Conference Transcript - FROG 2026-06-04

Koji Ikeda, Analyst — Bank of America

My name is Koji Ikeda. I am one of the software analysts here at Bank of America. Welcome to day three of our 2026 technology conference. Here to kick off day three, absolutely thrilled to be hosting a fireside chat with JFrog. We have Ed Grabscheid, CFO of JFrog, and Jeff Schreiner, head of IR. So thanks so much for joining us.

Ed Grabscheid, CFO

Thank you for having us.

Koji Ikeda, Analyst — Bank of America

I guess, you know, maybe just to kick it off, I always like to start with just a high-level overview of JFrog for the listeners in the room that are maybe new to JFrog's story. It's in the weeds of DevOps, but DevOps is a fantastic category, and so maybe just a high-level overview of what you guys do at the beginning.

Ed Grabscheid, CFO

Yeah, sure, happy to do that, and it's great to see everybody. I see a lot of familiar faces, some new faces, so I'll give a very high-level overview of JFrog and kind of what we do. And you're right, it used to be in the weeds. I think there was a lot of people that misunderstood the story of JFrog and what we did and what is a binary. Binaries were kind of something that was a machine language that nobody really talked about, nobody understood. They understood source code, that you write code, you write it in English, German, Spanish. But that converts into a machine language, which is known as a binary. And that's what JFrog does from the day one. It always focused on binaries. We have built a trusted, secure, and automated platform that delivers software through the software supply chain as a binary to distribution. And in the era of AI, as many, many new binaries are being created, We have built a very scalable and holistic platform that allows for this tsunami of binaries to come through into production and through distribution.

Koji Ikeda, Analyst — Bank of America

So when you're out there talking with customers and in this category of binaries and the security of binaries and, frankly, the whole supply chain of software, When you're winning deals out there, what are maybe the one, two, or three top priorities and differentiation that JFrog offers, you know, that they're telling you, this is the reason why we chose you guys?

Ed Grabscheid, CFO

Yeah, so as I stated when I opened about JFrog, what are the critical kind of technical moats that we win? And one is the automation. So the automation process, it is a holistic, universal solution, which means that more than 30 languages connect with JFrog. It's agnostic to any languages, any cloud provider, any foundational lab and AI model. So that's number one. Number two is it is a control plane. So everything comes through JFrog. And you have full visibility, a holistic view of all of those applications that are coming into JFrog or into your organization and through JFrog. And so when you look at other solutions and when we go up against other maybe smaller competitors, the technical win here and the moat that really separates JFrog from those others is the holistic view and the scalability and the fact that it's not just a good enough solution. in the era of AI, it is the best solution that supports all of the languages that are available to any of the agents.

Koji Ikeda, Analyst — Bank of America

One of the questions I often get from investors, and I try my best to answer it, but would love to hear how you guys would answer it, is hyperscalers and other big platform vendors might have some sort of binary solution. If you quickly Google, you know, artifact management, things come up.

Ed Grabscheid, CFO

And so why are you winning a lot, you know, against some of these bigger platform vendors that offer a lot of solutions out there yeah why don't i start yeah i'll start and then you can jump in jeff with maybe a little bit more of a technical view on this but it goes back again to the universal approach and the fact that we support many language and the scalability so maybe a year or two ago you might have heard uh where the hyperscalers had a container registry offering and maybe smaller organizations were going to the container register offering from the hyperscalers and there was a competitive advantage from a price perspective and a good enough solution to support one two or three languages today it's very different if you're using agents and we can say that 80 percent or so of developers today are using an agent to build code in some capacity that agent itself is going to go out and pull what is the most efficient way to write the code and that may not be with npm it may not be with PyPy, it may not be with Kondo, it may be in its own language that it creates on its own and JFrog can support all of these languages. It's a scalability so as a new language comes into into play with the development process that language can be added to JFrog very quickly and it doesn't break the model or the platform and therefore a good enough solution like a container registry coming from the hyperscalers is not going to be good enough in the era of AI And this is why nowadays JFrog has become mission critical to all organizations. We're focused on the enterprise, but we see an opportunity for that to expand to all organizations, especially as we move forward to an automated, fully autonomous process in AI.

Koji Ikeda, Analyst — Bank of America

When we look at the infrastructure software category and, frankly, the entire software universe, I think investors out there are trying to figure out AI winners, maybe AI neutral and AI, we don't know. And JFrog definitely, I think, falls in the AI beneficiary category, facing a lot of tailwinds here, benefiting from a lot of tailwinds here. And so maybe help us explain or help me understand why JFrog is a beneficiary of AI. I know the simple, simple, simple thesis is AI equals more binaries equal more JFrog, but why is that?

Ed Grabscheid, CFO

Well, it goes beyond that, to be honest with you, Koji. It's not just the ability to take the amount of new code that is converting to a production-level binary into the organization and handle that level of the surge. And clearly those numbers that you see in our cloud growth, 50% cloud growth now representing 51% of our total revenues, a great outcome. And this is strategically what we've been building towards is moving as many workloads from self-hosted to cloud, landing new customers in the cloud, building new capabilities in the cloud. And that's being represented in the numbers, but it's also the governance aspect. And so where the AI winner, maybe they're looking at JFrog as an AI winner, it's around the governance. So once you allow the machines to be autonomous or working in collaboration with the machines, you have to have the governance. And this is where JFrog quickly is becoming recognized as a beneficiary to AI because the model itself is a control plane or the platform is a control plane allowing the governance. So when the machines start creating binaries, you have to have the governance layer on top of this. This is why it's critical with AppTrust, a product that we introduced during Swamp Up in September of last year, and it's starting to gain traction. Customers see the value of the governance as more and more code is being created by machines and not by humans that are overseeing the process. The governance layer will become critically important in the era of AI.

Koji Ikeda, Analyst — Bank of America

I think in the new world of AI and the current world of AI, everyone is trying to understand, number one, where technologies sit in the stack. And then also, where does the technology sit within the ecosystem? So I want to ask you the ecosystem question. And when you look back at the transcripts and the prepared remarks, there's a lot of commentary of how you guys are playing partnerships here and there. And so maybe help sum that up for us. Where does JFrog sit in the ecosystem?

Jeff Schreiner, Head of Investor Relations

Well, I think in the ecosystem, I think you heard Ed speak about it earlier, Koji, and that's the holistic view that JFrog has. And I think maybe that's one thing that might be underappreciated is with the universality that we have with so many tools connecting or utilizing JFrog or metadata from the binaries, we have a whole picture view. A model may have the view of the model. I mean, many models, if you try to move model to model, tell you, no, that model sucks, I'm better than that model, work with me. So they have a very centralized view of what they're trying to do, as do others, whereas the holistic view of JFrog, i.e. the Switzerland of binaries, so to speak, gives us a unique positioning in that ecosystem. And I think that's also a competitive mode for us in a way, because why? Because why would a larger player want to allow that universality, right? A larger hyperscaler may want to enforce their tools, their cloud, in that critical area where a lot of the enterprises need that universality so that they can choose the best solutions to plug in and work with JFrog Artifactory and with the software supply chain managed by JFrog. Got it.

Koji Ikeda, Analyst — Bank of America

When I look at the business model, I think one of the key growth drivers is cloud. So cloud just grew 50%. It grew 42% the quarter before, 50% the quarter before that. All great, right? But what's the best way to understand the durability of cloud and maybe get a little bit more comfortable with 50 going to 42, going back to 50? And what does that look like? Or how should we think about that?

Ed Grabscheid, CFO

So I think you're alluding to the seasonality. And that's a question that's been asked quite a bit as we've been on the investor circuit. What is the seasonality going forward? What should we be thinking about for JFrog? And how does workloads now, how does that play out with the rest of the year, especially in the era of AI? Previously, you had holidays to take into consideration. Q4 historically has always been a slower quarter. We always knew that Q3 was kind of a capture quarter in terms of commitments. But everything has changed in this environment because machines are running in the background. It doesn't take a break. It doesn't go to the restroom. It doesn't get on a holiday. it's a it's the million dollar question to be honest with you we don't know what the seasonality is and and what we do know is we have a commitment and we're different than a pure consumption play sas company we have a commitment an annual commitment to jfrog it's contractually obligated it's a legal binding agreement and we guide on that so whatever we're guiding we know it will not fall below that. That is the floor. We increased our guide heading into Q2. We raised it from a guide of 30% to 32% to 34% to 36%. And we also believe that we have a better confidence level of a sustained usage in the cloud above minimum commits today for a couple And I'll explain. Number one, we've had now four or five consecutive quarters where we've seen strong growth, even though it's not included in our guidance. We feel more confident about that. Number two, as our customers are telling us, budgets have been loosened. The purse strings are loose and we're not being pushed back to slow down the innovation that's coming from the board being asked by the board or by management. and we're not even being pushed back by the office of the CFO or procurement to go do a re-up on the agreement. We're going to spend over the minimum commitments for now. Now, once you get to an annual commitment at the end of the contract, you're going to have to renew. And we still see customers renewing at a higher annual commitment. It makes a lot of sense. We saw that. We captured some of that in Q1, and we hope to do that going forward. At the end of the day, we start to see customers spending over minimum commitments, and they're continuing to spend over the minimum commitments until they have the clarity. And once they have the clarity, they may re-up to a higher annual contract. Today, we feel like the seasonality with that is unknown, and the intent right now is to try and capture a higher annual commitment, So therefore, we have the visibility and we can guide clearly to the group here and the investors in the street.

Koji Ikeda, Analyst — Bank of America

So not only do you have cloud, you have a very robust on-prem self-managed solution, too. And so maybe talk a little bit about why a customer would go cloud versus on-prem and vice versa.

Ed Grabscheid, CFO

Yeah, I'll start and then maybe you can talk about the technical side. But, yeah, so there's two ways to look at it. There's organizations that first come to JFrog, and many of those today, as a new organization landing at JFrog, will land in the cloud. They see economic benefit because they don't have to manage their network. They don't have to manage deployment across a global topography. Everybody is up to date from a version perspective. We also have customers today that are on self-hosted that are still migrating. Even though we talk about a slowdown in migration, there is still benefit for those customers to move workloads from self-hosted to cloud. Now, what's happening with the very large organizations that have millions and millions of artifacts that are 20,000 developer shops or so that had intention to migrate from self-hosted to cloud, These are very advanced developer organizations that are also using AI. They don't have the clarity yet on the cost structure, and those have been paused. It's not a matter of if, it's a matter of when, and they also see the value of moving to cloud and putting the workloads into cloud. But those are being paused at the moment right now.

Jeff Schreiner, Head of Investor Relations

Yeah, and I would just add, I think, Koji, the decision to be on cloud or self-hosted, that's a customer decision that we leave to the customer. And I think what you're going to see over time is there will be a cohort of the self-hosted group that will be in regulated industries or be somewhat forced by some type of regulated policy to have a self-hosted instance. And those will be the customers that will continue to use that. However, we are starting to see things emerge with the use of hybrid in the area of AI, because we all go through these periods of costs of cloud when new technologies or the use of technology and shifting from self-hosted to cloud earlier in the few years back that we had seen causes some type of realignment of the vision, but inevitably cloud goes on. But I think right now in the area of AI, certainly some are looking to say, is there a hybrid approach in which I may choose to put certain workloads into self-hosted and then move certain workloads into the cloud? And as you utilize JFrog, you're not experiencing any difference in how that's interfaced. The UI is completely the same to you.

Koji Ikeda, Analyst — Bank of America

And again, I think that's a differentiated opportunity versus not only the large players, but other smaller players beyond just scalability that, you know, each is kind of restricted to their area and their sandbox, one in self-hosted and one cloud native. in the software landscape pricing models has become a pretty topical conversation you guys have been a very consistent pricing model and so maybe spend a minute or two and remind us exactly how you price on cloud and on your self-hosted solution again another question that's asked quite a bit i think there's concerns around you know where is pricing going to go in in the era of ai especially with the seats um and the change uh in seats going from humans to

Ed Grabscheid, CFO

to agents and how do you price that the good news is jfrog has never been a seat based pricing model on the cloud side we always monetize based off of data consumption and storage and on the self-hosted it's on number of servers so we've avoided the seat discussion on security we do monetize based on number of contributing developers. That's a common currency and we went to the market with our security solution based on that. We thought about maybe does it make sense to do something on scans or artifacts, but it was confusing for buyers and as we were stepping into security, we wanted to make sure that there was a common currency for CISOs to understand the value of JFrog. Now as you move forward and you think about tokens and this token environment. And as tokens start to increase, there's a lot of discussion about now as more and more use or more and more development will go through tokens, what does that mean from pricing? We're not going to be the pioneers behind the pricing. We'll certainly follow the trends, but there could be some kind of bundle of pricing or a shift in the way that things are being priced. And we're keeping a close eye on that. We don't have any updates yet on JFrog. There's no intention to change anything yet, but we're keeping an eye on the market and see where it goes.

Koji Ikeda, Analyst — Bank of America

So you mentioned security there in your answer. We haven't touched upon it. We've gone 18 minutes without talking about one of the most exciting growth drivers, I think, for JFrog. And so, you know, clearly you guys have built an incredible franchise with your Artifactory product. I mean, I don't use best in class all that much in software, but we hear it all the time with your partners and customers out there. So congratulations on what you did with Artifactory. But let's talk about security. What is security to JFrog? What is security to your customers out there, and how are they thinking about it?

Ed Grabscheid, CFO

So security, there's two ways to look at it. There's the security, the basic security that's added to our subscription called X-Ray. You have Enterprise Plus, Enterprise X, and Pro X. That is a tier zero scanning capability once you bring artifacts into your organization. We also have an add-on security. This is really what's driving the growth in the ASP, which is driving our net dollar retention rate, which is driving the expansion that we're seeing and very healthy KPI and metrics that we shared at the end of 2025. that is curation and advanced security curation is the firewall that sits outside of the organization that you curate what you can bring into the organization and then once you bring those packages and artifacts into the organization you use advanced security advanced security is a platform that replaces seven disparate scanning tools into one platform replacing those those tools. Now, security has gained a lot of momentum over the past year, and in particular since Q3 of last year, when you started to see a lot of these open source vulnerabilities, NPM attacks, the Shai Halud attack, that created a lot of awareness for curation and protecting your organization outside of the firewall or outside of the organization as a firewall. And we saw great momentum, especially in Q4, where we had a lot of security curation purchases that were done really within the quarter in a short period of time. And that momentum carried into Q1, and we're building a very strong pipeline. It's no longer a situation where there's an incident creates awareness. There's maybe fear buying. This has become a pipeline builder. The awareness is clear. It's really a no-brainer to protect your organization, especially in the era of AI when packages are moving at the speed of light into the organization. This is the best way to control that. It's the best way to keep developers productive. And curation is becoming a very good product for JFrog and a nice pipeline builder.

Koji Ikeda, Analyst — Bank of America

Can you break down exactly what curation does from a very simplistic view? We've done a fair amount of work on it. We hear good things, but always a good reminder of, you know, what exactly does it do?

Jeff Schreiner, Head of Investor Relations

Yeah, thanks, Koji. As I described it, you know, we try to paint it for investors to understand as kind of the wall around the castle to keep out the barbarians at the gate, okay? And this has become something that was actually developed, and I want to highlight this, that, you know, what JFrog has been able to do well and continues to do well and I think will benefit us as we continue to work with these frontier labs is create products that solve very important pain points for our customers. So there was a large financial services firm who came to us at the time because at that point in time, a few years back, prior to curation, what an organization did, at least this organization did, allowed the developer to build, but you were not allowed to have the package approved. And you had to hope that the package was approved by the time you built because they brought nothing in and you had to get that one package approved to be then built. Others at that time were just bringing everything in and scanning with x-ray to try to secure in that sense. And so this customer said, well, wouldn't it be great if we could have a centralized policy in which I could state and as Ed stated, curate, that's the name curation, the repositories that I, in fact, want to work with and want to allow my organization to use. And so I will tell curation to point to repository A, B, and C. And within that repository, it will be curating and managing the packages, and it will manage the packages within that repository that I want to use and keep an eye on what is going on in this repository. Has anything been changing with the packages that I'm assigned to be in charge of? Thus, it creates that firewall, which in essence has become critical in the area of AI, because now the hackers have ai and and the patch and the remediation of all these cvs we're seeing almost by the hour where are they happening they're happening at the binary level and so when i now want to start moving towards more autonomous work as as i start to shift at some point to allowing agent 101 to build and go into production what i want to have is a sandbox that I've approved centrally to say do as you will be creative you know build build build baby but do so with what tools you know what packages I've allowed into the organization so in the world of AI that's very critical to enterprises and I think it's that's why it's becoming somewhat almost of a you know no-brainer solution to have because it sits outside your ID sits outside source, model, where the data is created so that that will eventually as well. Another thing I want to add as I wrap up the answer as it relates to curation is that our CTO kind of snips it at an eye and we're having conversations because he's like, you guys talk about curation a lot of security. I'm like, yeah, well, you know, VDU built its security. It's governance. And you wait, they'll learn that it's governance. And so it's going to be a critical aspect to the governance aspect that Ed talked about in tying into AI catalogs. So curation has become a very critical product. And the last thing I'll add there is that it's become so critical that there's been some Johnny-come-latelys that have tried to fill a void. And they tried to fill a void on the typical way that Ed had described earlier in his first answer, in which I come with a good enough solution to tell you that you don't need everything JFrog offers, and this is going to be just good for you. Well, some people chose that route and they've been hacked. And I'll say that curation has never been penetrated. So I think that there's a lot of opportunity out there for us still as it relates to curation.

Koji Ikeda, Analyst — Bank of America

Is there a benefit to all with what you learn within curation? Oftentimes with software you hear, hey, we take all the data and what's happening and we don't share everything with everybody, but the learnings that we do within certain products do help everybody. Does Does that have that aspect?

Jeff Schreiner, Head of Investor Relations

I think it's different in the way maybe you're talking, right? We're obviously part of the community, and that's another thing we do that I think many don't want to do in terms of really working with 36-plus languages. That's all the repositories that come with that, supporting the community and doing community-led things that will always lead to monetization. You know, that's some of the things we've done. But what you may be talking about or what I would probably answer the question with Koji to how you presented it is back to what I said with solving pain points is now being very tied into some of these AI frontier labs that you are all very familiar with and understanding that when they came to us, we have very, very smart people. But they had a light go off when they were shown what an AI company views JFrog and a system of record as in the world of AI. And now we are able to start to work with them and try to build to their pain points as AI scales and grows at their individual companies.

Koji Ikeda, Analyst — Bank of America

So the security story sounds great. And so what are you guys seeing that is giving you confidence in the durability of growth for security? Maybe things that you're seeing from the customers or usage or conversations, whatever it may be, you know, that helps support this durability of security.

Ed Grabscheid, CFO

So, as I mentioned in the beginning, we have two products. One right now is probably weighted a little bit heavier in terms of criticality, which is curation, because there is no alternative solution at this point, and organizations didn't have it unless they tried to build it on their own, which they weren't able to do. So, there's an immediate caffeine high, so to speak, to bring curation into your organization, implement that, and see value immediately. And as I mentioned previously, this is no longer an incident-driven purchase or a fear buy. This is becoming obviously critical every week. Maybe even daily you're starting to see these open source attacks and vulnerabilities that are happening. So if you're an enterprise and you're using AI capabilities and you're concerned about security, you're obviously going to take curation. So there's durability there based off what we're seeing in the pipeline. The second piece is advanced security, which, again, is critical. It's critical to consolidate all of these point solutions that many of these are not publicly traded companies. They had a value proposition maybe three or four years ago. Their value has come down, consolidated to one platform with the provider that is securing your asset, the most critical asset, the primary asset, the binary and managing the binary. So it makes a lot of sense to consolidate those point solutions to one platform. So there's a lot of value in that as well. And we continue to see a strong demand and interest in advanced security as well.

Jeff Schreiner, Head of Investor Relations

And I would say the advanced security, just to add quickly, Koji, it's going to have a much long tail type effect. Because you can think that some of our large deals that we signed a few years back, the largest deals in history, they'll be coming up over time for renewal. And let's see if in the first, you know, multi-year, three-year agreements that they've signed, do they in fact replace all those seven tools? Because that's the difference here. As Ed said, I'm putting as many contributing developers behind the firewall. Now, you know, the jazz solution or advanced security is more for the good actors gone bad inside the castle, so to speak, right? And I may replace one tool in year one because I have to run it in parallel for nine to 12 months. And then obviously, I'm going to take a different step up in seats by year two because I'm running one and I may now be testing one or two to replace as well. Now, each has a built-in step up over this multi-year period, but I think the step up is more weighted for its advanced security as you build in the tool adoption over time. And so that's still very early innings in terms of the consolidation.

Koji Ikeda, Analyst — Bank of America

Running up on time here. So I do want to ask you the growth and profitability question. And one thing that I've always loved about JFrog is your responsible growth. You've never done a reduction in workforce, always been growing, always been innovating. And so you guys are really like facing a nice opportunity here. And, you know, that always bears the question, why not invest more for growth? And so how are you thinking about balancing that growth and profitability framework?

Ed Grabscheid, CFO

Yeah, you know us well. You've been with us for a long time and you know the story. We're a very efficiently run company. We're very disciplined in the way that we deploy our capital and where we hire. And like you said, especially now, and there's so many headlines with reduction in headcount, we knock on wood have never done that. And we don't intend to do that. We continue to hire in this environment because we want to capture the innovation and make sure that we're staying very relevant in the AI era. In addition to that, we're also implementing a lot of AI internally. So we will have efficiency gain over time. Like many companies, we're continuing to educate ourselves and exploring. And I think efficiency will come in 2027 around AI and we'll have to consider, you know, what that means from a hiring perspective. But for the time being, when there's an outperformance on the top line and we you understand our guidance philosophy, we're a little bit more conservative or responsible on the top line, less so on on our operating expenses from a guide perspective. So we would expect that outperformance, a portion of that to flow to the bottom line. We had a very strong quarter in Q1, over 21% operating margin, a nice growth in operating margin on a year-over-year basis, and we'll see how the rest of the year goes. But we'll maintain that efficient, disciplined approach.

Koji Ikeda, Analyst — Bank of America

Got it. We're all out of time. Ed, Jeff, thanks so much for doing this. Appreciate it.

Ed Grabscheid, CFO

Thank you, guys.

Koji Ikeda, Analyst — Bank of America

Thank you, sir.