battle that people see within the enterprise and their security of that enterprise. I think the opportunity for JFrog has evolved. When I started here over four and a half years ago, we were much still a product-led organization, still had a bottoms-up type sales motion, which we were evolving to.
We had begun to evolve into a security company with the acquisition of Vdoo and had the vision to become a platform, a platform for binaries, which was then secured and offered additional value-add products on top of it. Circa today, that's in fact what we have become. We have the Enterprise Plus platform that offers you, on top of that, additional SKUs related to security. We released AppTrust at SwampUp in early September. That's our new SKU called the GovDevOps market, where you had the governance side, which had been done previously manually, now being brought into the organization through integration with ServiceNow platform. So overall, I think when you look at JFrog and you look at what are we about, we are about helping you go as fast as you can in software development, but doing it securely.
That's perfect. And I'm glad we have our director of research sitting here in the front row, and we were pitching him on this security is going to come together with developers.
Yes.
And that's why we need to cover both spaces together.
Yes.
So the thesis is playing out here. He's all.
All right. We got a winner.
So as you mentioned, JFrog is now the platform for being a single source of record for software supply chain. You have a loyal customer base that knows JFrog for being the standard for artifacts, which is the one area. But what drove the expansion beyond that artifact repository?
Yeah, so the expansion was, as I had just noted, was that our founder and our CEO, Shlomi Ben Haim, had seen the need that the industry was going to start to shift to. It had always been a best of breed, but it had been best of breed and selected by developers, that developers liked the latest bells and whistles from this product and then would switch to this product. And I think a lot of times what happened, and if you look back, a lot of dead bodies on the highway from companies that were very much developer-focused and thus could never secure the larger budgets that were necessary.
And I think the transformation for JFrog that happened is we saw that a platform of the core aspects of software development were going to be critical, with source code being one of those, observability runtime being one of those, and binaries of the software supply chain being one of those. And I think because of that and because of that evolution and the addition of security, what we've been able to do is we're your infrastructure provider. We're the plumbing within your organization. But in order to maintain that position, what we've had to do is institute what I call a Lego strategy, where DevOps is our first Lego. Now we had security as the second Lego. Then we had MLOps as the platform to develop, to manage, build, and deploy your large language models. Then we had AppTrust.
All these are incremental drivers of revenue, but also incremental drivers of retention.
I love those types of models where that upsell is high contribution margin, helps margins and profitability. Those are great software businesses that we look for. As we think about more of the near-term questions that we're getting, and I sat in on a group meeting earlier, there was some discussion around this. The guidance approach was revamped coming into this year. Maybe just touch on what drove that change and what is today's guidance philosophy as investors think about that?
Yeah, so in Q2 of last year, we had a little bit of a hiccup. It was Ed Grabscheid, our CFO, his second quarter. So it was a little bit of a hiccup, probably a little bit more indigestion than investors would have liked to have during that transition, and it occurred because of the way we had been handling guiding the business and the way our predecessor did, and the predecessor's standard deviation to beats was about 1%, and we had continued that philosophy at NI, but what happened was in Q2 of that year, we signed Qwak, and we had a deal that was also about to be closed within the final five days of the quarter.
So we signed the Qwak announcement, put a press release out about five days before the quarter close, and reiterated our guidance because we had a deal in which historically 99.9% of the time was going to close on a migration activity. Well, this particular customer understood the dynamics, given that this was going to be, at the time, the largest deal in our company history of what that deal meant to us, and came to us about a day after the press release and said, you know, we don't really need this done by June 30th. But if you want it done by June 30th, we want price caps for life. And we were not going to bend the knee. Good thing we didn't. We've expanded greatly with that customer.
But it caused a lot of pain for us and for our investors and thus spurred about a much more conservative guidance philosophy in which Ed is now only guiding to commitments. And we don't and never had guided to overusage above the commitment you make to JFrog or migrations now, very large eight-figure migrations like this one was that could slip for whatever reason, not necessarily change the dynamics of the business, but change the perception as it related to Wall Street. We've excluded those in our guidance going forward. And I think it's been fairly well received with Wall Street on how we've managed that.
Yeah, and obviously be super topical as investors start thinking about next year, which you haven't spoken to just yet, but probably setting proper expectations ahead of that. Revenue growth has also been accelerating throughout this year with some sizable outperformance versus expectations. Drivers have been over consumption in cloud, cloud migration and upsell, security add-ons, which is a big part of our thesis, and higher-tier adoptions. Maybe just speak to those drivers and how sustainable those trends are that you're seeing.
Yeah, well, let me rank those up in terms of rank order those types of growth drivers. I think that in 2025, you've seen something different than what you've seen in 2023 and 2024. 2023 and 2024, we were still that company that when I first started here was kind of a bugaboo about JFrog, that they're a big deal company and they got to get that big deal to make the year. And that was the case in 2023 and 2024. And two ways in which cloud really drives growth for us is either a migration in which you move from self-hosted to the cloud, and in year one, we can get a 20%-80% uplift, or it's consumption on the cloud side is how we monetize. And so this year, unlike the last two, it's been very heavily weighted to overconsumption above commitment.
The consumption driver has been a key driver of growth. The next part is then capturing some of that overusage into higher commitments, which then gives us better visibility and a better ability to guide you guys based on a commitment level. I think third has been security. Security has been a strong driver of growth and is the reason why you see us in Q3 add 10 new, greater than one million ARR customers. Why is that? That's because the addition of security is making that happen now, and the deal sizes are becoming incrementally larger.
Yep. And that's going to lead into the next question, then I'm going to pause for audience questions. I know this is a little bit more of a technical story, so please feel free to ask any high-level questions. But RPO growth is another metric that investors look at for this business, just kind of representing the total commitments to JFrog. And it's been really strong, basically doubled since the end of 2023, giving you record visibility. Why do you think customers are now committing to larger and longer deals? And were there any sales compensation changes or something internally to influence that behavior?
Yeah, to the latter, no compensation changes. I mean, 2024 was the first year that our reps had a bogey for security, and that carried over into 2025. I think it goes back to what we spoke about earlier, is that the industry is now turning to this platformization that we saw. And they are also, in fact, adopting platforms and the best of breed platforms in each of those areas, whether it be GitHub in source code, JFrog in software supply chain. There's several observability. Some may say it's Datadog out there or others. Pick your poison. But I think more so it's because when I started, it was funny. There was a multi-year deal when I started about four and a half years ago. Then we went to annuals. Everybody wanted annual.
Now that we're committing and consolidating vendors because of the platform architecture, I'm much more willing to commit on a multi-year basis with built-in step-ups. Obviously some of that RPO growth has been duration benefit. I would say 18 months ago, we were probably closer to 14, 15 months of duration, whereas circa today, we're probably around 24. There has been some duration benefit to that. But as you said, I think that the willingness to commit has been driven by the fact that I recognize the value of binaries and that multi-year commitment is what I'm trying to do with all the key vendors within my software development organization.
I imagine that step-up aspect probably gives you better visibility into future growth if you have that effectively built into contract.
Correct, correct. It's not, well, we also want to convey that we're not signing away the company. We're not giving you three years, and then it'll be three years before we can get incremental increases for those products, that there are in fact consumption and as it relates to security headcount increases built in in year twos and threes.
Any questions so far? Yes, please.
I'm less familiar with regards to your product per se, but can you kind of outline in the three buckets that you're in, who are the main competitors and why is it your right to win?
Sure, fair enough. In DevOps, kind of the core business for us, the Artifactory platform, there are two competitors, and one's really been around since the beginning of time for us. They were founded around the same time as us. That company's Sonatype, a Vista Equity-owned company. They actually took the market originally in 2010-2012, but then around that time started making a shift towards focusing on security and less focusing on the DevOps portion of their business and started funding that with service contracts. You can imagine that over time, the amount of technological innovation that got put into that platform lessened and lessened. Today, that's the real drawback I think that you would find if you spoke to customers with Sonatype, is they're great if I'm a smaller guy and JFrog Artifactory and all that it offers is overkill.
But as I grow in complexity and size, Sonatype just cannot support me. And then they generally migrate from Sonatype to JFrog. I also migrate from Sonatype to JFrog because Sonatype does not have cloud. So I'm an alternative to them in cloud. There is another smaller player called Cloudsmith, who's a native AI player, probably sub 10 million ARR. They are focused primarily on the cloud, but the problem being there that now we're seeing concerns about consumption and costs of that related to the AI/ML world that I may want to go hybrid, where I have self-hosted and cloud. So that wouldn't work for me either. On the security side, it's a lot of the point solutions that we're trying to consolidate: Aqua, Checkmarx, Veracode, Black Duck. A lot of those that are in the software supply chain.
There's about seven tools in JFrog Advanced Security that cover various technologies that are all done by a private, I want to note, point solution company, many of which four years ago had flush roadmaps of what they were going to do, but then funding dried up and then funding became trying to just survive. And I think also the industry got very tired of having all these disparate tools. I equate it to the fact that the industry was buying two car policies, two car insurance policies, and I've got better protection because I have two policies on my car. They weren't really better protected. They just had more stuff. And the industry is now trying to consolidate vendors in the security world. And so those leading point solution vendors are guys that we compete against.
In the AI/ML world that's emerging today, I don't have a clear landscape yet. I think that's still evolving. And I'm ready to admit that there's probably a guy in San Jose in his garage that could be my competitor in three years for all I know at the rate that we're moving in this new world of AI and ML. So in those buckets, those are kind of the competitive landscapes. And we've got the right to win because of the binary. And each of those you can track from Artifactory up. What's the value add that JFrog has versus the other? It's our expertise of the binary, managing it in Artifactory, securing it with the security aspects, and now with AI/ML becoming possibly the model registry for all these large language models.
Good question. Yes, please.
In the past, JFrog was very cautious in saying that there's an accelerated consumption driven by more code generated [audio distortion] get overexcited too early, but it does seem that 2025 is some sort of like a pivot year in that sense, and I'm wondering, are you guys keeping the cool tone here or are you actually seeing any changes?
We're keeping the cool tone. We're keeping the cool tone just because, one, we don't know that it's a trend yet, but we have seen a change, as you've noted, and a lot of that's been on the traditional workload, and why is that? Because we know publicly some of our customers are in fact using these coding assistants, right? Now, these coding assistants, you heard GitLab last week in their presentation say something that we've already been saying before that, that we think a lot of this coding assistant activity has created more volume of code, but not necessarily more code into production. The quality issue is still there. I'll let the customer decide when that gap is closed, right? But the more volume equals more binaries, we're certainly starting to move towards that.
I think there's two gating factors that really stop that trend from emerging too soon, and that's cost predictability. What's my cost if I go to 100% cloud in the AI/ML world and security? When those two factors are covered, I think organizations are going to be much more willing to open the kimono. I also would point you to the fact that I think our Curation product, to the extent that you hear us talk about that continuing to accelerate in 2026, can also be looked at as a toe in the water for AI adoption of these coding assistants or AI, because in essence, then I have centralized policies that the CISO can know that if I turn the machines loose, they are only going to be utilizing packages that I have in fact allowed into the organization for development. So I think we're with you.
I think there could be a trend emerging. That being said, even if a trend emerged, we will not change our philosophy and try to predict overusage above commitment from that customer.
In that same vein, how are you guiding customers in terms of predictability? As you mentioned, AI coding, it is very unpredictable. What are you seeing from the predictability analysis?
I would say the buyer for cloud has gotten much better over the last three years. They first started out as a new thing for them. You saw a lot of mismatching in terms of buying, underbuying, sometimes overbuying for other customers, what have you. I think we've gotten down to a good science of working with the customer and trying to align their needs with what they purchase, and you're starting to you saw that last year in the fact that we really had no overage contribution last year. This year it's been somewhat different, but you could also have that same procurement buyer in the example I'm talking about, where I feel I bought the right amount of cloud, okay, but my team in Q3 needed to go over for a project.
I'll take the overusage penalty, okay, JFrog, but then I'm just going to go back to my minimum commit because I know that there was a flex up, but we may not continue to run at that level. So I think what we want to do is, and second, I would also alert you to the fact that if you are a JFrog sales rep and you oversold me on cloud, you're probably going to be kneecapped in the next year because if there's any downsell, that's a very, very negative impact for you as a salesperson on your overall commission package. So I don't think that what we have is a very poor job of customers buying.
I think that they're continuing to evolve, and I think that this AI/ML has brought into the mix a new dynamic because in fact now I could be moving packages of binaries that are 10x the size of what I was moving previously. So that plays into it as well in terms of how I'm going to buy and plan for my cloud consumption needs going forward.
Do they send you around to do the kneecapping?
No, no. I'm not that guy. I'm not like our friends that we talked about otherwise that have done end of life and have gone out there with a hammer to tell their customers that they're going to be stopping certain things. Yes.
Yeah, that wouldn't be fun to be a sales guy there. Since AI and ML is getting brought up, I think kind of like two distinctions, and I'm going to have to go off script. Mark's going to kill me for this, but two things that we often talk about, and I think it was maybe important to talk about here since it came up in the meeting that I sat in before. One is the idea that seat-based pricing models are going to be pressured as there's less humans in seats, but I think JFrog is very different in the way that you can monetize machines. So if you could touch on that. And then the second thing I want to talk about, the LLM providers themselves as opportunity or threat, but maybe we'll just start with seats and pricing.
Yeah, so for us, it's based on contributing developer. And the uniqueness for us in the fact that a machine could in fact be a contributing developer. So if you do start building more with a large language model in your source code or you use more coding assistants, vibe coding, what have you, those can all still be a license for a seat for JFrog, which is different than the human developer world, the source guys that have seen those types of headcounts decline as the use of these coding assistants have rise. As it relates to kind of the foundational model providers, we're working with three out of five of them today, but one has taken a little bit more, I'd say, air out of the room than the rest.
The reason being is we've highlighted that this particular company is doing something very unique with Artifactory that we hadn't thought of. They brought it to us and started working with it in AI in ways that were quite interesting to us.
They tried to do it themselves first.
They tried to do it themselves first and failed and sought out JFrog and sought us specifically. That occurred in Q1. The unique aspect of this is that this is not a cloud-based deployment. This is a self-hosted deployment in which this particular customer is looking to build out their own data center. The ultimate end goal that we would like to reach and that they are trying to achieve is to create a business model, lack of a better term, a model as a service where they are hosting and managing and training thousands of models daily that are being run through Artifactory. All that change, every change, every movement being monitored in Artifactory, every security update being done through Artifactory.
Then I, as a consumer, may want to download models X, Y, and J because those may be the models that I use to build my source code. Now, if that was to come to fruition, they could be one of our largest customers ever. Today, they're still a small customer, but growing very quickly. So we see them as a reference account. We treat them as a strategic enterprise account because we feel that if it does come to fruition, it's certainly something that's replicatable to other customers down the future.
So three out of the five big LLM providers are at least engaged with JFrog. The other two that are not, do you have any sense of why, why not that they're using?
I don't. And even so, I tell people that even of the three, it's the one that gets the most attention. The other two hasn't risen to its level yet.
In that same vein, is the LLM group the main customer, or would it be somebody like Cursor ?
No, the LLM group is probably who we would work with in this sense in terms of being the model registry for their LLM because in the end, a large language model is in fact a binary. So that's why we feel we have the right to win in that aspect. It's just a very large binary that's being moved and updated only through containers, the largest binary out there, right? So I think the Cursors of the world are very much focused with up to the point of compile. If you run an AI search on Cursor, you will find no word about packages, about binaries, about any of this. They are very much focused on just bringing ease-ability to the generation of the code, and then from there, letting the machines control what processes into production. That's where we are today.
I don't see them as a competitor today. I see them as complementary by increasing the volume, and in fact a relationship like we have with GitHub. There very much could be in 2026 some relationships you hear us announce with some of these new vibe coding guys because too integrated to fail is something that we really believe is the key to JFrog and why we've done well as integrating so many various aspects of the software development technology into Artifactory.
We'll take a sec to talk security a little bit. Of course, in very Mark fashion, this is a very detailed and long question with three different parts. I think you've already read this script, so I won't read the whole thing, but the gist of it is talk about security platform, the various products, and if you can maybe help quantify and size this for investors, why this matters because it's starting to become a key part of the bull thesis over time since it's becoming more material in the model.
Yeah, the security part of the business is unique in the fact that when I joined, a lot of investors were kind of confused or had been telling Shlomi, "Why were you buying the security company? Your DevOps company do DevOps, let security companies do security." And at the time, Shlomi had seen the need that platforms were going to need to have a core asset and that you were going to need to secure that core asset. And thus, security became an opportunity for us through the acquisition of Vdoo. And through that acquisition, Vdoo created two new products for us. One being Advanced Security, which is seven different disparate technologies in one solution that covers your full software development lifecycle from source code to runtime. The other is Curation.
Think of it as a firewall for your organization, which I think one is why some CISOs may find it easier to understand. If you've been in the networking firewall industry for 20 years, protecting the organization, and now the software development security has been thrown on your desk, and you're looking at all these tools and you don't necessarily understand this, that, the other, but I hear firewall, oh, I know what that means. Okay, I think that's some of the interest that's being driven there. Not to mention that Curation is in fact a technology that did not exist until JFrog created it.
I would say that the fear-induced interest in Curation has accelerated dramatically since the first npm incident that we had in early September and have since had two corresponding incidents with the npm repository, causing many of our customers to try to shorten the lead times as it relates to Curation and try to bring that product in-house quickly.
Got it. And that's probably a good bridge into capital allocation. Since the last two acquisitions that you're referencing here, the security and ML functionality seem to be really working well. Maybe just take us into the boardroom, take us internally. How does the team think about capital allocation priorities, especially given you're generating nearly 30% free cash flow margin on a trailing 12-month basis?
Yeah, you know, and Ed would tell you if he was here that maybe by the end of the year, based on guidance, we'll be at about $700 million in cash balance. And it's something that some people look at cash balances and, ooh, high. We look at it as, well, 4% - 5% is pretty solid. And since I've been here, there's been two disruptions that could have taken out JFrog. One being security with the acquisition of Vdoo. If we had not done that, we would be in a very difficult position today, precarious, no doubt. Second was the acquisition of Qwak last year. And again, that with the ML world and large language models centering around binaries could have been something that could have completely disrupted JFrog as a whole.
So we're starting to look at cash more strategically in the way of how we merit and compensate our employees. We're now five years into IPO as a public company. We think it's probably more appropriate at this time for merit to be more based on cash and less on equity, which will then help with burn rate over time. Okay, I think the other thing we do is we keep that cash available for when those other new strategic disruptions, and they may likely come again in another two years at how fast development activity is changing, that we have that firepower to go out and inorganically acquire something that may be disruptive to JFrog in the future if we need to do that.
Perfect. Well, do we have one more question? Okay. I think we're going to wrap up, but before we do, I know we've touched on a lot of different areas, and it's, like we said, technical story, and we can get in the weeds on a lot of different areas. If you were to boil it down to an investor who's maybe newer to the story, just hearing the JFrog story for the first time, what's the key message that you want them to walk away with?
Yeah, the key message I would say is that we are monitoring and protecting an asset, the binary, which has become of critical importance as we move into the AI/ML world. Ten years ago, this would not be a product or an asset that many in the software industry would talk about or even recognize to its importance of the level that it is today. I think the demand that we're seeing in terms of volume growth is starting to accelerate. I think some of that can be related to experimentation of AI and ML. We don't think that that's going to be a driver in 2026 of our business. We still think it's very much going to be consumption and security. We think security has added a lot of opportunities for us that are just emerging.
And then on top of that, the ML platform is something that we offer today inside the JFrog subscription, but we hope to monetize independently as our customers start to utilize and engage more with the ML platform in the development, securing, and deployment of the large language models. So I would say that we're on the cusp of the binary entering into a very important stage in software development, more so than it has been in the last two decades. And I think JFrog is appropriately positioned as the leader in that particular asset where we have solely focused. We've never gone into CI/CD. We've never gone into observability. We continue to focus on that one asset and being the expert as it relates to binaries.
It's been an excellent story. Congrats so far. Thanks, Jeff.
Thanks, Adam. Appreciate it.