JFrog Ltd

Overview

JFrog provides a hybrid, universal, end-to-end software supply chain platform for delivering trusted, secure software updates from code to production. Our goal is to function as the single source of truth for an organization’s software footprint, bridging digital gaps between developers, security teams, machine learning engineers, data scientists, and other business units to empower a world of always-on, always-current software which we refer to as “Liquid Software.”

Today, DevOps, DevSecOps, and MLOps teams have a universal goal within organizations: ship secure, intelligent software more efficiently and confidently. As a pioneer in the DevOps movement, JFrog recognizes the challenges that companies face as they attempt to converge traditional software development practices, operational teams, security (or DevSecOps), artificial intelligence (“AI”), machine learning (or MLOps) and more. This rapidly-evolving demand requires a new generation of tooling that encompasses the complete software supply chain; a platform that serves many functions in an organization.

We expect that our all-inclusive platform serving “EveryOps” will endure: as the volume of software increases - created both by developers and by emerging generative AI technologies - companies will increasingly require scalable, efficient tools to help manage workflows, processes, policies, application security and all software components. JFrog serves demanding enterprises, leading companies to increasingly appoint JFrog as their system of record across their software development organizations.

Software and the Business Environment

Software’s role has changed from a functional tool to a cornerstone of nearly every company, dictating that the continuous development and release of software is now a mission-critical operation. Beyond providing competitive advantage for companies, the safety and security of people’s data is now often software-dependent.

To meet this need, updating a feature of a software application, rather than releasing a new version of the entire application, ensures that current software is brought to market faster, allowing organizations to be more responsive to their customers’ needs, security concerns and corporate welfare.

The proliferation of open source software, and availability of newer and more efficient software development technologies such as AI technologies, enable organizations to produce software at an increasing rate. However, with speed can come software supply chain complexity through disparate services, adoption of containers, and deployment across hybrid and multi-cloud environments. Organizations’ existing approaches can create silos and bottlenecks around critical steps, such as planning, curating, building, testing, securing, and delivering intelligent software. The merging of new technologies with legacy approaches has placed significant strain on traditional software workflows, which are even further complicated by the introduction of AI components.

The DevOps, DevSecOps, and MLOps Workflows

DevOps is a maturing discipline that integrates software development and operations, shortening, automating, and improving the software build and release workflow. DevOps is a combination of technologies, methodologies, and culture that powers a continuous, fast, and secure software release cycle.

The DevSecOps workflow spans the DevOps workflow, but with the addition of security capabilities, including the planning, curating, coding, building, securing, and testing of software components by developers, to the secure releasing, deploying, operating, and monitoring of that software by operators. Sometimes dubbed “shifting left,” DevSecOps integrates security practices across the DevOps workflow for early detection of issues and ongoing software security throughout the software’s lifecycle. JFrog provides the common ground for software developers, security teams, and IT operators, making it integral to the DevOps and DevSecOps workflows to create trusted software releases.

Similar to the DevOps workflow, the MLOps workflow combines the work of data science and machine learning engineering teams who build, train, and deploy machine learning models with operational motions that bring these models and AI-empowering technologies into production as part of an application.

The convergence of DevOps, DevSecOps, and MLOps solutions into a single platform allows JFrog to address multiple processes to enable more rapid, intelligent application delivery across a business.

Code Versus Software Packages

Modern society heavily relies on software, and most individuals understand that software comes from code generated by software developers. But software, in code form, doesn’t equate to an application. Code is built (i.e., transformed) into binary files (or “software packages”) that allow it to run alongside other components as a complete application for consumers as it runs on a server or device. The vast majority of applications today are built using only a small percentage of original source code written by developers, with an estimated >80% of an application’s binaries coming from open source, existing software. JFrog’s unified platform (“JFrog Platform”) is designed to universally manage and deploy all types of software packages within an organization, making it the system of record for an organization’s software, whether bespoke or consumed from a third party.

Increasingly, the need to manage software components is being heavily influenced by the emerging needs to manage machine learning models (and large language models) and their dependencies. The increasingly large volumes and complexity of packages within an organization’s software supply chain requires a new, systematic, and automated approach to trusted management of packages. Tracking and managing software at the package level enables organizations to make incremental updates to software and deliver trusted software bill of materials alongside their software releases. Universal package management allows software releases to be continuous, and capable of handling the volume, variety, security, and velocity of trusted software required today.

Our Platform

The JFrog Platform connects all of the software release processes involved in building and releasing software, enabling trust by offering a single source of truth for all software release inputs and outputs. We empower our customers to shorten their software and AI technology release cycles and enable the continuous flow of current, secure, up-to-date software from any source to any distributed edge. Our platform is designed to be agnostic to the programming languages, source code repositories, and development technologies that our customers use, and the type of production environments to which they deploy.

The JFrog Platform allows customers to compile software from source code repositories, curate the importation of external software packages, manage the dependencies among components within software packages, keep these packages under a single universal repository, manage and automate the usage of open source libraries and packages, scan for vulnerabilities through various stages and contexts, distribute to endpoints, and deploy securely to production, all through a single user access point. This complete process is often referred to as management and securing of the “software supply chain.”

Since JFrog’s inception with the creation of the software package management category (JFrog Artifactory), we have consistently innovated and added new solutions to expand the capabilities of our platform.

The JFrog Platform

Solutions

JFrog Platform solutions enable enterprise DevOps, DevSecOps, and MLOps teams to efficiently and securely collaborate to deliver traceable and trusted software at near-infinite scale.

•

JFrog Artifactory. JFrog Artifactory provides core functionality to the JFrog Platform. It allows teams and organizations to store, update, and manage software packages at any scale, ensuring all software packages being deployed are current, secure, and trusted. JFrog Artifactory supports all major software package technologies, and can be seamlessly deployed on public clouds, in multi-cloud environments, on-premises, in a private cloud, and across hybrid environments. Serving as the “single source of truth” for an entire organization’s software supply chain components, JFrog Artifactory ensures consistency, trust, and automation in the software release process.

For data science and MLOps teams, JFrog Artifactory also manages machine learning models - the fuel of expanding AI technologies - and their dependencies as part of a new generation of companies’ AI-driven applications. We believe JFrog uniquely unites MLOps practitioners with DevSecOps best practices to create a universal software supply chain across an organization.

•

JFrog Curation. JFrog Curation is an optional add-on and functions as a guardian outside the software development pipeline, controlling the admission of packages into an organization, primarily from open source or public repositories. JFrog Curation understands package metadata, allowing companies to build policies around the entry or blocking of software packages into a company’s repositories based on multiple factors such as age, version number, security risk, release timelines, target environments, and more. JFrog Curation relies on the JFrog Catalog of open source package information, with over 4 million unique packages and their advanced metadata available.

•

JFrog Xray (Security Essentials). JFrog Xray continuously scans JFrog Artifactory to secure all software packages stored in it. JFrog Xray is able to understand software packages at a binary level, utilizing the metadata stored in JFrog Artifactory to accurately uncover potential vulnerabilities, policy violations, and open source software license compliance issues. JFrog Xray also provides unique security information to customers that is derived from a dedicated security research team that uncovers vulnerabilities in public and private repositories.

•

JFrog Advanced Security. JFrog Advanced Security is an optional add-on for select JFrog subscriptions as an advanced security solution integrated into the JFrog Platform. It offers in-depth binary scanning to examine data that is not accessible via package managers, software bill of materials or typical metadata. Natively integrated with JFrog’s Artifactory binary repository and JFrog Xray’s software composition analysis solutions, JFrog Advanced Security capabilities, including source code scanning (“SAST”), secrets detection, contextual analysis, Infrastructure as Code (“IaC”) scanning, container scanning, malicious machine learning model detection and more, offer holistic coverage for software supply chain security at scale.

•

JFrog Runtime Security. JFrog Runtime Security is an optional add-on for select JFrog subscriptions that is designed to work seamlessly with other JFrog Security solutions. It offers insight into runtime environments (such as Kubernetes clusters), delivering full visibility and traceability of compromising software components for DevOps and Security teams.

•

JFrog Distribution. JFrog Distribution provides reliable, scalable, and secure software package distribution with enterprise-grade performance. It uses proprietary technology to reliably distribute packages to multiple locations and update them as new release versions are produced. JFrog Distribution offers native support for the major package technologies, allowing smooth integrations.

•

JFrog Connect. JFrog Connect is a connected device management solution that allows companies to manage software updates and monitor performance across Internet of Things (“IoT”) device fleets from anywhere in the world. JFrog Connect scales to automate secure software package delivery across the development-to-device lifecycle.

•

JFrog ML. JFrog ML is a platform-integrated solution designed for data science and MLOps teams to transform and store data, build, train, and deploy models, and monitor the entire Machine Learning pipeline as part of the JFrog Software Supply Chain Platform.

Benefits to Our Customers

•

End-to-end, unified platform. We provide a central, unified platform for our customers’ software release needs with our universal package management solution, JFrog Artifactory, at its core and a portfolio of adjacent solutions including build integration, workflow automation, software supply chain security, and deployment. We designed our products to integrate with each other natively, with a unified user interface. This allows organizations to effectively and efficiently manage the full software supply chain through a single user access point.

•

A single source of truth for the digital organization. We designed JFrog Artifactory to be the only software package repository that an organization needs. By securely storing, monitoring, and distributing software packages created inside and outside an organization, we provide a single, trusted local repository that any user within an organization can rely on, serving as the system of record for all of the software in an organization. JFrog Artifactory automatically caches updated software packages from both external and internal repositories, ensuring that an organization always has the latest, validated packages available.

•

Acceleration through automation. Our platform accelerates the software release cycle by enabling the automation of workflows across teams and providing tight coordination between development, security, data science, machine learning and operations groups, removing silos within organizations’ software release processes. We seamlessly integrate with source code repositories to push software updates and to manage software package flows between all software release gates seamlessly and continuously, offering a uniquely efficient way to orchestrate software release from build to deploy.

•

Hybrid and multi-cloud deployment. We empower organizations to release software that is execution-ready across any number of different production environments. Our cloud-native platform supports public cloud, on-premise, private cloud, multi-cloud, and hybrid deployments, helping organizations avoid vendor lock-in and allowing software developers, security, machine learning, and IT operators across an organization to use our products in any environment. Our unique model offers the same product in the cloud and on-premise, so users can work in any environment with an identical user experience.

•

Scalable across the organization. Proprietary technology allows our platform to seamlessly scale across even the largest of customers and deployments. Our platform supports a wide variety of enterprise-scale storage and retention capabilities and also accommodates spikes in usage without compromised performance. The JFrog Platform supports High Availability cluster configuration, in which redundant components are created to maximize network uptime and can therefore seamlessly serve nearly any number of concurrent users, build servers, and interactions.

•

Trusted and secure. We enable organizations to analyze software packages for vulnerabilities, rapid remediation, license compliance, and quality issues in near real-time. Our fully integrated security solutions enable continuous automation of security policies from before a package enters the organization through to deployment to the runtime. Our platform embeds security into the DevOps and MLOps workflow, creating a seamless DevSecOps and MLSecOps flow that allows organizations to have speed and control in the software release cycle. All software packages on our platform are fully traceable, ensuring the accuracy and reliability of software applications. To enhance application quality while minimizing risk, our security controls offer customizable governance policies to specific software packages and complete auditing capabilities and business impact analysis.

Benefits to Software Developers, Security Teams, Machine Learning Engineers, Data Scientists, and IT Operators

•

Easy, secure, and automated package management. Through our JFrog Artifactory package management solution, software developers, security teams, machine learning engineers, and IT operators are able to automatically fetch software packages from public and private repositories, ensure that packages are consistent across their organizations’ instances of JFrog Artifactory, scan for vulnerabilities and contextual errors with our security solutions, and manage dependencies among packages. JFrog Curation allows for automated policies to protect companies from undesired software packages before they enter Artifactory. JFrog Artifactory then stores software packages and uses their metadata in a manner similar to a relational database, enabling software developers and IT operators to manage package versions, organize and track dependencies, and perform replication of trusted packages across geographically distributed sites.

•

Integrated across the development ecosystem. We believe in user freedom of choice and provide software developers and IT operators with technology that seamlessly integrates with their ecosystems. Our out-of-the-box integrations with third-party technologies offer software developers and IT operators the freedom to choose their tool stacks, allowing them to minimize disruptions, increase productivity and innovation, and avoid vendor lock-in. Our solution includes user-friendly application programming interfaces (“APIs”) that organizations can use to integrate our hybrid solutions and third-party technologies in a reliable and high-performance manner.

•

Universal and extensible. Our platform natively supports all major package technologies, including package libraries, continuous integration tools, container registries, and testing and deployment tools, and has been designed to quickly and seamlessly add support for new package technologies as they arise, including ML- and AI-centric packages. JFrog Artifactory’s ability to search for, manage, and cache software packages from different sources enables software developers, security teams, data scientists, and IT operators to execute faster and take advantage of innovation throughout the broader software development ecosystem. As an organization’s development environment changes, our products automatically adapt, with little to no downtime or the need for complex migrations.

Business Model

We combine bottom-up and top-down approaches in our business model. The bottom-up approach is community focused, driving increased usage of our products, in which we focus on demonstrating the value that our products can provide to software developers, security teams, data scientists, and IT operators. Increasingly, we have adopted a top-down motion for full platform adoption that focuses on enterprise values for both new and expansion business. To support growth of large strategic customers, JFrog also empowers a direct sales team supported by dedicated DevSecOps technical staff. We strive to make software developers, security teams, MLOps teams, and IT operators more efficient, effective, and productive, and create champions of JFrog in the process.

•

Our go-to-market strategy.

o

Make software developers, security teams, machine learning engineers, and IT operators successful. Our product innovation, thought leadership in software supply chain management, and knowledge sharing with software developer, security teams, machine learning, and IT operator communities engender trust that fuels increased usage of our products. We enable our users to stand out for the value they deliver to their organizations, making others within their organizations want to adopt our products to emulate their success.

o

Enable user freedom of choice. We are agnostic to the types of technologies a software developer or IT operator may choose to use, which we believe provides us with a competitive advantage. Our platform is designed to quickly and seamlessly add support for new package technologies as they arise.

o

Align pricing with value provided. Our free trials and open source software options provide low-friction entry points for software developers, security teams, and IT operators. Customers often upgrade to paid and higher-tiered subscriptions as they increase their usage of our products.

o

Provide best-in-class support. Our customer support and customer success teams provide extensive engineering-level support directly to software developers, security teams, machine learning engineers, and IT operators. Our customer support team is differentiated by the number of team members who have engineering backgrounds, which allows our customers to have consistent access to individuals with intimate technical knowledge of our products and of the different technologies and protocols with which they integrate.

o

Directly support strategic accounts. Our strategic sales team focuses on accounts with high expansion potential to deliver more customized experiences and dedicated approaches. This is often a top-down approach or executive-level relationship that ensures JFrog is consistently meeting the needs of top-tier customers with high scalability requirements.

o

Expanding partnerships and go-to-market motions. We are expanding JFrog’s channel strategy throughout the world, with a focus on emerging markets and localized buying patterns. We believe that in addition to our traditional direct-sales business, channel expansion will drive growth by giving specific industry verticals and geographies purchase options that are flexible to their localized needs. Specifically with public cloud providers, we believe that enhancing our partnership relationships and channel strategy may be a significant contributor to JFrog’s growth.

•

Multiple tiers of subscriptions. Our subscription structure is aligned with the way we have built our product platform, with JFrog Artifactory at the core of each subscription and a portfolio of specific solutions and services that differ by subscription tier. Our pricing model aligns the value we deliver with our customers’ needs as they scale.

•

Technology partnership ecosystem. Our extensive integrations with technologies across the software development and AI ecosystems power significant extensibility of our platform and offer our customers the ability to use external software development technologies of their choice on our platform, driving increased customer affinity and product stickiness.

Multi-Tiered Subscription Offerings

We offer our products to customers through a multi-tiered subscription structure. Our current paid subscription tiers include JFrog Pro, JFrog Pro X, JFrog Enterprise X, and JFrog Enterprise Plus.

•

JFrog Pro. JFrog Pro is cloud-only subscription that provides access only to the universal version of JFrog Artifactory and ongoing updates, upgrades, and bug fixes.

•

JFrog Pro X. JFrog Pro X is a self-managed-only subscription that provides the same features as JFrog Pro with the addition of JFrog Xray basic scanning functionality and license compliance, along with service-level agreement (“SLA”) support.

•

JFrog Enterprise X. JFrog Enterprise X provides the same features as JFrog Pro X with the addition of High Availability cluster configuration, federated repositories, multi-region replication, and JFrog Mission Control, enabling larger enterprise-scale deployments, and SLA support as well as deeper security features. JFrog Enterprise X customers are also able to purchase the full suite of JFrog security and/or IoT products and are granted access to JFrog and GitHub integrations including GitHub Copilot and GitHub Advanced Security integrations designed for a single platform experience for developers.

•

JFrog Enterprise+ (Enterprise Plus). JFrog Enterprise Plus provides the same features as JFrog Enterprise X, with the addition of JFrog Distribution, Access Federation, private content delivery network cloud capabilities, and private edge nodes. JFrog Enterprise Plus is our full platform subscription option, delivering our entire suite of products and functionality, as well as Private Distribution Network capabilities. JFrog Enterprise Plus customers are also able to purchase the full suite of JFrog security and/or IoT products and are granted access to JFrog and GitHub integrations, including GitHub Copilot and GitHub Advanced Security integrations designed for a single platform experience for developers.

•

JFrog ML, with features to help data science and machine learning engineering teams build, test and deploy machine learning models into the software development pipeline, is available to Enterprise X and Enterprise Plus customers.

•

Additional, optional subscriptions.

o

JFrog Advanced Security, with functionality for SAST, IaC scanning, container scanning, contextual analysis and more, is available as an optional, add-on subscription for Enterprise X and Enterprise Plus subscribers, as well as through private offers in the cloud marketplaces.

o

JFrog Runtime Security, with functionality that provides in-depth security monitoring and analysis of production environments, is available as an optional, add-on subscription for customers already utilizing JFrog Advanced Security and Curation.

o

JFrog Curation functions as a guardian outside the software development pipeline, controlling the admission of packages into an organization, primarily from open source or public repositories.

o

JFrog Connect functionality for IoT devices is available for separate purchase as a means to control updates and deployments to device fleets.

We have an unwavering commitment to the software developer, MLOps teams, security teams, and IT operator communities, and demonstrate this commitment by offering varying forms of free access to our products in addition to the paid subscriptions described above. This free access takes the form of free trials and open source software and helps generate demand for our paid offerings within these communities.

•

Free Trials. We offer time-limited free trials of our platform that allow prospective customers to test the full functionality of a JFrog subscription within their environments or in the cloud. At the end of this trial period, prospective customers must pay for a subscription in order to continue utilizing JFrog services. Community, free services include a limited version of Artifactory as well as a community version for C/C++ developers (Conan).

•

Platform Tours. We offer environments with pre-populated data and streamlined experiences to allow prospective customers the ability to securely test-drive functionality without requiring their own data.

•

Open Source. Our open source offering is a limited functionality version of JFrog Artifactory that only supports Java-based software packages, and does not support organization-wide adoption by DevOps teams.

Growth Strategies

We intend to pursue the following growth strategies:

•

Extend our technology leadership. We expect to continue to invest in building new capabilities and extending our platform to bring the power of software supply chain management to a broader range of use cases, including maturation of security solutions for DevSecOps, expansion of AI-enabling technologies including MLOps, and continuing to enable DevOps solutions for devices on the edge. Additionally, we believe acquiring new technologies to complement our organic innovation efforts will help us rapidly adapt to address the evolving needs of the market and drive increased value for our customers.

•

Expand within our existing customer base. We have demonstrated a differentiated ability to retain customers, expand existing customer usage, and cross-sell a broader set of products and features within an organization. Our net dollar retention rate of 116% as of December 31, 2024, highlights the increasing value of our products to our customer base. While maintaining our self-service and inbound sales model, we intend to continue to expand our strategic sales team to identify new use cases and drive expansion and standardization on JFrog’s Software Supply Chain Platform.

•

Acquire new customers. Our free trial subscription options and open source version of JFrog Artifactory increase software developer, security and IT operator familiarity with our products, and allow for low-friction product adoption. MLOps functionality may expose JFrog solutions to new audiences such as AI/machine learning Engineers and Data Scientists. Additionally, we have steadily grown our international presence since inception and intend to continue to expand regionally as DevOps and DevSecOps practices are increasingly adopted around the world.

•

Expand and develop our technology partnership ecosystem. We have designed our platform to work with the major package technologies and be deployed in any environment, allowing our technology partners to better serve their customers. We also intend to cultivate and leverage channel and alliance partners, including cloud providers, to grow our market presence and drive greater sales efficiency.

Customers

As of December 31, 2024, we had a global customer base of approximately 7,300 organizations across all industries and sizes, including approximately 82% of Fortune 100 organizations.

As of December 31, 2024, 1,018 of our customers had annual recurring revenue (“ARR”) of $100,000 or more, increasing from 886 customers as of December 31, 2023, accounting for 72% and 68% of our ARR, respectively. We had 52 customers with ARR of at least $1.0 million as of December 31, 2024, increasing from 37 customers as of December 31, 2023. For the year ended December 31, 2024, our 10 largest customers represented approximately 8% of our total revenue. Additionally, approximately 40% of our revenue was generated from customers outside of the United States. All references to our customers included in this Annual Report refer to paying customers.

Technology

Our proprietary technology, fueled by our optimized database architecture, enables best-in-class reliability, scalability, and performance.

Our technology includes the following key attributes:

•

Universal package management. The center of our platform, JFrog Artifactory, stores software packages and manages the metadata from major package technologies, including Docker, OCI, Debian, RPM, Go, Helm, Kubernetes, NPM, NuGet, Python, Java, Rust, and machine learning models and datasets. Our platform is designed to quickly and seamlessly add support for new package technologies as they arise, ensuring a comprehensive view of an organization’s software supply chain.

•

Curated public repositories. JFrog Artifactory automatically queries third-party repositories and allows organizations to exert choice and governance in the software packages they cache. This enables our customers to better maintain control and security via the blacklisting or whitelisting of certain components.

•

Rich metadata. Every package in JFrog Artifactory is stored and referenced using metadata, including dependencies, author, and date modified. We utilize our proprietary technology to store and index metadata, allowing it to be queried for multiple uses such as package promotion, tagging, security, and more, which enables automation. This metadata is critical for organizations meeting new strict software bill of materials requirements.

•

Checksum-based storage. A checksum is a sequence of numbers and letters that serves as a “digital fingerprint.” Each package has a unique checksum that is stored as a file and referenced by JFrog Artifactory, significantly reducing the amount of data needed within JFrog Artifactory or when copying software packages to remote sites or replicating repositories, making it substantially faster than traditional approaches.

•

High Availability. Our High Availability configuration allows multiple JFrog product nodes to be deployed as a redundant cluster to reduce reliance on any single node, ensuring that there can be no single-point-of-failure. Importantly, our High Availability configuration allows customers to update our products with the latest versions with little to no downtime, as each node is updated one at a time.

•

Enterprise-class security and compliance. Organizations can use our platform to help manage the integrity of software being deployed by digitally signing packages and binary files. Groups, API tokens, users, and other characteristics can all be managed from various points within multiple data centers, alongside real-time access replication.

•

Advanced security scanners. Scanners that analyze the actual exploit risk of a vulnerability, in-context, based on the environment under which it exists and minimize security "noise" for developers so that they can focus on fixing the impactful issues. Scanners include Contextual Analysis, Service and Application Exposures, SAST, IaC Analysis and Secrets Detection.

•

Machine learning security. Scanners that identify malicious behavior or vulnerabilities embedded in Machine Learning model files of different formats.

•

Package Admission Filtering. JFrog Curation acts as a firewall for open source and third party packages coming from public repositories. By using JFrog Catalog as a database of open source packages and their advanced metadata, Curation applies policies to govern the admission of new package versions into the company’s repositories.

•

Hierarchical graph of software packages. By tracking against a database of known vulnerabilities, our platform provides continuous security and analysis of software packages in the development environment, making it less likely for vulnerable components to reach production.

•

Easy user plugins. User plugins allow customers to extend the functionality of our products with the JFrog Artifactory REST API, providing a simple way to add functionality, including scheduling tasks, managing security and authentication, license compliance, open source governance, package resolution and deployment, build integration, promotion logic, maintenance, and clean up.

•

Global federation of repositories. The ability to have bi-directional content synchronization across multi-site, globally distributed repositories, used for disaster recovery and geo-location transparency.

•

Machine Learning lifecycle management. End-to-end platform for development of machine learning applications and management of their versioned software components, including model and dataset registry, feature store, security scanning, model experiment tracking, model promotion, deployment, serving and monitoring.

•

Smart IoT updates. Lightweight agent that sits on Linux-based IoT devices and facilitates the orchestration of device software updates in an outbound-only network and includes out-of-the-box integration with our Software Supply Chain Platform, providing validation that update bundles are secure and automatically received.

•

Device Remote Access & Control. Ability to connect remotely to services on an edge device using port-mapping or to create a secure shell to devices for debugging and inspection.

Marketing and Sales

Marketing

JFrog’s marketing approach is a dual-pronged effort to both enable and empower users in a bottoms-up motion, as well as enterprise level or “top-down” approach for broad platform adoption at a strategic company level. Our community-focused approach to marketing prioritizes increasing the effectiveness of software developers, security teams, machine learning engineers, data scientists and IT operators. We empower these technologies to release software faster and more securely, and in the process create champions of our products who are well-positioned to demonstrate the value of JFrog to their broader organizations. These communities can easily engage with our products through free trials and open source software before deciding to use them on a paid basis. We believe this approach gives us a competitive advantage, as technical communities have become integral in spreading awareness of our brand, expanding use cases, and promoting the adoption of our platform in the overall organization. As a result, the value we bring to software developers and IT operators organically drives demand, as increased awareness, knowledge sharing, and adoption leads to greater exposure to the other features and products in our user interface.

Our enterprise-level and geography-focused field marketing functions support our strategic sales team, providing an account-based approach to drive expansion of JFrog solutions amongst our largest customers and prospects. Additionally, we engage with prospective end-users through user-centered events, including JFrog swampUP, our annual, global DevOps, DevSecOps, and MLOps user conference, hands-on training events, persona-driven events, and co-marketing activities with technology partners and large cloud platforms.

Sales

Flexible self-service, inbound and strategic enterprise sales approaches make it easy for customers to try, adopt, and use our products in a way most advantageous for them, creating a highly efficient sales motion. Our customers can start with an open source version of JFrog Artifactory, free trial subscription options, or land directly with one of our paid subscription tiers. Our open source and free trial options provide low-friction entry points for customers, who often upgrade to paid and higher-tiered subscriptions as they increase their usage of our products through the identification of new use cases, the need for additional functionality, or the adoption of our products by new teams or in new geographies. Once a user has decided to use our products beyond what is available in open source or at the end of a free trial, they can upgrade to one of our paid subscriptions, which are priced based on number of servers or consumption to align the value we deliver with our customers’ needs as they scale.

Our customer success teams are focused on enabling organizations to realize the full benefits of our platform by helping them advance DevOps, DevSecOps, and MLOps practices and promoting the adoption of additional products and more advanced functionality of our platform. We intend to continue to expand our strategic sales team to identify new use cases and drive expansion and standardization on JFrog within our largest customers.

Competition

We compete in the DevOps, DecSecOps, and MLOps markets on the basis of a number of factors, including:

•

ability to provide an end-to-end, unified platform for secure software supply chain workflows;

•

ability to provide security solutions across software developers and enterprise workflows;

•

ability to provide machine learning operation solutions across enterprise workflows;

•

breadth of technologies we support;

•

breadth of technology integrations;

•

total cost of ownership;

•

extensibility across organizations, including software developers, security teams, machine learning engineers, data scientists, and IT managers;

•

ability to enable collaboration between software developers, security teams, and IT operators;

•

ability to deploy our products in any combination of cloud, multi-cloud or on-premises environments;

•

performance, security, scalability, and reliability in tandem;

•

quality of customer experience and satisfaction;

•

quality of customer support;

•

ease of implementation and use; and

•

brand recognition and reputation.

Our products are available for self-managed, software-as-a-service (“SaaS”), multi-cloud, and hybrid deployments. While we believe we compete successfully on the above factors, particularly with regards to the comprehensive nature of our solutions, we do experience competition in each of these categories with different vendors:

•

Home grown solutions. Over time, many companies built solutions in-house for specific use cases they uniquely required. Often, these solutions do not scale or were not designed to meet the needs of modern software delivery methodologies or technologies.

•

DevOps and developer-focused vendors. Many companies address only certain parts of the DevOps cycle and may compete with a limited set of JFrog offerings, including Microsoft’s GitHub, GitLab, Cloudsmith, and Sonatype.

•

Cloud providers. While also partners, cloud providers, such as Amazon Web Services (“AWS”), Microsoft Azure (including Azure DevOps) and Alphabet Inc.’s Google Cloud, may compete with a subset of JFrog functionality.

•

Security point solutions. Some security-focused companies may compete with a subset of JFrog’s holistic security offerings or address only developer-level security, such as Aqua Security, Snyk, Sonatype, and Black Duck.

•

Diversified vendors. Some diversified technology companies, such as IBM, Inc. (including Red Hat), Pivotal Software, and Broadcom’s VMware may have offerings that compete with certain JFrog products.

Additionally, we may compete with start-up and open source technologies across the categories described above. Many of our competitors have greater financial, technical, and other resources, greater brand recognition, larger sales forces and marketing budgets, broader distribution networks, diverse product and services offerings, and larger and more mature intellectual property portfolios. They may be able to leverage these resources to gain business in a manner that discourages customers from purchasing our offerings. Furthermore, we expect that our industry will continue to attract new investments, including smaller emerging companies, which could introduce new offerings. We may also expand into new technology or geographical markets and encounter additional competitors in such markets.

Our research and development organization is responsible for the design, development, testing, and delivery of new technologies, features, and integrations of our platform, as well as the continued improvement and iteration of our existing products. Our most significant investments in research and development are to drive core technology innovation and bring new products to market. Research and development employees are located primarily in our Israel and India offices.

Our research and development team consists of our architects, software engineers, security experts, DevOps engineers, AI and machine learning experts, product management, quality assurance, and data collection teams. We intend to continue to invest in our research and development capabilities to extend our platform and products.

Intellectual Property

Our success depends inpart on our ability to protect our intellectual property. We rely on a combination of copyrights and trade secret laws, confidentiality procedures, employment agreements, license agreements, invention assignment agreements, trademarks, and patents to establish and protect our intellectual property rights, including our proprietary technology, software, know-how, and brand.

As of December 31, 2024, we hold a number of active patents and have filed patent applications both in the U.S. and in other countries. With any of our patent applications, it is possible that they could result in the issuance of a patent or the examination process could require us to narrow our claims. Any of our patents issued in the future may be contested, circumvented, found unenforceable or invalidated, and we may not be able to prevent third parties from infringing them. In addition, we have international operations and intend to continue to expand these operations, and effective patent, copyright, trademark, and trade secret protection may not be available or may be limited in foreign countries.

Although we rely on intellectual property rights, including trade secrets, patents, copyrights, and trademarks, as well as contractual protections to establish and protect our proprietary rights, we believe that factors such as the technological and creative skills of our personnel, creation of new modules, features and functionality, and frequent enhancements to our platform are more essential to establishing and maintaining our technology leadership position.

We control access to, and use of, our proprietary technology and other confidential information through the use of internal and external controls, incl uding contractual protections with employees, contractors, customers, and partners, and our software is protected by U.S. and international copyright and trade secret laws. We require our employees, consultants, and other third parties to enter into confidentiality and proprietary rights agreements and control access to software, documentation, and other proprietary information. Our policy is to require employees and independent contractors to sign agreements assigning to us any inventions, trade secrets, works of authorship, developments, and other processes generated by them on our behalf and agreeing to protect our confidential information. In addition, we generally enter into confidentiality agreements with our customers and partners. See Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K for a more comprehensive description of risks related to our intellectual property.

Government Regulations

Our business activities are subject to various federal, state, local and international laws, rules and regulations. For example, we are subject to numerous laws, directives, and regulations regarding privacy, data protection, and data security and the collection, storing, sharing, use, processing, transfer, disclosure, and protection of personal information and other data. In addition, in some cases, our software is subject to export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce, and our activities may be subject to certain trade and economic sanctions. Compliance with these laws, rules and regulations has not had, and is not expected to have, a material effect on our capital expenditures, results of operations and competitive position as compared to prior periods. For additional information about government regulation applicable to our business, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

Employees and Human Capital

Our Board of Directors and its committees share oversight of our human capital management strategy. We annually conduct talent reviews and succession planning and the Board of Directors receives updates from senior management regarding succession planning, management talent assessment, and employee attrition. The Compensation Committee of the Board oversees our approach to human capital and provides oversight of our overall compensation philosophy, policies, and programs, ensuring their respective alignment with our human capital strategy. The Audit Committee of the Board reviews our ethics and compliance programs for human capital and workplace-related issues with management. The Nominating and Corporate Governance Committee has oversight of our approach to diversity as part of its broader oversight of our sustainability strategy and initiatives.

As of December 31, 2024, we had a total of approximately 1,600 employees globally, including approximately 800 employees located in Israel and approximately 400 employees in the United States. None of our employees are represented by labor unions or, except for our employees in France and Spain, covered by collective bargaining agreements.

Our Culture

Our core values are reflected in our CODEX, which was created by our employees. We emphasize these values through formal and informal training. Each year we conduct a CODEX employee engagement survey asking for employee feedback to better understand our strengths and weaknesses and assess the alignment of the CODEX with the needs of our company. Based on the results of our annual employee surveys, we believe the CODEX will continue to support our growth and success moving forward. Our CODEX values are:

•

Integrity. We subscribe to presenting the truth, honestly, even if it’s subjective, in order to achieve mutual well-being and transparency. We might make mistakes, but we always play fair.

•

Community and Customer Happiness. As pain solvers focused on the solution and not on the problem, we invest time and effort to build and develop strategic, long-term relationships to ensure happiness among our community and customers.

•

Thinking BIG. We encourage our employees to stretch their capabilities, knowing that while we think outside the box, every detail counts.

•

Everyone Counts Everyone Matters. Each and every employee has a significant and driving impact on the success of JFrog. Everyone has a voice and everyone’s thoughts and ideas matter.

•

Innovation. We strive for technological excellence and innovation, stepping outside our comfort zone to achieve more and support market needs.

•

Team Spirit. We foster an atmosphere of genuine teamwork and believe in the importance of mutual trust, joint effort, and collaboration to ensure our collective success.

•

Open Communication. Anyone can approach everyone about anything at any time regardless of rank or affiliation.

•

Agility. We believe change is an opportunity; an agile mindset leads us to better results in a rapidly changing environment.

•

WIN! We believe that with a “good enough” mindset, we will never achieve greatness.

•

Care. We care more; it’s the source of our “better-ness.”

Recruiting, Training and Development

Our human capital objectives include, as applicable, identifying, recruiting, retaining, incentivizing and integrating our existing and new employees and consultants. We attract new employees by advertising on our JFrog careers website and on LinkedIn, as well as leveraging our employee referral program. In order to meet our professional development objectives, we have implemented several formal and informal cross-company training programs to train new managers and employees with the skills to embark on a successful career at JFrog. In addition to annual performance reviews and merit-based compensation, we also encourage employees and their managers to maintain an open dialogue on progress throughout the year. Moreover, we focus on providing each employee an individualized career path and professional development opportunities.

Everyone Counts, Everyone Matters

We recognize and view equality as key to our success. We strive to foster a culture where all of our employees feel they are respected and treated equally, regardless of gender, race, ethnicity, color, age, disability, sexual orientation, gender identity, marital status, veteran status, pregnancy, HIV/AIDS status, cultural background, religious belief, genetic information status, or domestic violence status. We emphasize this principle in our CODEX value “Everyone Counts Everyone Matters” and aim to provide our employees a diverse, equitable, and inclusive work environment.

We continue to support equal opportunity in hiring and mandatory non-discrimination and anti-harassment training for all employees. For example, our workforce is diverse both in ethnicity and gender, including and up to the highest level of management, where three of our 10-member board and three of our 10-member executive management team are women.

Compensation and Benefits

Our compensation policy is designed to attract, retain and reward personnel. In addition to competitive base salaries and other cash compensation, we offer equity incentive plans that align the interest of our employees with our shareholders by motivating individuals to perform to the best of their abilities and achieve our business objectives, thereby driving the success of our company and increasing shareholder value.

Workforce Health and Safety

In addition to traditional employee benefits, we have implemented a number of initiatives to support the well-being, safety and health of our employees. We provide comprehensive health insurance that includes medical, dental, vision, and prescription drug coverage, along with many other benefits such as an Employee Assistance Program and wellness and fitness membership reimbursement programs. Additionally, we are committed to workplace safety and security through office maintenance, employee training, and emergency protocols.

Corporate Information

We were incorporated under the laws of the State of Israel on April 28, 2008. We are registered with the Registrar of Companies under the company number 514130491. Our main place of business in the United States is located at 270 E. Caribbean Drive, Sunnyvale, California 94089. Our telephone number at this address is (408) 329-1540. Our registered office is located at 3 HaMahshev Street, Netanya, 4250465, Israel. Our telephone number at this address is + 972 (9)-894-1444. Our agent for service of process in the United States is JFrog, Inc.

“JFrog,” our logo, and our other registered or common law trademarks, service marks or trade names appearing in this Annual Report on Form 10-K are the property of JFrog Ltd. Other trademarks and trade names referred to in this Annual Report on Form 10-K are the property of their respective owners.

Available Information

Our website address is https://www.jfrog.com, our investor relations website is https://investors.jfrog.com, our blog https://www.jfrog.com/blog and our X account is @JFrog. We have used, and intend to continue to use, our website, investor relations website, our blog and X accounts as a means of disclosing material non-public information and for complying with our disclosure obligations under Regulation FD. The following filings are available through our investor relations website after we file them with the SEC: Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, current reports on Form 8-K, and our Proxy Statement for our annual meeting of shareholders. These filings are also available for download free of charge on our investor relations website. The SEC also maintains an Internet website that contains reports, proxy statements and other information about issuers, like us, that file electronically with the SEC. The address of that website is https://www.sec.gov.

We webcast our earnings calls and certain events in which we participate or host with members of the investment community on our investor relations website. Additionally, we provide notifications of news or announcements regarding our financial performance, including SEC filings, investor events, press and earnings releases, and blogs as part of our investor relations website. Further corporate governance information, including our corporate governance guidelines, code of business conduct and ethics, and committee charters is also available on our investor relations website. Information contained on, or that can be accessed through, the websites provided does not constitute part of this Annual Report on Form 10-K or in any other report or document we file with the SEC, and inclusions of website addresses in this Annual Report on Form 10-K are inactive textual references only.