Conference Transcript - FROG 2026-08-12

Speaker 3

Good morning, everyone. Thanks for joining our 46th annual Canaccord Genuity Growth Conference. Pleased to have with us today. Once again, JFrog, we have Ed Grabscheid, CFO, and Jeff Schreiner, VP of IR. Thank you for having us. Let's kick it off with last week's quarter. We had a broad, beaten raise, cloud up 53%. It's been a volatile market, but the reaction has been positive. Just what were the biggest takeaways in your view? Did anything surprise you to the upside?

Ed Grabscheid, CFO

Yeah, we're very pleased with the results of the quarter, as you mentioned, 29% growth on the top line, 53% growth in the cloud. And we see three contributing factors here, and not in particular order of magnitude, but security continues to be a significant growth driver for the company. And we had a great quarter in terms of security. We gave some of the proof points around security wins in those million-dollar cohort, as well as in the new customer lands. We continue to see strong usage with our cloud products. Some of those customers, and broadly across our portfolio, are going above minimum commitments. That's contributing. And then, of course, annual commitments. We see those customers not only using above minimum commits, but we also see an expansion of those existing customers to a higher annual commitment. And the combination of that leads to our E-plus platform and continued strength in our full platform. Was there a surprise? We kind of expected this, and I think the surprise really came from the street and from investors on how strong JFrog is performing.

Speaker 3

Good to see, good to see. So you've described, and the team has described, a tsunami of binaries. And so when a customer is adopting coding agents, can you just help the audience better understand how that flows into Artifactory, building more code faster? And then just how does that then concretely turn into revenue for you?

Ed Grabscheid, CFO

Yeah, we love that the term tsunami of binaries is sticking, and we saw that. We strategically positioned JFrog to be able to capture that tsunami of binaries, and it really comes down to a few factors here that are easy to describe. Organizations today are becoming software factories, every organization, and they're moving at the speed of machines. And when you're moving at the speed of machines, this creates a surge in the amount of creation of code that, of course, turns into a binary. But then add on top of that large language models, MCP and skills, which six, eight months ago wasn't even part of discussion. Those are also binary. So you're creating an exponential amount of binaries. And we're seeing that increase through artifactory, through software supply chain, and how critical JFrog is becoming to these large organizations in particular, the foundational labs and many of the AI native companies. And this is a tsunami that we're seeing.

Speaker 3

So, you know, you talked about how the idea of an artifact is changing. It's now models, it's agent skills, it's MTP servers that are first class artifacts alongside binaries. Can you just double click again on why that makes you so much more strategic to these customers that are figuring out how to develop with AI?

Speaker 1

Yeah, thank you for the question, Kingsley. I think what you're describing is what we're seeing is that JFrog was the system of record for your software artifacts. your software binaries we are now positioned and we would like to think of ourselves positioned as now your system of record for your large language models for your mcp connections for your skills registries and those are all going to be critical in the world of ai in which we've already seen some customers come to us and look at hosting their skills their mcp connections in artifactory thus bringing more importance to artifactory and having to treat those as you as almost first-class citizens in the same way that you would treat the way that the artifacts and the software artifacts have been treated previously because each of those skills are attached to an agent. Is the agent in fact doing what it was programmed with those skills to do? That's being managed and where you would go to find that out? Artifactories, MCP connection that I have with JFrog or Atlassian or other companies, is that acting up or is it acting different than it's supposed to be in the way that it's registered in the Artifactory? And then models likewise. The models are becoming first class binaries because they're in fact the largest form of a binary, typically in a container, and now they're becoming different in a way of the way they impact our storage. Because I no longer can say that the Git repository, I can no longer delete anything, and that was unique to Git, where the binary repository and software could be cleaned out of what I did not need. In the new world of models, when I do update one, and I'm now on update Three, I can no longer delete update one and it has to be hosted. So it's changed the dynamics of how companies in the world of AI are looking at JFrog, binaries, and artifactory.

Speaker 3

So in recent quarters, you've had success with customers consuming above committed spend as well as then translating that into higher committed spend levels. I think, you know, as you pointed out, you weren't as surprised by Q2, maybe investors were. So can you give us a better sense of insight into how durable some of that increase in consumption is and converting that?

Ed Grabscheid, CFO

Yeah, so the trends of what we see in terms of usage have materially changed, particularly in the cloud. So over the last, I'd say, three quarters, we saw usage trends going well above minimum commitments. It was a historical level in Q1. Q2 ended up being consistent in terms of usage over those minimum commits and broadly across our portfolio. What we see today is there's less friction between the developer and the budget holder, and partly due to the fact that two things are happening. Number one is that AI is impacting those organizations, and organizations are learning how to utilize those tools. Secondly, I think that budgets are shifting in order to support AI spend, so they're offsetting it with other areas and allowing this frictionless spend, so to speak, and giving them the autonomy to learn. Now, as you move forward, what does this mean? Our model is built to give that flexibility. So you have the minimum commitment, and you can certainly go above that minimum commitment. It comes with an overage rate, and we capture that as revenue. So as long as the customer continues, and we don't see why there would be a reason for that not to continue at least through the duration of this year, above those minimum commitments, it's going to be reflected in our revenue. We are actively, meaning Our sales organization is actively working with the customers to capture that usage into a higher annual commitment, but we're going to do it in a strategic way. We're not going to force the customer to do that. At some point, there will have to be a budget that is brought to the office of the CFO to procurement, and once you have that budget aligned and you have that event of a renewal, we believe will capture a higher minimum commitment, which would be durability and revenue and predictability in that revenue going forward.

Speaker 3

And so when you say through the end of this year, is that sort of a comment in CFO language about before we commit to a higher level of spend? Or maybe you could just reframe that in terms of experimentation that we're seeing or durable increase in step change in consumption right now?

Ed Grabscheid, CFO

Well, I think it's a combination of both. Like every organization, JFrog is not immune to it. So you start to see spend levels that at the beginning of the budget cycle in 2026, that has shifted more towards now using tokens and developer AI tools. And so you offset that in order to be able to deliver durable profitability, which JFrog has done. And you see many organizations doing that either through reduction of headcount or shifts in the way that they manage expenses. And this is why we believe that the durability through the rest of the year will continue and that the usage will continue because most organizations have made that change to be able to offset that spend level. At some point when you rebudget and you start to think about the plan for 2027, you have to capture that now. There will be less, what we believe, maybe forgiveness and overspend of those budgets in 2027.

Speaker 3

And so we believe that most customers will come back to JFrog and recommit at higher levels as they typically do and you would start to see a capture of that usage as a commitment so you now have some cloud code and cursor integrations and access over a million developers maybe you could just help the audience understand what those integrations do what kind of opportunity is for you and then there was a quote recently just thinking bigger picture about how the markets changing Matthew Prince said that humans are going to be a rounding error in terms of traffic on internet over the next decade and so thinking about code creation you know are you moving towards more focusing on an agent than maybe a developer i'll take the second first i would say

Speaker 1

that you know we're still very focused on working with developers and agents or machines i mean jfrog and artifactory and binaries that their essence are in fact machines but we've been working with developers and building binaries over time and i think that we'll continue to see some form of humor human interaction human development work alongside machines for some time and I don't think that that's changed the persona that we're selling to it could be the change of persona of the user right within the organization and who now is utilizing JFrog more heavily the human or the machine and in relation to the first part of the question with the connections through Claude and cursor I think these are unique connections that allow us to integrate that kind of Switzerland of binaries where we continually to integrate with everyone to have that flexibility and use ease of use for our customers you now have native as it relates to let's say Claude native integration with Artifactory through that native integration I can now have curation scan packages the agents may pull that are PI PI go NPM a lot of these type of normalized packages that those agents and Claude are typically utilizing in some of their builds so it's allowing me to integrate more cohesively with Artifactory in my use of these coding agents and whatever that coding agent may be. You saw it's cursor, it's clawed. You know, we're certainly trying to work with others as well to be able to give the customer the choice of who they would like to use and then integrate the JFrog tool stack.

Speaker 3

So one of the early use cases for JFrog is analyzing and securing third-party packages. And now we're sort of seeing this mimicked and mirrored with users going out and pulling down whatever model they'd like to work with their third-party models. And so that's a new use case for JFrog. But in terms of security and curation, how much is that going to be applied to this AI use case? So what are you saying now?

Ed Grabscheid, CFO

Well, this is where curation becomes critically important for organizations because it sits outside of the organization. It's outside of the firewall. And this allows really to curate what comes into the organization so if there's concerns around open source packages or open source models coming into the organization or maybe it's around the versioning of those models you can curate that and protect the organization and still move at the the speed of machines and the speed of speed trust and governance that's needed in order to develop new application so we see curation as being a critical asset and we're certainly seeing that in the numbers that we reported during the quarter around security with wins of 80% and that million-dollar cohort security contributing 80% of those to those customers and then for even new

Speaker 3

customers that we brought into JFrog 40% of the customers landed with security and the primary asset is curation see right so we've seen a significant step change in security where it's gone from an attached product to a leader for you 80% of the million dollar customers in the quarter adopting security, 40% of new business adopting security. Just how has that changed in terms of how you're targeting a buyer persona, or just how has it changed buyer conversations?

Ed Grabscheid, CFO

Yeah, so there's been a shift over the, let's call it three years. Before it was two separate budgets. You had the CIO budget, and then you had the CISO budget. Those two budgets are now coming together. We had an overlay security team. That's now been consolidated in one team that is going to market and speaking on behalf of a platform. So it's not only Artifactory, the assets that are around Artifactory, which is security and, of course, DevGovOps, which is something we'll talk about, but you're selling the platform. So you can bridge the two teams together and go with one offering, and we see the budget also converge into one. So many of the decisions, and you talked about the numbers of these large million-dollar wins that we had, 80% of those, with security, those discussions are being led with security, no longer being led with artifactory, it's being led with security. So that's how you're seeing this shift. Security is becoming critically important to the software supply chain and protecting the software supply chain, and those discussions start with security.

Speaker 3

So the supply chain security market is somewhat fragmented and crowded.

Ed Grabscheid, CFO

When you do win why do you win and is it the platform approach yeah why don't I start Jeff you can follow so what you know there's two ways to look at it we have two offerings and security first is curation where there's very little if if at all competitive landscape there and I think cure a clear value proposition to protect the organization and we believe that every company should have curation to protect especially in an AI world. So that's number one. Number two is the advanced security. Advanced security is a natively integrated platform into Artifactory and that consolidates the the best of breed point solutions. So we see an opportunity there of a consolidation. Many organizations want to consolidate.

Speaker 1

The fact that it is natively integrated and it does consolidate we see that there's a big value proposition there and this is what we're leading with yeah and talked about it native integration scalability so a lot of the competitive alternatives the Johnny come lately's they they are point solutions they are point solutions that if you read their product documentation tell you to essentially hack artifactory and give us all the information from what a factory for us to work properly for you so being the fact that we are the creators and give you native integration with our factory we think that that's a strong selling point against these alternative tools also the scalability a lot of these Johnny come lately's have tried to create solutions that would have worked I think well in a software world as I described it where good enough if I only programmed in four languages and I wasn't very sophisticated a good enough solution could have got me across the finish line in software but in the AI world a good enough solution ends up inevitably getting me hacked because I don't necessarily program in that language but But the agent says, that's the best language to use for the task that you're asking me to do, brings in a language you're not even conceivably programming in. And thus, we have had people get hacked utilizing those alternative solutions. So those are two of the main drivers when we're sitting down and talking with customers about why you want to utilize JFrog security versus a point solution.

Speaker 3

So first, I want to point out that you've developed pretty deep relationships with the Frontier Labs. and one of those relationships is with OpenAI. They've been using you as part of this sandbox containment. We've all seen it, the agent broke out with the hugging face and there was this Artifactory Zero Day and I think the response was excellent. You patched it quickly, but is there any more takeaways on what you learned from the incident, maybe how it made your relationship with either the Frontier Labs or other customers stronger?

Ed Grabscheid, CFO

Yeah, I'll start Jeff and you can jump in. So we see, first of all, let's talk about the benefit and what we saw. We can now openly speak about OpenAI as our customer. For the last 18 months, we weren't able to talk about OpenAI as a customer, although many of you here in the room probably already assumed that. And as you said, we have deep relationships now with the foundational labs, and that's very important, especially as these very sophisticated and intelligent developers are using JFrog as a critical asset for their software supply chain. That's number one. Number two is the environment, self-hosted. So OpenAI used a self-hosted environment here. You talked about breaking out of the sandbox. And we're very responsible together with OpenAI to remediate, patch, and distribute the update. But when you're a self-hosted customer, even a most sophisticated company like OpenAI, it takes time. It could be days before you get that remediation updated on your system, unlike a cloud customer that immediately gets an update. So we saw a big benefit there. we know over the last three or four quarters that cloud migrations have declined because as customers are considering what that cloud deployment looks like in an AI world, maybe there's an opportunity to reignite those discussions around migration because of the situation. So I think there's a benefit there.

Speaker 1

Kingsley, you brought up a great point that I think maybe hasn't been talked about enough. Who's allowed in the sandbox? What infrastructure tools are even allowed? in the sandbox at Foundational Labs. We now know one of them, and that's JFrog. And that's because the critical nature that we bring and how they work and incorporate JFrog into their model architecture. And so I think that when we're working closely with them, the other thing I think that people are hopefully starting to understand that I've been communicating and Ed's been working and communicating is that, we're having a very close relationship with these labs. And this particular customer in general came to us with a moonshot opportunity that we still believe is inherent, an opportunity that could be very transformative for JFrog and how we're utilized in an AI world. And I think that's one thing that maybe is underappreciated somewhat is that we are very close with these labs, thus we are seeing where they want to go, the problems that they need solved as it relates to binaries two, three leaps down the road of product reiterations. And I think that bends to give that type of a customer interaction a great benefit to JFrog to be able to meet customer pain points for leading foundational labs that will tend to trickle down to other enterprises as well.

Speaker 3

Right. So it's a great point that if a customer like OpenAI is choosing you to operate in a sandbox, that's a good win. And if other customers want to skate where the puck is going, they could look at what some of the frontier labs are doing and take note. I just want to think one step further about potential implications. Do you think that that will be universally understood by customers over the next few quarters? And what's the cloud migration opportunity on the back of this as well?

Ed Grabscheid, CFO

So we saw this over the last, let's call it two years. We were really big in technology. We were big in financial services. Then we moved into automotive. Automotive became an industry where, you know, you had a car, but it's really software on wheels. And there was a very large North American automotive company that adopted JFrog, and it became a blueprint for other automotive makers. We're creating a new category now, which is these AI natives, and I think you're going to start to see a blueprint of how these companies are using Artifactory and the full platform, hopefully. Today, they don't have security. I think there's an opportunity for them to adopt security, but that will become the blueprint for the next generation of companies, and they'll start to look to those foundational lab and AI native companies on how they will adopt JFrog and use JFrog going forward, especially in a model in an AI world.

Speaker 1

Yeah, I would just point curation. talking a lot about curation curation was was created how it was created because a customer came to us with a pain point saying well do i i have two ways to handle my binaries either i allow everything in and i scan it with x-ray and then i feel comfortable and i'll use what what is approved or in this particular customer's case i allow nothing in the developer petitions for the package and hope that it's approved by the time that the software is created but hey wouldn't it be great if I could have a centrally located security policy that I create, that then allowed only certain packages into my organization. So again, we've then taken that and that pain point that is created and look at what it has evolved in and grown into as the opportunity driving security today. I think that's what you can take away then Kingsley in terms of what can be done with these foundational labs and then products that can be derived and brought to market for other customers.

Speaker 3

So I just want to make sure it's not lost in the audience. So you grew high 20s in the quarter, 33% free cash flow margins. That's elite territory. How are you thinking about that growth versus margin trade-off in such a big opportunity in front of you?

Ed Grabscheid, CFO

Yeah, we're really actually proud of the rule of balance. So between the growth and the profitability, we've never been a company that was driven by significant growth and maximizing growth and minimizing profitability. it's always been a strong balance and going forward I think we'll use that same philosophy although we'd be willing to give up a point in margin for to accelerate growth I think most investors would be very happy about that and we certainly look at that at this stage but the balance between the two is part of the DNA and part of who we are and we'll continue to operate under that same philosophy and I think that you've put on a master class in guidance over the past couple quarters and years and so maybe just help the audience understand how you what your philosophy and how you go about guiding your business work increasingly customers are consuming above committed spend and navigating that well first of all thank you for the kind words I appreciate that and it's certainly been a learning experience sitting in the seat of the CFO and you when you step in and changing the guidance philosophy and and that strategically changed because of JFrog. I've been at the company over seven years now, and the company has changed quite a bit from developer-led purchases now to enterprise-led purchases, security, a new asset on top of artifactory that is driving meaningful growth in the ASPs, large deals, and then the way that we've constructed the cloud growth. Now 53% of our revenue is coming from cloud. So when you take all of these factors into consideration, you have to be responsible on the guidance. There's variability in the outcome of the revenue that can materially change from one quarter to the next and so we felt the most responsible way to do this was de-risk those large deals that are being driven by enterprise purchase decisions and the usage over the minimum commit. This gives the confidence as a floor and this is what we did. We guided which we think was exceptional. 34 to 42% midpoint in the cloud. We increased our net dollar retention rate of 120 on the floor. All of these represent what we believe could be some meaningful upside if the business continues to operate because you de-risk that variability.

Speaker 3

Helpful to see that de-risking. Close on time. Just want to check if the audience has a question.

Speaker 2

Sure. as one of the applications are going to create a lot more traffic than humans. First of all, how do you think about pricing? Obviously you cannot price linearly, and everybody needs money to compute. Secondarily, it's kind of a hypothetical question. These days, you know that if data are very powerful, they can create their own version of their own software, their own database, if the cost of using your service becomes so significant, could a bunch of agents just get them together and form their own JFRR?

Ed Grabscheid, CFO

Yeah, I know we're running up on time, so I'm going to be very quick on my response, and I can catch you afterwards. But from a pricing perspective, I want to remind you, we actually generate revenue off of data consumption and servers. So the only thing that we do on a PERSI or contributing developer is security. There may be some change in pricing and we're not going to be the driver behind the pricing change. We'll keep an eye on the market. Regarding your question on can foundational labs and models replace JFrog, there are going to be signals in terms of maybe a change from a security perspective that's needed But JFrog is a system of record, and they're the ones that are going to drive the governance. They're the ones that are going to do the remediation and push those out. The models are not intended to be a universal platform. It might be a signal going forward, maybe let's say a red team, but JFrog will still remain as a system of record.

Speaker 1

I'll just add to that real quickly. You're not going to allow Claude to govern open AI or vice versa. And so within governance, I'll jump the shark to where you're even going. When they don't need humans and they don't need Git anymore because that's just for us humans and they're building just binaries, you still need JFrog because we govern what the agent's doing. And that's what we do differently that the agents will never be allowed to do in an enterprise. Thank you so much for the time. Thank you very much.