JFrog Ltd. (FROG) Earnings Call Transcript & Summary

Well, thanks, everyone, for attending. I'm Jeff Hickey. I work on the UBS Software Equity Research team. And today, I have Jacob Shulman, CFO of JFrog, and we also have Ed who will be taking over on January 1. And just for a quick reminder for people tuning in online. You can feel free to submit questions, and we'll have them on the iPad come up here. So we can ask those as we go.

But maybe just kicking things off, we'd love to just get kind of an overview of JFrog in the story and where things stand today, maybe for those in the audience who are less familiar with you.

Yes, absolutely. First of all, thank you for having us at the conference. For those who are not familiar with JFrog, JFrog is a company in DevOps space, pretty much every company in this world became software company. You know very well what software did to the financial world, but it's transforming pretty much every industry. And to survive and be competitive, you have to develop software. But the software development process is very complex. People know software engineers writing the code, and people know software running on the machines, what in between? Not many know, but it's a huge industry full of manual, siloed, inefficient and vulnerable processes. So JFrog came to this world to streamline this process and to enable fast and secure software release all the way from developer keyboard to pretty much an edge.

Got it. That's super helpful. And maybe top of mind at this time of year or 2 for investors is just maybe thoughts on macro, we're now in late November, early December. Would love to get a read, just how your conversations with customers are kind of trending right now. If they're thinking about 2024. We're coming out of a year where there's some hesitancy, just more broadly in IT spend? How are those conversations trending and how is JFrog positioned in that?

Yes. Our product is mission-critical for our customers. Again, we support the overall digital transformation of these customers. And again, it's very mission critically important for customers. And that's why we see -- once the budget is allocated, people continue to execute on those budgets. We infrastructure play, therefore, people cannot stop investing in infrastructure if they're serious about software development. And that's why we continue to execute very nicely throughout 2023 despite having kind of macro environment. Our products could be deployed either on-prem, kind of self-managed or deployed on SaaS. And as other SaaS-based companies, we did go through this optimization headwinds that we experienced -- we started experiencing in Q3 of last year, more pronounced in Q4. And even entering this year, we did experience some headwinds. But then in March of this year, we saw the reversal of trend. We start seeing more usage for SaaS products, that usage increased in Q2 and continued to grow in Q3. Actually, Q3, we did see acceleration of our SaaS revenue growth. So we believe those macro headwinds related to optimization behind us. How it would look in 2024, it's too soon to tell. Again, the secular trend of SaaS migration, the security of software releases, the overall digital transformation, the mission-critical and top of mind for CIOs. But many of our customers today going through planning exercises. So it's too soon to tell how the budget would look like. We'll have more visibility when we report our annual reports.

Got it. It's great to see the acceleration. In terms of optimization, it's a hot topic, not just for you, but a lot of software companies and infrastructure names in particular. Do you have any sense of how much more optimization organizations might be able to do? Or do you view optimizations as more of a onetime exercise or more of an ongoing journey that customers will always continuously be looking to squeeze as much as they can?

I would divide it into 2 parts. One is like onetime effort to bring sanity to the system. And we did experience those headwinds, as I said, Q3, Q4 of last year and even the beginning of this year. Going forward, we believe people will just be more mindful for efficiencies and growing in a more efficient manner. That's why it's going to be probably ongoing exercise going forward. But less impactful as a onetime event that we experienced at the beginning of the year.

Got it. Generative AI is this little topic. Some people ask about -- the DevOps space is interesting a lot of chatter about GitHub Copilot, how that's potentially revolutionizing how software is developed. And I would love to get kind of your sense and take on how the advancements over the last year impact JFrog in terms of the amount of software people are writing or if there's any ideas in the road map on the security side or the binary repository side?

Yes. We believe, first of all, the adoption of generative AI will be a tailwind for our business. Again, generative AI comes to make development organizations very efficient. Therefore, velocity of software creation will increase, and therefore, we believe it's going to be a tailwind for us, providing kind of platform for software release process. The more code means more binaries, means a better business for us, because it's not just important to make your R&D organization efficient, what's really important is how fast you take software to the market. And the software release process will become the next bottleneck, and therefore, more automation will be required, means they're better business for us. There is another aspect of AI adoption, is we identify opportunities to support ML processes, MLOps processes for our customers. We see that many customers would want to host AI models, and they use Artifactory, our flagship product, to do that. They also many times post the premium data in Artifactory, what is AI model, is another form of binary. What it means to train AI model, it means another software update. This is bread and butter of what we've been doing for years. And therefore, we believe that it's a great opportunity for us. And we want to enable our customers to build efficient MLOps processes. And that's where we currently focus on, how to do that and our R&D is focused on enabling this opportunity.

Got it. I'm curious, JFrog's positioning is interesting also with the IoT angle which sometimes doesn't get talked about a lot. How should we assess the momentum of the increasing number of devices? And do you think AI impacts maybe how many more devices there will be to connect to and additional tailwinds to JFrog through that angle as opposed to just the security and repository side?

Yes, even today, IoT world is huge. We had billions of devices that need to be updated. And yet it's another form of a siloed process that were -- the R&D organization releases the product to your operation group that takes users manually to update certain hubs and et cetera, that goes to the devices. So our platform comprised of 3 cores, DevOps core, security core and IoT core. And the purpose of the IoT core is really this last mile from the hub to the devices. And we already have some large projects around that capability. Specifically, about a year ago, we announced a very large deal with one of the militaries in Europe to update their military vehicles. As you can imagine, in today's world, military vehicles cannot drive. They cannot shoot without software updates. And yet the soldiers with helmets, go with a USB drive to update software. So -- but the IoT world is very complex, updating software on tank is different from updating software on manufacturing robot or medical device. And therefore, a lot of verticals and with different protocols, different security requirements, et cetera. So for us right now, we're kind of in the exploring phase where we could go direct, where we could go with partners, what technical capabilities we should have. Therefore, we believe for us, IoT core prime time will come 2 years from now.

Got it. Got it. Maybe it'd be helpful to get an update on just go-to-market, traditionally selling to developers typically kind of a bottoms-up groundswell motion. You have an open source version of Artifactory, whereas you've made more recent investments into a top-down approach, focusing on a broader platform. Where are we in that kind of transition in those 2 models kind of working hand-in-hand together?

Yes, you're absolutely right. Historically, we've been going through bottom-up, Artifactory, our flagship product, is became de facto standard in this space, loved by developers. And this is how we got foot door -- foot in the door, even in the largest organizations through bottom-up developers, adopting Artifactory. Over time, our product capabilities evolved. We launched a full platform for DevOps. We added security capabilities, DevSecOps, our security core. We just talked about our IoT core. So it became a full platform, touching multiple persona with an enterprise, not just developers, but also DevOps managers, security engineers, CISOs, operation managers, those who are responsible for software updates on the customer side. So it became more holistic digital transformation project for organizations. And therefore, top-down, go-to-market capabilities required. It's selling Artifactory to developer is very different from selling full platform to the enterprise. And therefore, about 2 years ago, we started building the top-down capabilities, which not just includes hiring different sales persona. Absolutely, yes. But it's also different marketing collateral, marketing developer product to developer is very different from marketing digital transformation platform to the sea level. Also requires different solution engineering capabilities. It requires different support engineering capabilities. And this is what we've been building for a little bit over 2 years by now. And we started seeing first success, you could track that either by a number of our largest deal, that pretty much every quarter, we report bigger deals, bigger competitive displacements, more holistic deals. For example, last quarter, we report our largest deal so far, 8-figure ACV customer in telecom space, overall number of over $1 million customers was 6, the highest ever. So we started seeing this approach. Second, as we develop and launch our security core that, again, touching security persona, CISOs, it's not a bottom up. So it's primarily top-down sell. So therefore, enabling these capabilities will also help to drive our security product.

Got it. Maybe unpacking that, I'd be curious, historically, JFrog has been a lot about expansion of spending through existing customers. How do you think about the runway left of your existing customer base? And maybe that cross-sell motion, how much more opportunity there is given you keep increasing capabilities on to the platform?

We believe we're just starting because we got first step in the door with Artifactory. And today, our customers, 90% of Fortune 100, majority of Fortune 500, over 1/3 of Global 2000, but we see significant expansion opportunities in this customer base. We believe we have not penetrated more than 20% even in the largest customers. It's adoption of these capabilities. It's a long-term project for our customers, and that's where we see that it's platform adoption is going to be one of the long-term drivers for us. Even today, we have customers that pay $10,000, Global 2000 company will pay $10,000 just because they just start in adoption of these capabilities. And we believe each of these customers could be a multimillion dollar customers. So big opportunities still in front of us.

Got it. Also, maybe thinking about whether it's bottoms up or gross retention rate is very high at JFrog You have free offerings out there. I would be curious what you're seeing in a free-to-paid pipeline conversion, your rates internally are those contracting a bit? Other players in the DevOps space have called out headwinds for many quarters now on that. And just curious what you guys are seeing?

Free-to-pay specifically also evolved as our products evolve also our funnel -- top of the funnel evolved. We started with open-source Artifactory, when we're just a developer tool company, Artifactory -- selling primarily Artifactory. And we still have open-source Artifactory. It's a product that supports only one technology. So you can't really do any commercial work on it. It's great for -- to learn about capabilities or to -- for kind of a student project, but you cannot do any commercial stuff on that. Then initially, we had like 3 tier. But as our products evolve and we're now offering more of the platform play, it's really hard to adopt platform on the 3 tier. So we transitioned that more to kind of cloud tile, and we see nice adoption. But overall, absolutely agree that macro headwinds have impact on new customer acquisition, similar to other companies in the space because of the budget headwinds or sometime head count, headwinds of those customers, many customers decide to just -- or reduce the level of innovation, adoption -- adopting new capabilities and more focus on keep the lights on. But historically, JFrog has been the story of expansion. Obviously, our customers land very small and go to multimillion dollar arrangements. It's all expansion story. And therefore, we continue to have very attractive net dollar retention rates. We reported our last quarter, 119% net dollar retention rate, which is very attractive. Our gross retention rate also very attractive, 97%. So JFrog continue to execute on expansion of existing customers.

And one angle a lot of companies are doing. I'd be curious what the magnitude uplift from moving from self-managed to SaaS, give someone like JFrog. It's interesting you've got multiple monetization models around those 2 different areas. But curious like how difficult it is to walk customers from effectively on-prem or self-hosted to cloud?

I just have to qualify when we say on-prem, it's really self-managed because customers would buy server licenses and could deploy them either in their data centers or even could deploy in public clouds or private clouds. They would just manage it themselves. And all they could use us as a service -- our services. So we -- the 2 different monetizations, we monetize our self-managed by a number of servers, and a number of servers will be dependent on size of the organization, geographic footprint, a number of different projects, a number of different technologies that you use because many times, people prefer to have separate servers for certain projects or certain technology. Our service SaaS capabilities monetized by data transfer and storage. So the more you use our products, the more data transfer and storage you generate and therefore, we charge more. Secular trend of transition from on-prem to SaaS is driven by several kind of reasons. Specifically for us, DevOps is a very complex area. And if you have geographic footprint in multiple geographies, you may not have same in-house capabilities in all those geographies, you may run different versions of the product. You -- it's really hard to find skilled DevOps engineers, the retention is an issue. So you don't want to be dependent on certain employees to maintain your kind of backbone of your software release process. And that's why you want to partner with someone, JFrog, to manage that for you. So that's the reasons. And obviously, TCO is much cheaper to use as on SaaS, then maintain the infrastructure and people who maintain the infrastructure. So those are the reasons to transition to SaaS. We also see that many times, people utilize this transition to adopt new capabilities. That's another thing. On average, we see uplift in ASPs, 20% to 80%. When people migrate from self-managed to SaaS. We also have exceptions, sometimes people get aggressive in adoption SaaS, and we've seen that customers migrated from entry-level self-managed platform $120,000 to over $1 million contract, but that's very aggressive. But on average, we see 20% to 80%, and that's why we believe that the migration to SaaS is not just immediate uplift on ASP, but also much better expansion because of more direct monetization methodology.

And SaaS is a growing mix of the pie. You report the corporate average, 119% NDR. Any sense on -- I'd assume SaaS is even higher than that? What's the expansion for...

Obviously, the overall SaaS is higher than corporate. Expansion of our SaaS business comprised of 2 components, expansion of existing SaaS customers and the pace of migration from self-managed to SaaS. We talked about cloud rebounding, the usage of the cloud rebounding during this year that kind of indicates better expansion of our existing customers. The pace of migrations in 2023 is still slower than in 2022 because it's -- a lot of that is multiyear projects driven by budget decisions, and we talked about tough macro environment that impacted the pace of migrations. We're happy to see that once customers make a decision to go to SaaS, they don't reverse the decisions even despite the macro. Obviously, it's secular trend for them. They may be doing it slower than initially expected, but they don't reverse decision. And therefore, we believe that the SaaS migration and SaaS growth will be yet another secular driver for us for long term.

Talk a bit about competition I talked to a lot of investors in the DevOps space sometimes and they ask about GitLab and GitHub, also pitching, someone like GitLab, a broader platform, touching everything. How do you compete with them and maybe touch a bit on how you differentiate from them and...

Yes. So first of all, we believe that the entire DevOps loop will be split or is split into 3 kind of areas of expertise. Obviously, one of them is monitoring tool DevOps. A lot of companies in monitoring tool space. We believe the secondary of expertise to the left of us is developer tools and GitHub and GitLab are part of that category. And in between is the software supply chain, where we believe we're leaders. There are a variety of tools that will always be loved by developers. And there used to be days with developers would write on their resume, I'm a C++ developer, I'm a Java developer. No one does that anymore. Because there are tons of different technologies evolve and developers, to be a full stack developers doing many more things. And they will be using tons of different technologies to each of those tasks. So developers would always want a variety of different tools. Enterprises don't want variety of different tools. Enterprises want standardized framework, secure framework for software releases. This is what we offer to them. Therefore, our strategy is to integrate with as many developer tools as possible on the left of us and provide a standardized framework for soft releases that will be later monitored by the guys from the right of us. So what we see is that our customers use GitHub or GitLab as coexisting tools. Obviously, managing source code is a very complex area, and they solve different pain from ours, managing a source code is different from managing binaries. We tackle different problems, and we deal with completely different issues. Therefore, we believe that we will be existing with source code players. Specifically, GitHub and GitLab expressed in the past that they desire to develop capabilities in software supply chain. But frankly, we don't see them. We continue to believe that we are the leaders in this space. And the #2 guys who are coming up with presale calls, primarily called -- a company called Sonatype, it's a private company, owned by one of the private equity.

Got it. Final one for me, and then I can open it up to the floor if anyone has any questions, would just be pace of uptick on the newer security offerings, Advanced Security as well as Curation. And maybe you can talk a bit about that, what opportunities that opens up for JFrog?

Yes. Definitely, it's a new core that we introduced in these days. What industry realized it's not just important to be very fast and efficient. You also need to be secure and pretty much every gate of the software release process. And DevSecOps area is a very fragmented area, comprised of very wide umbrella comprised of a set of different capabilities, and there are multiple point solutions that exist to tackle that specific area of capabilities, which ended up or resulted in the big enterprises, deploying 5, 10 different point solutions, which provide inconsistent results false positives or inactionable alerts. So definitely, there is a trend for consolidation in this space and more platform approach. All of these point solutions integrate with Artifactory because Artifactory became your single source of record for your software supply chain. And we believe that our new capabilities that we launched specifically JFrog Advanced Security and Curation have a very good opportunity there. The dynamic is slightly different. JFrog Advanced Security is a combined set of 6 or 7 different capabilities. And the primary goal is to replace those point solutions with a platform approach. On Curation, it's a new set of capabilities, different competitive environment, only a much smaller number of competitors in this space. And pretty much selling these capabilities to the same persona. Today, 80%, 90% of your application comes from open source. So what historically, people have been doing, they bring in the open source in to the organization, developing and only then checking for vulnerabilities. Basically, Curation allows you to perform those checks even before you bring open-source component to the organization and enforce security policies as a firewall. So we see a very nice pipeline developing from Curation, although it's a very young product just launched 3 months ago, we already have customers who have made purchasing decision, and we have very high hopes for this security product. We believe it's going to be a material to our kind of business in 2024.

That's great to hear. Well, we've got a couple of minutes left. I want to give an opportunity to anybody in the audience if anyone has any questions.

Yes. So I'll just repeat the question. I think the question was about our opportunities in AI development and what kind of revenue we could capture in this space. So we see 2 different aspects of how AI could impact our business. First of all, generative AI today is primarily making developed organization more efficient by using generative AI, creating code faster. More code means more binaries to be created, the software release processes, bottleneck and therefore, more automation will be required. And this is the value that we provide. Therefore, we believe more code equals more binaries, equals better business for JFrog. Second aspect of that is how we enable our customers to build efficient MLOps processes, helping our customers to train their models to develop their models in an efficient manner. That's the second aspect. Today, it's too soon to talk about revenue impact because we don't see yet a massive adoption of these capabilities and large enterprises. We do hear about success stories at the individual developer level, but don't yet see that there's a massive adoption by big enterprises because of the security concerns, IP infringement concerns, some entire legal framework kind of to be built. So therefore, we believe that it's more future opportunity for us. Today, we're developing capabilities to support those opportunities, but we don't see a significant revenue today coming from these initiatives.

Got it. More to come absolutely. Well, Jacob, we're unfortunately out of time, but thank you so much for attending.

Thank you very much UBS for the conference this year. Thank you, Jeff.

Yes. Yes. Great.

Thank you, guys.

Thank you.