JFrog Ltd. (FROG) Earnings Call Transcript & Summary

Good afternoon, and thanks for joining our fireside chat. I'm Jason Ader from William Blair, and I'm pleased to introduce Shlomi Ben Haim, CEO of JFrog; and Jacob Shulman, CFO. Before we begin, I'm required to inform you that a complete list of research disclosures or potential conflicts of interest is available on our website at williamblair.com. Also, if you have questions, please put them in the chat, and I will get to as many of them as I can. With that out of the way, Shlomi and Jacob, thanks for being with us today.

Hi, Jason. Thanks for having us.

Great seeing you again. Hi, Jason.

Great. Shlomi, let me start with you. For investors less familiar with JFrog, could you give us a quick overview of the history of the company, what you guys sell and who your customers are?

Yes. So Jacob probably shared it 1,000 times with the investors. JFrog was founded in 2008 around the mission of making software updates an easy process. A few years after, it was phrased DevOps. So JFrog is the company behind the end-to-end DevOps platform. It gives you a full solution to build, manage and secure your software delivery, all the way from the developers' fingertips to the edge in the cloud or on-prem.

And your customers are, I guess, very diverse as a result?

We have over 6,000 customers today, and we serve the majority of the Fortune 100. Customers are coming in all size and from all sectors. Everyone, actually, everyone in the industry that do anything with the software requires tools like JFrog. And we are honored to have the leaders in the industry on every vertical powered by JFrog DevOps.

And I know you have a big following, big community following. Do you have any metrics on just kind of free usage, where people are using the free version, the free tier?

Yes, Jason, that's actually a great question because the origin of JFrog came from the community. We actually always say that this company was built by developers for developers. So everything we started with was open source. So millions of developers, assuming millions of developers are using JFrog tools on the open source. Obviously, this is a bit more challenging to track because you can download them and share the infrastructure with other developers. What we see on our free tier, our cloud, the free offering that we have is that thousands of new companies and developers are joining every quarter. And we are very pleased to provide the community and not just our customers with this solution.

Great. And I'm guessing some investors may be intimidated by the technology. So for nontechnical people, how do you simplify what JFrog does and what problem you solve?

So when we look at today's world, and if you want to ask yourself, what is my contribution as a pain solver to what we see in the world? The very authentic pain that we see is that we consume more software. We got used to the rapid releases very, very fast. And we also -- we will not touch any software that will not be secured. That's the end in mind. So every organization would like to be faster and would like to be secured with any software releases, any software update. Otherwise, any organization, no matter what industry, no matter what vertical you're coming from, will fall behind and will lose the competitive advantage. What JFrog did is introducing the world with the first and only back then binary repository manager. Now what does it mean, Jason? What it means is that since you have to move fast, you need one to automate the process. And you need to go to the software package and to be able to manage the incremental change in the software release cycle in order to be faster and more secured and automated. We started with the repository, our flagship product called Artifactory, that manage all of your software packages, no matter what type, no matter what technology. If you use Java, C++ or .NET or whatever, JFrog will host it for you, coined by the community, the database of DevOps. Then in 2016, we added the security component on top of it, natively sitting on Artifactory. Xray is our DevSecOps solution that scan and bless your repository. So you don't just have repository for your software packages, but also a security tool that natively scan and secure your repository. From that point, the next logical step for us was building a distribution solution. Until today, the only one that provide a full end-to-end solution for private network distribution, for your software packages is JFrog distribution. Basically, the concept is that once you have something ready in your repository, what we call the release bundle, it's secured by Xray and distributed by JFrog Distribution. We acquired 2 companies. One of them came to be JFrog Pipeline, the CI/CD machine that automate the full process; and the other one, JFrog Mission Control and JFrog Insight that oversee the full pipeline. So bottom to top, you have a full solution for your software packages, binaries or artifact, the same thing with different names, that this is what every organization now build and deploy in a real-time basis.

And if I may just add, as a nontechnical person, that software is a text. What's running on the machine is not the text. It's a binary file. Therefore, every company that wants to release software has to go through the process of building binaries, securing them and distributing. And this is what we address.

This is the most technical CFO you ever met.

I actually remember when we first met, Jacob, that you walked me through -- we're at a cafe somewhere. You walked me through the whole text versus binaries. And I didn't even realize that binary repository was a thing. So, I guess, a lot of the rest of the world didn't either until you guys came along. But yes, I think that is a really important distinction that source code and the Git repo is text base. And what you guys do is 1s and 0s, is binaries. Can you talk a little bit about the importance of open source in terms of -- not open source of your product, but in general, the idea that most apps have something like 80% of their content coming from open source?

Yes, of course. So open source is already part of the reality. Developers that started to write code 20 years ago already used open source on almost every organization that I know. There is no even single customer of JFrog or user that will tell you today that they will not use open source, including highly regulated environment. Open source is being used and consumed on a daily basis. And our software release process on every organization consumes software packages or binaries from outside the organization from the public hub, whether it's Docker or Java or .NET or Python or almost every technology that you know. Now what is the special thing about -- the special magic of software packages, binaries and open source? Basically, this is what you bring from the outside. You bring binaries on the outside, usually open source. You consume it internally to build your own packages from the packages that you bought from the outside. And then you have your own software packages. So basically, even if you build your own software package, it's including an open source component that you bought from the community. I think that open source became super popular mainly because of the fact that you save a lot of time and money when someone else already build it for you. And the organization started to appreciate the community effort once they realize what is the ROI of using a component that was built by the community, test by the community, scale with the community volume and kind of promoted, not just by one organization, but by many.

Right. And if we think about the SolarWinds breach, part of that was the fact that they were using open source libraries, correct?

If you open your gates, Jason, to software or anything coming out of your organization, obviously, you enjoy the benefit of it. But you also have to be aware of the risks. And this is where Xray, JFrog Xray comes into the picture. You could bring Artifactory, will fetch software packages automatically for you from the public hub and will serve you as the local repository for your binaries. On the other hand, you cannot leave it unsecured. Therefore, JFrog Xray sits natively on Artifactory and secure those software packages. Now the nice thing and the -- I think the innovation JFrog introduced to the world back in 2016, 2017 is the composition analysis and the dependency graph because software packages are tricky. You need to be able to open them like a Russian doll and see 4 tiers, 5 tiers inside in order to find a SolarWind like and to protect your organization. Xray will do it for you. And therefore, the name Xray, it can scan the packages and give you a full composition analysis of all the components that you have inside Artifactory, not just to secure the specific build, but also all kind of dependencies that you might brought from an unsecured open source outside of your organization. By the way, it's not end here. You also wanted to be automated and to secure the process, the fast process as you build your software. So Xray will also integrate with your CI/CD to break the build once the vulnerability of a license compliance issue was detected.

Got you. And how do you -- I guess, how do you explain to, again, a nontechnical person why you need a software package?

Software packages is actually the only asset, the primary asset that's starting from a point that you created the package. This is what you will automate. This is what you will build with. This is what you will deploy. This is what you will test. This is what the edge will consume. So basically, source code is very important for managing the versions of what developers are doing. Inside JFrog, we also use a Git repository. But from the moment you create your binaries, from the moment you create the software package, you keep it as software package. This is what machine speaks. They speak 0 and 1. They don't speak source code. This is what you test. This is also the incremental update that you want to push. You don't want to push the old version of 10-point something. You want to have the incremental update to fix the software that you have on the edge. Now another very important thing, Jason, the world of DevOps is the combination of the machine power and the developer power. And tools like JFrog provide a common ground for both of them to collaborate in order to be faster and secure. If you look at JFrog Distribution, you need something that will be cheap and fast, faster than a CDN that will update any device at the end. And this is something that you can do only with binaries. Not just JFrog would say that today, but JFrog was the first company that introduced the world with this solution. Therefore, we are named the binaries people.

And you have support for something like close to 30 packages today. Is that right?

Correct. And this is also a very important question because universality matters. And we said it from day 1, we are the company that will provide developers with the Switzerland of DevOps. The freedom of choice is something that we have deep in our DNA. This is part of our philosophy. But when we build the support, it was not just a marketing promotion. We built a depth -- in-depth solution that support binaries in a way that you can actually manage them and not just hosting them. You can test them. You can automate them. You can see the meta data. You see the dependencies. You have a very strong integration with the hub that produces them. And therefore, when we speak about 30 software packages and different technology that is supported by JFrog, it's the only solution in the world that gives you this variety of universality for all software packages. For the developer, it's a joy because they have all technology supported on one platform. For the organization, it's a benefit because you avoid any kind of vendor lock-in that comes with the technology vendor.

And do most organizations utilize many different software package types? Or are there like 5 or 6 that are the 80-20 rule?

Well, in today's world, Jason, there is no single organization. Even if it's just you and I at my home garage building software, we will use more than one technology. We will build with Java or .NET, and we will use Docker for packaging. We will use NPM, Node.js for content. We will use Python for scripting. These are all software packages. These are all binaries. This is not source code. These are binaries that you bring from outside or you build inside the organization. What we see in the enterprise is over 10, 15 different technology types. Obviously, you have the most popular one. But -- for example, a few years ago, we got a phone call from one of the biggest bank in the world asking us to support the data scientists that are using R as the language, and they wanted to use Artifactory as the repository. We had a phone call coming from the community, from the foundation behind the cloud native, asking about Alpine that help you in the world of containers. So JFrog is a very good listener and amplifies the need that's come from the community. And therefore, the balance between the enterprise need and the developer need works great for us.

Great. Let's turn to kind of the current business environment. From your perspective, what were the big takeaways from Q1?