JFrog Ltd. (FROG) Earnings Call Transcript & Summary

Okay. Great. I think we're going to get started here. Thank you, everyone, for joining us today at JPMorgan's 50th TMC Conference. My name is Noah Herman. I'm currently a software research analyst here at JPMorgan. And we're really thankful to be hosting Jacob Shulman from JFrog today, CFO. Thank you for joining us.

And thank you all for having me at the conference.

Thank you.

It's great to be back in person.

So just taking it off here, Jacob, could you provide an overview of JFrog and summarize the value proposition of the company and the problems you really help solve for customers?

Yes, sure, absolutely. So JFrog's vision is to power all software updates in the world. And software becoming competitive advantage and how fast you release your software, that's what defines a competitive advantage in the business. We help our customers to automate the entire software release process, focusing on the software supplying chain. Software world now moving to the space where hardware guys have been doing that for years, knowing where software component is coming from and where they're going, right? This is our kind of the value where we provide a lot of automation in the software release process, but also making it very fast and secure. As you know, about 10% of your software coming from source code, 90% of your software coming from open source and third-party components. And all of that is done via binary management. So we've built a platform for the full binary life cycle management. Our platform comprised of multiple 6 products, with Artifactory being a flagship product and it's a binary repository manager de facto standard in this space. And over time, we also added security capabilities with our Xray product and also distribution capabilities with our distribution product, all of that powered by CI-CD. And on top of that, we have kind of administrative console and dashboard. So this all comprise our enterprise, Enterprise Plus platform, and we see growing adoption of the platform today in the marketplace.

Yes. No, that's a great overview. And before I move on, if anyone has a question, feel free to raise your hand. We'll try to leave about 10 minutes before the session to see if there are any questions and someone will come around with a microphone to help assist you. Just sort of at a high level, where are we in the adoption of DevOps by companies? And what are the biggest benefits for companies to use an Artifact repository?

Yes. So I think we're still in the first innings of the adoption of DevOps. Again, it's a very fragmented area. There is more adoption in certain areas, less adoption in others. For example, in our distribution capabilities, we're the only guys who even offer those capabilities, only a small portion of our customers transition to that. So we definitely see a lot of greenfield in this space. Still majority of the market today is a combination of open source and homegrown tools. But when we came up with Artifactory idea, the goal was to automate the entire development cycle for developers. As you know, developers always love this variety of different tools, and there are new technologies that come every day to help them to do turn the task in a more efficient manner. There used to be developers who write on the areas, I mean as I'm a Java developer or I'm C++ developer There's no that thing anymore, right? Everyone is doing multiple tasks and using multiple tools. On the other hand, enterprises don't want a variety of different tools. They want standardized framework for software release process. So we see it in this bridge between developer world and the enterprise world. And on one hand, we integrate with all developer tools allowing this freedom of choice for developers. On the other hand, we create the standardized framework for enterprises to release software to the market. And again, Artifactory is a flagship product that became the system of record for all of your software that you either create internally or bring from outside of the world and then deliver to the market. So that's your system of record, your single source of truth for the entire software in the space.

And if companies aren't using a repository, what would they be using?

They will still use repository, but it would be a combination of different open source repositories. Again, each technology that was created as a byproduct, they also had a repository for that type of technology. For example, Docker, which is a company that came up with container as a byproduct, they had Docker repository. NPM, there was an NPM technology. So what companies historically have been doing, they've been using this multiple repositories and some sort of homegrown tools to connect all of that together. So Artifactory was the first one to offer support for multiple technologies. So instead of having tons of different technologies, tons of different repositories, you could have one system of record that supports all of your technologies. And that's what Artifactory is. And today, we support over 30 different technologies. The competitors, they support mid- to high single digits of technologies. For example, one of the large Fortune 100 customers, when they transitioned to Artifactory, they had over 1,800 of different repositories, and they replaced it with all one single pane of glass with Artifactory.

Got it. Just switching gears here a little bit. I wanted to sort of focus a little bit more on the go-to-market strategy. How is JFrog working with the channel partners? And how strategic has the sales force been and upselling with the current customers.

yes. So historically, JFrog has grown through bottom up. And I actually attended the previous conversation with New Relic, and it's similar to what we see. Developers don't want to talk to salespeople. And the best selling tool is your product. So this is how we started growing up, developers started adopting Artifactory, and that's how it became the [indiscernible] standard. But when over the time, we offered additional capabilities in security and the distribution and other products and build the platform, it became much more than just a developer play because Artifactory does address developers, but our security tool there is different persona, security engineer. And then the platform addresses the distribution capabilities, address the product manager, those who are responsible for software updates on the customer side. So it became much, much bigger play, and that's why we added top-down capabilities to move the platform to the market. Now we're in the next stage where we started working with channels and partners. Today, it's very minimal contribution. The biggest contribution today is our -- from our partnerships with cloud providers. Today, we work with 3 major cloud providers and continue to develop relationships with others. But our contribution from marketplace and private offers from these cloud providers today is 10% to 15% of our business, but it's very fast-growing piece of that cloud business. On the other side, we haven't yet seen contribution from resellers or value-added resellers, et cetera. We did have certain business done with GSIs, but that was primarily driven by end customer when GSI has a big digital transformation project with the end customer, end customer would require them to buy JFrog. But we haven't seen yet kind of big push from GSIs to adopt the customer because we haven't built those relationships. This is what we're currently doing. Same with professional services companies. We just started building this go-to-market -- those go-to-market capabilities. We hired right people to do that, and we have very good kind of road map to build and expand those relationships, so they contribute their meaningful piece of the business.

Got it. And I think last quarter, you actually signed, I believe it was the largest cloud contract we had, and this is...

Yes. That was the largest contract that was driven by one of these relationships with major clouds. It was, again, on marketplace private offer cloud, and we see that as a continued growing piece of the business.

Got it. And are you starting to see existing customers sort of shift to like higher tier price plans? What is sort of the dynamic there in terms of the customers per pricing tier that you have going forward?

I mean that just -- you're talking about high tier planners transition to the platform?

Exactly.

Yes. So definitely, a platform becomes the significant value to our customers. And it's driven by different trends, either whether it's security trend or whether your time-to-market trend, a platform becoming a significant portion or significant value for our business and a significant portion of our business. Today, roughly 5% to 6% of our customers transition to the full platform. The best metric to track our progress with the platform is to track number of over 100,000 customers because the entry level into the platform is $115,000 for on-prem installations, so $150,000 for cloud. Not every one of these 599 customers on the platform, but it's a good approximation. And you can see that the number of over 100,000 customers actually grew over 50% year-over-year, which indicates that adoption of the platform continued at a very high pace.

Yes, it definitely seems that customers are more comfortable migrating to the cloud along with their DevOps tools. How is this really impacting the company and the way you think about cloud growth?

Yes. So cloud growth is growing -- cloud is growing much faster than on-prem. And by the way, just for clarification, when we say on-prem, we actually mean self-managed because many of that on-prem business is still running in private or private cloud, it's just managed by customers themselves. So when we say cloud, it's mean our service to customers. So our SaaS is growing faster than self-managed. Last quarter, the SaaS growth was 63% year-over-year, which has accelerated from kind of mid-50s in previously, driven primarily by high adoption of our security capabilities as well as the transition to the platform. And we will continue to see our SaaS offerings growing faster than self-managed for several reasons. First of all, obviously, all of our customers understand that the NorthStar is a cloud. And -- but we have hundreds or even thousands of very large customers that it will take them years to get there. So therefore, it's not just cloud, but also hybrid. It provides a lot of value for our customers. And from get-go, our philosophy on that was that our cloud and on-prem self-managed products will be identical. So same touch and feel, same feature set exactly, so that will enable our customers this freedom of choice to move their workloads from self-managed to SaaS offerings in a seamless way. And by the way, that large contract that we reported in Q1 was actually that transition. That customer used to be a self-managed customer. And just as a strategic move, they decided to move to SaaS. And that's our philosophy of having same exact products that actually make it seamless transition for this customer. So we will continue to see our SaaS offerings continue to grow at a higher pace than self-managed.

Got it. And so at this point, what mix of your customers are also using security? And can you give us a sense of what this opportunity is long term?

Yes. Security is evolving landscape, and it's still very fragmented. Security comprised of various areas of expertise like static analysis, dynamic analysis, software composition analysis, runtime security, container security. And no one today has this end-to-end offering in the security space. And that's why we see many times people use multiple tools in the stack. We made a lot of investments in the security, and we see our security business is growing. And actually, acceleration in the cloud in Q1 was partially attributed to high adoption of our security capabilities in the cloud. Security is also a must-have prerequisite before people move to the platform because you want to distribute only secured components of your software. You don't want to distribute something that will later on cost some vulnerabilities, et cetera, right? So we are working towards enhancing our security capabilities. Xray today, our tool, is one of the best tools in software composition analysis. With video acquisition, we expand in our reach and building this full end-to-end capability. We're not there yet. It will take time, but we definitely want to provide many more capabilities. And also, we believe that with the elevated level of interest in security, we will also be working on making security as a new [indiscernible] point. So, so far, our security capabilities were only available to those who are the Artifactory customers. But we see that security engineers more and more interested in products like ours, and therefore, we're working also to make security kind of a new stand-alone solution to enable yet one more [indiscernible] point into our customers.

And as you sort of extended security in these other areas, are you seeing any change in the competitive dynamic? Or when customers come up for a renewal, how are you kind of incentivizing them to renew? Or anything you're seeing in terms of difference in the competitive landscape?

Yes. From the security perspective, I think people realize now that just scanning is not enough, okay? People want to have capabilities and remediation of vulnerabilities. And I think last quarter, maybe a quarter before that, we gave an example of a very large bank that was able to remediate Log4j vulnerabilities within less than 12 hours. And that particular bank has thousands of different applications running in hundreds of different environments. So potentially, if they had just a security tool, they could scan 1 application -- 1 by 1 application in different environments and identify these vulnerabilities. That bank was able to identify vulnerability within a matter of a few minutes just by going into Artifactory. And since Artifactory is your single source of tool for all of your software, within Artifactory, they were able to see what applications and what environment are impacted. It's not a stand-alone security tool. It's Artifactory feature. Then when they brought the new component, yes, it had to be scanned by Xray as a security tool. The next step in the remediation was to automate the builds against the new component. And again, it's Artifactory feature. And finally, when the software remediated and ready to be replaced in those different applications, that's a distribution capability. So really, people see the value of the full platform for remediation of security capabilities. So it's not just scanning that provides value. It's the Artifactory, in combination with Xray and distribution, that would provide a lot of value, and that we see people understand that more and more, it's not just enough for them to know that they have vulnerability, they want to have tools to be able to remediate that vulnerability fast.

Got it. Makes sense. I think we'll take a pause here. If anyone wants to ask any questions, you could just raise your hand. I think we'll have [indiscernible].

You described your business well. Now could you actually comment on the -- your competing competitive positions? I mean who are the other players? And what is your relative positions, either segment-wise and/or at the platform level?

Sure. Yes. So when we think about competition, we divide it on the 4 different levels. So primary, the largest market share today is a combination of open source and homegrown solutions. In majority of cases, when we bring new customer, they basically replay in homegrown solutions. And that's greenfield [indiscernible] still we're in the first innings of replacing that. Second tier is companies and DevOps space. And our platform comprised of several products, and each of them has their competitors. For example, Artifactory today is our flagship product, the largest installed base. The second largest installed base is a company called Sonatype, which has been our competitor for many years. And there are a few other smaller start-ups that exist. In security, we just talked about security, a variety of different tools. In distribution, it's primarily some sort of homegrown solutions built on top of CDNs. CI-CD, very fragmented area. There are different players in CI-CDs, several players. No one today has this platform that encompasses full binary life cycle management. There are certain players in source code that realize the value of binaries and also developing capabilities in the binary management as well, players like GitLab and GitHub, but they're far behind and just at the beginning of the kind of development capabilities. Third layer is cloud providers. So first of all, I want to say that cloud providers are very good partners of ours. And a significant portion of our business comes from partnerships with these cloud providers, and that continues to grow. We have different KPIs. Our KPIs is how fast -- how we enable our customers to release their software fast and secure. Cloud KPIs is how much traffic they run on their systems. We generate a lot of traffic, they partner with us. However, they want also to be close to developers and offer certain overlapping tools, but again, on the different KPIs. For example, each one of them have container registries. Containers are very large files, therefore, when moving containers, you generate a lot of traffic. But you cannot create software with just containers. You need many more technologies support for many more technologies, and that's why they continue to use Artifactory for creation software. However, there are also 2 -- so there are technological differentiator, depth of the solution and platform play, but there are also 2 business differentiators. One is hybrid because we have significant portion of very large customers who, as we said, going to go to cloud, it will take them years. Therefore, hybrid is very significant value for them, and none of the clouds today they have hybrid capabilities. And second, significant business differentiator is multicloud. None of our largest customers and/or any enterprise customer want to be just AWS shop or Azure shop. So all want to have multi-cloud capabilities to have different capabilities in different regions to prevent the vendor lock-in and other reasons. And that's yet another business differentiator that will always be in our favor. And then the last layer is diversified software companies such as IBM and VMware. They've made first steps into this direction, definitely identified DevOps as area of interest. But frankly, they kind of -- they made a few acquisitions in this space, but they're far behind right now.

Would you consider yourselves [indiscernible]?

Yes, I'll just repeat the question because we're on the webcast. So do we consider ourselves leaders or we're one of the leaders? So what we believe is that -- I'm sure you're all familiar with DevOps Infinity loop. And we believe that various areas of expertise exist in this DevOps Infinity loop. Obviously, for example, monitoring is one area of expertise, collaboration, yet another area of expertise. We believe we are leaders in the software supply chain area and the binary life cycle management. And we believe that these leaders will coexist in the future in different installations. For example, we see ourselves deployed many times next to different monitoring tools or different source code management tools and different collaboration tools, and we'll have to coexist in this environment.

Yes. Over here.

You talked about a move to the cloud will take years for a lot of your customers. Is it particular to what you do that where customers would rather stay on-prem longer? Is that because we're dealing with code? Or is that just a general statement, it's going to take...

It's just a general statement because if you take a look at Fortune 100 bank, 5 years ago, no one thought banks would go to cloud. Now people open to idea, but only small workloads who are currently moving to cloud. So it will take time for them to move to cloud. And many of them actually will remain hybrid and many of them will remain on-prem for regulatory purposes or maybe for other reasons.

But the bulk of development is ultimately moving to the cloud, right? So more of the software that's being written today, this is a question, is being deployed in the cloud?

Software is deployed in the cloud but different organizations have different topologies and different capabilities in different regions. So in one region, they may work on -- in self-managed environment, Again, when we talk about self-managed, it could be running in public cloud, but managed by the customer. So anyway, a lot of the workloads running in public cloud. It's the question whether they get it from us as a service or self-manage their systems.

Any other questions before we move on?

Yes. You talked about the idea of the platform. Can you describe me what the challenges and difficulties are? It seems as if it's been sort of difficult year and security also what you mentioned. Can you talk about it's hard to build a platform in DevOps?

Why is it, sorry?

Hard. What are the difficulties challenges in building a very -- platform in a very fragmented sector?

Yes. I think the word platform is -- different people define platform in different ways. The way we look at the platform has everything to do with only one type of asset, and this is binaries. From the moment binary is created, until they run in on the end device, this is what our vision of the platform. And this has to do everything with binaries, have scalability, management, security, distribution, one type of assets, one type of expertise. Different people look at the platform differently. Some of them look at monitoring -- again, coming back to my predecessor here at New Relic. They talked about different vision of the platform from others. So each -- again, each company has their own definitions. Our vision is everything to do with the binary life cycle management.

Okay. I think we have time for a few more questions. If you have any, just raise your hand. So you've talked to 30% revenue growth as sort of the long-term outlook. I think the guidance for this year implies a little bit more above that, 34%, 35% growth. Can you just talk to what's driving that and the durability of that growth sort of above your long-term target?

Yes. So first of all, the primary reason for our growth is expansion of existing customers. And we've seen our net low retention rates actually accelerating to 131%. And we truly land and expand. We typically see customers [indiscernible] at relatively small volume, kind of a small ASPs, about $10,000, and then continue to expand in very nice levels after that. So if you expand that 130% plus, then obviously, your growth is 30%, and we continue to see that those are sustainable levels of expansion, driven, again, by several factors: one, our leadership position in Artifactory; two is increased interest in security capabilities; and three, completely greenfield in terms of distribution. Again, only a small portion of our customers, only about 5% of our customers move to the platform and already generate 35% of the business. We definitely see a lot of opportunities in expansion within our large customers. We gave -- we had an Analyst Day back in February, we provided a few statistics, ASP for Fortune 100 customers, about 400,000 for us. ASP for Fortune 500 is about 200,000. So we already penetrated into those customers, but each one of these customers could be millions of dollars in terms of volume of business with them. Therefore, growth in those accounts could be meaningful. And to capture that growth, we start -- we built the strategic team, which all of the kind of fully operational, maybe for several quarters, and we've already provided stats that we see in the contribution of the team and expansion of these large customers. So therefore, we believe that our retention rates are sustainable, and therefore, our growth rate is sustainable as well.

Got it. And sort of going towards margins, where is the biggest area of improvement for margins? And are you seeing any wage inflation on the horizon? Or what -- can you just sort of give a detailed overview of the margin expectations going forward?

Yes. So first of all, historically, we built the company to be very efficient. As even as a small company, we're growing free cash flow positive, even reaching profitability at certain quarters and years. Back in 2021, we decided to make additional investments in the security space by acquiring Vdoo but also making some internal investments in the security. We also acquired smaller company apps to extend our distribution capabilities. So we continue to build those products. And actually, this week, we'll have our user conference, where we will announce a lot of innovations that will be a result of the integration of video capabilities into our product. We also continue to invest on the go-to-market. We talked a bit about building the strategic team. Now we focus on building partnerships and alliances, still only small portion of our revenues coming from that. And obviously, we expect much higher ROI in the future. So Q2, we guided for operating loss of $2.5 million to $3.5 million, primarily as a result of merit increases, speaking of wage inflation. A portion of that increase in operating expenses is attributed to merit increases that became effective as of April 1. But for the full year, we expect to be on the breakeven levels, which means that first half, we'll be in a loss position; second half, we'll be in a profitable position. And then we'll continue to build from those profitability levels going into 2023.

And then sort of what does the mix look like in terms of like investments in R&D, sales and marketing?

Yes. So today, our R&D running at approximately 30% of revenue. Again, in 2021, we expect to be around those -- sorry, 2022, we expect to be around those levels, and then we'll start gradual conversion toward our long-term target. S&M is around 38%, 39% of revenue. And again, in 2022, around these levels and the improvements. G&A today is around 15% of revenue, and we'll continue gradual improvements towards our long-term model.

Got it. Does anyone have any last question? I think we're wrapping up here. No? Okay. Well, I just want to say thank you again, Jacob.

Thank you very much for having us.

We really appreciate it. For everyone, just a heads-up that the next session, there is a keynote in Grand Ballroom A and B on the concourse level. So if you just want to make your way down there for that session, that would be great. Thank you.

Thank you now. Thank you. Appreciate it. Thank you so much.