JFrog Ltd. (FROG) Earnings Call Transcript & Summary

Good morning, and thanks for joining us today. I'm Jack Andrews. I cover the data analytics and infrastructure software space at Needham. Very pleased today to have with us the management team from JFrog. We have the CEO, Shlomi; and the CFO, Jacob. So welcome, gentlemen. Thanks for taking the time to speak with us today. Maybe just to sort of level set everybody. You're still a fairly recent IPO. I still get a lot of investor questions trying to grapple with what exactly JFrog does. So could you just maybe perhaps summarize the value proposition of what kind of problems you're trying to solve, and maybe a typical use case these days?

Yes, of course, and good morning, Jack. Thank you for having us. JFrog is a full end-to-end DevOp solution that provides you with a platform that helps you keep your continuous software update life cycle happening. We are providing tools to manage your software packages so your software build can be faster, secure and deployed anywhere, anytime on any environment. In today's world, where software need to get anywhere, anytime, tools like that are crucial for the life cycle of software management.

Got it. Is there maybe an example of a recent customer win that you can talk about, and just how they're deriving value from what JFrog offers?

Yes, that's a great question. We have thousands of customers actually. The majority of the Fortune 100, 1,000 are powered by JFrog. And basically, what we do behind the scene is providing you with the solution to host your software packages, then secure them, then distribute them to your runtime environment, to the deployment environment. So just a recent use case that we were very excited about was one of the biggest food chain -- fast food chain in North America that shared with us a use case of how they manage the full life cycle in the restaurants, 2,000 restaurants in North America, managing everything from the order to the inventory, and even the french fries that the machine are counted, by powering the system with software. So basically, what JFrog do that behind the scene is making sure that these software updates are happening continuously and smoothly anytime that the cashier is setting an order, counting the inventory and at the end delivering the food. So food today, Jack, is being delivered almost with a zero human touch.

Wow, interesting. Thanks for that. So kind of a bigger picture question. Shlomi, you referenced sort of a platform in the DevOps space. I think a lot of investors are still struggling to just understand the complexity of the DevOps ecosystem more broadly. There's many different tools. People are having -- have many different strategies and outlooks about how to think about how fragmented this whole ecosystem really is. So could you just maybe speak to just how your platform fits into the broader DevOps ecosystem in general? And I guess another -- the second question related to that is just, why have you chose to focus on binaries at your core as kind of a strategic, we'll call it, a fulcrum point in this landscape?

Absolutely. So what is our biggest challenge today? It's already clear that software is powering the world almost to the level of accretion. And it's everywhere. And we see it everywhere. Just last week, I've heard about the gas pipe in Atlanta and the cyber issue that we had. My team in Atlanta started to work from home, not because of the pandemic but because of lack of fuel. So that's controlled by software. Can you imagine that, that we will not have fuels in our car because of software. So every organization, no matter what industry you're a part of, no matter what sector you're a part of, no matter where you are in the world, it's already clear that our life is powered by software. And when you break it into pieces, you understand that there are 2 challenges. One, it needs to be fast, continuously promoted from the developer's keyboard to the long-term environment. And second, it need to be secure. If you want to be fast and secure, there is only one way that you can automate your software and power the full process with the machine and the developers at the same time. In order to do that, you have to go down to the software packages, or what you call binaries, or software artifacts or images. Software packages are being built from outside or built inside. And from that point, this is what the organization manage. This is what you build, this is what you secure. This is what you distribute. This is what you have as a software update to fix this cyber security issue on the gas pipe. This is what JFrog is doing. We are the binaries people. We are managing all the software packages of the world in a universal solution. So basically, we provide you with the storage, with the repository to manage your binaries, your software packages, then we secure it with a different tool on the repository. We distribute the release bundle that is ready to be distributed and blessed by the organization and making sure that this full automated -- this full solution is automated. We decided to be focused on the binaries and the software packages because from the moment those software packages are being created, this is the only thing that you have in the system. This is the only thing that you manage. This is what you want to have as an incremental update continuously on the edge devices. We see it as a very big addressable market, and this is why we are very excited about it.

And Jack, if I may just add to that, I'm sure investor is familiar with DevOps infinity of open close multiple stages on both dev side and ops side. And we're uniquely focusing on build, test, release and deploy components of this infinity loop, and software packages is the only asset that's important in this -- in these stages.

Right. No, thanks for clarifying that. So yes, so that makes a lot of sense. And so then, I guess, from here, from where you are today, again, because this ecosystem is so fragmented, you've started with artifact. You've since enhanced your platform over time. Just how broad do you think you need to go or want to go in terms of having a platform versus how important is it to integrate with others in the DevOps ecosystem? How do you think about the trade-offs around that?

I think that in order to answer this question, we have to understand what it means to sell bottom-up to approach developers. When you send to the developers of the world, over 30 million developers in the world today, when you provide them with a full platform, you have to come not just with the enterprise value proposition, but also what makes them the champions of the organization. And in order to do that, we believe in the philosophy of freedom of choice and the full end-to-end solution. What it means is that I want to give you, as a developer, the freedom to use whatever ecosystem you have. So if you want to use multiple tools or different technologies, I will not be the one that try to educate you to use just JFrog. We'll provide you with a full end-to-end solution for your software packages, but it will seamlessly integrate with your ecosystem environment. That gives us a very -- a good start and easy, easy entering to the organization. It gives you as a developer an easy onboarding and very fast adoption of the tool. The second thing -- that's the business side of it and how you go from the bottom up and to remind, Jack, you and the audience, JFrog built the business from the bottom up. And what we have created came from the developers and by the developers. The other thing about that is that when you look at the ecosystem of making DevOps and making software, as Jacob mentioned, you have to decide where are your expertise. We know that we bring value on the continuous software release life cycle. If it continues and if it's about software release, this is where JFrog step into the picture. We are not the best vendor for monitoring your system or to planning it or to test it. For that, you have companies like Atlassian and Datadog, and Pager Duty and others. We are very relevant from the moment you bring your software through the security process and deployment process.

Got it. No, that's really helpful. And so just continuing on that theme, I wanted to, Shlomi, just -- I think you mentioned on your most recent earnings call, you're very excited about a lot of new product enhancements that happened here in the first quarter of the year. Could you just flesh out for us, what are you specifically excited about and why?

Our product and R&D team was very, very busy during the past few quarters, collecting information from the market and from the community, asking what is the real next pain for you. And what we have heard from the market is that everybody knows now what continuous integration and build and software and automation and DevOp. DevSecOp, yes, there are a lot of buzzwords in the world, everyone that want to be part of this party needs to say something with ops, and voila, you're part of the party. But when you need to really dig into it, and this is what our product team did, you need to ask the organization and developers and the DevOps engineers that you are serving, what is your next pain? What is it that prevent you from having a full automated life cycle, that makes you faster than your competitor? And then what we heard is that we know how to build the software fast. You know what, we even know how to secure it on the developer side, but we don't know how to distribute it automatically in a multi-site, multi-topology environment. And this is where we were focusing -- we developed JFrog Distribution to be the only tool in the world that pushed software packages from every -- from any environment to any location. With that, we enhance the security capabilities. So it will not just be security on the developer side, but also throughout the full binary life cycle. We improved the automation around it, so you will be faster. And we also added integrations with other ecosystem like rust and other developers environment, so more and more developers and organization will be able to use JFrog.

Right. Okay. No, that's helpful. And so since you touched on that, I wanted to see if you could discuss a little bit more how you view the importance of Xray, in particular. I think there's some news, on your earnings call, you talked about bundling Xray now in certain of your subscriptions. Can you just speak to why you're doing this? And what is the demand like these days for Xray?

So JFrog is a hybrid solution, Jack, and we are not just available on the cloud, but in any cloud where you can have JFrog as a service: in AWS, in Google Cloud, in Microsoft in over 30 regions worldwide, and we're expanding this multi-cloud solution. But we also have a self hosted solution. [ Something ] you could take the software and host it yourself on the cloud or in your [ brances ]. And in this role, that is built by subscription, some of the subscription came with Artifactory as the binary repository manager, you mentioned it before, our flagship product. And some had the option to add Xray to it. What we have seen is that there is no enterprise use case that can avoid securing the universal binary repository manager. And therefore, we added Xray from the enterprise and above as a mandatory tool. #1 thing was to make sure that the technology that we release, what you mentioned before, will be part of the enterprise subscription, plus Xray as a mandatory security solution to secure your SecOps flow. This is change #1. Change #2 was having an easy way to move from just a single user in one site to a multisite user in a multi topology environment. And this is where we added features like Federated repositories and distribution solutions to make sure that the enterprise can enjoy this subscription. Jacob, if you want to chime in with the changes we have made on the prices, feel free.

Yes, I will definitely do that in a moment. But just to highlight the importance of Xray, Jack. DevSecOps are on top of mind for all organizations, especially following the SolarWinds attack. People realize that their security is not just about source scope. It's all about the packages that, in this case, they brought outside of the organization. On top of that, even government takes steps to make sure that federal institutions are protected. And the recently White House issued a new ordinance to make sure that DevSecOps is implemented in all federal organizations. So it's clearly on top of mind for people, and Xray is a very unique tool and actually was chosen as the best tool for software composition analysis in last year. With regards to price changes or changes that we made to our subscriptions, so first of all, these changes do not apply to all of our customers. And the changes were made only for on prem. So they do not apply to our cloud business. And they do not apply to our Enterprise Plus platform. For enterprise package, as Shlomi noted, we had Xray as optional. And about half of enterprise customers decided to go with Xray, and about another half decided to go without Xray. By making Xray mandatory, so it means no changes to those who already had Xray. So that applies only to those who did not have Xray. And those customers who did not have Xray and used to pay 29.5k as an entry-level, next time within their renewal they will get Xray and will pay entry-level of 41.5k per year. We did increase price for Pro X subscription from about $14.4 to about $19,000, and we did increase price for our Pro subscription by about 8% from 2,950 to 3,200.

Got it. That's really helpful. And maybe just to put a fine point on it, Jacob, since I know there was a common question after your earnings. This -- for the on-premise customers, the price increases take effect upon -- whenever their contract is up for renewal. Is that correct?

Yes, this is correct. So if we look at these changes in the long term, these changes will contribute about 10% increase in revenues. However, given the fact that they will apply only upon renewal, given the fact that some of our customers did use opportunity to upgrade and secure those lower prices for another 12 months, so in certain cases, multiyear contracts, which happened in Q1. And that's why our bookings were higher than typical seasonal in Q1. We'll see these changes flowing gradually through the P&L and the impact on 2021 revenues will be just low to mid-single digits depending on where customers renew. So long term, it's going to be a more meaningful contribution, but these changes will take effect only when customers renew.

Got it. Okay. That's helpful. And maybe just stepping back more broadly, I mean, because I feel like pricing was one of the most common topical questions. Just is there anything else that you feel is important to just to highlight from your 1Q earnings report recently that you felt was important that investors should know about?

Yes. We had 37% year-over-year growth, still growing very fast. Our cloud, again, was growing much faster, and we see that cloud will continue to grow faster than on prem solution. By the way, when we say on prem, significant portion of our on-prem solution anyway [ are riding ] in the cloud, whether it's public cloud or privately, just managed by customers themselves. When we're talking about cloud, our cloud, it means that the service that we provide. And we see a lot of customers decide to go hybrid, which means they manage certain components of the systems themselves and manage and using us for managing some other components and workloads. We saw our net dollar retention at 130%. And we believe that we're going to be stabilizing around these levels. As pre-pandemic quarters roll off of the trailing 4-quarter calculation, we see our stabilizing around these levels, and we will be targeting net dollar retention of 130% for the full 2021.

I will add to it, Jack, that another thing that we were very excited about Q1 is the adoption of our full end-to-end platform. And Jacob touched the subscription level. Obviously both in the cloud and in the self hosted solution, we had a record number of new users that are jumping in and starting to adopt the platform and not just 1 product at a time, full end-to-end solution, 6 different products. And the second thing that we were very excited about was the fact that the adoption of our product by new customers, net new customers, is going back to the numbers that we used to see pre-COVID. We invested a lot in -- in the adoption of new customers and new levels and kind of improved the top of the funnel, and we start to see the fruits of our Free Tier and free trial as a way to use JFrog tools.

Right. No, I appreciate that. And actually, that's something I wanted to flesh out a little bit more. I mean, to your point, you introduced this free cloud tier. Could you just speak -- I mean, are there any sort of metrics that you can sort of speak to in terms of -- obviously, it seems like it's going well. It's filling the top of the funnel. Are the customers that are appearing now perhaps the same, or maybe different than your historical customer base? Any more context you can provide about the importance of that strategic shift?

Yes. Historically, we had only free trial, meaning that you can either start your journey with JFrog on-prem or in the cloud for a limited time. And then we added -- in Q3 of the previous year, we added the free tier. The free tier is different by concept, because from day 1 it exposes you to the full solution. You have Artifactory and X-ray and JFrog Pipeline and Distribution to start with. So you can actually enjoy the full platform with no integration needed, no installation, no deployment needed. And we see thousands of users every quarter, starting their account on the free tier. And our job is also to optimize the process so these users will enjoy it more, and we will convert them to become a customer. Still, we see thousands of other users that prefer to download the free trial of the self-hosted solution and to have JFrog solution tested on their environment. We also see a growing number of hybrid setup request. One of the biggest bank in the industry just recently moved to a hybrid solution, that they have their legacy self-hosted solution or on-prem solution and next to it, deploying and having an environment on AWS and Microsoft. We also see some new initiatives with the government and highly regulated environment that are enjoying the govcloud trial to full solution that we provide on the cloud. So the free tier and the free trial combination is growing. On the metrics level, we are monitoring our customers' usage. We see more and more adoption of Xray. Jacob just mentioned the order that was released by the White House last week, speaking about cyber security regulations. We will see, Jack, we will see this growing more and more. And the next thing that you should expect would be more demand for software distribution that is secured. Both of them are covered from the 3 tiers to the highest subscription that JFrog provides.

And if I just may add to that, free tier allows customers of any sizes to join this. And we see many customers in employee headcount from up to 500 joining and growing with us. So that significantly increases the pool of potential users for our products, and that's why we're very excited about it.

Right. No, that's really helpful commentary. So just taking a step back, one of the other common questions that I think people are still grappling with is, do you think you're attacking what is largely a greenfield market opportunity? Or are you typically replacing other vendor solutions? I mean, if I go back to my own software development days, we were releasing code once a year. And so there wasn't a whole lot of a need for something like this. So how much of the world still is maybe operating like that versus how much has something in place already that there's a displacement opportunity for JFrog?

I'm smiling because JFrog 12 years ago and today is still getting the same questions. It makes me feel great. It means that we keep on building the business and pushing the boundaries and making sure that the innovation is still injected to the pipeline. Listen, Jack, JFrog was the first company in the world that said that software binaries, software packages will become the primary asset. And look what happened. There is no organization, including our competitors, that avoid developing solution for software packages. It's all about your continuous integration and security, and everything is about your software packages now. So we are very happy about that. Then we introduced the world with a software composition analysis too, not just security scanner that sits on top of your repository, your software code repository and scan your source code, but also scanning your software packages, making sure that in the world of micro services, cloud-native and containers, you can open whatever image and look at the dependencies and make sure that there is no vulnerability [ in the build ]. And next, what happened is that we decided that we need to take this release bundle and sign it and cryptonize it and make sure that the organization has full confidence to deploy it automatically with no human touch. And what we see now is the distribution became a greenfield. We're basically the only vendor in the world that provides this solution for software packages. Therefore, obviously, we are replacing a lot of home grown solution and in house development that organization built 10 and 20 years ago on top of whatever CDN. So if you take the full platform from the repository, Jfrog was the first one to introduce the world to it. Then Xray with the software composition analysis, making sure that you have a dependency graph and a smart analysis of your security challenges, all the way to distribution. I think that what you see is that JFrog is kind of paving the way for the next DevOps and DevSecOps challenges to be solved. We are very excited about that. And we are also looking at the world of device management and IoT because that's the next edge that you will have to push software to.

Sure, sure. So just to follow up on that. So when you think about paving the way here, could you talk about maybe how your sales motions may be changing? I would think when I think about the core Artifactory, I would -- in my mind, I think it's more of a developer-led adoption. But as you introduce more and more elements of your platform, is this becoming more of a top-down sale? How do you think about that?

Well, first of all, our bottom-up in-house sales is growing very, very fast, the inside sales. We still see massive adoption of developers that understand that it's not anymore about having your repository to manage your binary, you also need to secure it. And you need to take responsibility, ownership and accountability on the food process. There is no one at the end of the pipeline that will do it for you. Developers really became the master of the process. And therefore, the adoption from the bottom-up is still happening, still happening. However, when you have 6 different products and you bring a value proposition that changes something that the organization built years ago, obviously you start to speak with different function in the organization, and different group in the same organizations that want to consolidate to the same solution. This is where we started more than a year ago to build our strategic sales team. These guys are going to our top 100, top 200 customers and making sure that our solution is expanded wisely across the organization. This team is growing very fast. We already see the results. Some of them were covered on the earnings call. And we will keep enlarging and increasing this team. Another thing, if I may, Jack, is the geographical expansion. What we see in North America and what we see in EMEA is great, but DevOps adoption in APAC is now starting on the enterprise, maybe in the last 2 years. And therefore, our presence in Japan and in China and in India and Australia is very important. And our sales team is expanded there, and we will keep on investing in not just on the team, the sales team in the field. The marketing team, developer advocates and also more and more clouds integration to the APAC cloud is in our road map.

Right. Yes. No, thanks for bringing that up. And the geographical expansion is something that, yes, we definitely want to keep an eye on. Just shifting gears a little bit. Could you just touch on how you view the competitive landscape these days, in terms of just who might you run into today? And perhaps who are you keeping an eye on who could potentially enter some of your markets over time?

Yes. Well, this is changing every day. Every day there's a new DevOps company or a new SecOps company. This market is booming. And obviously, we are happy to be part of it. We are following a 4 tier model when it comes to competitive landscape. The first thing and probably the biggest opportunity for JFrog and for other companies is what we call the home-grown solution and the in-house development. What you see, Jack, is that a lot of these organizations are now adopting DevOps on the runtime environment. I think that what happened with Kubernetes and microservices kind of accelerate that. The cloud adoption accelerated even more, and then the pandemic came and you understand that you have no other choice. You will either start to adopt these new methodologies or you will fall behind as an organization. So we are replacing a lot of systems that were built in the company like not so long ago, 5 years ago, 10 years ago. But cloud-native was not there. This is tier #1. Obviously, the competition there is to replace something that the organization maintained by itself. This is where JFrog Distribution shines. This is also where Artifactory still replace repositories that were built inside the organization. The second thing is -- the second-tier is the cloud providers. They are great partners of ours. We are working together. We are building the company together. But on the other hand, AWS and Microsoft Azure [ will get up ], and Google Cloud, all of them also provide developers and DevOps engineers with tools that might compete JFrog Solution. I'm keeping my eyes open on them, but we are also very excited about every step that we take together and provide a better solution to the market. But for sure, there will be customers or users that will ask you, so why can't they use the cloud for this or the cloud that. I think that the KPIs are different there. And when it comes to the cloud and you answer that, you can provide a multi-cloud solution, and you can provide a solution that will help you to avoid vendor lock in, then it starts to make sense to customers. When you say that you also have a hybrid solution, that's a knockout and our customers, especially the enterprise customers, are very excited about the collaboration we have in the cloud and not the competition. The third tier is obviously other companies that -- coming from sole scope solution managing a Git repository. And now understand that software packages and binaries became the primary asset. And you look at the road map, and it's all about tools like Artifactory, tools like Xray, tools like Distribution or trying to build solutions like distribution. And the competition is growing there and the community will choose, but I think that every organization in the world will look at you only if they understand your expertise. When they look at JFrog, they know that we are the binaries people. And they know that the full life cycle of the binary, when managed by JFrog, is more secured [ empowered ]. And the last tier, the fourth tier is the legacy company that just replaced legacy software with cloud-native solution. This is barely being adopted, and most of them are reaching out to us to integrate with JFrog Solution. A very long answer. But as I said, the market is booming. There are a lot of new DevOps initiatives.

Yes. No, I really appreciate that, and that makes a lot of sense. Thanks for segmenting that, that way. I guess to maybe summarize it then, from my vantage point, one of the key differentiators that you have is that you've historically been very close to the developer community, and developers are the ones who are really driving a lot of the decisions these days. So is it fair to assume that you stick close to the developers and meet their needs and that's a way to head off any looming competition? Is that one way to think about it?

Yes. Well, look at us. JFrog is a 800-people company in 10 different countries, all of us, most of us are developers. This company was built by developers, for developers. So obviously, authentically, we feel comfortable there. We feel comfortable in this environment. And not just that, we also bring an authentic value to the developers. It's not a fake solution that covered by marketing. This is a pain solver. We are driven by solving the pain of who became the rainmakers of the industry. Developers, they are very cynical about sales and marketing. If you don't bring value, they can be very brutal with you. And thanks God, for 12 years JFrog keeps fueling the developers' community, all developers' community, with more and more value when it comes to liquid software. When it comes to make their -- the pipeline flow from one end to another. And we have a great funnel and honor to get their [ log ] back.

Right. No, that's great. So I think we just have a couple of minutes left, but just I want to ask you, next week, you've got your upcoming swampUp event. What -- any sort of preview that you can share in terms of what we should be looking for from the event?

Yes. Well, we spoke about DevOps and the competition around that. We have an amazing -- I think it's the first time ever on one stage -- an amazing panel with our colleagues, my friends and colleagues, CEO of Datadog, CEO of Elastic, CEO of PagerDuty, CEO of [ Fragico ] all joining me on one [ funnel ] managed by Alan Shimel, the CEO of Devops.com, that's kind of zooming out from the DevOps world and speaking about the software world, and I'm grateful for having them with us at swampUp. We have over 40 different sessions that were contributed by the community to share best practices of DevOps. And obviously, our CTO and Co-Founder, Yoav Landman, together with our CPO Dror Bereznitsky, are going to share the highlights of our road map in the next few quarters. So we are very excited about it. Already having thousands of users, customers and prospects that registered. And if you didn't yet, make sure that you join us on May 27, 28, it's all online. swampUp is our user conference, and we'll meet you there.

Yes. No, signed up, looking forward to it. So thanks for that. I guess we've got about a minute left. Any last things that we didn't necessarily touch on that you think would be important for investors to know about JFrog and what you're up to?

Yes. We are in our first year of being a public company. I just celebrated 200 days in NASDAQ as a CEO. We are building our trust with the market. And what you see in the 3 earnings that we had and Jacob emphasized that very well. What Jfrog has committed, JFrog is delivering. And we will keep building the business this way, and we will do the right investment and the expansion needed organically or inorganically in order to deliver what we committed to.

Got it. Okay. Well, I think we will leave it there. But thank you so much to both of you for joining us today, and we appreciate your commentary on some of these -- on what's happening with JFrog and some of the most recent questions we've been getting.

Maybe the frog be with you, Jack.

Take care.

Take care.