JFrog Ltd (FROG) Q3 2026 Earnings Call Transcript

To raise your hand, and star six to unmute. Please stand by while we compile the Q&A roster. Your first question comes from the line of Sanjit Singh with Morgan Stanley. Your line is open. Please go ahead.

Yeah, thank you for taking the questions and congrats on an awesome quarter. There's so many things to talk about with this with these set of Q3 results. Where I wanted to start was just those customers that have been exceeding commitment, and then stepped up to say, take on a new contract, a higher commitment contract. As they do that, Shlomi, how are you seeing any evidence of attach of the security portfolio or the parts of the product portfolio? As they sign up, make larger commitments with JFrog, are you seeing that sort of product portfolio attach?

Yes. Hi, Sanjay. Thank you for your question. The answer is absolutely yes. Our customers are not just exceeding their commitments with more data transfer and storage of new artifacts coming in the world of AI and therefore raise the consumption base, but also adopting more solutions from the platform. As I mentioned on the call, some of them are coming with more security demands, others with more governance demands, and therefore are feeling more comfortable not only to raise their commitment, but also to sign on a multi-year deal, seeing the future growth together with JFrog.

Your next question comes from the line of Radhi Sultan with UBS. Your line is open. Please go ahead.

Awesome. Yeah, thanks for taking the question and great stuff here. If I think about the rate of cyber incidents that we're seeing, just being structurally higher going forward, your customers are getting a lot more value out of your security offering. So how do you think about monetizing more of that, maybe in terms of pricing model changes, price increases, or adding more security SKUs to capture more of that security wallet? Maybe just walk us through, what are the levers you have to capture more security wallet at existing customers? We'd love to get both your perspectives on this. Thank you.

Yes, Radhi. We see more and more software supply chain attack coming from everywhere. Attacker became far more sophisticated in the world of AI. So obviously, this increases the demand for our security solutions, starting from JFrog curation at the gate as a firewall, all the way to JFrog Advanced Security, X-Ray, and other solutions. Currently, we are not yet sharing the results of our security numbers in 2026. We will do it at the end of the year. But we are very, very pleased with the impact it made on our total growth and the expansion into a whole new world of software supply chain protection. We will look at 2027 and the opportunities next to the risk, and we will take decision then.

Your next question comes from the line of Miller Jump with Truist. Your line is open. Please go ahead.

Hey, great. Thank you for taking my questions, and congrats on another just great set of results here. I think kind of along the same lines of the questions we've heard, but last quarter, it did sound like security was a standout driver of the upside you saw. I'm curious. It really sounds like everything was clicking this quarter. How do you really highlight, you know, what was the biggest driver of upside between the AI tailwinds that you called out and security? And then, Ed, if you could just remind us how we should think about the Q4 security pipeline this year versus prior years. Thank you.

Thanks for the question, Miller. Why don't I go ahead and start? I'll talk a little bit about what to expect from a pipeline perspective. This is no longer a situation where we're seeing an event and then you're building a pipeline based on an event. This has been sustained. We've had now multiple quarters of really strong security outcomes. We talked about it at the end of Q2, and we saw that momentum carry into Q3. As Shlomi mentioned previously, we'll provide you with those results at the end of the year. But we continue to see this momentum in security, and it's a very healthy purchasing environment at the moment when it comes to security, in particular with the amount of attacks that are happening in the open source and with the protection that's needed with AI.

Your next question comes from the line of Mike Seacos with Needham. Your line is open. Please go ahead.

Hey, terrific. Thank you for taking the questions here, guys, and I'll echo the congratulations on just a fantastic quarter that you guys posted. I wanted to come back to the commitments for a second. And it's a bit of a two-parter, but one, can you help us think about the timing for when these customers sign these larger commitments? Was there anything to note from a linearity standpoint, if we think about Q3 and when these commitments were signed? And then the follow-up on that commitment, it's just, I'd love to hear, but it feels like customers are coming back to you at a faster pace versus historical precedent in terms of. Re-engage in JFrog, and then willingness to sign a larger commitment. Can you give us any data points around that? My assumption there. I just want to see if we can validate that or confirm that in any capacity, because it does feel like between the go-to-market traction that you guys have, the expanded platform, the customer outreach to you, it does feel like they're coming back at a faster pace, but we'd just love to get your insight. And thank you again.

Thank you, Mike. So, there is nothing new about the methodology and the strategy that we're following, right? So, it's been more than two years that we are converting over-usage into commitments, coming to the customers proactively and offering them a better deal for a higher commitment. This helps us not only to stabilize the cloud usage, but also to build a long-term partnership with our customers. So, some of them are reaching out to us, understanding that the volume of AI introduces them to a completely new demand on the cloud, and others are reaching out to us, or we are reaching out to them proactively to discuss their future needs as we see their overusage on a monthly basis. This is an ongoing discussion with our customers. As we mentioned on the call, the flexibility model, the flexibility in the model is super important because there is no pressure there. They can't keep on going with the on-demand, and this will be usage over commitment that we will not guide you for. But if they are willing to take a higher commitment for a longer year, then obviously we are working with them, and this is what we report as part of our guidance, and you see the consistent growing and the durable growth every quarter.

Your next question comes from the line of Jason Salino with KeyBank Capital Markets. Your line is open. Please go ahead.

Great. Thank you. Wow. Absolutely phenomenal order. I wanted to take the time to ask maybe a higher level question. So it's been widely publicized that Anthropic spent six to nine months developing their own internal. Version control system. So coming from a person who isn't a developer, and most investors are not developers, but presumably some might think that with AI coding, a company like this could spend another, you know, six to nine months to develop more in the software development stack. So on this forum, I wanted to give you, Shlomi, the opportunity to discuss why, you know, it doesn't make sense or why it'd be incrementally more difficult to develop like a complete peening artifactory solution.

Yeah, absolutely. Well, Jason, we were honored to have Anthropic on stage at Swamp Up just last month in New York, and then again in Barcelona, stating what we keep saying. The world is demanding for more trust and control over the software supply chain, and this can only come with a system of record. We see and we use the products that Anthropic or OpenAI provides, and both of them are honored customers of JFrog. But there will be no developer nirvana in the age of AI if it will be just for a faster model or a smarter agent. It's only reachable with a scalable, universal, governed system of record, one trusted source of truth for everything that goes from the build to the consume to the ship. You cannot trust what you ship if you don't have a system of record, and if it's not universal, then it will be a one-vendor or one-agent-focused solution. So actually, when we see what they are building, it goes complementary with what we provide. And I think that our customers see the same. That's the growth that we keep on delivering.

Your next question comes from the line of Mark Cash with Raymond James. Your line is open. Please go ahead.

Yes, thank you. Shlomi, a question for you. So I know we've talked a lot about the AI driving a tsunami binaries. So I guess I want to know, as the frontier models accelerate vulnerability discoveries, are you seeing that translate into more artifact rebuilds, transfer storage, and security scans, which in turn helps drive a surge in cloud results and guidance? And I guess if you are seeing that tailwind, this has also created a natural upsell conversation for security and governance for you as well. Thank you.

Yes, so, Mark, the facts are that there are new artifacts introduced to us by AI, right? None of us spoke about MCP skills and others a year ago. These artifacts belong to the same place as you manage the rest of your binaries. You have to manage their dependencies, their security, their governance, and everything that comes along that. So, yes, we see it as a tailwind in terms of storage and data transfer. Not only that, we also see Artifactory, the system of record, expand to become your MCP registry, your skilled registry, and this is how our customers are looking at it. So what would be the impact of it on the long run? Will it be more than your Python or NPM or Docker? I don't know. But for sure, more and more artifacts, binaries and software packages are added to the solution we provide.

Your next question comes from the line of Shrenik Kothari with Baird. Your line is open. Please go ahead.

Yeah, thanks a lot for taking my question and echoing my congrats on the great results. So, just stepping back, your results and some of the customer examples do suggest you are becoming more deeply embedded in enterprise-wide infrastructure, especially with the Ford migration that you talked about with the petabyte of artifacts. It seems customers are increasingly consolidating security around you as a single system of record. So my question is, beyond the new AI-generated binaries and the tsunami of binaries you mentioned, Shlomi, as AI is seemingly accelerating modernization of these legacy applications, and it looks like there are some examples, just wanted to understand broadly, Are you seeing this legacy software assets already creating this another significant adoption cycle, and are there evidence of building of more enterprise-wide standardization coming from that?

Yeah, Shrenik, thank you for the question. As I mentioned on the call, and we gave three examples of giant organizations that are scaling, A, with new artifacts, as I mentioned before, but B, with the fact that every developer is now powered by an agent and has more to produce. The desired outcome of the world of AI results in a binary, a software package, whether it's a new artifact or something that belongs to the previous world of NPM, Python, Docker, Maven, and 40 other technologies that are supported in JFrog. JFrog Artifactory is the Switzerland of system of record. We support all technologies as long as they are binaries. And the fact that you are now powered by agent provides us with one challenge, is to scale to where you want us to go. And you mentioned Ford and others. We are scaling with them to infinity.

Your next question comes from the line of Howard Ma with Guggenheim Securities. Your line is open. Please go ahead. Hey, thanks.

Incredible quarter. I wanted to ask about the massive telco deal. Shilomi, could you talk about the characteristics of this expansion that you believe are repeatable versus not repeatable with other similar type, very, very large enterprises? And for Ed, on a related note, you kind of gave us the numbers to do the math. We calculated to like a $40 million expansion. And if you assume five years, and maybe it's like ratable 2 million a quarter, and if I back that out from Q3, I think you would have still accelerated cloud revenue in Q3, even without this massive deal. So, you know, any color to help investors do the math would be helpful. Thank you.

Why don't I go ahead and start, and then Shlomi can talk about the construct of the large telco deal and why we won that deal. But first off, we're not going to go into the math of what we saw in that deal. It was a very strong deal. You saw it was a capture of a commitment, 167% in terms of data consumption and storage. They were capturing overusage as a commitment, and it also showed the power of the platform. We were able to not only capture an expansion of security, but we also captured governance in that deal, and it turned out to be a very, very strong outcome, a $76 million deal, multi-year deal, and that will be reflected as a commitment going forward, and this is why you saw the confidence that we're showing and our guidance as we head into Q4.

Yeah, well, first, I'll mention again that none of our customers represent more than 3% of our total revenue. That's a very diverse portfolio, and we are very disciplined with that. Second, we were honored to sign this contract and to scale with these customers, covering tens of thousands of developers that are powered by tens of thousands of agents. That generated more consumption, more data consumption on Azure Cloud, and it also introduced this organization to new needs of governance. The fact that you are faster and stronger powered by AI doesn't mean that you are scaling at the same pace with your governance system. So the adoption of AppTrust was a very important leap forward with this customer. And the second thing is obviously the security iron dome that we managed to put on top of the software supply chain and scale with them. So having this size of customers with this size of contract, it's not only the platform. It's not only the technology. It's not only the environment. It's the trust that our customer success, our sales team, our product team is building with these customers, and we are very, very honored to get to these limits of contracts.

Your next question comes from the line of George McGreen with Bank of America Securities. Your line is open. Please go ahead.

Hi, this is George McGreen on for Koji Kida. Thank you for taking our question. I wanted to also ask, you know, a bit of a theoretical one. So obviously we're seeing the tsunami of binaries and kind of upstream of that. How much has How did production-ready code improve today in terms of code quality versus a year ago? And how much better do you think it can get over the next few years, and specifically, why?

Yeah, George, that's a great question. We are not necessarily breaking down the numbers now to how much of it was produced by this specifically. But what I can tell you is what I also said on the call, is that... Developers are now running much faster. They become more product managers than developers. They are managing tens or hundreds of agents and produce more and more. The result of everything they build, if it's a quality result, will end as a binary. A binary that needs to be governed, that needs to be secured, that needs to be deployed, that needs to be managed from versioning perspective and so on. So we see more and more of it coming. And on the other hand, what we see, and you probably read the news in the last weeks, that source code becoming commoditized. So on one hand, there is a lot of efforts to secure your primary asset, which is the binary. On the other hand, generating source code by agent or developers becoming commoditized. So that's obviously raises the volume and the demand for the JFOG platform.

Your next question comes from the line of Brian Essex with JP Morgan. Your line is open. Please go ahead.

Hi, good afternoon. Thank you for taking the question, and great to see the acceleration with margin expansion. Really nice results. Maybe, Shlomi, for you, we'd love to understand how your budget environment has evolved throughout the year. If you maintain the same stakeholders or with the elevated threat environment and some of the vulnerabilities that we've seen, some of the incidents that we've seen, has that scope of stakeholders within enterprises expanded? And then part B of that, is awareness of your platform moving up to CIO C-suites more frequently and garnering more stakeholder support within the enterprises? Just trying to get a sense of the momentum that you have. Are your budgets, is your budget visibility expanding as we kind of head into the end of the year and think about the setup for next year? Thank you.

Yes, Brian, thank you for the question. I believe that we all understand that a $76 million deal is not being signed by a developer. So, of course, the introduction to the C-suite of our customers is something that enables us to scale. And we report quarter after quarter the growth of our over a million dollar in ARR customers that are betting more and more on JFrog. So that's obviously a great achievement of our strategic and sales team that managed to build this relationship with the C-suite of our customers, which, by the way, are the biggest organizations in the world. The second thing, to your point, you are very much right. This is not just the CIO or CTO that used to pay for DevOps. A lot of our new customers are coming from the CISO office, the CISO itself, whether it's for governance and compliance or security demand. And the security momentum that we see and the adoption of the JFK security solution that contributed to the growth of the net dollar retention, as we mentioned, this comes with larger checks that are being signed only by the C-suite. So the answer is yes on the C-suite and yes on the expansion of the C-suite.

Your next question comes from the line of Matt Hedberg with RBC. Your line is open. Please go ahead. As a reminder, if you have dialed in today, please press star 6 to unmute.

Oh, hey, guys. Sorry about that. Just had to hit star six. Thanks for taking the question. Congrats on the quarter from me as well. Maybe just to follow up on that last question on expansion. Obviously, it's great to see the tick up both year-on-year and sequentially here. I guess, Ed, you guys have a lot of drivers of that. We've talked about a lot of them on the call tonight. But I guess, how should we think about the guardrails for where NRR could go, especially as we kind of start to think about calibrating our models for next year as we think about 4Q into next year?

Yeah, thanks for the question, Matt. Really, today we're seeing a very, very healthy buying environment, and we're focused on that momentum just to continue to build with execution in 2026. We've seen strong usage over minimum commitment. We've been able to capture some of those customers into higher annual commitments. We're also seeing usage broadly across our platform above minimum commitments. It was sustained usage during Q3. So the focus today is really around the execution in 2026. We set the floor for 2026, and we'll provide some insights next quarter when we close out Q4 in the full year.

Your next question comes from the line of Jonathan Recaver with Cantor. Your line is open. Please go ahead.

Yeah, hey, guys. And once again, very, very impressive print. I'm just curious, when you look at the AI and ML model development trends, I mean, it does sound like, Shlomi, based on some of your comments that you're seeing, incremental usage, any way to quantify that use case and usage trends versus traditional software development? And are AI-related repositories growing faster than traditional software repositories? And then just, you know, finally, how does AI model development compare to software as relates to data usage?

Yeah, well, that's obviously something that we track closely. We are looking at the data, not only in our cloud, but also when we speak with our self-hosted customers to understand the level of adoption of AI. Obviously, the more progressed companies are adopting MCP skills, data sets, plug-ins, and other new artifacts that were introduced during the era of AI. We are not yet ready to disclose the breakdown of the numbers, but for sure, this is increasing. This is the first thing. The second thing, by using those tools, skills and MCP more specifically, it enables agents as first-level citizens on JFrog platform, using JFrog as a system of record, being protected by our security. So this generates not only those new packages, but also the usage of others, such as the legacy binaries that we all know from the open source environment. So we are collecting the information. Once we will be ready and feel comfortable with it, we will share, of course, more information about it.

Your next question comes from the line of Yifu Lee with Stonex. Your line is open. Please go ahead.

Hey, congratulations, Shilomi and the JFRT. Such a monster quarter, obviously 60% RPO growth, etc. Just want to get a sense on the, you know, AI native customers. I understand the biggest debate was converting the overage to long-term commitments, which you guys have done. I was wondering, what was it that this call that drove the, you know, You could say like customer crossing the chasm, right? To sign longer term with you. It's just certain things that drove this behavior. And then I know you're not going to give, but like, I'm going to try anyway. On the longer term, right? You know, in the back of the deck, you know, obviously we have a long term model, you know, after this master B, you know, is there anything you could like, you know, comment on that? Any changes? That's it from the text, guys.

Thanks for the question, Yifu. I'll go ahead and start. First, let me remind you that the AI native customers are primarily self-hosted customers. We did talk about one that we closed in Q2, which is a hybrid customer. That just started. It's very early in the lifecycle with JFrog, and so we're not going to necessarily comment on anything around conversion or capture for that particular customer. Again, reminding you that there's not one single customer that represents more than 3% of our revenues. But in terms of what we saw in a very, very strong quarter, as you mentioned, RPO was strong, capture of some customers to higher annual commitments. When we look at the investor deck, I think you're referring probably to the long-term model. We're tracking very nicely against that. We will come back to you at the end of the year, and we can talk a little bit more about 2027. We're not ready to disclose anything at this point, but we're building momentum. We're building strength. As I mentioned, it's a healthy purchase environment, and we're capturing, through the execution of our strategy, very strong outcome and results. And Shlomi can talk a little bit about what we saw in terms of those customers that we did capture bigger commitments.

Yeah, well, Ifu, the commitment of these customers is obviously growing by the self-hosted demand, which is more projects, more departments, more regions, and we are very happy to see the collaboration with them. Some of them shared on stage at SwampUp the partnership that they are building with JFrog. We are not commenting on one by one, but we are very honored to have those that are building AI with AI using JFrog as a system of record.

Your next question comes from the line of Jason Ader with William Blair. Your line is open. Please go ahead.

Yeah, thank you. Good afternoon. Can you talk, Sean, a little bit about the competitive landscape in supply chain security, you know, who you see the most in bake-offs, and related to that, it seems like GitLab and GitHub are at least talking about security more, maybe investing more, maybe because they're You know, their repo business is under pressure, but maybe just talk about that picture for us.

Yes. Well, Jason, the landscape, the competitive landscape is very diverse. On the landscape of security, obviously, we see point solutions. Trying to provide a scalable solution for artifact firewall and for SBOM, AI-BOM solutions, software composition analysis, and things like that. I think that JFrog is well positioned as it differentiates itself by having those security solutions very tightly integrated with Artifactory, the system of record. So what our customers keep telling us, that there is no complete security solution and no complete governance solution without the very tight integration with Artifactory. Now, if you look at the point solution that I just mentioned, all of them need an access to Artifactory, and this is something that we look at and we consider every day. But it gives us a very strong reason to believe that our customers would prefer one platform over point solutions. Regarding the system of record landscape, you know the players there, most of them are providing solutions that are not hybrid, not universal, and for sure not scalable to the level of artifactory. Therefore, the world of enterprise trust JFrog and scale with us.

Your next question comes from the line of Ramo Lencho with Barclays. Your line is open. Please go ahead.

Hey, guys. This is Damon Cogginal from Ramo. Thanks for saving the question. I guess, Ed, on the commentary of converting some of those over-usage into hiring commitments, has that timeline shortened over time as customers gain more confidence in AI workload durability, or do procurement and forecasting uncertainty still make these conversions primarily on a case-by-case basis? And then, is there any way to rank higher consumption, security adoption, and self-managed migrations contribution to cloud growth this quarter? Thanks, guys. Congrats on the quarter.

Yeah, let me start and then Shlomi can fill in if there's anything that I'm missing here. But what we saw in the first half of 2026 was a hesitation. And we saw customers almost like an insurance policy spending more than their minimum commitments. That trend is continuing even still today in Q3. But what we saw some of our largest customers with clarity that AI workloads are continuing to grow and that they need to make commitments to JFrog, not only with their offerings to increase data consumption, But also with security and governance, it's not necessarily that those timelines have shortened, but the clarity around the decision making became much clearer in Q3. So this is why we saw some of those customers converting, and it was more of those large customers.

Your next question comes from the line of Nick Altman with BTIG. Your line is open. Please go ahead.

Hey, awesome. Thanks, guys. I wanted to circle back to the $76 million TCV contract. And the question is, can you just kind of give us a flavor of where that sort of compares to your other deals that have historically been very large on like an ACV basis? And I guess what I'm trying to get at is it seems like you guys are kind of in a different atmosphere in terms of the deal sizes that you were really in even a year ago. And so, Ed, I know that you guys don't include these large transactions in the guidance, but. Maybe just talk us through how long that deal sort of took to close, whether there's other transactions of a similar size opportunity in the pipeline or whether this deal had, you know, maybe some anomalies that maybe, you know, leads it to, you know, an outsized opportunity versus what you guys see. Thanks.

Thank you, Nick. I'll start and Ed can chime in with more details about it. You know, signing an $80 million deal is not something that is based on a product or on a sales maneuver. It's an investment, a long-term investment, building trust with the customer for many years. It started with the migration from Sonatype Nexus to Artifactory, then the scalability, then the migration to the cloud, then the additional security solution, then more and more petabyte of usage, and then AI came and changed everything in terms of the attack surface and the governance requirement. So I think that this specific customer found a partner that could scale with it and provide the flexibility of a universal solution that will support several vendors, several agents, several solutions that they are adopting and using at the scale of AI. It's not necessarily different from other customers we see. Obviously, the magnitude is different, but we see more and more multimillion-dollar deals, not only in 2026 results, but also in our pipeline, and therefore we felt comfortable to raise the guidance for the year as we looked at the pipeline. This comes not only from one region, not only from one sector, not only from one side. It's across our portfolio, and we have a very strong confidence in our pipeline.

And just to close out Shlomi's, what he was saying here, in terms of the timing and the cadence, we see these very large deals typically come in the back half of the year. So if you recall, we had three of the largest deals a few years ago in Q3. This seems to be more of the theme where these type of deals close towards the back half of the calendar year.

There are no further questions at this time. I will now turn the call back to Shlomi for closing remarks.

Thank you, everyone, for joining the call. We are very, very pleased with our Q3 results. We are looking forward to seeing you at the end of 2026, and may the frog be with you.

This concludes today's call. Thank you for attending. You may now disconnect.