JFrog Ltd. (FROG) Earnings Call Transcript & Summary

Thanks, everyone, for joining us. My name is Sterling Auty. I'm the software analyst here at JPMorgan. Very happy to have with us Jacob Shulman, who is CFO of JFrog for our next presentation. JFrog is a provider of software in the DevOps space. It's an area that we've been keenly interested in because of digital transformation. So Jacob, first of all, thanks for joining us. Really appreciate it.

Hi, Sterling. Thanks for having me at the conference.

So just to get us started, let's start at a very high level. So within that entire DevOps world, where does JFrog actually sit?

Yes. So I guess software become an integral part of everyone's business. How fast you release the software, that's what defines a competitive advantage. And that's what -- where we see it. We offer the company's tools to streamline their software release from the developer keystroke all the way to the edge device. We are uniquely focusing on binary life cycle management. As you know, software is a text, but what's running on the machines is not a text, it's binary files. That's why every company releasing software has to go through the process of building those binary files, bringing them from outside as people rely more and more on open-source or third-party binaries, securing them and distributing them to edge devices or remote locations or to your customers. And that's what we focus on, the binary management uniquely focusing on this entire life cycle for binaries.

Where do you think we are in terms of just the general adoption of DevOps out there in companies?

Yes. So DevOps is a very large umbrella. And it's not -- does not just include tools. It's also the technology, culture. And that's the driving force behind the digital transformation. But if we look in our domain, I'd say that CI and automation pipeline is pretty much 90% maybe of the market. We see a lot of automation. But DevOps is not just automating processes around the source code or just initial building of binaries. It's also about how you get your incremental updates all the way to the edge. And this is something that we're just starting with. We're really in the first inning of that motion.

So for companies that for maybe those that are not as familiar, DevOps is kind of the current structure or process and philosophy that's used. Prior to that, it was called agile development. So even for companies that are in the agile development world, do your solutions still apply?

Yes, absolutely. And agile replaced waterfall, and software was released even within waterfall from waterfall. And binaries, they existed for tens of years. But our solution, if you use our solution that -- and you, an agile company, you can obviously use our solution because it provides you visibility for all your software. It can secure your software. That's -- you're basically given one source of truth for everything that you create in your organization.

The question I probably get the most is, all right, if a company is not using an Artifactory repository, a JFrog type of solution, what do they use currently to manage these binaries?

So every company has to manage binaries. And also, you're right that a significant portion of the market is still using a combination of homegrown solutions and open-source technologies. As you know, some of the companies that created those technologies as a byproduct, they have repositories for those technologies. For example, Docker or npm, all of these companies create significant improvements in the technology. But as a byproduct, they had a Docker registry or npm Registry. Now some companies who have not adopted yet our solution, they use a combination of these different open-source tools, typically, it would be one repository per technology, and some homegrown solutions that try to somehow automate or streamline the use of this disparate -- separate solutions. Our product provides universal source of truth, universal repository for all the types of technologies that you potentially produce. Today, we support over 27 different technologies, which is kind of the largest offering in the market today.

So besides that universal source of truth, what are maybe a couple of other benefits to using an Artifactory repository?

Yes, absolutely. First of all, the main benefit is that you can automate processes with the software release cycle. Artifactory sits in the heart of your ecosystem and connects to your source code repositories, to your CI and CD tools, to your testing tools, to your security tools, to your deployment tools. So it's really in the heart of the ecosystem, and it allows a lot of automation throughout that ecosystem. In addition, Artifactory becomes your single source of truth for all of your software. And that's why you have visibility into the metadata for all your packages, which means you know exactly who created this package, where it's coming from, how it was tested, how it was secured and what kind of dependencies on other packages it has. We also offer you automated mechanisms for cleanups because companies today using CI/CD, they create thousands of -- tens of thousands of these packages. And they may be using only a small fraction of that. So -- and the package is typically very large files. So if you don't create very smart cleanup mechanisms and scalability mechanisms, then you just explode in terms of storage. And that's why using our tool, you can achieve those benefits. And also, we'll provide your proxy machine. Artifactory can go outside of the organization and bring all of those open-source packages for you automatically, securing them and creating this standard process of doing that. And that's another significant benefit of using Artifactory.

So maybe for the people watching, just to add, so when you talk about connecting to the source code tools, that means connecting to the GitHubs, which is Microsoft or the Jiras, which is Atlassian, and connecting into CI/CD pipeline, that's everything from open-source Jenkins to even the deployment tools like an Ansible, which is Red Hat. So you become a common layer through it. Is that the right way to think about it?

That's exactly right way to think about it. And today, we offer more than 40 different integrations with different tools within the ecosystem, which basically creates us very integrated into the entire software release creation and the release process.

So for an organization, just to -- for investors to understand the sizing, how many servers if it was on-premise or how many instances if it's in the cloud does a larger organization need to support their efforts?

Yes. So the number of servers for on-prem would be dependent on multiple factors: how many different teams you have, how many different projects, how many different technologies you use. Some customers prefer to have dedicated servers for specific technology. How many different geographic locations you use? So how centralized or decentralized the organization. So it's really multiple factors impact your installed base. What we see is that some of our largest customers have hundreds of servers in the usage.

Absolutely. I know that one company that I talk with has 125 servers because they have 30 terabytes of data of binaries in it. And they have to keep it replicated on a global basis because nobody wants to deploy an application in Eastern Europe from a server in California. That would take forever.

Absolutely. Some of our customers who adopted JFrog replaced us -- prior to JFrog, they used more than 1,200 different repositories worldwide. And by adopting JFrog, they basically created one repository that automatically replicates between different locations. And then developers have single source of truth and visibility to the same exact binaries irrespective of where they are located.

Excellent. So how did the pandemic really impact your business?

Yes. So first of all, pandemic really crystallized the need for tools like ours. With remote work from home, people understand that this process today is siloed, many times manual with full of vulnerabilities. So they completely -- the pandemic completely raised the need for tools like ours. However, on the other hand, we did see that companies became more restrictive on their budgets. We did see some headwinds because some of our tools is replacing existing infrastructure. So do people decide to change the infrastructure when the world is falling apart or they wait a few quarters until the business environment become better? So we did have some headwinds from the pandemic. We did see that in terms of number of new customers adopting our solutions because people decided to go with just must-have projects. They all understand the infrastructure needs to be replaced. But they just decided to take time until the pandemic eases. And we also see that in terms of expansion of existing customers. Prior to pandemic, our net dollar retention rates were above 140. Post-pandemic levels, we did see our retention rates in the levels of 130s.

Yes. We heard that same thing from -- actually, we had -- the CEO of Palo Alto Networks this morning said the exact same thing, that they even saw a pushout in some demand for newer solutions. Nobody was going to change out their infrastructure when they're working from home. They want to be back in the office where they feel comfortable before they do it. So it does make some sense.

Especially when you're in the heart of your software release process. As I said, we've many times integrated with tens of different tools. So that means that you really need to rebuild your integrations with the new product, yes.

India is an area that we often think about in terms of application development. They're obviously being very hard hit by the pandemic at the moment. What are you seeing given that current situation?

Yes. First of all, we have our swamp in India and have significant presence in India. And I want to wish health and being safe to all of our India employees. But right now, we don't see any significant headwinds specifically related to situation in India because nature of our customers, more global customers. Yes, they have significant presence there, but they also have presence in other locations as well.

All right. Good. As we start to see increased vaccination, at least outside of India, we're seeing a broader kind of opening up in the global economy. Is that starting to create a little bit of a splash back or snapback in terms of demand around new customers?

Yes. We've seen this improvement in the COVID situation. And the improvement in business environment also impacts our net customer additions. We reported that our Q1 net customer additions were higher than in previous quarter, which were higher than from Q3 low. So you see this continued acceleration in the net customer additions, yes.

All right. Good. And what kind of impact has the implementation of a free tier or a freemium model had on the business?

Yes. So we launched free tier in the late Q3, made it public in October of Q4. So it's really fairly new offering, just 6, 7 months offering. If you think about it, this is the first time when we actually started seeing how prospect interact with our products. Prior to free tier, we had open-source Artifactory, that kind of limited version of Artifactory that supports just one technology. And we have hundreds of thousands of these downloaded. But the code of conduct in these open sources that you don't market and don't sell to those users. And we did not even have visibility with how they -- whether they use the product or how they use the product. We also had opened kind of time-limited trials for on-prem installations, but that went product by product. If you want an Artifactory, you could download the trial for Artifactory. If you want an Xray, you could download a trial for Xray. But trying the full platform capabilities was somewhat -- a very significant undertaking by potential customers. So this addresses significant portion of prospects that are interested in our products. And we talked about it earlier that the pandemic crystallized the need to elevate the interest in products like ours. And that's why we launched the free tier. So we've seen thousands of registrations by users on a quarterly basis. And we continue to see improvements in conversion rates. Since free tier was the first time we saw how prospects interact with our products, it created a lot of opportunities for us to streamline customer journey and improve customer experience. So they don't just adopt one product but several products that offer on free tier. And that's why we see free tier also helps us sometime to land at a higher level of subscriptions because customers had capabilities to try not just Artifactory but also Xray and also pipelines prior to conversion into a paid customer.

So it sounds like you're not just using the free tier to juice a new customer addition number by taking any customer. It sounds like you're really using it to drive high-quality adoption.

In terms of both purposes, we do see that free-tier users also kind of represent smaller customers, who probably had some sort of open-source solution together with homegrown. But now, they also have capability to try best-of-class solution at these levels. And also, they have capabilities to try multiple products. That's a significant differentiator from maybe others in the market.

So let's talk a little bit about the go-to-market. How is sales structured? Especially given the success that you've seen in large enterprise?

Yes. So we divide our organization, sales organization into several groups: The group that deal with new customer acquisition, that's SDRs and new customer sales reps. We have another group that helps existing customers to expand. And recently, about a year ago, just prior to pandemic, we started building the strategic sales team. What we realized is that selling Artifactory to developer is different from selling platform to the enterprise. There are different value propositions. There are different stakeholders within enterprise. They're dealing with the platforms, not just developers or DevOps managers. It's also security specialists or CISOs and also product managers, those who are responsible for software updates at the customer side. It's also C level, those who want to understand how fast the enterprise releases software, what kind of vulnerabilities and bottlenecks they're facing. So it's a different value proposition. And that's why we started building that strategic sales team to help enterprises to tie these multiple loose ends and expand within the enterprise. The pandemic put some pause on that and then resumed that later on during the pandemic. And today, it's still a small team. We're not yet back to travels. This team is supposed to meet customers, supposed to travel. We're not there yet. But we're seeing first examples of work of that team. And on our calls, kind of quarterly updates, we provided the investors with different examples of how this strategic team impacts adoption of the platform with the largest organizations. And this is something that we continue to build and expect to grow from these levels.

Are they only focused on new logo acquisition? Or have they overlaid into some of your large existing accounts to drive further adoption?

The primary goal of this team is to expand existing customers. So they -- we identified the top strategic accounts that were transferred to this team. And the team now is dealing solely with these accounts.

Got it. So the land and expand, expand has been the lifeblood of the growth that you've been able to put up. So how should investors think about the runway that's left within that customer base? So in other words, if you never added another customer, how big could the revenue actually get to?

Yes. I think the best example would be to look at our over-$100,000 customers. We reported -- in latest quarter, we reported 395 customers over $100,000. Entry-level into our Enterprise+ subscription, the full platform is $115,000 and not all of the 395 customers on the platform. So you could see that only a small portion of our customers transition to the platform and already represents 29% of our business. Therefore, we see significant opportunities to grow even within our existing customer base by adding more capabilities. So the customers not just adopt Artifactory in Excel but also adopt distribution, which is #1 driver behind the platform adoption.

You recently made some pricing changes. Can you kind of review for us what did you actually change on?

Yes. So first of all, it wasn't just pricing changes. We've also aligned some subscription structure. And it does not apply to all customers. So it does not apply to cloud customers, which is -- or cloud business, which is 23% of our revenues. It does not apply to Enterprise+ subscription, which is another 29% of our revenues. For Enterprise subscriptions, we had the Xray as optional. And about half of the customers decided to go with Xray from get-go. Another half did not have Xray. We made Xray mandatory for several reasons. First of all, we ingested a lot of innovation in Xray. And it's top of the class product right now in software composition analysis. Second, DevSecOps becoming top of mind of all of our customers, specifically following the SolarWinds attack and also recent White House order to implement this kind of processes to ensure that software composition analysis is monitored. So we made Xray mandatory. So those customers who had Xray from the beginning, they're not impacted as well. Those who do not have Xray, they will get Xray when they renew their agreements. They will get Xray and will pay higher price. We increased the price for our Pro X package from about $14,400 to slightly over $19,000, which is approximately 40% increase. And we increased the price for our Pro package from $2,950 to about $3,200, which is approximately 8% increase. So when we look about -- when we look at overall impacted business, we estimate that over long term, this change will result in a contribution of 10% to the revenue. However, it will not flow into P&L right away for several reasons. First of all, in Q1, we had some customers renew early before the change. And we did say that about 40% of our bookings in Q1 were related to those early renewals. So for those customers who renewed in Q1, the change will be effective in Q1 '22. If -- those who entered into multiyear agreement, maybe even later than that. Also, those who renewed in Q1, it made more sense for customers who were scheduled to renew in Q2 to renew earlier, to the lesser extent in Q3 and then in Q4. So we'll see this impact of the changes accelerating towards end of the year. And that's why we believe that the impact on revenue in 2021, low to mid-single digits. We started working on this change back in Q4 because you don't implement this change overnight. And we took that intake count when we guided for the full year in Q1. And so far, we're progressing as planned.

Is this -- may I ask it this way? When's the last time you made a significant price increase? So in other words, is this part of a program? Or is this more of a one-off?

Yes. We don't have this policy or process of annual price changes. Last time price for Pro X was changed when the subscription was established, I think it was 3 years ago. Pro pricing changed more than 3 years ago. I've been with the company over 3 years. That was well before my time. So we don't have this annual cadence of price changes. What we do though is we're constantly monitoring the value that we provide to our customers versus the price that we charge for. We also look at competitive situation, the pricing power, et cetera. So we're constantly monitoring the situation. And we may decide on the price changes on an actual basis.

All right. Great. Let's shift over to the cloud. I think you had just mentioned that 23% of your business is in the cloud. It finally looks like what we're hearing from customers is they're ready to more fully move their DevOps tool chain into the cloud. How do you see that impacting your business?

Yes, you're absolutely right. Our cloud continued to grow faster than on-prem, and it's clear to every one of our customers that the North Star is cloud. But many of them have significant on-prem installations, and many of them will have to remain on-prem as well. So this transition to the cloud, while most significant portion of workloads will move from on-prem to cloud, we don't think that it's going to be 100% cloud. We think it's going to be hybrid story. And that's why from the beginning, JFrog philosophy was to offer this freedom of choice to our customers to use either cloud or on-prem. And that's how we designed our products because our products have exact same features for on-prem installations or cloud. It's exactly the same touch and feel in UI. So really does not have any hurdles for customers to use either of the installation. And what we're hearing from our customers is that hybrid is a must. We're also hearing from our customers that multi-cloud is a significant advantage because none of them want to be locked in into one of vendors. That's why having multi-cloud capability is a significant advantage.

Which is a great point. I think you have some partnerships across all the public cloud vendors. How do you leverage those partnerships to drive growth?

Yes. You're absolutely right. We -- today, we have partnerships with 3 of the largest clouds in the U.S. It's AWS, Microsoft Azure and Google Cloud. We're also building additional partnerships with providers in the Far East. If you think about it, Sterling, the major KPI for cloud is how much traffic generated on their systems. Our KPI is slightly different. Our KPI is how fast we release and update software on edge device. But we generate a lot of traffic, and that's why we partner with all of these clouds. So what we're doing, first of all, all of them offer us on their marketplaces. And we've been working on kind of streamlining and aligning offerings on these marketplaces with our cloud offerings. We also enabled, in the last quarter, kind of core enterprise sales activity, where this cloud will offer what is called private offers or private links, where the customers could use basically umbrella of the agreements with this cloud to buy our tools. That significantly streamlines the process. Also, sales reps from the cloud will be compensated on selling JFrog tools. So that's yet another step in our partnerships. And all of them -- by the way, we have our swampUP conference coming up this later this week, and all of these 3 cloud sponsors of this conference as well.

That's great. And I think also for some of them, you're in their government cloud instances as well, correct?

Yes. We established the government cloud instances with AWS and Microsoft Azure. And we're working to expand our business in -- with government. Today, it's still small numbers for us. It definitely creates significant opportunity for us to grow there. When we looked at it and analyzed how government spends on tools like ours, there are 2 ways that they do that: direct purchase from vendors in this space or through third parties. Even the direct purchase from -- for tools like ours, it's over-$100 million opportunity. But a much bigger portion is going through third parties. That's why it's kind of difficult to see the exact numbers, but it's definitely a much bigger portion of the direct purchase. So for us to meaningfully participate in that, there are few prerequisites: First one is achieved is tool has been offered on government cloud. And there are certain certifications that we need to obtain. One is Iron Bank, which is for on-prem installations and then FedRAMP for SaaS installations. And we're working on those to get certified and to enable this opportunity.

Are those certifications things that can be done this year? Or is that a 2022...

Iron Bank is more weaker process. It probably takes a few quarters. So it definitely could be done this year. FedRAMP is a longer process. It's several quarters, so it's more 2022 opportunity.

Because I want to tie that back to you had alluded to the executive order that President Biden had signed and pushing on cybersecurity. And I think you were tying Xray into it, which I think is a good segue. Do you see that as a significant opportunity? In other words, can Xray actually be another leading driver to adoption of your overall platform? Because I always viewed it as the other way around. You start with Artifactory repository, and then you take Xray. But could it flip the equation?

Yes, you're absolutely right. The DevSecOps, specifically software composition analysis, become area of focus for investors, not just for investors but for customers...

That's good.

In the first place, yes. And we do see a significant interest in Xray. We also invest a lot in expanding capabilities of Xray. And when you look at the White House report, that absolutely kind of, once again, crystallizes the need for tools like ours. So Xray is a significant value for our customers. That's why we made some subscription changes and also pricing changes because of this innovation and because of the value that Xray provide. And that -- of course, it could be also additional driver for customers to adopt solutions like ours.

Right. Right. All right. Let's finish off with competition. How often do you see a direct competitor in the deals that you're competing for in a quarter?

Yes. So competition, we divided into several layers, but it really depends what kind of transaction it is because repositories, there are several competitors in the repositories. There's tools like Nexus, the second-largest installed base in the market. And there's other tools like -- offered by some of the cloud and open source. So if we just -- competition on repository, that's one thing. When it's security, security is a very fragmented market, multiple tools and really depending where the area of focus. Today, Xray focuses on software composition analysis. We don't yet have capabilities in software-static analysis, source code scanning. There is another area such as container security. So it's a very fragmented area. And we plan to expand our capabilities in -- for Xray in those areas as well. And distribution, really, there's no competition at all. Today, the market is some homegrown solutions, sometimes built on top of CDNs. And there's no commercial vendors who offer solutions like ours. So it's completely greenfield.

Let's make sure we clarify distribution versus deployment because I think sometimes investors get that confused. I mean continuous deployment tools like Ansible from Red Hat or HashiCorp, et cetera, they would pull from your solution. Your distribution is making sure that all of the proper artifacts and binaries are distributed to the key points that they pull from. Is that the right way to describe this?

That's exactly correct. So our distribution solutions make sure that Artifactory are present in that edge that you want to install the software arm. And then other solutions take it from that and deploy into run time.

All right. So wrapping it all together, improvement in net new customers, interest in DevOps, if I look at that in the context of your guidance, it sounds like -- or it looks like you expect at least a little bit of acceleration in the second half of the year. Is that the right timing to think about for that improvement?

Yes, I think you're correct. We -- when we guided for the year, we did say that Q2 will be the slowest growth quarter. And our guidance for the year does imply a certain acceleration in the second half. So you're absolutely right.

All right. Excellent. I think we're at time. Jacob, thank you so much for joining us. Really appreciate it. Give our best to everyone and good luck with swampUP.

Thank you very much.

All right. thank you.

And we invite everyone to participate in swampUP conference.

Sounds good.

Thank you.