JFrog Ltd. (FROG) Earnings Call Transcript & Summary

Great. Well, hey, everyone. My name is Koji Ikeda. I am one of the software analyst here at Bank of America. I'm absolutely thrilled to have Ed, what's your last name?

Grabscheid.

Grabscheid, the CFO of JFrog. Thanks so much for doing this. Apologies on the last name there.

It's okay.

Just basic question here. For those on the webcast and in the room that are unfamiliar with JFrog, maybe just a couple of minutes on what is JFrog? What do you guys do? What's the opportunity you're going after? And you're relatively new to the scene, so tell us a little bit about yourself.

Great. Well, first of all, my name is Ed Grabscheid. I'm the CFO at JFrog. I've been the CFO officially for about 6 months, but I've been at JFrog for 5 years now. So I know the story very well. I know the company very well. I took the company through the IPO and helped kind of build everything that we've done in terms of the long-term model and the forecasting process and what we do. So, like I said, very familiar with the company. JFrog -- well, first off, let me just say thank you for having us, by the way. It's been a great day of meetings, and I got to see a lot of people, a lot of familiar faces and a lot of new faces. So it was a really good meeting so far. JFrog founded in 2008. For those of you that are not familiar with the story, JFrog is a dev sec ops company. Most people know that developers write code, machines read the code. What happens in between is a very large market, fragmented, siloed, inefficient tools. JFrog came to this world and was founded simply just to improve the developers and fix the pain points for the developer. And this is done through automation. So when you have velocity, when you have scale across your organization, JFrog is critical infrastructure. What we see in terms of our opportunities, we started as a developer tool and it was loved by developers. It was a bottoms-up strategy. We're now more of an enterprise solution. So we're now focused more from a go-to-market perspective as a tops down. As I said, when you have velocity, when you have scale in your organization, when you have complex processes where you have multiple developers, this is where JFrog becomes very valuable. We have very large organizations such as Cisco, BofA, et cetera, that use JFrog to scale their organizations and deliver critical software updates at a high velocity and secure, which is very important. And this is where the value of JFrog comes into play. From a competitor perspective, you asked about where we differentiate. We have the ability to scale. This is what we hear. In addition to that, we also operate in a hybrid mode. So you can have both an on-prem as well as a cloud deployment. In addition to that, we're agnostic. You can host on any of the hyperscalers. We do not require you to host on one single hyperscaler. You can choose if it's AWS, GCP, Azure. So we're agnostic from that perspective, and that's a differentiator for us.

Thank you. I've been asking all the companies, the management teams over the course of the last 2 days, the macro -- the demand environment. It's been an interesting software 6 months, I would say. And so -- but it did feel like to us that the JFrog first quarter results were pretty good. And so, can you tell us a little bit about the demand environment? How are you feeling about it today versus January versus maybe a year ago?

Yes. Well, first of all, thank you for your continued support. I think you were one of the ones that at the end of Q1, really came back and said, "I appreciate what you guys did in terms of your prem." We were kind of the canary in the coal mine. People thought maybe it's a JFrog problem. We had a very, very strong Q4. We came off of probably sequentially the strongest quarter we've ever had in the history of the company. We did not back off of our philosophy in terms of our guidance. In the cloud, we guide to the mid-40s. We maintained that philosophy of only guiding to what we know. I think there was some whisper numbers that expected something higher than what we had guided to. And we certainly -- we don't control that. What we can control is what we see and we continue to guide to what we see. The macro environment for us hasn't changed, and we said that. What we saw during 2023 was very similar to the trends that we see in 2024. The difference is, in Q1 of last year, we saw optimization. We saw customers optimizing in terms of their workloads, in terms of their spend, in terms of their budget. What we're seeing now in Q1, what we saw is maybe more rationalization. So, you start to see some more rationalization in terms of their budgets. The great thing about JFrog and maybe the misconception around JFrog is that we were a 100% consumption-based company. That's not necessarily the case. We have commitments from our annual customers. Those commitments give us visibility into the mid-40s growth, and this is what we continue to guide to. So, it doesn't matter as priorities shift. Maybe if a priority shifted from developer workloads to AI, for example, that doesn't impact my cloud growth. I have a commitment in the mid-40s and then I have visibility into that. So, a shift in priority, for example, in Q1, which tends to be a planning quarter, and maybe there was some shift into other activities. That doesn't affect JFrog like it may affect other companies that are a 100% consumption-based. So, what happens is the customer can then ramp up their workloads throughout the year. And this is where we said, from a macro environment, maybe we see some more kind of activity based on the pipeline of what we see towards the back end -- back half of 2024, which would be similar to what we saw in 2023.

I wanted to dig in on something you just said about rationalization, and I think that with mid-cap companies specifically, the number of products available and the number of users shrink, meaning you're not Microsoft, you don't sell 50 different line and all that kind of stuff. You sell Artifactory and a security platform. And so, help us understand how the end user uses JFrog maybe from a January to December perspective or from a contract perspective, rationalization sounds interesting, I will say, but what does that mean from the user perspective?

Yes. So, the user has become much more sophisticated. They have lots of tools today to determine and have visibility into their usage patterns. So what we see today is this compression between what the user is committing to and their overages. So that's first off and what we've seen, and that's kind of changed over the last couple of years, where a user, a customer may have been willing to take an 80% commitment on their assumed usage and then been willing to have some overages. Our overages obviously are priced much higher than what you would do from a commitment perspective, but that is now being a little bit more compressed. The great news about that is, when you look at the behavior of the customer, Q1 typically becomes a planning quarter for customers, and then they'll plan their workloads. This is not a linear business. This is a project-based business. So, you may have Q1 where you plan Q2, where there's an increase in that developer workload, then you may have a slight drop in 1 month and then you may ramp that back up. Again, it's not linear. It's project-based. But what we have now is a commitment from the customer over that annual contract of mid-40s growth. That gives the flexibility to the customer in terms of their workloads to plan appropriately. Maybe we hear this, maybe there were some attention being shifted to AI during Q1. It doesn't impact JFrog though, because we have that commitment.

Got it. Got it. And you mentioned AI right there. And so, good segue into the next question. I remember last year, we were sitting on this stage and Shlomi was kind of pumping his fist that AI is going to be a growth -- good driver for you guys in the future. And here we are, fast forward a year from that. I mean, really 18 months post hyperawareness of generative AI. And so, the question really becomes, what has AI meant to JFrog? I mean I totally appreciate that many of the AI-created binaries are coming in the future, but what does it mean from the end users, the high-level CIOs, CTOs, Head of DevSecOps, how are they thinking about AI and where does JFrog fit into that?

We can't have conversations without a discussion around AI. That's just the way the world is going, and that's how software is kind of moving. I think there's going to be a tailwind for JFrog at some point around AI. We certainly don't see anything today that would indicate that we're receiving benefit from AI. We're not the type of company that's going to say, I had mid-40s growth in my cloud. I delivered 47% in Q1. So, oh, those 2 points of growth must be AI-driven. That's not really what we see. We do see that there's potentially 2 avenues of opportunity. There's the generative AI piece. Generative AI means that more source code. There's better efficiency, more improvement in source code, means more binaries, more binaries means more opportunity for JFrog. That will come at some point. We're very, very early, and I'll use a baseball analogy here. We're just exiting the dugout. We haven't even thrown the first pitch on that. The second avenue of potential and opportunity is going to be MLOps. MLOps has an opportunity for JFrog because you're pulling a package, a large language model from a Hugging Face, a SageMaker into your organization. That package is a binary. Who manages the binary? Who owns that asset? JFrog. So, there's an opportunity there in terms of bringing that into your organization, storing it, securing it, managing that. In addition to that, there may be an opportunity down the road to move that, train that package and move that along your software supply chain. This is where an MLOps company. We're partnering with Qwak, for example, that may have an opportunity to move those packages along your software supply chain, that can be of value to JFrog. That will be a potential tailwind for JFrog as you're driving data consumption in the cloud with these large language models.

So when we think about AI workloads, and it does feel like JFrog gets thrown into the bucket of "should be a beneficiary at some point in time." I do believe that. And other companies out there, there's other software companies that have given some sort of visibility into the AI participation, whether it's a big company or a little company, they've talked about it. So how do you guys see AI-driven workload within your revenue streams and pipelines? And I'm not going to ask you to commit to a metric today, but it's -- in the future, as you begin to see more and more of this and have that visibility and confidence, how do you think about talking about it qualitatively or quantitatively?

So, there's a couple of things. First, let me tell you, we just turned on Copilot as a company. JFrog just turned that on. And the reason why is, we want to do it in a very secure manner. We want to bring in Copilot, we want to understand it. We want to bring opportunity to improve efficiency, but we're not just going to allow packages coming into our organization without knowing; A, we're not infringing on any IP. So if we're just turning it on, that means that most other enterprises, and especially those highly regulated enterprises like banks, government, et cetera, certainly are not turning that on yet or maybe using it, and it's nascent in the technology, maybe limitation in terms of their usage. So for me to say today, Koji, I'm seeing this benefit coming from AI would be; A, a false statement; and B, it's too soon for me to know really what is going to be the impact. Maybe in a year from now, I can sit here, and the next year when we have this discussion and we're doing our fireside chat, I can tell you, "Okay, I see value in AI. I see a potential uplift of x percent." But today, I cannot commit to a number, nor do I have the visibility. I don't know if code is being written by a human or if it's being written by a machine. We don't have that technology yet. And once I have that technology, then I can confidently sit here and say, "I see that machine is driving x amount of code, therefore, it should generate x amount of benefit going forward. Until I have that, I don't feel comfortable to even comment on that. I think it's too soon.

Got it. No, that makes sense. So, we talked a little bit about cloud and how developers use it. Is it similar with self-managed too? Or is there any sort of differences in the way they consume self-managed, buying seasonality? I mean, anything to comment on within self-managed?

Yes. So, as you mentioned, cloud is monetized through data consumption, okay? So you see growth as either your commits increase or your data consumption increases over your commit. Self-hosted is on a per server basis. So regardless of my utilization and my server, I may have a customer that has 3 servers, 2 of those are 100% utilized. One of those is 20% utilized. If they increase the utilization of that server from 20% to 80%, there is not necessarily a value in terms of my revenue uplift. I don't see value in that. Maybe, down the road, there might be an opportunity to expand with an additional server, but at the time of that increase in the utilization of that server, I don't benefit from that. What we see in terms of our self-hosted business, it's stable. We don't see that being a significant growth driver. Where we do see some opportunity for growth in our self-hosted business is through security. Security historically has been purchased with self-hosted customers. As we add on an additional SKU, so advanced security being an additional SKU for JFrog, that will sit on top of your self-hosted licenses, then you have opportunity for some expansion in the self-hosted. But really, that's going to offset maybe some of the stabilization or maybe even some of the limited growth that we have right now in self-hosted. Most customers are looking, and it's not going to ever be 100%. But the secular trend of moving from self-hosted to cloud, and as the macro environment improves, you'll start to see more customers moving from self-hosted into cloud environments.

You just mentioned security, so let's touch on security for a little bit. You guys have been talking about security for a while now. You have the advanced security SKU. You've talked about broadly how to think about customers, people that have been looking at security. When I look at security, I see a lot of different options out there. And you had security out there for some time now. So, tell me little bit about the security, what you've learned about your security product, how those conversations are coming with customers and what are they focused on and how are you helping them with your security products?

So, let me first ask you a question, who manages the binaries? Who is the one that is going to manage the binary?

I don't know.

JFrog. So if JFrog is managing the binary, who are they going to trust to manage and secure those binaries? It's JFrog. And when you bring in a platform that is securing your binary platform or the factory, then this is the differentiator. You have 7 point solutions, multiple point solutions right now. And we see this. It's a very fragmented environment. There's maybe even inefficiencies between each of these point solutions, false positives, things of that nature. What we're hearing is vendor consolidation. One vendor to standardize on platform, all of the things that JFrog offers resonates with our customers, and this is what's giving us the right to win. Now, what are we seeing so far? We delivered in the second half of 2023, the advanced security and curation to the market. We had tens of customers. We talked a lot about 2023 security. Our position in security, the advantages of security. And 2024, this is a year of execution. At the end of the year, we'll disclose our revenue in terms of that contribution from security. Today, we're building a very strong pipeline. What have we learned from this? We've learned that there are a lot of people involved in the decision-making practice of purchasing security. This is not like a DevOp sale. It's not a developer in the room deciding that we need to take out our homegrown, do-it-yourself tool or maybe Sonatype and replace that with JFrog. This is a situation where you're bringing cross-functionally, the CIO, the CISO even the CFO, legal, the developer all involved in the decision-making process. It's becoming a large purchase. It's going to be a longer duration in terms of the contract because you're replacing multiple point solutions. It's not something that you can decide, I'm going to rip out infrastructure. I'm going to do this in 1 year. You may replace 2 point solutions in year 1, replace 2 more in year 2 and then fully adopt in year 3. And we're having those strategic discussions, and this is what we're learning as we go and have these conversations with our enterprise customers.

Keep me honest here Ed, I think you mentioned in the past that security might represent 5% of revenue this year. Is that right? And are you -- how are you guys tracking to that?

Yes. Yes, so we said that security will be a material piece of our revenue during 2024. We're still confident in delivering that number. And that's based off of what I see in my pipeline. That's based off of what I've seen so far in those customers that we landed during the second half of '23 that are coming up to renewal. So those that were on annual contracts, we're already starting those conversations. And we're seeing the size of those opportunities, which are relatively large opportunities for us. And so based on these factors, we're still very confident in delivering a material piece of our revenue during '24.

When you say coming up to renewal, does that mean that when those customers that you talked about in 2023 that adopted security, were they coming on as more of a test and see and now they're enterprise? I mean, walk me through kind of that conversation.

Yes. So, in '23, we did more proof of concept. We started with a -- tens of customers really to kind of drive, understand what the trends are going to be. We would be naive to think that all of a sudden as a DevOps company to come in as a DevSecOps company, selling security that we would be able to see this flywheel motion of purchases in security. So we went specifically with tens of customers with proof-of-concept, and we did that during 2023. Now what we're looking at is, from those learnings, how do we take that to have more strategic discussions with enterprise customers on multiyear engagements? Overall, the feedback has been very good from those customers. We're starting to see adoption increase in the number of users. So we monetize our security based on number of seats, which is different than what we do in our cloud business, which is on data consumption and different, of course, from our self-hosted, which is on number of servers. And the reason is, security at the number of seats, that's the common currency. So, we go as a like-for-like, so you understand exactly what you're spending with JFrog versus your other vendors. And we're starting to see some proof points that would say renewal, starting to see some increase in those seats coming off of those proof of concepts.

Got it. I'm going to ask you 1 more question and then I do want to open it up to the floor to see if there's any questions from investors. So my question is going to be about, I think recent -- it was last week or maybe the week before, I saw an announcement JFrog times GitHub. I thought that was pretty interesting. So tell me a little bit about that, what's kind of the key takeaway from that announcement?

Yes, that was a really good announcement for us. I see this as there's 3 real pillars of the stool that we think about here, and this was a technology and co-marketing discussion and release. Number one is, I think there's a clear delineation in terms of best-of-breed on source code and best-of-breed in terms of software supply chain. I think there might have been confusion from investment community from our customers, where does source code end? Where does the binary start? Now there's -- it's clear. You have best of breed and GitHub, you have best of breed in JFrog and you bring the 2 together. The second piece is this is not a one-time announcement. This is a technology come together, work on creating value on the technology side. So you have people from JFrog, you have a group from GitHub, you come together, you build a single pane of glass that allows you now to track, which will come out in the second half of this year, your security. So from source code all the way to the binary, so it gives you this traceability. And so exceptionally important. And at some point down the road, there may be a co-sell opportunity. It's too soon to know. I'm not ready to come out and say, from a long-term model, from a guidance perspective, that this is going to drive value, but it may, some point down the future, grows.

Got it. Any questions from the audience, please raise your hand, and we could -- we can call on you. I got questions.

Yes. Perfect.

I wanted to switch the conversation to go-to-market. I think the go-to-market evolution for JFrog has been pretty interesting. And you've been with the company for a long time, so you've seen it. So maybe walk us through the evolution. It used to start bottoms up, trying to get some sort of scale. I'll let you talk about it. But what does the go-to-market motion look like today? How do you balance bottom up versus top down? And what does it look like for the next 3 to 5 years?

Yes. You know our story well. You've been with us for a while. And as I said, JFrog came to this world to solve the pain points for the developer, and that started from the bottoms up. So we got the foot in the door with the developer, and as they adopted within maybe 1 organization, and they saw the value that it went to another organization and it scales across the entire universe of the company. This is where we saw the shift. Now this becomes an enterprise application and you go after the enterprise and you go after the platform. So, with that being said, it's no longer a discussion around bottoms up. You're now working for tops down. You're selling to the C-level. So, we've shifted in terms of our approach and our investment; A, we brought in a strategic team. We invested in that about 2 years ago. We spent a significant amount of resources to build out our strategic team. Secondly, channels. Channels is an important piece of our business and in order for us to get the scale, we now have a platform that channel partners can sell the platform, do the integration of the platform, and provide services and value for JFrog through the reseller. Additionally, we have the hyperscalers in the marketplaces, and we're using those. That gives us a little bit less friction in terms of the selling cycle, and we're seeing a lot of these strategic deals. We did a significant number of strategic deals in the second half of 2023. You saw it in the number of $1 million-plus customers that we landed, many of those deals go through our marketplaces. So, this investment that we've made over the last 3 years, we're starting to see the fruits of that. We really saw that starting to take where there is traction towards the second half of 2023. Now, how does it look over the next 3 to 5 years? We'll continue to invest in channels. We see value there. Channel today is a bigger piece, probably in Asia and Europe where you have different languages, you have different selling practices. Channels will start to expand a little bit more here in North America. We also brought in Carahsoft. This gives us the ability now to sell more frictionless with our government-based customers. So Carahsoft will be a partner for us in terms of the opportunity in the government. We're now looking to continue to invest there in the government. So I can see that being an opportunity going forward as well.

How big can a customer get with JFrog theoretically? Just from a core binary Artifactory perspective and then Artifactory plus advanced security. Is there a broad way to think about, I don't know, F-100 company to become 6, 7, 8, 9 figure deal?

I'll give you 2 points here to kind of think about. Number one is, we're a little over 80% penetrated in the Fortune 100, 50% penetrated in Fortune-500, 40% in the Global 2K. We probably penetrated somewhere between a little over 20% of their IT spend. So there is a long runway there. The other point that I'll give you is AT&T. We talked about this in our Q4 call, I believe it was, yes, Q4, Q1 call, AT&T, significant deal, 8 figure over 3 years that had Artifactory, had security. So you can see the size and magnitude of the deal. They were a Sonatype customer that came over to JFrog. They had scalability issues. They wanted to be in the cloud. They wanted to take security. They came to JFrog because of the fact that they can scale with JFrog, the velocity that we offered, the fact that we can do that on cloud. So you see the potential there that we had with AT&T.

So, you mentioned some penetration rates amongst the Fortune 100 all the way to the G-2000. And one question I get is, and maybe you could help me answer it right here is, how do you guys expand the penetration within these bigger customers? I assume with these bigger customers, you're already talking with the CISO, even the highest level buyers are there. How do you expand that spend? What is that strategy?

Yes. It's -- there's 2 pieces. Just because they're in the Fortune 100, Fortune 500 doesn't necessarily mean that they're on the full platform. So we still have less than 10% of our customer base on the full platform. So there's opportunity in terms of the adoption of the platform. And secondly, it's security and bringing in security as a growth driver for those customers that are on the full platform. Security is relatively new to JFrog, bringing security on top of your Enterprise Plus subscription will drive incremental growth.

Okay. Okay. We're almost up on time. So I just wanted to ask you one last question, and I've been asking most of my management team this is, as the CFO, what gets you most excited over the next 12 months?

Well, the opportunity in front of JFrog right now is incredible in terms of the platform adoption and what we saw in those $1 million customers and the traction that we're getting there. The fact that the way we do our model from a cloud perspective, knowing that I have the visibility and the mid-40s growth is, yes, in this market and being able to continue to commit to that when you're hearing a lot of these customers or companies that are 100% consumption based that are -- don't have necessarily the visibility we do. And what also excites me is security as a new opportunity for JFrog as we continue to drive the security pipeline and execute on that. And lastly, I think at some point, as MLOps becomes more mature, I think that there is an opportunity for JFrog to really execute on MLOps and have that become a meaningful piece of business down the road. That excites me.

We're out of time. Ed, thank you so much. This has been fun. Thanks so much for joining us today.

Thank you. Appreciate it.