JFrog Ltd

Overview

JFrog’s vision is to power a world of continuously updated, secure, trusted software – we call this Liquid Software.

We provide an end-to-end, hybrid, universal Software Supply Chain Platform that enables organizations to continuously and securely create and deliver software updates across any system. This platform is the critical bridge between software development and deployment of that software, paving the way for modern software supply chain management and software release processes. We enable organizations to build and release software faster and more securely while empowering developers, security teams and Machine Learning Operations (MLOps) teams to be more efficient.

Digital transformation has become an imperative for all organizations, and as such, organizations of all types and sizes are increasingly dependent upon software to better engage with their customers, partners, and employees. As a result, the continuous and trusted release of new software has become mission critical. An organization’s failure to keep software current or react to problems with timely software updates, whether feature oriented or security-demanded, can lead to lost revenue and reputational damage, and even threaten human safety and lives. We believe the end state of digital transformation is a non-stop, always-on, secure, continuous delivery of value to users, enabled by a world of version-less software.

DevOps and DevSecOps enables the software innovation that is driving digital transformation. The need for organizations to better serve their customers, partners, and employees through software is driving the demand for constant innovation of the software build and release workflow. As the pace and variety of software creation have increased, the domains of software “developers” and IT “operators” have converged, rapidly including “security” professionals. Since our inception, we have embraced the culture and methodologies of modern software development and delivered a platform that connects developers, security teams and operators, thus providing the foundation for DevOps and DevSecOps. These paradigms have become the approach modern digital organizations take to software development and operations, shortening, automating, securing and improving the software build and release workflow.

Software as it is written by a developer, in source code, cannot be deployed in a runtime environment. In order for software to run in production, source code is transformed into or packaged into executable binary files that can be understood by and run on a server or device. Organizations need tools that can turn source code and other resources into binary files, store, manage, and secure these binaries, and then create software packages, or combinations of one or more binary files, that can be released and deployed to runtime environments. Our platform is designed to universally manage and deploy all types of software packages, including machine learning models, within an organization, making it the system of record for an organization’s secure software release processes, often called the “database of DevOps.”

Software and the Business Environment

The volume and importance of software in the business environment is increasing exponentially. Organizations in all industries and of all sizes have turned to software as a competitive advantage, facilitating interactions with their customers, managing day-to-day operations, gaining actionable business insights, securing their digital environments, and driving digital transformation. As a result, software’s role has changed from a functional tool to a cornerstone of nearly every company, and the continuous development and release of that software has transformed into mission-critical operations.

For example, if drivers and riders are not running the same version of a ride-hailing company’s software and fail to connect, even for the briefest of moments, those riders can easily turn to a competitive service. If an out-of-date piece of a financial institution’s software stack allows a security breach, the organization can suffer enormous reputational harm and be liable for damages. If an airplane’s software is not securely updated, passengers’ lives may be put in danger.

In order to address these growing customer expectations and regulatory compliance, organizations have dramatically reduced the time between releasing new features and functions and resolving security vulnerabilities, from years to months or even days and hours. Updating a feature of a software application, rather than releasing a new version of the entire application, ensures that current software is brought to market faster, allowing organizations to be more responsive to their customers’ needs, making software updates less disruptive to the user experience. To keep software current in today’s environment, software updates need to be released incrementally, securely and with increased frequency.

The proliferation of open source software, availability of newer and more efficient software development technologies such as generative artificial intelligence (AI) technologies, and the increasing interconnectedness of software enable organizations to produce software at an increasing rate. Meanwhile, the adoption of new architectures, platforms, and technologies, such as microservices, containers, and hybrid and multi-cloud environments, creates significant complications in managing the software supply chain flow. Organizations’ existing approaches to software releases and updates address each step of the cycle separately, creating silos and bottlenecks around critical steps, such as planning, curating, building, testing, securing, and delivering software. The merging of these new technologies with legacy approaches has placed significant strain on traditional software build and release workflows.

The DevOps and DevSecOps Workflows

DevOps enables the software innovation that is driving digital transformation. As the domains of software developers and IT operators have converged, DevOps has emerged as a discipline that integrates software development and operations, shortening, automating, and improving the software build and release workflow. DevOps is a combination of technologies, methodologies, and culture that powers a continuous, fast, and secure software release cycle.

The DevSecOps workflow spans the lifecycle of software, from the planning, curating, coding, building, securing and testing of software components by developers, to the secure releasing, deploying, operating, and monitoring of that software by operators. DevSecOps integrates security practices across the DevOps workflow for early detection of issues and ongoing software security throughout the software’s lifecycle. While many software development technologies today address aspects of a particular segment of DevOps, JFrog provides the common ground for software developers, security teams and IT operators, making it integral to the DevOps and DevSecOps workflows to create trusted software releases.

The Importance of Software Packages

Software as it is written by a developer, in source code, cannot be deployed in a runtime environment. In order for software to run in production, source code and other components are transformed or packaged into executable binary files that can be understood by and run on a server or device. Organizations need tools that can turn source code and other components into binary files, store, manage and secure these binaries, and then create software packages, or combinations of one or more binary files, that can be released and deployed to runtime environments. In addition, the vast majority of applications are built utilizing open source software that enters organizations in the form of binaries. The JFrog Platform is designed to universally manage and deploy all types of software packages within an organization, making it the system of record for an organization’s software.

In today’s business environment, the volume and variety of software packages that need to be managed and stored by organizations is rapidly growing. This includes the management of machine learning models and their dependencies, which see massive adoption due to the commoditization of large language models (LLMs). Software packages are increasingly created by both humans and machines as software build and release workflows are automated, and can also be imported from external sources, such as open source libraries and repositories. The increasingly large volumes and complexity of packages within organizations’ software development ecosystems require a new, systematic, and automated approach to trusted management of packages. Code repositories, which store and manage source code, are helpful and important developer tools, but cannot efficiently take software that was written by developers and deploy it in runtime environments because they are not purpose-built to manage, cache and secure binary files. Tracking and managing software at the package level enables organizations to make incremental updates to software, and deliver trusted software bill of materials (SBOMs) alongside their software releases. Package management allows software releases to be continuous, and capable of handling the volume, variety, security and velocity of trusted software required today.

Our Platform

We built the world’s first universal software package repository, JFrog Artifactory, to fundamentally transform the way that the software supply chain is managed. Our package-based approach to releasing software allows software releases to be continuous and software to always be current.

We enable organizations to securely store all package types in a common repository where they can be tagged, tracked, and managed. Our unified platform connects all of the software release processes involved in building and releasing software, and enables trust by offering a single source of truth for all software release inputs and outputs. We empower our customers to shorten their software release cycles and enable the continuous flow of current, secure, up-to-date software from any source to any edge. Our platform is designed to be agnostic to the programming languages, source code repositories, and development technologies that our customers use, and the type of production environments to which they deploy.

Our fully integrated suite of products allows our customers to compile software from source code repositories, curate the importation of external packages, manage the dependencies among components within software packages, keep these packages under a single universal repository, manage and automate the usage of open source libraries and packages, scan for vulnerabilities through various stages and contexts, distribute to endpoints, and deploy in production, all through a single user access point. This complete process is often referred to as management and securing of the “software supply chain.”

Since our initial launch of JFrog Artifactory, we have consistently innovated and added new products to expand the capabilities of our platform. Today, our platform comprises the full workflow for releasing trusted, secure software.

Products

JFrog Artifactory

At the center of our platform is JFrog Artifactory, the first universal package repository. It allows teams and organizations to store, update, and manage their software packages at any scale. JFrog Artifactory ensures that all software packages being deployed are the most current by automatically caching dependencies between packages and package versions, including from external sources. JFrog Artifactory supports all major software package technologies and can be seamlessly deployed across public clouds, multi-cloud, on-premises, private cloud, and hybrid environments. As a result, JFrog Artifactory serves as the “single source of truth” for an entire organization’s software packages, ensuring consistency and enabling trust and automation in the software release process.

JFrog Artifactory is also expanding to include MLOps functionality, with the key capability to manage machine learning models and their dependencies as they are released alongside and within software applications. These models and dependencies are foundational components for AI-powered functionality in software applications. We believe this expansion will unite MLOps practitioners with DevSecOps best practices to create a universal software supply chain across an organization.

With JFrog Artifactory at its center, our platform is a cohesive, integrated, end-to-end solution comprised of the following additional products that encompass the complete software release cycle:

•

JFrog Curation. JFrog Curation functions as a guardian outside the software development pipeline, controlling the admission of packages into an organization, primarily from open source or public repositories. JFrog Curation understands package metadata, allowing companies to build policies around the entry or blocking of software packages into a company’s repositories based on multiple factors such as age, version number, security risk, release timelines, target environments and more. Software packages addressed by JFrog Curation rely on the JFrog Catalog of open source package information, with over 4 million unique packages and their advanced metadata available.

•

JFrog Xray (Security Essential). JFrog Xray continuously scans JFrog Artifactory to secure all software packages stored in it. JFrog Xray is able to understand software packages at a binary level, utilizing the metadata stored in JFrog Artifactory to accurately uncover potential vulnerabilities, policy violations, and open source software license compliance issues. This enables more cohesive DevSecOps processes, allowing organizations to achieve both control and trust earlier in their software release cycles by automating security workflows. JFrog Xray also provides unique security information to customers that is derived from a dedicated security research team that uncovers vulnerabilities in public and private repositories.

•

JFrog Advanced Security. JFrog Advanced Security is an optional add-on for select JFrog subscriptions as an advanced, binary-focused security solution integrated into the JFrog Platform. It offers in-depth binary scanning to examine data that is not accessible via package managers, software bill of materials or typical metadata. Natively integrated with JFrog’s Artifactory binary repository and JFrog Xray’s software composition analysis solutions, JFrog Advanced Security capabilities, including source code scanning (SAST), secrets detection, contextual analysis, IaC scanning, container scanning, malicious ML model detection and more, offer holistic coverage for software supply chain security at scale.

•

JFrog Distribution. JFrog Distribution provides reliable, scalable, and secure software package distribution with enterprise-grade performance. It uses proprietary technology to reliably and optimally distribute packages to multiple locations and update them as new release versions are produced. JFrog Distribution offers native support for the major package technologies, allowing smooth integrations between an organization’s deployment tools and the runtime environment, and enabling seamless software releases. JFrog Distribution also offers the industry’s first Private Distribution Network, allowing companies to customize how they distribute software across any infrastructure, device fleet or hybrid topology.

•

JFrog Artifactory Edge. JFrog Artifactory Edge is a specialized, read-only version of JFrog Artifactory, co-located close to the runtime environment. JFrog Artifactory Edge sits downstream from JFrog Distribution, providing reliable deployment of software packages at the actual locations where updates are executed. Designed to work with JFrog Distribution, JFrog Artifactory Edge utilizes and leverages metadata from JFrog Artifactory to facilitate the transfer of only the incremental changes in software packages from their previous versions, rather than entire applications, enabling efficient, real-time updates to edge instances.

•

JFrog Mission Control. JFrog Mission Control is our integrated platform control panel, providing a high-level view of all the moving pieces of an organization’s software supply chain workflow. As part of JFrog Artifactory, JFrog Mission Control allows users to configure and view services under administrative control, whether across any public cloud, on-premise, private cloud, or hybrid environment, or at geographically dispersed development sites.

•

JFrog Insight. JFrog Insight is our universal DevOps intelligence tool. JFrog Insight integrates with our other products to provide customers with powerful BI and analytics capabilities. JFrog Insight processes and collects key metrics, correlates them across diverse systems, and provides actionable insights to development managers, operations teams, and compliance officers across an organization.

•

JFrog Connect. JFrog Connect is our connected device management solution that allows companies to manage software updates and monitor performance across IoT device fleets from anywhere in the world. JFrog Connect scales to automate software package delivery across the development-to-device lifecycle.

•

JFrog Pipelines. JFrog Pipelines is our Continuous Integration and Delivery tool, responsible for automating and orchestrating the movement of software packages through our platform. This includes the creation, compilation, and management of software packages throughout the DevOps workflow. JFrog Pipelines also provides end-to-end visibility and control over the software release cycle, ensuring that various repositories, testing tools, and deployment tools are seamlessly coordinated, while attesting to the security of the pipeline process.

Benefits to Our Customers

•

End-to-end, unified platform. We provide a central, unified platform for our customers’ software release needs with our universal package management solution, JFrog Artifactory, at its core and a portfolio of adjacent products including build integration, workflow automation, security, and deployment. We designed our products to integrate with each other natively, with a unified user interface. This allows organizations to effectively and efficiently manage the full software supply chain through a single user access point.

•

A “blessed” repository for the organization. We designed JFrog Artifactory to be the only package repository that an organization needs. By securely storing, monitoring, and distributing software packages created inside and outside an organization, we provide a single, trusted local repository that any user within an organization can rely on, serving as the system of record for all of the software in an organization. This is commonly referred to as a “blessed repository.” JFrog Artifactory automatically caches updated software packages from both external and internal repositories, ensuring that an organization always has the latest, validated packages available.

•

Acceleration through automation. Our platform accelerates the software release cycle by enabling the automation of workflows across teams and providing tight coordination between development and operations groups, removing silos within organizations’ software release processes. We seamlessly integrate with source code repositories to push software updates and to manage software package flows between all software release gates seamlessly and continuously, offering a uniquely efficient way to orchestrate software release from build to deploy.

•

Hybrid and multi-cloud deployment. We empower organizations to release software that is execution-ready across any number of different production environments. Our platform supports public cloud, on-premise, private cloud, multi-cloud, and hybrid deployments, helping organizations avoid vendor lock-in and allowing software developers, security and IT operators across an organization to use our products in any environment. Our unique model offers the same product in the cloud and on-premise, so users can work in any environment with an identical user experience.

•

Scalable across the organization. Our proprietary technology for package management allows our platform to seamlessly scale across even the largest of customers and deployments. Our platform supports a wide variety of enterprise-scale storage capabilities and also accommodates spikes in usage without compromised performance. The JFrog Platform supports High Availability cluster configuration, in which redundant components are created to maximize network uptime, and can therefore seamlessly serve nearly any number of concurrent users, build servers, and interactions.

•

Trusted and secure. We enable organizations to analyze software packages for vulnerabilities, rapid remediation, license compliance, and quality issues in near real-time. Our fully integrated security solutions enable continuous automation of security policies from before a package enters the organization through to deployment to the runtime. Our platform embeds security into the DevOps workflow, creating a seamless DevSecOps flow that allows organizations to have speed and control in the software release cycle. All software packages on our platform are fully traceable, ensuring the accuracy and reliability of software applications. To enhance application quality while minimizing risk, our security controls offer customizable governance policies to specific software packages and complete auditing capabilities and business impact analysis.

Benefits to Software Developers, Security Teams, and IT Operators

•

Easy, secure, and automated package management. Through our JFrog Artifactory package management solution, software developers, security teams, and IT operators are able to automatically fetch software packages from public and private repositories, ensure that packages are consistent across their organizations’ instances of JFrog Artifactory, scan for vulnerabilities and contextual errors with our security solutions, and manage dependencies among packages. JFrog Curation allows for automated policies to protect companies from undesired software packages before they enter Artifactory. JFrog Artifactory then stores software packages and uses their metadata in a manner similar to a relational database, enabling software developers and IT operators to manage package versions, organize and track dependencies, and perform replication of trusted packages across geographically distributed sites.

•

Integrated across the development ecosystem. We believe in user freedom of choice and provide software developers and IT operators with technology that seamlessly integrates with their ecosystems. Our out-of-the-box integrations with third-party technologies offer software developers and IT operators the freedom to choose their tool stacks, allowing them to minimize disruptions, increase productivity and innovation, and avoid vendor lock-in. Our solution includes user-friendly application programming interfaces (“APIs”) that organizations can use to integrate our products and third-party technologies in a reliable and high-performance manner.

•

Universal and extensible. Our platform natively supports the major package technologies, including package libraries, continuous integration tools, container registries, and testing and deployment tools, and has been designed to quickly and seamlessly add support for new package technologies as they arise. JFrog Artifactory’s ability to search for, manage, and cache software packages from different sources enables software developers and IT operators to execute faster and take advantage of innovation throughout the broader software development ecosystem. As an organization’s development environment changes, our products automatically adjust, with little to no downtime or the need for complex migrations.

Business Model

We combine bottom-up and top-down approaches in our business model. The bottom-up approach is community focused, driving increased usage of our products, in which we focus on demonstrating the value that our products can provide to software developers, security teams and IT operators. Once customers are of a certain size, we engage in a top-down approach for full platform adoption that focuses on enterprise values. To support growth of large strategic customers, JFrog also empowers a direct sales team supported by dedicated DevSecOps technical staff. We strive to make software developers, security teams and IT operators more efficient, effective, and productive, and create champions of JFrog in the process.

•

Our go-to-market strategy.

o

Make software developers, security teams, ML engineers, and IT operators successful. Our consistent product innovation, thought leadership in software supply chain management, and knowledge sharing with software developer, security teams, and IT operator communities engender trust that fuels increased usage of our products. We enable our users to stand out for the value they deliver to their organizations, making others within their organizations want to adopt our products to emulate their success.

o

Enable user freedom of choice. We are agnostic to the types of technologies a software developer or IT operator may choose to use, which is a philosophy that we believe provides us with a competitive advantage. Our platform is designed to quickly and seamlessly add support for new package technologies as they arise.

o

Align pricing with value provided. Our free trials and open source software options provide low-friction entry points for software developers, security teams, and IT operators. Customers often upgrade to paid and higher-tiered subscriptions as they increase their usage of our products.

o

Provide best-in-class support. Our customer support personnel provide extensive engineering-level support directly to software developers, security teams, and IT operators, ensuring those individuals who use our products most are set up to succeed. Our customer support team is differentiated by the number of team members who have engineering backgrounds, which allows our customers to have consistent access to individuals with intimate technical knowledge of our products and of the different technologies and protocols with which they integrate. Our technical support offerings primarily include issue diagnosis and root cause identification, as well as bug isolation and software fix delivery.

o

Directly support strategic accounts. Our strategic sales team focuses on accounts with high expansion potential to deliver more customized experiences and dedicated approaches. This is often a top-down approach or executive-level relationship that ensures JFrog is consistently meeting the needs of top-tier customers.

o

Expanding partnerships & go-to-market motions. We are expanding JFrog’s channel strategy throughout the world, with a focus on emerging markets and localized buying patterns. We believe that in addition to our traditional direct-sales business, channel expansion will drive growth by giving specific industry verticals and geographies purchase options that are flexible to their localized needs. Specifically with public cloud providers, we believe there is great potential for partnerships and channels to be a significant contributor to JFrog’s growth.

•

Multiple tiers of subscriptions. Our subscription structure is aligned with the way we have built our product platform, with JFrog Artifactory at the core of each subscription and a portfolio of adjacent products and services that differ by subscription tier. Our pricing model aligns the value we deliver with our customers’ needs as they scale.

•

Technology partnership ecosystem. Our extensive integrations with technologies across the software development ecosystem power significant extensibility of our platform and offer our customers the ability to use external software development technologies of their choice on our platform, driving increased customer affinity and product stickiness.

Multi-Tiered Subscription Offerings

We offer our products to customers through a multi-tiered subscription structure. Our current paid subscription tiers include JFrog Pro, JFrog Pro X, JFrog Enterprise X, and JFrog Enterprise Plus.

•

JFrog Pro. JFrog Pro provides access to the universal version of JFrog Artifactory and ongoing updates, upgrades, and bug fixes.

•

JFrog Pro X. JFrog Pro X is a self-hosted-only subscription that provides the same features as JFrog Pro with the addition of JFrog Xray basic scanning functionality and license compliance, along with service-level agreement (“SLA”) support.

•

JFrog Enterprise X. JFrog Enterprise X provides the same features as JFrog Pro X with the addition of High Availability cluster configuration, federated repositories, multi-region replication, and JFrog Mission Control, enabling larger enterprise-scale deployments, and SLA support as well as deeper security features. JFrog Enterprise X customers are also able to purchase the full suite of JFrog security products.

•

JFrog Enterprise+ (Enterprise Plus). JFrog Enterprise Plus provides the same features as JFrog Enterprise X, with the addition of JFrog Pipelines, JFrog Insight, JFrog Distribution, and JFrog Artifactory Edge. JFrog Enterprise Plus is our full platform subscription option, delivering our entire suite of products and functionality, as well as Private Distribution Network capabilities. JFrog Enterprise Plus customers are also able to purchase the full suite of JFrog security products.

•

Additional, optional subscriptions.

o

JFrog Advanced Security, with functionality for Infrastructure as Code scanning, container scanning, contextual analysis and more, is available as an optional, add-on subscription for Enterprise X and Enterprise Plus subscribers, as well as through private offers in the cloud marketplaces.

o

JFrog Curation functions as a guardian outside the software development pipeline, controlling the admission of packages into an organization, primarily from open source or public repositories.

o

JFrog Connect functionality for IoT devices is available for separate purchase while in early production phases.

We have an unwavering commitment to the software developer, security teams, and IT operator communities, and show this commitment by offering varying forms of free access to our products in addition to the paid subscriptions described above. This free access takes the form of free trials and open source software, and helps generate demand for our paid offerings within the software developer, security and IT operator communities.

•

Free Trials. We offer time-limited free trials of our platform that allow prospective customers to test the full functionality of a JFrog subscription within their environments or in the cloud. At the end of this trial period, prospective customers must pay for a subscription in order to continue utilizing JFrog services. Community, free services include a limited version of Artifactory as well as a community version for C/C++ developers (Conan).

•

Open Source. Our open source offering is a limited functionality version of JFrog Artifactory that only supports Java-based software packages, and does not support organization-wide adoption by DevOps teams.

Growth Strategies

We intend to pursue the following growth strategies:

•

Extend our technology leadership. We will continue to invest in building new capabilities and extending our platform to bring the power of software supply chain management to a broader range of use cases, including maturation of security solutions for DevSecOps, expansion of AI-enabling technologies including MLOps, and continuing to enable DevOps solutions for devices on the edge. Additionally, we believe acquiring new technologies to complement our organic innovation efforts will help us rapidly adapt to address the evolving needs of the market and drive increased value for our customers.

•

Expand within our existing customer base. We have demonstrated a differentiated ability to retain customers, expand existing customer usage, and cross-sell a broader set of products and features within an organization. Our net dollar retention rate (“ARR”) of 119% as of December 31, 2023 highlights the increasing value of our products to our customer base. While maintaining our self-service and inbound sales model, we intend to continue to expand our strategic sales team to identify new use cases and drive expansion and standardization on JFrog’s Software Supply Chain Platform.

•

Acquire new customers. Our free trial subscription options and open source version of JFrog Artifactory increase software developer, security and IT operator familiarity with our products, and allow for low-friction product adoption. MLOps functionality may expose JFrog solutions to new audiences such as AI/ML Engineers and Data Scientists. Additionally, we have steadily grown our international presence since inception and intend to continue to expand regionally as DevOps and DevSecOps practices are increasingly adopted around the world.

•

Expand and develop our technology partnership ecosystem. We have designed our platform to work with the major package technologies and be deployed in any environment, allowing our technology partners to better serve their customers. We also intend to cultivate and leverage channel and alliance partners, including cloud providers, to grow our market presence and drive greater sales efficiency.

Customers

As of December 31, 2023, we had a global customer base of approximately 7,400 organizations across all industries and sizes, including approximately 83% of Fortune 100 organizations.

As of December 31, 2023, 886 of our customers had ARR of $100,000 or more, increasing from 736 customers as of December 31, 2022, accounting for 68% and 62% of our ARR, respectively. We had 37 customers with ARR of at least $1.0 million as of December 31, 2023, increasing from 19 customers as of December 31, 2022. For the year ended December 31, 2023, our 10 largest customers represented approximately 7% of our total revenue and no single customer accounted for more than 1% of our total revenue. For the year ended December 31, 2023, approximately 38% of our revenue was generated from customers outside of the United States. All references to our customers included in this Annual Report refer to paying customers.

Technology

Our proprietary technology, fueled by our optimized database architecture, enables best-in-class reliability, scalability, and performance.

Our technology includes the following key attributes:

•

Universal package management. The center of our platform, JFrog Artifactory, stores software packages and manages the metadata from major package technologies, including Docker, OCI, Debian, RPM, Go, Helm, Kubernetes, NPM, NuGet, Python, Java and Rust. Our platform is designed to quickly and seamlessly add support for new package technologies as they arise, ensuring a comprehensive view of an organization’s software supply chain.

•

Curated public repositories. JFrog Artifactory automatically queries third-party repositories and allows organizations to exert choice and governance in the software packages they cache. This enables our customers to better maintain control and security via the blacklisting or whitelisting of certain components.

•

Rich metadata. Every package in JFrog Artifactory is stored and referenced using metadata, including dependencies, author, and date modified. We utilize our proprietary technology to store and index metadata, allowing it to be queried for multiple uses such as package promotion, tagging, security, and more, which enables automation. This metadata is critical for organizations meeting new strict software bill of materials requirements.

•

Checksum-based storage. A checksum is a sequence of numbers and letters that serves as a “digital fingerprint.” Each package has a unique checksum that is stored as a file and referenced by JFrog Artifactory, significantly reducing the amount of data needed within JFrog Artifactory or when copying software packages to remote sites or replicating repositories, making it substantially faster than traditional approaches.

•

High Availability. Our High Availability configuration allows multiple JFrog product nodes to be deployed as a redundant cluster to reduce reliance on any single node, ensuring that there can be no single-point-of-failure. Importantly, our High Availability configuration allows customers to update our products with the latest versions with little to no downtime, as each node is updated one at a time.

•

Enterprise-class security and compliance. Organizations can use our platform to help manage the integrity of software being deployed by digitally signing packages and binary files. Groups, API tokens, users, and other characteristics can all be managed from various points within multiple data centers, alongside real-time access replication.

•

Advanced security scanners. Scanners that analyze the actual exploit risk of a vulnerability, in-context, based on the environment under which it exists and minimize security "noise" for developers so that they can focus on fixing the impactful issues. Scanners include Contextual Analysis, Service and Application Exposures, SAST, IaC Analysis and Secrets Detection.

•

Package Admission Filtering. JFrog Curation acts as a firewall for open source and third party packages coming from public repositories. By using JFrog Catalog as a database of open source packages and their advanced metadata, Curation applies policies to govern the admission of new package versions into the company’s repositories.

•

Hierarchical graph of software packages. By tracking against a database of known vulnerabilities, our platform provides continuous security and analysis of software packages in the development environment, making it less likely for vulnerable components to reach production.

•

Easy user plugins. User plugins allow customers to extend the functionality of our products with the JFrog Artifactory REST API, providing a simple way to add functionality, including scheduling tasks, managing security and authentication, license compliance, open source governance, package resolution and deployment, build integration, promotion logic, maintenance, and clean up.

•

Global federation of repositories. The ability to have bi-directional content synchronization across multi-site, globally distributed repositories, used for disaster recovery and geo-location transparency.

•

Scalable peer-to-peer based distribution. To accommodate network traffic bursts when deploying a new software version for thousands of clients concurrently across geographies, overcoming slow or unreliable network connectivity.

•

Smart IoT updates. Lightweight agent that sits on Linux-based IoT devices and facilitates the orchestration of device software updates in an outbound-only network and includes out-of-the-box integration with our Software Supply Chain Platform, providing validation that update bundles are secure and automatically received.

•

Device Remote Access & Control. Ability to connect remotely to services on an edge device using port-mapping or to create a secure shell to devices for debugging and inspection.

Marketing and Sales

Marketing

JFrog’s marketing approach is a dual-pronged effort to both enable and empower users in a bottoms-up motion, as well as enterprise level or “top-down” approach for broad platform adoption at a strategic company level. Our community-focused approach to marketing prioritizes increasing the effectiveness of software developers, security teams, AI/ML engineers, data scientists and IT operators. We empower these technologies to release software faster and more securely, and in the process create champions of our products who are well-positioned to demonstrate the value of JFrog to their broader organizations. These communities can easily engage with our products through free trials and open source software before deciding to use them on a paid basis. We believe this approach gives us a competitive advantage, as technical communities have become integral in spreading awareness of our brand, expanding use cases, and promoting the adoption of our platform in the overall organization. As a result, the value we bring to software developers and IT operators organically drives demand, as increased awareness, knowledge sharing, and adoption leads to greater exposure to the other features and products in our user interface.

Our enterprise-level and field marketing functions support our strategic sales team, providing an account-based approach to drive expansion of JFrog solutions amongst our largest customers and prospects. Additionally, we engage with prospective end-users through user-centered events, including JFrog swampUP, our annual, global DevOps and user conference, hands-on training events, persona-driven events, and co-marketing activities with technology partners and large cloud platforms.

Sales

Flexible self-service, inbound and strategic enterprise sales approaches make it easy for customers to try, adopt, and use our products in a way most advantageous for them, creating a highly efficient sales motion. Our customers can start with an open source version of JFrog Artifactory, free trial subscription options, or land directly with one of our paid subscription tiers. Our open source and free trial options provide low-friction entry points for customers, who often upgrade to paid and higher-tiered subscriptions as they increase their usage of our products through the identification of new use cases, the need for additional functionality, or the adoption of our products by new teams or in new geographies. Once a user has decided to use our products beyond what is available in open source or at the end of a free trial, they can upgrade to one of our paid subscriptions, which are priced based on number of servers or consumption to align the value we deliver with our customers’ needs as they scale.

Our customer success teams are focused on enabling organizations to realize the full benefits of our platform by helping them advance DevSecOps practices and promoting the adoption of additional products and more advanced functionality of our platform. We intend to continue to expand our strategic sales team to identify new use cases and drive expansion and standardization on JFrog within our largest customers.

Competition

The worldwide DevOps and DevSecOps markets are rapidly evolving. We compete on the basis of a number of factors, including:

•

ability to provide an end-to-end, unified platform for the DevOps and DevSecOps workflows;

•

ability to provide security solutions across software developers and enterprise workflows;

•

ability to provide machine learning operation solutions across enterprise workflows;

•

breadth of technologies we support;

•

breadth of technology integrations;

•

total cost of ownership;

•

extensibility across organizations, including software developers, security teams, AI/ML engineers, data scientists, and IT managers;

•

ability to enable collaboration between software developers, security teams, and IT operators;

•

ability to deploy our products in any combination of cloud, multi-cloud or on-premises environments;

•

performance, security, scalability, and reliability in tandem;

•

quality of customer experience and satisfaction;

•

quality of customer support;

•

ease of implementation and use; and

•

brand recognition and reputation.

Our products are available for self-managed, software-as-a-service (“SaaS”), multi-cloud, and hybrid deployments. While we believe we compete successfully on the above factors, particularly with regards to the comprehensive nature of our solutions, we do experience competition in each of these categories with different vendors:

•

Home grown solutions. Over time, many companies built solutions in-house for specific use cases they uniquely required. Often, these solutions do not scale or were not designed to meet the needs of modern software delivery methodologies or technologies.

•

DevOps and developer-focused vendors. Many companies address only certain parts of the DevOps cycle and may compete with a limited set of JFrog offerings, including Microsoft’s GitHub, GitLab, Inc., Cloudsmith and Sonatype.

•

Cloud providers. While also partners, cloud providers, such as Amazon Web Services (AWS), Microsoft Azure (including Azure DevOps) and Alphabet Inc.’s Google Cloud, may compete with a subset of JFrog functionality.

•

Security point solutions. Some security-focused companies may compete with a subset of JFrog’s holistic security offerings or address only developer-level security, such as Aqua Security, Snyk, Sonatype and Synopsys.

•

Diversified vendors. Some diversified technology companies, such as IBM, Inc. (including Red Hat), Pivotal Software and VMware, Inc. (now Broadcom Inc.) may have offerings that compete with certain JFrog products.

Additionally, we may compete with start-up and open source technologies across the categories described above. Many of our competitors have greater financial, technical, and other resources, greater brand recognition, larger sales forces and marketing budgets, broader distribution networks, diverse product and services offerings, and larger and more mature intellectual property portfolios. They may be able to leverage these resources to gain business in a manner that discourages customers from purchasing our offerings. Furthermore, we expect that our industry will continue to attract new investments, including smaller emerging companies, which could introduce new offerings. We may also expand into new technology or geographical markets and encounter additional competitors in such markets.

Our research and development organization is responsible for the design, development, testing, and delivery of new technologies, features, and integrations of our platform, as well as the continued improvement and iteration of our existing products. Our most significant investments in research and development are to drive core technology innovation and bring new products to market. Research and development employees are located primarily in our Israel and India offices.

Our research and development team consists of our architects, software engineers, security experts, DevOps engineers, product management, quality assurance, and data collection teams. We intend to continue to invest in our research and development capabilities to extend our platform and products.

Intellectual Property

Our success depends inpart on our ability to protect our intellectual property. We rely on a combination of copyrights and trade secret laws, confidentiality procedures, employment agreements, license agreements, invention assignment agreements, trademarks, and patents to establish and protect our intellectual property rights, including our proprietary technology, software, know-how, and brand.

As of December 31, 2023, we hold a number of active patents and have filed patent applications both in the U.S. and in other countries. We cannot assure you whether any of our patent applications will result in the issuance of a patent or whether the examination process will require us to narrow our claims. Any of our patents issued in the future may be contested, circumvented, found unenforceable or invalidated, and we may not be able to prevent third parties from infringing them. In addition, we have international operations and intend to continue to expand these operations, and effective patent, copyright, trademark, and trade secret protection may not be available or may be limited in foreign countries.

Although we rely on intellectual property rights, including trade secrets, patents, copyrights, and trademarks, as well as contractual protections to establish and protect our proprietary rights, we believe that factors such as the technological and creative skills of our personnel, creation of new modules, features and functionality, and frequent enhancements to our platform are more essential to establishing and maintaining our technology leadership position.

We control access to, and use of, our proprietary technology and other confidential information through the use of internal and external controls, incl uding contractual protections with employees, contractors, customers, and partners, and our software is protected by U.S. and international copyright and trade secret laws. We require our employees, consultants, and other third parties to enter into confidentiality and proprietary rights agreements and control access to software, documentation, and other proprietary information. Our policy is to require employees and independent contractors to sign agreements assigning to us any inventions, trade secrets, works of authorship, developments, and other processes generated by them on our behalf and agreeing to protect our confidential information. In addition, we generally enter into confidentiality agreements with our customers and partners. See the section titled “Risk Factors” for a more comprehensive description of risks related to our intellectual property.

Government Regulations

Our business activities are subject to various federal, state, local and international laws, rules and regulations. For example, we are subject to numerous laws, directives, and regulations regarding privacy, data protection, and data security and the collection, storing, sharing, use, processing, transfer, disclosure, and protection of personal information and other data. In addition, in some cases, our software is subject to export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce, and our activities may be subject to certain trade and economic sanctions. Any failure or perceived failure to comply with laws and regulations that currently apply or become applicable to our business in Israel, the United States and internationally could have an adverse effect on our business and results of operations. Compliance with these laws, rules and regulations has not had, and is not expected to have, a material effect on our capital expenditures, results of operations and competitive position as compared to prior periods. For additional information about government regulation applicable to our business, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

Employees and Human Capital

Our Board of Directors and its committees share oversight of our human capital management strategy. The Nominating and Corporate Governance Committee has oversight of our approach to human capital and inclusion and diversity as part of its broader oversight of our Environmental, Social, and Governance strategy and initiatives. We annually conduct talent reviews and succession planning and the Board of Directors receives updates from senior management regarding succession planning, management talent assessment, and employee attrition. The Audit Committee reviews with management our ethics and compliance programs for human capital and workplace-related issues. The Compensation Committee provides oversight of our overall compensation philosophy, policies and programs, and their respective alignment with our human capital strategy.

As of December 31, 2023, we had a total of approximately 1,400 employees globally, including approximately 750 employees located in Israel and approximately 350 employees in the United States. None of our employees are represented by labor unions or, except for our employees in France and Spain, covered by collective bargaining agreements.

Our Culture

Our core values are reflected in our CODEX, which was created by our employees. We emphasize these values through formal and informal training. Each year we conduct a CODEX employee engagement survey asking for employee feedback to better understand our strengths and weaknesses and assess the alignment of the CODEX with the needs of our company. Based on the results of our annual employee surveys, we believe the CODEX will continue to support our growth and success moving forward:

•

Integrity. We subscribe to presenting the truth, honestly, even if it’s subjective, in order to achieve mutual well-being and transparency. We might make mistakes, but we always play fair.

•

Community and Customer Happiness. As pain solvers focused on the solution and not on the problem, we invest time and effort to build and develop strategic, long-term relationships to ensure happiness among our community and customers.

•

Thinking BIG. We encourage our employees to stretch their capabilities, knowing that while we think outside the box, every detail counts.

•

Everyone Counts Everyone Matters. Each and every employee has a significant and driving impact on the success of JFrog. Everyone has a voice and everyone’s thoughts and ideas matter.

•

Innovation. We strive for technological excellence and innovation, stepping outside our comfort zone to achieve more and support market needs.

•

Team Spirit. We foster an atmosphere of genuine teamwork and believe in the importance of mutual trust, joint effort, and collaboration to ensure our collective success.

•

Open Communication. Anyone can approach everyone about anything at any time regardless of rank or affiliation.

•

Agility. We believe change is an opportunity; an agile mindset leads us to better results in a rapidly changing environment.

•

WIN! We believe that with a “good enough” mindset, we will never achieve greatness.

•

Care. We care more; it’s the source of our “better-ness.”

Recruiting, Training and Development

Our human capital objectives include, as applicable, identifying, recruiting, retaining, incentivizing and integrating our existing and new employees and consultants. We attract new employees by advertising on our JFrog careers website, as well as leveraging our employee referral program. In order to meet our professional development objectives, we have implemented several formal and informal cross-company training programs to train new managers and employees with the skills to embark on a successful career at JFrog. In addition to annual performance reviews and merit-based compensation, we also encourage employees and their managers to maintain an open dialogue on progress throughout the year. Moreover, we focus on providing each employee an individualized career path and professional development opportunities.

Diversity, Inclusion and Equity (“DEI”)

We recognize and view equality as key to our success. We strive to foster a culture of diversity and inclusion so that all of our employees feel they are respected and treated equally, regardless of gender, race, ethnicity, age, disability, sexual orientation, gender identity, cultural background or religious belief. We emphasize this principle in our CODEX value “Everyone Counts Everyone Matters” and aim to provide our employees a diverse, equitable, and inclusive work environment.

We continue to support DEI-focused hiring and mandatory DEI training for all employees. For example, our workforce is diverse both in ethnicity and gender, including and up to the highest level of management, where three of our 9-member board and four of our 12-member executive management team are women.

Compensation and Benefits

Our compensation policy is designed to attract, retain and reward personnel. In addition to competitive base salaries and other cash compensation, we offer equity incentive plans that align the interest of our employees with our shareholders by motivating individuals to perform to the best of their abilities and achieve our business objectives, driving the success of our company and increasing shareholder value.

Workforce Health and Safety

In addition to traditional employee benefits, we have implemented a number of initiatives to support the well-being, safety and health of our employees. We provide comprehensive health insurance that includes medical, dental, vision, and prescription drug coverage, along with many other benefits such as wellness and fitness membership reimbursement programs. Additionally, we are committed to workplace safety and security through office maintenance, employee training, and emergency protocols.

Corporate Information

We were incorporated under the laws of the State of Israel on April 28, 2008. We are registered with the Registrar of Companies under the company number 514130491. Our main place of business in the United States is located at 270 E. Caribbean Drive, Sunnyvale, California 94089. Our telephone number at this address is (408) 329-1540. Our registered office is located at 3 HaMahshev Street, Netanya, 4250465, Israel. Our telephone number at this address is + 972 (9)-894-1444. Our agent for service of process in the United States is JFrog, Inc.

“JFrog,” our logo, and our other registered or common law trademarks, service marks or trade names appearing in this Annual Report on Form 10-K are the property of JFrog Ltd. Other trademarks and trade names referred to in this Annual Report on Form 10-K are the property of their respective owners.

Available Information

Our website address is https://www.jfrog.com, our investor relations website is https://investors.jfrog.com, our blog https://www.jfrog.com/blog and our Twitter account is @JFrog. We have used, and intend to continue to use, our website, investor relations website, our blog and Twitter accounts as a means of disclosing material non-public information and for complying with our disclosure obligations under Regulation FD. The following filings are available through our investor relations website after we file them with the SEC: Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, current reports on Form 8-K, and our Proxy Statement for our annual meeting of shareholders. These filings are also available for download free of charge on our investor relations website. The SEC also maintains an Internet website that contains reports, proxy statements and other information about issuers, like us, that file electronically with the SEC. The address of that website is https://www.sec.gov.

We webcast our earnings calls and certain events we participate in or host with members of the investment community on our investor relations website. Additionally, we provide notifications of news or announcements regarding our financial performance, including SEC filings, investor events, press and earnings releases, and blogs as part of our investor relations website. Further corporate governance information, including our corporate governance guidelines, code of business conduct and ethics, and committee charters is also available on our investor relations website. Information contained on, or that can be accessed through, the websites provided does not constitute part of this Annual Report on Form 10-K or in any other report or document we file with the SEC, and inclusions of website addresses in this Annual Report on Form 10-K are inactive textual references only.