JFrog Ltd. ($FROG)

All right. Good morning, everyone. My name is Brian Essex, JPMorgan's large-cap, midcap software analyst. With me today, I'm very happy to have JFrog with their CFO, Ed Grabscheid; and Jeff Schreiner from IR at the end there, to keep them honest. What I'll do is I've got a number of questions for the company, which I'll run through. I'll leave maybe 10 minutes or so at the end of the session for Q&A from the audience. But Jeff, thank you so much for joining us.

Thank you for having us.

Thanks for having us, Brian.

Maybe to kick it off, probably the most popular question that I've gotten after your earnings, which amazing results, 50% cloud growth, which is fantastic. How do you guys think about the sustainability of cloud growth, particularly given that a lot of it is overage related and it doesn't seem as though enterprises are at least in 1Q, too focused on managing the utilization of that overage? But we'll love to understand how much visibility you have into that growth trajectory? And how do you think about things when companies start to manage those costs maybe a little bit more...

Well, it might be the most popular question being asked you. It's certainly the most popular question being asked to us. It's really around the cloud growth. People are very excited about a 50% growth in the cloud. And even more importantly, we're now starting to be at the point where we're seeing more contribution in revenue -- total revenue coming from our cloud than our self-hosted. This is strategically aligned to what we're trying to do in moving as many customer decisions from self-hosted to the cloud or landing in the cloud. And we have proof points in that now as 51% of our revenue is coming from the cloud. So that's great news. The second piece is how sustainable is this? Is this going to continue? We don't know. We really truly don't know. We're happy with the way things are going. We're built for scale. So when you have this surge of usage and the number of binaries that are being created and coming into Artifactory, we can manage that. We can certainly capture that value, and we also guide on the minimum commit. So this way, we're protecting the shareholder. We're being very responsible in our guide. We increased the floor of our guidance. We were at 30% to 32% on our cloud. We increased that to 33% to 35%. And if this continues at these levels of usage, you'll certainly see that benefit captured in our revenues, and we'll increase the guide as we start to capture the commitment. But more importantly is that, that is -- that benefit in what we're seeing, as you mentioned, right now, the appetite to spend and to adopt AI in organizations is continuing. And as long as that continues, you'll see that in JFrog revenues.

Great. And what is the feedback from customers as they get the bills for that overage. Are you seeing any pushback on pricing? And maybe as a part B of that question, when a customer is evaluating committing to a more significant amount of utilization versus maintaining the current plan where they're seeing these overages, what does the cost trade-off look like?

Yes. Yes. So you would think that as a customer starts to use over their minimum commitments and not only are they using over their minimum commitments, there is a rack rate or a rate above their committed. They go back to a rate that's higher than the committed rate, and you would think that the customer would maybe be incentivized to move to a higher annual commitment. Right now, there's not a lot of clarity. So clarity is the key here. They don't know what the usage trends are going to be because AI and this agentic economy is creating a lot of uncertainty around the clarity. So there is no pushback at the moment. They're willing to spend at higher rates. They're willing to pay the additional premiums, as they go over their minimum commitments. We worked very closely with the customers. It's not a matter of JFrog not trying to move the customer to a larger annual commitment. There's economic value. There's benefit for both sides. It's a commitment to JFrog. It's committed revenue. It shows up in our RPOs. And it's an economic benefit for the customers they get better unit economics. However, the customer is telling us, we're okay to spend more. We're okay. We're not being told by our office at the CFO to stop spending at this point. The pursestrings have loosened a bit, budgets are available, and they'll continue to spend, and we'll continue to capture that revenue. We're confident that we can move that to a higher commit at some point. When that's going to happen, that's still uncertain. And that's, again, I'm going to go back to the guidance philosophy of only guiding on those commitments because tomorrow, that could stop, and we want to make sure that we're protecting ourselves with a responsible guidance philosophy.

And what is it -- I mean, based on conversations you might have with your customers, what is it that they evaluate? What does their purview look like when they're trying to figure out whether or not they commit to a higher level of spend? Is it migrating from an experimental phase to one where they have a greater degree of certainty in terms of how they're going to utilize agents or AI or utilize your platform across the SDLC? How are they looking at that, just taking a step back and trying to evaluate where enterprises are in the experimental versus production?

Yes. The key word was experimental. We're still in this experimental phase. We would love to think that we're in this production phase. We're far from that. There's still a lot of experimentation going on there. Started with the experimentation with the code assist tools, and you saw the increase in the amount of code that's being created. That now is cleaner code and going into a binary, but we're still very much at that experimental phase. We're certainly not at this autonomous building code moving into a binary into a production level quality binary. It's still a lot of experimentation. And I think this is where the decisions are being paused around taking a larger commitment or a multiyear commitment because of the uncertainty and clarity that they need once they get into production.

Got it. That's super helpful. Wanted to touch on Mythos because -- or Mythos depending on where you're from. Just because it's had such a profound impact on the rest of our on the rest of our space, particularly in the security names that I cover. And one interesting conversation I had was a large GSI on Friday. And he said, basically, since Mythos emerged, CIOs, CISOs have been freaking out and trying to figure out like how do they respond to this. And particularly, given that when that came out, your stock took a pretty meaningful nose dive. Where do you feel as though initial -- I don't know fears is the best word, but initial concerns were misplaced? And what have you seen across your platform since Mythos and GPT 5.5 kind of emerged as a significant models?

Yes. Well, we described February 20 as Anthropic day inside JFrog. I think it was a day in which investors were coming to some sort of conclusion, maybe more simplistic conclusion, and I understand that, that the models were eventually going to start moving in and doing security, which is a key growth driver for JFrog. And thus, now the terminal value of JFrog has somewhat been impacted in a negative way. I hope we've done a good job since that date in explaining to people that in the world we're moving towards with AI and its intelligence getting better, that's going to be the creator, i.e., a lawyer in a courtroom. But no courtroom is going to be sufficient if it's just the lawyers trying the case. You're going to have to have a judge or a governor. And that's where JFrog comes in and where we think we have the right to win today. And what I tell people is that even if we don't win, someone else will be that governor, even when we get to the point that machines, I mean, let's be realistic, they're only using human language because they have to talk to us. When they don't need us anymore, they quite frankly, may just go to what they need, which is producing the buy-in, right? And even in that instance, when they're producing binaries to try to go straight to production, you will still need to separate the creators and the governors. And I think that was the fundamental misunderstanding. I also think as it relates to the security aspect you brought up is that there's a -- maybe a misunderstanding that if they do some code scanning on their end, and yes, they're picking up vulnerabilities and finding things. That's good for the community. They're not yet remediating a lot of those. And I think you understand that with some of the companies that you cover. But I think that with the security aspect, I think that the better code that is created is going to likely end up into a production level code that can lead to a production binary. And so I just think that there was some misunderstanding of that in what they do. And I think the word vulnerability whenever it gets published, somehow is tied to JFrog. And if somebody says vulnerability, then that means JFrog is at risk. And I don't see that as the case. And I think that I try to remind investors as well that remember, curation is outside the IDE. So it's security that's happening before model has even been engaged.

I'm going to add 1 thing. Jeff is exactly right on everything that he said. But the other thing to remember, JFrog is a system of record. So you have these foundational labs in these large models that are coming in. It is not a system of record. You need a system of record, which Jeff alluded to, and this is where JFrog really separates itself in a control plane because a model sees 1 aspect, JFrog is a control plane. It sees a holistic 360 view of every open source repository that comes into your organization. And this is really where the moat is being built. And this is a misunderstanding. You saw an aspect that the model was creating, I think people overreacted clearly, and there was an over rotation and it impacted our share price. But there is also now proof points that the critical nature of JFrog and the need for JFrog in the enterprises and to have a system of record and control plane is critically important.

That's helpful context. And any visibility from your customers? I think you guys have commented that the volume of binaries driven from LLMs is substantially larger than your typical application. Any visibility in terms of the magnitude that maybe your customers might have visibility? I mean, you may not have it. I don't know if you do, may not have visibility, but do they have visibility? And can you just help us gauge the scope of expansion due to the usage of LLM?

Yes. Yes. So a couple of things. First off, we talk about 3 of the foundational AI companies that we currently have as customers. None of those customers today are a cloud customer. They're self-hosted. So we're not necessarily seeing the cloud growth and the overusage and cloud coming from those foundational lab companies. That's number one. Number two is what we're seeing in terms of the trend and the over usage, which could be driven by AI workloads, it's a combination of conventional package type and certainly AI workloads that are increasing across all package types. It's diversified across all of our customers' portfolio. So we have several thousand customers that are on cloud. All industries, all geographies, we saw an increase during Q1. So it's not concentrated by 1 customer in 1 enterprise, 1 specific group of customers. It was very diversified, which is good news. It's not concentrated. It's happening across the board. And again, we continue to capture that value in our cloud and the scalability as more and more binaries are coming into the organization, we're able to capture that and turn that into meaningful revenue for shareholders.

Great. And I wanted to ask, I mean you're seeing some dynamics in across other stocks that cover meaningful -- notably identity where you have nonhuman identities just proliferating throughout the environment. And some of these identities are more sophisticated and some are less sophisticated than human identities depending on what they might have access to and how they're provisioning governed. Do you have a similar dynamic on your platform with the introduction of LLMs? Is -- any new features and functionality like MCP server? How are customers and how are you thinking about pricing with the adoption of those new platforms relative to how things have been priced before?

I'll start with the pricing piece. And if you want to talk maybe a little bit about where the market is going with MCP and skills. From a pricing perspective, we recognize also that non-humans are now starting to make their way into the organization. We monetize in the cloud on data consumption and usage. And for security, we monetize based on number of developer -- contributing developers. That could be a machine in the future. We're not at the stage yet, and we certainly don't want to be pioneers in the pricing world, but we're evaluating that. We realize that the gorillas, the big companies that the hyperscalers and infrastructure companies, they recognize they've historically priced off of seats, and they recognize that there's an opportunity to price off of maybe some type of hybrid model of seats and data consumption. We're following those trends very closely, and we'll see how that transpires, and we'll adapt. But today, we're continuing with the data consumption in the cloud seats for security. It's a common currency. And we'll see where the market evolves and will change those practices as they evolve.

Yes. And Brian, as it relates to -- I think you were talking about MCP, and I'll add skills as well. I think this adds to the scalability, the word you're going to hear me use a lot during this quarter. And going forward, I think scalability is a twofold word for us. It's a moat that we have in how we do things, but it's also scalability in this aspect that we added new opportunities into Artifactory with new technology being created. The creation of MCP, which is a connection outside of your organization to use tools within your model, like Atlassian's Jira, like JFrog Artifactory, other tools, those are exposed to your organization. And as you said, it could be spoofed. So those are things that you're going to want to manage and have a system of record for them to say when was this last accessed? Was it accessed properly? Where did it access? Was it doing something different? And I think as it relates to skills, I think the unique aspect there is, you heard Shlomi talk about that was built in 2 weeks ahead of GPC. Now, you can think about 10 million, 20 million, I don't know, maybe I'm being too low of the amount of skills that will be built into agents inside an enterprise. And again, is that agent going to hallucinate? Is that agent doing what it was supposed to do is acting differently? Those are things that will now likely be managed in Artifactory, in our new scalable revenue opportunities that have been built and added on in the world of AI. How we'll monetize that? I think it's part of a discussion of the AI governance bundle will come up with, but those can be things within AI catalog that you say, "I'll take AI catalog, and I'd also like skills registry and MTP registries add on features". And just to let you guys know, our technical team sees skills as the next real vulnerability injection point as risk to the enterprise.

And how are most of your customers managing access from an identity perspective to make sure that the right people, the right agents are accessing your platform? Are you just partnering with some of the identity vendors? Or are you assuming some of the...

We're assuming not the identity side of probably matching the identity. We're assuming more the management of the MCP since it's built as kind of an open source architecture anyway. So it can be easily pulled into Artifactory and registered so that you know what it's doing. And you can be working in conjunction with like, let's say, an ID type security company. Our security more is what's being moved in and out of the organization? Was it allowed? Was there something accessed that should not have been accessed? Those types of things are going to be tracked once you're in, right? And the idea, I think, is going to be to the spoofing of creating some type of spoof saying, I'm Jira, and I'm not really the Jira connection and then that becomes an exposure to the enterprise.

Got it. And maybe on the point that you just -- you recently mentioned on scalability, maybe help for those that maybe aren't too familiar with the story. Help us understand where the scalability enables you to efficiently grow compared to maybe competitors that are trying to edge in our space? I mean, you got Sonatype to focus us on open source binaries, you have others like GitLab, they've tried to elbow their way into your space. But you're able to scale much more efficiently, particularly into incremental languages. So maybe that as well as maybe part B, the difference between code versus binary repositories.

Sure. Well, I'll start on the first. I think we talked about this in the follow-up from earnings, Brian, and I'll give you the same type of example I gave then. Scalability is becoming very critical. I think in the past, in the last 5, 8 years, you could be a company that said, "Well, I program in the 3 largest open source packages. So I don't really need all of the platform offerings from JFrog in the 35 languages it supports". In AI, that's not going to work anymore. That's a very much changing dynamic that those alternatives that were good enough will not cover you since AI is using all of the languages and your exposure will be to all of the languages. As it relates to the scalability aspect, when I joined JFrog, I wanted to know, hey, guys, what's our difference? What's our moat here, right? Tell it to a dummy a guy that's not maybe very technical. And how would I go out and explain that? And the way they talk to me about it is to think about it as a frequency. And so here's a frequency, and we've got, let's say, 10 languages being supported, okay? I add a new language, it's going to drop, and the frequency is out of balance. Now, JFrog can bring the frequency back to balance immediately. Others need time to bring that up. And then, if you add another language, you fall back further, and you're constantly playing catch-up to get that additional language built in to keep that frequency of speed and security in terms of how you're developing. And that's really the differential for JFrog. And I think that where that can also play out into the future, as we talked about, I think that as the machines start talking to each other and they're doing more and even with maybe human developer assistance, we could see new packages that become important, being created from AI and you're going to have to scale and be able to support those to scale with AI.

And what is it about your platform that enables you to bring your frequency back into sync from maybe a technical perspective that is hard for others to replicate?

There's a check sum feature that goes beyond my software for dummies kind of knowledge. There are some aspects built in that we built inherently from the ground up. The things that my guys would tell me is that the competitor you referenced, Sonatype, they were a great competitor and have always still been someone that maybe you go to in that case I gave you, where maybe I started Sonotype because it was -- I didn't need everything JFrog had. But then when I want to go to the cloud, then I have to go to JFrog. Well, Sonotype's problem was that they got stuck at 15 languages and the inherent scalability from the way they built the platform, that's where they're stuck and that you would have seen them bought, I think, inherently come after JFrog by someone else if they didn't have this problem. And my guys -- and nothing against any company out there joined to do what they do. But that you would have to basically rip it to the ground and rebuild it up to break that scalability problem. And where does this come in and the importance of the world we're in today, Brian, it comes in the importance that one of the AI lab companies who came to JFrog and is one of the leaders and has possibly a moon shot with us, unbeknown to us, he tried to build a JFrog replication fail because of scalability and then sought out JFrog. So I think that's very much the differentiator for us. As it relates to source code and binaries, just quickly to wrap up on that, really source code is where you're building up and you're creating the language of what you would like to go into production, but you have to hit compile. And when you hit compile, 10% to 15% of that source code is combined with the open source software and it makes a software package that you're going to deploy, i.e., when we do our updates on our iPhone, that update is a binary. So there's a difference. And also, source code at least today is written very much in language that you and I can decipher. Binaries are machine language, 0s and 1s, and there's a very much different skill set needed to manage each of those, and that's why they've been inherently different.

Got it. Maybe on that other point, too, is I think Elon Musk recently treated that you'll see models writing directly to binaries. I don't think you guys have seen that yet. But if something like that were to become a thing how might that change your model if we saw a tweet or something that all of a sudden this was happening.

I don't think we've tried to model that in yet. .

No, we have not modeled that in, and there's no benefit there. The only benefit that you would see is if you're starting to create code, or I should say, binaries that are going into production, that's going to be a benefit to JFrog. So skip the process of writing the code and converting that to a binary. You're writing directly as a production-ready binary. That's going to be great news for JFrog. And we're going to be prepared to capture that in terms of revenue and the scale that, that may provide in the future.

Because the production by Brian, is always more valuable than 1 that's spun up and busted because I have to do updates to that binary in the field. I have to secure that binary. I have to have the metadata of that binary something go sideways. So to Ed's point, you would probably see some additional value creation for JFrog because I'm going to start accelerating the number of production binaries that they're going to go.

How would you even govern that? Like how do you review that to make sure that it is what you think it is? Is that something where you would step in on the maybe the security side or the governance side?

Governance is the word you just used. And I think that's the next thing that you should be looking at in the world of AI, and we're a company like JFrog. But as we move to more autonomous world, governance is going to be critical, whether it be the governance of gating, all the steps were, in fact, done and are rewarded, whether it's the governance of understanding things like AI packages and what packages were used in the last 5 builds, like the wikipedia of binaries through AI catalog. I think governance is the next thing. We've had cloud we've got cloud and security today as growth drivers. And I think as we move to a more autonomous world, your governance is going to be critical.

Got it. Maybe on the security side. I don't know if you guys saw there's another mini-scale -- and it just seems like every day, you open up Bloomberg or you open up your inbox and you hear about another supply chain attack. How does that manifest itself? Is this just a building rate of demand and urgency on behalf of your customers? Or do you get a bump from an event like that if it's a major one?

Well, I think the bump happened in Q3, the awareness and the first shy haute event and then you had events weekly thereafter. So the awareness is there. And the decisions around bringing curation, which is critically important a firewall around, the organization has become very apparent. I can only comment on what we see in the pipeline. It's a very strong pipeline regarding curation. So I think the awareness is there at the enterprise, and we're actively working to convert those pipeline opportunities into actual durable revenue growth for JFrog. We've done a good job so far. Those decisions are being made at a very quick pace compared to, let's say, advanced security where you're replacing disparate point solutions, curation. There's no competitive alternative today that you're replacing. You're bringing that into your organization. It's a caffeine high. It's immediate. . It happens. You adopt and you put it into the organization, we see benefit in security revenues. We see benefit in the cloud because that's deployed in the cloud. And right now, it's been a nice growth driver and that momentum continues because of these events. Unlike, let's say, solar wins or a log for Jay that happened once every other year, exactly, you mentioned you open the laptop. And every time you open a laptop, you hear about a malicious attack in an open source and at the binary level, and so the awareness is there.

Got it. Super helpful. I'll have 1 more, and then I'll open it up to the audience for questions. But I wanted to ask you on the financial side, Ed. Amazing quarter, again, great top line growth that kind of flowed through to better profitability. Relative to kind of where you guided, which would assume, I guess, imply a little bit lower margins. How do you think about what you let flow through? And how we think about the amount of natural operating leverage in the business as we kind of progress through the year?

Yes. It's a very good question. First off, when you look at the practices of JFrog and the discipline that we have around our spend and the balance of growth versus profitability, we've done an exceptional job of continuing to expand and having durable, meaningful expansion in our operating margin. Now, the guidance philosophy, which I've talked about a few times is obviously a responsible top line guidance philosophy. And what we saw during Q1 was the beat, 100% of that flowed to the bottom line. Will that continue at that same level throughout this year? That's uncertain. But I'm less conservative on my operating expenses, I can't be. I already know what's committed on the operating expenses. So as we have and hope to have outperformance in future quarters, I would expect a portion of that would flow to the bottom line. And that's something that we've done. We did that effectively during 2025. I would think we would continue to do that. The focus is really around what you mentioned is the balance, balancing that spend and making sure that we're capturing it into growth opportunities and that we continue to manage the operating expenses effectively. And so that when we do have an outperformance that would flow.

Got it. Super helpful. With that, I wanted to check to see if there are any questions from the audience. If you could maybe wait for the mic right behind you.

Perfect. Yes. Just on that same topic, given the magnitude of the upside driven by overage at Raritan cloud, did you guys quantify how much of the upside was from the overage?

We didn't quantify it, but I think it's pretty clear that when you have a $7 million beat and you're carrying over $4.5 million to the full year guide, you can assume that the difference is going to be your usage over a minimum committed, at least in the first quarter.

Any others from the audience? All right. I have more.

I wanted to ask on the sales and marketing side and your go-to-market motion. How do you think about -- given where the company is today from a growth trajectory, how are the hiring trends? And what is the outlook for ramping reps and scaling reps to address the growing market that you have?

Yes. Specifically, as it relates to our sales organization, we're built off of a capacity model. Now 1 of the things that we've done really effectively over the last 3 years or so is shifting the go-to-market practices to the enterprise, and we did a significant investment in that arena around bringing strategic reps going after top qualities sales people from large enterprise sales organizations and bringing those to JFrog. And you see that in the results of our $1 million customers, our $100,000 customer and the growth that we've seen there. And we've been very pleased with that. We made significant investments as well during 2025, and we're starting to see the fruits of that labor. The usage over the minimum commitments is driving the outperformance, a lot of that in Q1, but we feel very comfortable right now that the sales organization has built the capacity to win in 2026. But, of course, if we continue to have an outperformance, we're going to reinvest that, not only in sales, but also in R&D to ensure that we're capturing future value from AI and making sure that we're ahead of the game as it relates to development of next-generation products and technology.

And how are the incentives for the sales organization, particularly given the fact that maybe more beneficial to commit to a higher level of spend, but your customers may not want to do that right away. So how do you manage the conflict between those 2 dynamics?

Yes. That's actually a question that's been asked quite a bit in Q1 because of the outperformance in the revenue in Q1 and what are we doing to incentivize. I think it's become abundantly clear that its usage over minimum commitment. I'll let everybody know and we'll put it on record that our sales organization is compensated on commitment, not on usage over minimum commitments. So they're incentivized to get the customer to commit to a higher annual commitment. They're not benefiting from the usage over a minimum commitment in terms of their commissions and what's going into their pocket. So there's a combination of the customer spending more. That's good news for JFrog. It's reflected in the revenue. It's not reflected in our RPOs, and it's certainly not reflected yet in the commission for our sales team, and they're actively working to move those customers to a higher annual commitment.

Got it. Maybe I want to touch as well on emerging products. Obviously, at swap up your user conference, you had a number of different releases. A handful of products emerging then. And I think a lot of people have been focused on security, curation, maybe haven't heard a whole lot about governance, but which get you more excited? And how do you think about the way you might disclose the traction of these emerging products on the platform going forward?

Yes. I'll start from the finance side. And Jeff, you can maybe finish with the technical side. But from a finance perspective, it's app trust and AI catalog where the 2 products that we released during swamp up. We're still in the very early stages of that. We hope to have maybe an update in Q2 with some customers that are considering some of those products. But we released them in September, Q3 of last year. We started to build the pipeline. We're seeing some nice traction in the pipeline. And as I mentioned, maybe an opportunity to convert that. It's certainly not considered right now as a growth driver in 2026. We see maybe in the future in 2027, and we'll update as part of our guidance. But governance is certainly an area of opportunity for JFrog, as Jeff mentioned, that's really where the platform is going. But today, it's not part of the guidance. So anything that we do in those products would be additive.

Yes. Technically, I don't think there's -- we've talked about some of the governance aspects and what they do on a technical basis. I think the key here to understand is that governance becomes much more critical to the enterprise as we move towards autonomous and more agents working autonomously. And I would just point out, I think a unique thing to think about for you guys is we talk to you guys about curation as a security product, created by the team that we acquired back in '21. Our internal team looks at curation is governance, and we'll see that as a core aspect of governance in the government's portion of their platform that we'll be rolling out in the coming years.

Helpful. Maybe I want to touch on real quick capital allocation. You guys had a pretty well-timed buyback that you announced. What's the structure of that? Are you guys on a grid? Or is this just opportunistic to be used at some future point? Have you dipped into it? How meaningful is that announcement?

Well, it was meaningful because we had an announcement that happened on February 2020, if that created a reaction in the markets and it created a reaction within JFrog. And within 6 days, we had an authorization from the Board to allocate $300 million of our capital to buy back shares. We are on a grid, obviously, at those levels that after February '20, that gave us an opportunity to build that grid, and we'll see what happens with the buyback, and we'll report certainly in Q2 where we are with that buyback. Now, as we think about capital allocation, and you mentioned maybe, what are we thinking about with free cash flow and the amount of cash that we generate, we're very fortunate because of our disciplined approach and how we manage expenses and driving free cash flow and the operations around collections, et cetera, that drive that. That gives us the flexibility to invest in the next generation of products and certainly with governance. There may be an opportunity to do some kind of tuck-in. And so -- right now, there's nothing that we're actively going after, but the nice thing is that we have the flexibility to do that because of the practices and the discipline that we have as a company.

Got it. Maybe 1 last quick 1 because we have like a minute left. But I just wanted to ask about the large customer adds in the quarter, 57 net new in the 100,000-plus category. What was the driver of that? And how sustainable is that traction?

Yes. A lot of that has to do with the addition of security and the add-ons. So if you take an enterprise customer, and they're adding security on that, enterprise at the lowest level is below that $100,000, and you add security and that obviously gets you above the $100,000 mark. So security was a brilliant move on the part of the management team when they did the acquisition of many, many years ago, but taking that to market and seeing the criticality of it, that's what's driving the ASPs and why we're starting to see the traction, not only in the $100,000, but in the $1 million cohort as well.

And I would just add quickly, I know we're at time, Brian. Net new lands, that ASP is going much higher than what it was 4.5 years ago when I joined the company. What a cloud win was then for LAN versus what it is now has materially changed. And part of that is people are landing on the platform because we are becoming much more strategic importance to the enterprise, landing with the platform and adding security on the initial LAN as opposed to 4 years ago, the kind of Artifactory product motion.

Super helpful. And with that, I think we're out of time. So Ed, Jeff, thank you very much for joining us.

Thank you, Brian.

Thank you for all of you as well.