JFrog Ltd. (FROG) Earnings Call Transcript & Summary

And just to come back to that, again, I don't know if it's too early to start discerning, but are you showing different retention rates for those customers once they've adopted security? Or is it still too early?

I think it's too early. At the end of the year, we will disclose -- end of the year. In the next earnings, we will disclose the security numbers as committed to our shareholders, and we will gather all the information that is required to tell the story of JFrog 2024 security success.

All right. Looking forward to it. And then...

Two weeks.

I think the other question that a lot of people have asked us as well, like, understood you have this broad customer base that you can go and cross-sell now. Are you actually seeing new logos coming in and adopting security right at the start? Or is the sales motion still predominantly centered on, hey, you land with Artifactory and then you'll expand into security over time?

Yes. That's actually a very good question. And Mike, you are following the JFrog story for a few years now. We had -- or I had to take a decision on what we want to be focused, whether we are going to keep focus on the developers and the developers and individuals sometimes and the SMB or we want to go after the enterprise. And 4 years ago, a bit more than 4 years ago, we were very clear about our main focus, which is going after the enterprise. And it's not just the sales mechanism, the marketing, the go-to-market, the customer success and the front -- the customer front. It actually changes your entire company. Everything, the relationship with the customer, the persona you speak with, the upmarket methodologies and playbook for sales, the people you hire, the overlay you have, everything just changes. And you also have to understand that you might let go on a $1,000 ARR customer or $3,000 ARR customer because the people that you now hire are not even selling this type of offering. They are not selling this. So on one hand, you want to keep the SMB because you know that some of them will become the pipe for tomorrow's enterprise. On the other hand, you have to choose how you build your offering, how you build your service, how you build your sales team and how you take over the enterprise. So that was my focus for the past 4 years. And then what happened is that when a new logo comes to JFrog or we land on a new logo, and it's an enterprise, usually, they will take everything. They will start with the platform. The SMB, they will start small and maybe grow. So that's the main difference. To be honest, we were focused -- very focused on the enterprise side of it. And in the future, we might look and come back and revisit the question of SMB and if we have a light offering for them.

Excellent. It's great to hear the traction you're seeing at that enterprise level. That's fantastic. I think...

By the way, sorry to interrupt. You can also see it in the numbers that we are reporting every quarter. The number of Enterprise Plus subscribers, the numbers of customers over $1 million, the number of customers over $100,000, these are not the numbers that we used to see 3 years ago and 4 years ago. And the consistent growth on those $1 million cloud represent and demonstrate the change that we have done on the go-to-market and sales force.

Let me ask -- and this is just taking a step back for a second, but most, I think, if not all, security vendors, in some way, are largely focused on security detection at the code level. Again, you guys, with your roots in Artifactory, the top-of-mind technology and focus for you guys is at the binary level. Can you just take a second to explain, like, what is the advantage of taking a binary level view versus looking at the code?

Yes. Well, I would argue about the focus on the code. I think that code security was there for the past 30, 40 years. And some of them changed the experience and some of them changed the technology. But the way CISOs and security experts are thinking, they don't think about the product. They don't think about the solution. And this is different than developers. They think about the threat. So when you are looking at the threat of the past 3 years, most of the big, very big episode we saw on the security landscape was coming from software packages, therefore, binaries, artifacts, not source code. So the Log4j, the NPM, the PyPI, the SolarWind, this is all binaries. Now why this is new? Because the hacker started to understand that software development is not starting from scratch anymore. Developers all over the world, no one in the world starts from scratch. You bring software packages from different public hubs, either you go to Hugging Face or you go to Docker center or you go to the C++ center or the Java or the NPM and you bring your packages, binaries. So if I'm a hacker and I'm leaving something there for you, and then I want to get into your organization, I find a way to get through developers. Why this is something that became so risky because the only asset that you have in production in run time where the hacker can meet you are binaries. There is no source code in production. So yes, source code needs to be secured. By the way, we cover that with JFrog Advanced Security as well. Static code analysis is being covered by JFrog as well. It needs to be secured because you don't want your developers to do anything by mistake and open the gate for someone to come in. But the only asset that you have in run time is binaries. Therefore, when you reverse engineer the risk from run time back to dev, binaries are the only asset that you have to protect when you protect your software supply chain. And this is being elevated every year more and more and more CISOs start to understand that's the only way to protect the organization. And not only that, the White House already issued 2 executive orders about that, how you protect your software supply chain, software packages, period. It's like binary, 0 and 1. There is no middle area here. So this market is growing. The understanding of the new threats is starting to be more and more kind of on the level of best practices. We are very excited to lead that. And again, it doesn't mean that you don't need to protect your code. So when you look at the integration we announced with GitHub last year, we know that developers will go to GitHub to see the filing on the source code. But what they really need is the binaries protection. And when we collaborated with GitHub, we brought it under one pane of glass, everything together, binaries and source code. Again, no conflict, just consolidation of point solutions and understanding the threat of the hacker coming from Runtime.

Great. And there's obviously been a number of announcements for you guys as far as new products out there. Like, there was the GA for Runtime. You have Curation out there as well. Can you -- I don't know if a compare and contrast is right, but can you just walk us through what has customer reception or initial feedback been for Runtime and Curation?

Yes. I've learned something in the past 2 years since we got really to the core of security. Selling DevOps and selling DevSecOps is not the same. You speak with a completely different side of the brain. When it comes to security, there is a lot of suspicious around what you said. So the main question would be what's the value of having JFrog Runtime Security. And you know there are huge companies on the world of security that protect your runtime environment. But the value that JFrog brings, and I will repeat it over and over again, because we are the single source of truth for all companies. The value we bring is that we are the only company that can give you an access all the way to your developers. And if you think about production in the cloud and developer environment, you need to build actually 2 bridges. Bridge #1 is what do I have on my screen when I'm monitoring my production environment in terms of risk. What do I have on my screen, I want to have as minimum as I can, open items that might be a risk. And with our contextual analysis coming back from the binary that we host for you, telling you, Mike, don't worry, this binary might have a vulnerability, but you are not exposed to it because you don't use it in runtime, only JFrog can build this bridge. The second bridge is the cloud to dev, the backward, the traceability of telling you, listen, "There's something wrong in your production. You have to recover and you have to do it fast." But with the amount of -- with the 1 million dependencies line, you will never be able to find a developer. Log4j, some of our customers needed over 7 months to recover. Seven months, Mike, this is eternity for CISOs. So when you can have, on a click of a button, a name, and we call it in JFrog a neck to chop, if you have a name on a click of a button, then remediation becomes easy. And this is very appealing for the CISOs that we are speaking with. And obviously, JFrog Runtime is new. We are also working very hard to build the partnership, the technical partnership around JFrog Runtime because JFrog is not a runtime animal, we come from the dev environment. So collaborating with the cloud, collaborating with observability tool, collaborating with this type of customer -- partners, sorry, is a plus. Regarding JFrog Curation, and again, I'm not going to disclose any numbers now, but I was very, very pleased with the adoption of JFrog Curation. It was so easy for the DevOps persona to understand why you need a firewall between your repository and the public hub. And just to say, if this binary is coming with the GPL, don't let it in. Everybody can understand why this firewall is useful for the company, and we had some major adoption of JFrog Curation in 2024.

Great. And pivot, because I don't want to leave it laying there, but MLOps, right, is obviously a major talking point for JFrog right now. Super high level, but you guys had acquired Qwak. Can you help us think through what is the vision for bringing MLOps into the JFrog platform here?

Well, first, we heard it from our customers. It was very clear. They said, listen, we -- you host all of our binaries, models, AI models, our binaries. Please make sure that they are being hosted natively in Artifactory. This is how our kind of wake-up even before GenAI became so popular, it was kind of a wake-up call from our customers. And when we looked at what would be the next natural expansion of our infrastructure, because it's not that easy to expand an infrastructure, right? Infrastructure are supporting thousands and thousands of users. And usually, you would not see an infrastructure being expanded. We expanded once with security, and now we are doing it again with MLOps. But it all goes back to what is the primary asset we serve. It's the binary. We host your binaries. We are the repository. We are the registry for your models and binaries. So when they started to ask for hosting it and securing it with Xray, we scan your models as well. Then there is one thing that you missed, where is the deployment and where is the test and where is the [ all ] CI for AI that JFrog can provide natively. And then we looked at companies like Qwak. We integrated also with MLflow and with Amazon SageMaker and with others. We liked what we saw, and we also understand that this world is rapidly changing. So if we would not be part of this change, it would be a risk for JFrog, because 5 years from now, you might manage binaries differently. And it's not going to be -- it might be the machine. So we know how big this addressable market is. And when we are expanding our platform, it always has to come with an authentic value to our customers. And when it comes from the customers and the technology and innovation coming from JFrog, usually, we saw a win-win situation.

Great. And maybe, unfortunately, probably the last question we'll have time for here. But just sticking with Qwak, I'd be interested. I know that you guys were partnering with them before you acquired them. So can you tell us about what went through JFrog's calculus when deciding, hey, do we continue to partner or do we acquire? And then, Ed, if you could comment as well, as far as the criteria when you guys do go through that M&A process, how does that look at JFrog?

So I'll start, and Ed obviously will complete the full picture. Mike, we first look at the opportunity, how big the addressable market, and we are looking now today, analysts are saying that it's over $60 billion market. This is huge. This is huge. So obviously, we want to be part of it. Second, we started to see that a lot of companies like Qwak start to integrate with Artifactory because otherwise, they are blind, they don't have access to the model registry. But some of them build their own model registry. This is why I said it can't be something that JFrog misses. And the last thing is that it's not a secret, all of those young companies that are part of the Gen AI festival are getting crazy valuation and crazy numbers and crazy offers. So if I would do it 2 years from now, it will cost me 5x more. So JFrog is very efficient. We deploy our capital into our own growth and into our own inorganic growth. So I think it was the right decision and a good move. And still, it's on us to prove how we expand the business and the revenue stream with the MLOps and not just DevOps and DevSecOps. Ed, go ahead.

And to complete the picture on that, Mike, what we're looking at when we make a large M&A transaction like we did for Qwak, it's not only the value that it's going to bring to the top-line growth, which we're looking at the size of the market, but what it will be in terms of the disruption if we do not do an investment in that technology. And as Shlomi explained around ML, this is what the customer is asking us. They want JFrog that owns their binaries and ML, large language models are a binary. It's a natural fit. And had we not made that decision, in doing it now, even with valuations the way that they are, if we miss that node, it will be a very costly mistake for JFrog. This is a natural fit for us, and these are considerations that we take when we make a transaction and do an M&A transaction. So it goes beyond just the size of the market, but the disruption to the company and the relevancy of JFrog beyond just 1 year. It's multiple years, and we want to be a very relevant company for a long time delivering durable growth and shareholder value.

And to continue, Ed just touched the most amazing thing because we saw it so many times at JFrog. What would happen if we wouldn't pull up the trigger on this deal, Mike? What will happen? I would tell you from our past experience, in 2016, if we wouldn't become the most popular and biggest Docker registry, I'm not sure that JFrog would be exist today. And again, with Kubernetes and again, with the migration to the cloud and again, with the merger of security and DevOps. So we see an opportunity. It's authentic. We can bring value to our customers with 7,000 customers. I know that if we build it right, they will come.

Excellent. Excellent. And with that, we'll have to cut it. But Shlomi and Ed, thank you very much for the time, and thank you to the audience for tuning in today. Take care, everyone.

Thank you very much for the opportunity. May the Frog be with you.

Talk to you soon. Bye.