JFrog Ltd — Call Transcript 2026

Awesome. Great. Well, my name's Lucky Schreiner, software analyst here at D.A. Davidson. Really happy to have Jeffrey Schreiner with me, a long-lost cousin, I guess. Something of the sort. Really happy. JFrog's been a great story. A lot of momentum in the business. Security's an interesting kicker too as well. Maybe just to start though, for any new investors, how would you describe JFrog's core role in the software supply chain, and why is it becoming increasingly mission-critical today? Well, first and foremost, thanks for having us, Lucky. We really appreciate the support and appreciate attending the conference today. I think in a general sense, when you think about JFrog, you should think about the word automation. That's what we've always done, is it for the software supply chain, we've been the aspect that you are trying to deliver speed and security at the same time, and that's been the crux for many who have tried to do what we do, is the ability to keep things in line, both speed and security, as you scale and add more support and more open-source languages into the architecture. What we are akin to is that in an organization, you are building code that has typically been done in the past with human developers generating source code. That source code today has been written primarily in a language called Git. You might be familiar with the likes of a GitHub or a GitLab who are very successful in the source code business. They generate that source code, and then that source code is compiled, and maybe 10% or so of that source code is combined with packages or open-source software from outside the organization, and that creates a package or i.e., the binary, and that binary is then transported through governance gates and is then eventually handed off and deployed by the organization into production, where it's then managed by the observability and runtime players. We sit in between kind of the source code and the runtime and provide governance to source code and provide data and visibility to the runtime organizations who may need to access the metadata that we have that is stored and held within binaries. Awesome. I think we got to start with last quarter two. Very strong results. Everyone's asking about why cloud growth is accelerating. A lot of that's driven by overages. What are some of the dynamics there, and how should investors think about the sustainability of cloud growth moving forward? Yeah. Cloud's been strong. I think it was strong last year, and it was strong in the sense that I've been here almost five years at JFrog, and for the majority of that time, the monetization strategy within JFrog, inside of cloud, is that you can either migrate from self-hosted, where you're managing that type of deployment yourself, and then shifting it to the cloud. A lot of our growth, when I first started, that was the way in which we grew. Last year was unique in the way that it was the first year that we saw consumption the other way. I buy a data package from JFrog, and each time I access a binary, I'm utilizing some form of that consumption that I buy from JFrog. We saw the use of consumption really be the driver of what was driving cloud growth last year, and very much so in Q1. In Q1, we talked about the broad use of all packages, and thus created a very high level of cloud usage amongst our customers in the world of tokenization. What we saw is that we were able to outperform the expectations, the guidance level, by roughly around $7 million. We carried forward of the combined business only four and a half into the full year. What we've tried to say to you is assume that that's the committed portion, security, other things that we've won and signed commitments to, versus the two and a half delta more or less being attributable to that penalty rate, that usage above the commitment rate that the customer has been running while they're running hot right now. I think that that is something that is happening because we still remain very much so in the world of experimentation and training the models. I'm telling the model to build this process. I don't like it, do it again. I don't like it, do it again. That's creating this activity. Eventually, I think we'll get to a portion when you talk about our cloud growth, where that activity will become more specialized, more production volume type levels. When the model starts determining that I don't need to use source code, I want to make binaries because that's what I'm starting to produce, these production-level binaries, whether it be from source code, human, agent, what have you, will be inherently more valuable than the binary activity we're seeing today because those will be assets deployed valuable to the company. They will need to be updated, which causes builds, secured, which causes the buys for security, stored, which is part of your consumption, and maintained. I think there's still a lot of activity as it relates to production binaries that we haven't seen the full effect of yet. Yeah. On that note, how do you see the model usage evolving with customers today? Do you think the models they use will keep getting bigger and bigger, or will they become more specialized, and how might that impact JFrog? That's a very timely and good question, Lucky, because as it relates to JFrog, I'm hearing it from others in my conversations when they speak to other organizations, one way that we're looking to manage token spend in this world of token maxing, as you guys have defined it, is to utilize very specialized models. We use Opus a lot. That's probably the highest usage model that we have today. We use Sonnet, we use other smaller models that we are finding can do certain tasks very well, and I think that that is how other organizations are doing that. That brings up a unique aspect that then brings favor back to us at JFrog, in the fact that if I'm using four disparate models to complete one build, I'm going to have to inevitably bring back the four models to one point. Where is that point? That point is the system of record, i.e. JFrog. Yeah. I wanted to touch on, too, the rise of different coding languages as agents use all kinds of coding languages. How does that impact your differentiation, especially today? It's magnified something that was always there, Lucky. You know this in talking to me that I've talked about scalability as inherent value, that why we win. I think I define things kind of now in the software world, two years ago, and the AI world now, right? In the software world, the scalability was always there and inherent. We had a competitor who started essentially as the same year as JFrog did, but has been stuck at being able to reach a certain level of only about 15 languages that they can support during this entire path. We've scaled up to 36 languages, that scalability is now very evident in the world of AI because what we have learned in 2026 is that it is no longer that you can feel like you did in the software world, that I program in these four primary languages. They're widely used, so I can use something that isn't all that JFrog offers. It's very sophisticated. I can use this good enough solution. Unfortunately, we found in the world of AI, that will lead to you being penetrated. Because while you may not say you program in a certain language, the model inherently is looking to be efficient. It is going to say, I am building X. The most efficient package for X is Y. Just because you don't program in it, doesn't mean it won't go get Y, and now you've been penetrated. In the world of AI, our ability to scale and scale with AI is becoming a big differentiator for us, as binaries are now becoming much more of the asset of focus. Yeah. I feel like that naturally brings up security. You guys had in your State of the Union report, malicious NPM packages grew by over 400% in 2025. Feels like that trend is continuing in 2026. That tends to create a catalyst for Curation adoption with you guys, and would you expect that to remain a long-term secular tailwind for you? Very good question. I think it's changed relative to maybe if you'd asked this question four years ago, I think you would be going down the right path, that it used to be that we would have an event like Log4j. That was the last major software supply chain attack. Enterprises would rush and spend to patch and fix, and then there would be a lull, and two years, three years would pass, and then maybe another software supply chain. Now it's happening daily, if not multiple times a day. They're all happening at the binary level. Thus, I think that people are starting to realize that a product like Curation, which is essentially a firewall for your software development organization. It sits outside the developer IDE station, and it curates various repositories and packages that you, as the central CISO or policymaker, have designated okay to utilize in your organization. I think the pipeline has remained very strong because the attacks continue to be in your face as a CISO, and it's something that you are now having to take note of. It's also becoming more important because there was an alternative you might've been looking at or looking to evaluate for Curation that had told you that if you only utilize a few packages, utilize this, you're better off. You now don't have that as an alternative, and people realize that, and I think it's just continued to fuel the demand and keep the pipeline strong for our sales team. Yeah. As the attack surface shifts upstream, how would you say your security conversations are trending from a budget perspective, and maybe compare and contrast the demand between JFrog Advanced Security and Curation? Yeah. A very good question. I think that, let's start with the second part first. Curation and JFrog Advanced Security. We've been quite open in the fact that we said, before the first Log4Shell event in Q3 of last year, the pipeline and the deployment was probably roughly 50/50, both Curation and JFrog Advanced Security. Since then, it's obviously skewed very heavy to Curation because industries are obviously seeing the need to have somewhat of a firewall type security out there protecting you, and those that had it in Log4Shell can tell you what it did for them in protecting their organization when the first Log4Shell attack happened, and the packages that were being blocked that you referenced in our State of the Union Artifactory report went up exponentially, right? That protected those organizations. Other organizations, think of it if you're a CISO who has now been given software supply chain, and that's now in your wheelhouse, but you've never dealt with it before. You've dealt with networking firewall security. You understand the concept there. A firewall-like product then for Curation, to your point, seems very likely to have to basically stop the inflow of what I will allow from a central location, then tell the organization, I don't want to interrupt your productivity. Be very productive and creative, but just do so with the products you have today in Curation. Thus, it's become very popular, and our CTO snaps at Ed and I sometimes saying that, you speak a lot about Curation to the investment community as security, but it's actually governance, if they don't see it yet, they will. What I would say to you is that some mind you may be seeing from maybe some of the smarter organizations could in fact be those looking to purchase Curation not only for security, but for the governance aspect of it down the road. We equate Curation to more of a caffeine-like high, right? It sits outside your developer organization. You'll want to put as many contributing developers, those who interface with Artifactory, behind that right away. It's a seat sale, just like security is, so the number of developers. Quickly, you can get a high level of developer seats right away with Curation. Advanced Security, on the other hand, is for good actors gone bad inside the castle. With that, I'm taking a tool. I have seven disparate point solutions. I want to consolidate all of them into the JFrog Advanced Security platform. I do so in year one with one solution. I run it in parallel for 9 to 12 months. I replace it. I get to year two. I'm running one tool. Now I'm doing another one or two for replacement. We'll have to see over a multi-year timeframe if some of these customers even replace all seven or eight in their first three-year, multi-year agreement. A much longer tail aspect where it's just the early innings of this consolidation trend playing out for Advanced Security. Yeah. You brought up governance, I want to shift to that. You guys released at JFrog swampUP last year AppTrust and AI Catalog. Those were exciting and received well. How would you characterize that opportunity for investors and maybe any timeline for when that might start to become more significant? I would say that for all the investors listening out there, that's where you want to start shifting your focus. If you talk to our customers, they will tell you a lot of the same things that you'll hear coming out of my mouth. That is the fact that right now today, I'm very much concerned with make AI work. I'm not so worried about the cost, things of this nature. Once AI is working, I'm going to be very concerned with governing AI. You referenced AppTrust and AI Catalog. Those, along with Curation, along with things that we've now added, such as MCP Registry and Skills Registry, which is scalability on the revenue side, adding new revenue opportunities in Artifactory without any real investment, will be part of our governance bundle. The team is meeting in an offsite this week to start our initial thoughts for 2027, and certainly, I think governance is going to be a topic du jour about how we will bring this to bear and the monetization strategy that we will use. We've seen a high degree of interest in AppTrust, AI Catalog. I think AppTrust is still being worked with customers in developing that product and bringing that product to bear so it's ready for primetime when we really have it as part of the full governance platform. AI Catalog has been doing quite well and seen a lot of interest. I would even tell you this, Lucky, that the MCP Registry and Skills Registry, while not a driver today, we've been seeing successful POCs close down in several weeks for this product, with people saying, yes, it does what it does, and it does it well, and we'd like to move forward. I think it shows you that the governance Lego, as we like to call our Lego strategy, with Artifactory being kind of your base Lego. Now you add security on for more value. You add governance on for more value. This is what continues to make us very strategic within the enterprise. We think that governance is the key. Why is that? Because as I was going, in another answer, kind of alluding to, the machines are going to learn that they are only using source code because they have to speak with us humans, and they don't really need source code. What do they really want? They want to produce binaries because that's what's going to be inevitably put into production. Even in that scenario, when a model is building at the binary level, governance will be critical because the creators and the governors will always be separate in the organization. I want to tie this to your go-to-market and talk about net new logos. You guys have historically shifted to targeting the largest enterprises. On the flip side, I think what you're alluding to, a lot of enterprises are reaching a certain scale where they have to adopt JFrog moving forward. Maybe how do you think about net new logo growth moving forward with all this new product? It's a focus, and we've got a new CMO in Genefa Murphy, and I think she's definitely got that as one of her tasks in which she's trying to help drive logo count. I would always say that we can always drive logo count. Yeah. That it's quality logo count that you're after. I think what you're seeing from us is that the last two years we've been going through kind of this year's theme for JFrog, ironically, is a rebirth. It's rebirth in the sense that some of the logos that had fallen off were logos that were in our lower price subscription tiers, had never really grown, liked JFrog, but were never really intent on upscaling their subscription or utilizing more JFrog. Were sitting at subscription layers that just weren't going to lead to that land and expand type of customer we've shown you in the slide deck. I think that we've seen a roll-off of a customer that came to JFrog four or five years ago when I joined, when we were selling you Artifactory as a product, hoping that Jeff's organization takes Artifactory. He's successful, he's productive. Lucky sees it. He wants to bring it into his organization. It was more product driven, bottoms up from the developer. Circa today, we're being sold top-down. It's strategically placed inside the enterprise that the developer's told what they will use, JFrog has become a strategic partner. I think that's what you've seen in terms of logo as it relates to count. I would tell you that the ASP is up materially in the five years that I've been here from a new cloud land to what we see today. That's just because I have customers now landing in the platform, and if you land on the basic version of Enterprise+ in the cloud, you're going to already be in that 100,000 cohort just with that. That's the difference that is what's happening, is that the logos are not maybe accelerating in terms of a high number, the contribution per logo is certainly growing, and certainly for new logos, it's growing. Yeah. I want to talk about some of those high-quality lands, specifically the AI natives. You guys have three out of the five. Maybe first, level set, how do you define an AI native? There's a lot of definitions out there. Two, I think most investors would assume they would build a solution like this internally. What was the catalyst on their end for adopting you guys? Yeah. Look, I say there's probably seven, you can interchange the last three for every person, depending on what they view as the models. When we talk about the frontier models, I think you can be safe to assume that we're talking about many of the models that we are all using or all hearing about in the news today, some of the major model companies out there. While there have been talk by many, and I think that that was a concern earlier this year, that perhaps inevitably these things are so large that they will encompass and take over so much in software and even binaries. What we learned is that there was one that tried to do just that, and that was one of our first frontier model customers who had tried to build JFrog on their own without benevolence to JFrog, and failed at doing so for that very key word I have said many times today, scalability, thus came to JFrog and began working in tandem with us. Now they are also one that has us on a moonshot-like project, which would lead to the management in a model as a package type of business architect that you would have at almost line rate speed, thousands of large language models being trained, secured, stored, transferred, all of this information being transferred to and maintained from Artifactory. The unique aspect of the way AI looks at Artifactory and the system of record has changed dramatically the way the intelligent people inside JFrog look at Artifactory versus maybe the restrictions of the software world before. I think if anything, what investors should take away is that there has been a significant intangible benefit to working with these guys and becoming very close with the frontier models and where they want to go, and solving the pain points on the binary aspect of getting there. Yeah. On that front, how do you target these companies moving forward? Does the go-to-market look different? Maybe in terms of the deployment, any nuances between cloud versus self-managed? Well, let us start with the second first, because the three we have today, as of the March quarter, have all chosen to go self-hosted initially. I do not think that precludes them from becoming hybrid at some point and moving to private or public cloud, what have you. A fourth model that we hope to sign during the second quarter, nothing is ever official until it happens, but to the extent that it does happen, the uniqueness that we have been trying to communicate to you guys, because we will not be issuing a press release, we cannot talk about these types of companies, but the uniqueness is that this particular one would like to engage with JFrog on a hybrid basis, which would bring cloud into the frontier model contribution, not just self-hosted in terms of how they are doing it. That is how the major models today have chosen. You had a group that says self-hosted is the right route, and what gets back to management myself from the sales team is as simple as, I have something special I don't want to share with the public cloud yet. Okay, understood. You can understand from one, the one that's working on the moonshot, why they want to get to building the data center, because that's inevitably where they're trying to go. Right? I think that each one of them, and I do it akin to the buy side when I have these events at conferences, right, that they all are asking the same question. They're asking it a different way, all trying to get to the same answer. Right? It's just a matter of preference for the model guys of trying to get to the same, solve the same problem, but we may do it different ways. Yeah. I think shifting gears just a touch, going back to the overages in the cloud, how has customers' willingness to commit to multi-year deals maybe changed today? What are customers telling you, and how are they approaching it? It's changed quite dramatically, and I would say that's just over 12 months. A year ago, we were going through the same thing in essence, in that we had strong usage in Q1. Agents were just starting to be introduced to the enterprise. We saw this tick up in usage in Q1 last year, and it was still very much the behavior of the historical trend of that was more of an oopsie, and let me come back now and capture economic value by signing a higher commit, a new commit with you that has a higher commitment of consumption, and thus I'm no longer utilizing that overage. That's captured in the new commitment I've made with JFrog. What's different today is that our customers are saying, I don't know what my cloud usage is two days from now, two weeks from now, or two months from now. Signing an agreement for two years, I don't know if that's right because I don't know whether my cloud usage may change, the way I use cloud could change. If I move from experimentation to productivity, does that change things? I try to equate it for you guys on Wall Street is to think about, is your PM asking you for a table-pounding idea? If he's not and you walk in there with one and it blows up, did you do yourself any service? Probably not, because procurement office right now is not feeling the pressure from the office of the CFO to go out and rein in costs or be my cloud expert and buy me the exact amount of cloud and don't get it wrong. Think about it. If you're that procurement guy and you're Joe Procurement and you think you're the best at buying cloud ever, you go in, do a two-year commitment, and in four months you've used it up and you're back hat in hand to the CFO, you didn't do yourself any favor in the environment you're in. I think right now, customers feel that running hot is the better choice. Inevitably at renewal, they will have to make a choice, and we'll see what that choice may in fact be. There has been a shift and change where typically an overusage would lead quickly to a new commitment, and we aren't seeing that just yet. Yeah. I think historically, you guys spoke to seasonality being more back half weighted with the large deals in the pipeline. It feels like with the 24/7 nature of coding agents, seasonality is changing a little bit. I guess, how would you characterize seasonality moving forward? Not to be flippant, I'd probably crush it up and throw it out that window. The reason I say that, right, Lucky, is because to your point, when I first joined here a few years back and cloud migration was the monetization mechanism for cloud, it was that I spent the first half really planning that deployment. The second half executing that deployment, and thus the second half more waiting typically in terms of our business. Last year, being consumption-driven, it was more steady Q1, Q3. The dynamics of Q4, which will always have this dynamic, at least for the near term, is that we all have holidays to celebrate and we work less. There's less development work, so there's typically rarely if ever any usage above commitment in Q4. That seasonal trend will stay, but that could even go out the door eventually someday. If Agent 101 is working while we are celebrating the holidays, that could change. That could change the dynamics of seasonality, but not this year, not anytime soon. I think as it relates to the consumption trends, it certainly seems like it is a steady as she goes for the first three, and then we have a seasonal trend of more of a slowdown in work, slowdown in development in Q4. Yeah. Anything to call out in terms of sales compensation with overages being a bigger piece of this quarter? How are you thinking about that moving forward? I think that our salespeople are kicking dirt right now. That is the way that works for us, and I think it is the right way. It is akin to paying you, the PM, for a high watermark, right, for something that could evaporate. They will not get compensated, our reps, until they are able to sign that higher usage into, in fact, a commitment. That commitment goes into RPO. Usage is captured today via revenue, and we can capture that, but inevitably, we would like to capture that into a longer-term agreement to have better visibility for ourselves and the customer, and the rep would obviously like to do it because that would help them in their comp structure. Yeah. Maybe taking a step back, how do you think investors should think about your long-term growth, the algorithm between cloud versus self-managed security and some of the newer AI products? I'll take security out right away because security's always going to fall, whether you're self-hosted or cloud, in the cloud. We maintain that database now, so that it is always updated, and you get five updates over the cloud through the day. That's the delivery mechanism, we recognize all security, whether self-hosted or cloud, in the cloud. Certainly a large driver for us. At only 7% of revenue, 10% of ARR as of last year, it's the new growth driver for us on top of cloud growth that we're seeing. I think longer term, you're going to add governance on to that growth mechanism as that next Lego of growth that will be additive to both the cloud and the security aspect of what we do. Over a longer term, certainly we've now achieved 51% as of Q1, the business in terms of cloud mix, so cloud has now finally become the larger portion, and I think that that will continue. However, there will be a cohort that will remain in self-hosted, self-managed, either through regulation or through a choice to do hybrid architecture. We will continue to support those customers, and I think you're going to see a lot of federal type of penetration. We had some success in federal last year. I think that's a new opportunity in self-hosted for us. A lot of work is done in those regulated industries within the government. To the extent that others that don't move over time in self-hosted, I think that those are the areas where we continue to add a lot of value, and we'll have to see how we can maybe extrapolate additional value, whether it be pricing or other things, into self-hosted, as that becomes more of the niche business and cloud becomes the real growth driver. Yeah. You talked about governance, I want to bring up again the report that some enterprises are maybe a little overconfident with their AI usage and not as well prepared on governance. Is it going to take something bad happening, or what maybe is the catalyst for customers to recognize this? They recognize it. I just don't think we're at the point where they're trying to What are they going to govern? The agents aren't there yet to govern, so to speak. We haven't trained the agent, or we haven't turned it loose. To your point, could there be some that don't see the importance? Sure. I think that what I'm hearing back from my own team, and then in conversations with the likes of investors and others, is that they're very much hearing back the governance conversation from other companies, and that this is very much a concern for them. I think more so you've seen the behavior you're describing happening somewhat on the security side with the, I'll try it good enough, I get penetrated, or, I haven't worried about binaries before. Why do I need to worry about securing them now? Something happens. Okay, now I'm wanting to step up to the table and talk to you more about Curation and the JFrog security products. Yeah. Maybe one more question and I'll open it up to investors if they're interested in asking a question. In terms of the share buyback that you announced recently, that was nice to see. How do you guys think about capital allocation moving forward and maybe the build versus buy equation, especially given your successful past acquisitions? Yeah. We've had success, as you noted, thank you, with two large acquisitions in Vdoo. That was the security that you're seeing today. In Qwak in 2024, which has emerged into really just AI and MLOps together, and those guys are the core of AI Catalog and AppTrust, delivering a lot of value to us today. I think that when we look overall in terms of where we're going with the business and how we see each one of these playing out, is that we're really looking at the business as taking security and driving it on top of Artifactory. They're going to be sold together at all times. The go-to-market there is never that we needed to go and hire a security staff to sell security. We were lucky enough that the industry started to shape a security sale to a panel, and we would bring in an overlay. We treat the customer has one main rep that you interface with, but you bring in overlays for security. We'll bring in overlays for governance because now at the panel level, you're selling to the CISO, the CIO, the chief risk officer. I think on a go-to-market basis, that's one of the changes that we've been seeing in terms of how things have been getting done and how we're approaching things and how the industry is looking at things from a top-down aspect. Yeah. Any questions from the audience? Hi, Matt. I'm curious, so what do you view as your biggest competitive risk today? Maybe differently asked, three years from now, what would be like, hey, we've got to monitor this. If this were to happen, we'd have to Yeah. Thank you for the question. The question was what is our biggest concerns today in terms of maybe competitive concerns, and what might it be for three years from now? I would say to that question, sir, that it may sound simple, but it is very much true. This is an opportunity that this management team and these founders have focused on in the binary diametrically for 18 years. One asset that they have told you was going to be of utter importance, and it never really seemed that way for some time because it was not where humans interfaced with software. However, in the world of AI, it has become very inherent that the binary is, in fact, that asset. I think that execution is our biggest risk in the near term, that we have a very large opportunity that has come to us. The market has come to us, the asset that we have focused on, and I think that it is execution. I think three years from now, it is does someone else try to work the binary in a way that we did not conceivably think. I think that is the biggest risk to us, not others that have tried the old way of I will support a certain amount of languages, and that is good enough to compete against JFrog. Maybe is there somebody that thinks about doing binaries in a way that we did not, and does that create disruption? I would say that there has also been disruption in the five years I have been here. Right before I joined, they bought Vdoo and Security, and that was something that could have disrupted the business. Buying Qwak and MLOps, that could have been something that would have taken over binaries and possibly disrupted JFrog. That is the other thing that we try to do as well, is run fast and see these holes that could be there in three to five years and use to your capital allocation conversation. Sorry, I got lost a little bit on that answer there. On the capital allocation, why we have used it to be inorganic when we need to, now we are using our strong cash balance as a way to help us maintain the merit increases within the corporation. We have shifted last year to higher merit increases from cash since we have such a strong cash-generating business and less in equity since we are a little bit more of a We have become a larger organization and now public for five years, and thus, we are trying to start to manage the burn rate. To come back, I guess I woke back up. The capital allocation is the cash will always be favorable to us. We get a very good return on that cash. We can use cash to be very quick and nimble in an inorganic fashion, as you noted, and I just noted with the two acquisitions we have made. It is not that something that it will burn a hole in our pocket. It is something that we see as valuable, and we will utilize it as best we can. The $300 million buyback that we put in place was put in place to be a buyer of last resort, as I think we need to have when we saw the disruption from what we call on February 20th, Anthropic Day. That will be that if we feel the market has disconnected in some way, we may be active in purchasing the stock, and we will certainly communicate what we were able to do with that initial authorization, after Q2 and with the Q2 results. That's how we're going to be looking at that, but that can also be a tool, not that that was created for, but the fact that if we're able to buy some treasury shares and use those in the future for employee issuance, well, that takes off the plate then of coming hat in hand to you guys asking for more shares, asking for dilution to continue to enhance and merit those employees that are helping drive the business higher. Yeah. Any other questions from the audience? Great. Well, maybe, on the profitability side of things, you guys have always had strong profitability. Where do you see additional leverage in the business, and how do you manage the push and pull between investments and maintaining your market leadership position? Yes. We very much see margins and the rule of, recently it's been a rule of 50, it's been nice. It's been a rule of 40, as how we kind of manage the finance organization is managing and running the business. I think that there's leverage still inherent because what we've done today with our guidance philosophy is that we provide you with a conservative, in our view, more of what has been contractually obligated to the customer. That's what we guide you on revenue, but we're not doing that with OpEx. We're giving you what we believe will be our essentially full OpEx. To the extent that we can continue to outperform on the top line, a good portion of that should flow through down to the margin line, and we should continue to expand margins. Certainly, we've had a long-term target out there, issued that target in May of 2023 when we were coming off a year of half a percent of EBIT profitability. Not a lot of profitability to speak of at the time, but told you that we saw a model that could grow to 21%-23% EBITDA margin on a non-GAAP basis. Well, in the first quarter of this year, we reported over 21% EBIT margin. We're along that target, and because the EBIT margin has been expanding, and also due to the fact of things like the cloud marketplace and customers paying multi-year deals up front with strong collections. We've also had strong cash generation and thus strong free cash flow margins due to the fact that profitability has been enhanced over the last few years as well. Yeah. Maybe final question, the NVIDIA Skills product, you guys were able to create that fairly quickly, and NVIDIA asked you to. How do you feel like that helps from a marketing sense and some of these strong partnerships and endorsements that you have in the ecosystem? Yeah. Well, I think that that's a key, right? Is I think that any one partnership shouldn't be looked at as the partnership. We've had partnerships with many companies, and I think if you look at the history of the company, if we had tied ourself to any one of those horses at one time, it might have looked like the right decision then, but down the road it might have not been. I think this universality is what really separates us and why our customers love us because we sit at that center that you want to choose what you plug in. You don't want to be told what you use and how you build your organization. The holistic nature of JFrog has been a competitive advantage for us in how we sit and can see holistically the entire software build and bring more value to you or as the organization from where we sit. Awesome. I think that does it. We're out of time, Jeff. Thanks very much for coming. Thank you, sir.

Speaker 2: Awesome. Great. Well, my name's Lucky Schreiner, software analyst here at D.A. Davidson. Really happy to have Jeffrey Schreiner with me, a long-lost cousin, I guess. Something of the sort. Really happy. JFrog's been a great story. A lot of momentum in the business. Security's an interesting kicker too as well. Maybe just to start though, for any new investors, how would you describe JFrog's core role in the software supply chain, and why is it becoming increasingly mission-critical today? Awesome. awesome Great. great Well, my name's Lucky Schreiner, software analyst here at D.A. well my name's lucky schreiner software analyst here at d.a Davidson. davidson Really happy to have Jeffrey Schreiner with me, a long-lost cousin, I guess. really happy to have jeffrey schreiner with me a long-lost cousin i guess Something of the sort. something of the sort Really happy. really happy JFrog's been a great story. jfrog's been a great story A lot of momentum in the business. a lot of momentum in the business Security's an interesting kicker too as well. security's an interesting kicker too as well Maybe just to start though, for any new investors, how would you describe JFrog's core role in the software supply chain, and why is it becoming increasingly mission-critical today? maybe just to start though for any new investors how would you describe jfrog's core role in the software supply chain and why is it becoming increasingly mission-critical today

Speaker 1: Well, first and foremost, thanks for having us, Lucky. We really appreciate the support and appreciate attending the conference today. I think in a general sense, when you think about JFrog, you should think about the word automation. That's what we've always done, is it for the software supply chain, we've been the aspect that you are trying to deliver speed and security at the same time, and that's been the crux for many who have tried to do what we do, is the ability to keep things in line, both speed and security, as you scale and add more support and more open-source languages into the architecture. What we are akin to is that in an organization, you are building code that has typically been done in the past with human developers generating source code. Well, first and foremost, thanks for having us, Lucky. well first and foremost thanks for having us lucky We really appreciate the support and appreciate attending the conference today. we really appreciate the support and appreciate attending the conference today I think in a general sense, when you think about JFrog, you should think about the word automation. i think in a general sense when you think about jfrog you should think about the word automation That's what we've always done, is it for the software supply chain, we've been the aspect that you are trying to deliver speed and security at the same time, and that's been the crux for many who have tried to do what we do, is the ability to keep things in line, both speed and security, as you scale and add more support and more open-source languages into the architecture. that's what we've always done is it for the software supply chain we've been the aspect that you are trying to deliver speed and security at the same time and that's been the crux for many who have tried to do what we do is the ability to keep things in line both speed and security as you scale and add more support and more open-source languages into the architecture What we are akin to is that in an organization, you are building code that has typically been done in the past with human developers generating source code. what we are akin to is that in an organization you are building code that has typically been done in the past with human developers generating source code That source code today has been written primarily in a language called Git. You might be familiar with the likes of a GitHub or a GitLab who are very successful in the source code business. They generate that source code, and then that source code is compiled, and maybe 10% or so of that source code is combined with packages or open-source software from outside the organization, and that creates a package or i.e., the binary, and that binary is then transported through governance gates and is then eventually handed off and deployed by the organization into production, where it's then managed by the observability and runtime players. That source code today has been written primarily in a language called Git. that source code today has been written primarily in a language called git You might be familiar with the likes of a GitHub or a GitLab who are very successful in the source code business. you might be familiar with the likes of a github or a gitlab who are very successful in the source code business They generate that source code, and then that source code is compiled, and maybe 10% or so of that source code is combined with packages or open-source software from outside the organization, and that creates a package or i.e., the binary, and that binary is then transported through governance gates and is then eventually handed off and deployed by the organization into production, where it's then managed by the observability and runtime players. they generate that source code and then that source code is compiled and maybe 10% or so of that source code is combined with packages or open-source software from outside the organization and that creates a package or i.e the binary and that binary is then transported through governance gates and is then eventually handed off and deployed by the organization into production where it's then managed by the observability and runtime players We sit in between kind of the source code and the runtime and provide governance to source code and provide data and visibility to the runtime organizations who may need to access the metadata that we have that is stored and held within binaries. We sit in between kind of the source code and the runtime and provide governance to source code and provide data and visibility to the runtime organizations who may need to access the metadata that we have that is stored and held within binaries. we sit in between kind of the source code and the runtime and provide governance to source code and provide data and visibility to the runtime organizations who may need to access the metadata that we have that is stored and held within binaries

Speaker 2: Awesome. I think we got to start with last quarter two. Very strong results. Everyone's asking about why cloud growth is accelerating. A lot of that's driven by overages. What are some of the dynamics there, and how should investors think about the sustainability of cloud growth moving forward? Awesome. awesome I think we got to start with last quarter two. i think we got to start with last quarter two Very strong results. very strong results Everyone's asking about why cloud growth is accelerating. everyone's asking about why cloud growth is accelerating A lot of that's driven by overages. a lot of that's driven by overages What are some of the dynamics there, and how should investors think about the sustainability of cloud growth moving forward? what are some of the dynamics there and how should investors think about the sustainability of cloud growth moving forward

Speaker 1: Yeah. Cloud's been strong. I think it was strong last year, and it was strong in the sense that I've been here almost five years at JFrog, and for the majority of that time, the monetization strategy within JFrog, inside of cloud, is that you can either migrate from self-hosted, where you're managing that type of deployment yourself, and then shifting it to the cloud. A lot of our growth, when I first started, that was the way in which we grew. Last year was unique in the way that it was the first year that we saw consumption the other way. I buy a data package from JFrog, and each time I access a binary, I'm utilizing some form of that consumption that I buy from JFrog. Yeah. yeah Cloud's been strong. cloud's been strong I think it was strong last year, and it was strong in the sense that I've been here almost five years at JFrog, and for the majority of that time, the monetization strategy within JFrog, inside of cloud, is that you can either migrate from self-hosted, where you're managing that type of deployment yourself, and then shifting it to the cloud. i think it was strong last year and it was strong in the sense that i've been here almost five years at jfrog and for the majority of that time the monetization strategy within jfrog inside of cloud is that you can either migrate from self-hosted where you're managing that type of deployment yourself and then shifting it to the cloud A lot of our growth, when I first started, that was the way in which we grew. a lot of our growth when i first started that was the way in which we grew Last year was unique in the way that it was the first year that we saw consumption the other way. last year was unique in the way that it was the first year that we saw consumption the other way I buy a data package from JFrog, and each time I access a binary, I'm utilizing some form of that consumption that I buy from JFrog. i buy a data package from jfrog and each time i access a binary i'm utilizing some form of that consumption that i buy from jfrog We saw the use of consumption really be the driver of what was driving cloud growth last year, and very much so in Q1. In Q1, we talked about the broad use of all packages, and thus created a very high level of cloud usage amongst our customers in the world of tokenization. What we saw is that we were able to outperform the expectations, the guidance level, by roughly around $7 million. We carried forward of the combined business only four and a half into the full year. We saw the use of consumption really be the driver of what was driving cloud growth last year, and very much so in Q1. we saw the use of consumption really be the driver of what was driving cloud growth last year and very much so in q1 In Q1, we talked about the broad use of all packages, and thus created a very high level of cloud usage amongst our customers in the world of tokenization. in q1 we talked about the broad use of all packages and thus created a very high level of cloud usage amongst our customers in the world of tokenization What we saw is that we were able to outperform the expectations, the guidance level, by roughly around $7 million. what we saw is that we were able to outperform the expectations the guidance level by roughly around $7 million We carried forward of the combined business only four and a half into the full year. we carried forward of the combined business only four and a half into the full year What we've tried to say to you is assume that that's the committed portion, security, other things that we've won and signed commitments to, versus the two and a half delta more or less being attributable to that penalty rate, that usage above the commitment rate that the customer has been running while they're running hot right now. I think that that is something that is happening because we still remain very much so in the world of experimentation and training the models. I'm telling the model to build this process. I don't like it, do it again. I don't like it, do it again. That's creating this activity. Eventually, I think we'll get to a portion when you talk about our cloud growth, where that activity will become more specialized, more production volume type levels. What we've tried to say to you is assume that that's the committed portion, security, other things that we've won and signed commitments to, versus the two and a half delta more or less being attributable to that penalty rate, that usage above the commitment rate that the customer has been running while they're running hot right now. what we've tried to say to you is assume that that's the committed portion security other things that we've won and signed commitments to versus the two and a half delta more or less being attributable to that penalty rate that usage above the commitment rate that the customer has been running while they're running hot right now I think that that is something that is happening because we still remain very much so in the world of experimentation and training the models. i think that that is something that is happening because we still remain very much so in the world of experimentation and training the models I'm telling the model to build this process. i'm telling the model to build this process I don't like it, do it again. i don't like it do it again I don't like it, do it again. i don't like it do it again That's creating this activity. that's creating this activity Eventually, I think we'll get to a portion when you talk about our cloud growth, where that activity will become more specialized, more production volume type levels. eventually i think we'll get to a portion when you talk about our cloud growth where that activity will become more specialized more production volume type levels When the model starts determining that I don't need to use source code, I want to make binaries because that's what I'm starting to produce, these production-level binaries, whether it be from source code, human, agent, what have you, will be inherently more valuable than the binary activity we're seeing today because those will be assets deployed valuable to the company. They will need to be updated, which causes builds, secured, which causes the buys for security, stored, which is part of your consumption, and maintained. I think there's still a lot of activity as it relates to production binaries that we haven't seen the full effect of yet. When the model starts determining that I don't need to use source code, I want to make binaries because that's what I'm starting to produce, these production-level binaries, whether it be from source code, human, agent, what have you, will be inherently more valuable than the binary activity we're seeing today because those will be assets deployed valuable to the company. when the model starts determining that i don't need to use source code i want to make binaries because that's what i'm starting to produce these production-level binaries whether it be from source code human agent what have you will be inherently more valuable than the binary activity we're seeing today because those will be assets deployed valuable to the company They will need to be updated, which causes builds, secured, which causes the buys for security, stored, which is part of your consumption, and maintained. they will need to be updated which causes builds secured which causes the buys for security stored which is part of your consumption and maintained I think there's still a lot of activity as it relates to production binaries that we haven't seen the full effect of yet. i think there's still a lot of activity as it relates to production binaries that we haven't seen the full effect of yet

Speaker 2: Yeah. On that note, how do you see the model usage evolving with customers today? Do you think the models they use will keep getting bigger and bigger, or will they become more specialized, and how might that impact JFrog? Yeah. yeah On that note, how do you see the model usage evolving with customers today? on that note how do you see the model usage evolving with customers today Do you think the models they use will keep getting bigger and bigger, or will they become more specialized, and how might that impact JFrog? do you think the models they use will keep getting bigger and bigger or will they become more specialized and how might that impact jfrog

Speaker 1: That's a very timely and good question, Lucky, because as it relates to JFrog, I'm hearing it from others in my conversations when they speak to other organizations, one way that we're looking to manage token spend in this world of token maxing, as you guys have defined it, is to utilize very specialized models. We use Opus a lot. That's probably the highest usage model that we have today. We use Sonnet, we use other smaller models that we are finding can do certain tasks very well, and I think that that is how other organizations are doing that. That brings up a unique aspect that then brings favor back to us at JFrog, in the fact that if I'm using four disparate models to complete one build, I'm going to have to inevitably bring back the four models to one point. Where is that point? That's a very timely and good question, Lucky, because as it relates to JFrog, I'm hearing it from others in my conversations when they speak to other organizations, one way that we're looking to manage token spend in this world of token maxing, as you guys have defined it, is to utilize very specialized models. that's a very timely and good question lucky because as it relates to jfrog i'm hearing it from others in my conversations when they speak to other organizations one way that we're looking to manage token spend in this world of token maxing as you guys have defined it is to utilize very specialized models We use Opus a lot. we use opus a lot That's probably the highest usage model that we have today. that's probably the highest usage model that we have today We use Sonnet, we use other smaller models that we are finding can do certain tasks very well, and I think that that is how other organizations are doing that. we use sonnet, we use other smaller models that we are finding can do certain tasks very well, and i think that that is how other organizations are doing that That brings up a unique aspect that then brings favor back to us at JFrog, in the fact that if I'm using four disparate models to complete one build, I'm going to have to inevitably bring back the four models to one point. that brings up a unique aspect that then brings favor back to us at jfrog in the fact that if i'm using four disparate models to complete one build i'm going to have to inevitably bring back the four models to one point Where is that point? where is that point That point is the system of record, i.e. JFrog. That point is the system of record, i.e. that point is the system of record i.e JFrog. jfrog

Speaker 2: Yeah. I wanted to touch on, too, the rise of different coding languages as agents use all kinds of coding languages. How does that impact your differentiation, especially today? Yeah. yeah I wanted to touch on, too, the rise of different coding languages as agents use all kinds of coding languages. i wanted to touch on too the rise of different coding languages as agents use all kinds of coding languages How does that impact your differentiation, especially today? how does that impact your differentiation especially today

Speaker 1: It's magnified something that was always there, Lucky. You know this in talking to me that I've talked about scalability as inherent value, that why we win. I think I define things kind of now in the software world, two years ago, and the AI world now, right? In the software world, the scalability was always there and inherent. We had a competitor who started essentially as the same year as JFrog did, but has been stuck at being able to reach a certain level of only about 15 languages that they can support during this entire path. I t's magnified something that was always there, Lucky. i t's magnified something that was always there lucky You know this in talking to me that I've talked about scalability as inherent value, that why we win. you know this in talking to me that i've talked about scalability as inherent value that why we win I think I define things kind of now in the software world, two years ago, and the AI world now, right? i think i define things kind of now in the software world two years ago and the ai world now right In the software world, the scalability was always there and inherent. We had a competitor who started essentially as the same year as JFrog did, but has been stuck at being able to reach a certain level of only about 15 languages that they can support during this entire path. in the software world the scalability was always there and inherent. we had a competitor who started essentially as the same year as jfrog did but has been stuck at being able to reach a certain level of only about 15 languages that they can support during this entire path We've scaled up to 36 languages, that scalability is now very evident in the world of AI because what we have learned in 2026 is that it is no longer that you can feel like you did in the software world, that I program in these four primary languages. They're widely used, so I can use something that isn't all that JFrog offers. It's very sophisticated. I can use this good enough solution. Unfortunately, we found in the world of AI, that will lead to you being penetrated. Because while you may not say you program in a certain language, the model inherently is looking to be efficient. It is going to say, I am building X. The most efficient package for X is Y. Just because you don't program in it, doesn't mean it won't go get Y, and now you've been penetrated. We've scaled up to 36 languages, that scalability is now very evident in the world of AI because what we have learned in 2026 is that it is no longer that you can feel like you did in the software world, that I program in these four primary languages. we've scaled up to 36 languages that scalability is now very evident in the world of ai because what we have learned in 2026 is that it is no longer that you can feel like you did in the software world that i program in these four primary languages They're widely used, so I can use something that isn't all that JFrog offers. they're widely used so i can use something that isn't all that jfrog offers It's very sophisticated. it's very sophisticated I can use this good enough solution. i can use this good enough solution Unfortunately, we found in the world of AI, that will lead to you being penetrated. unfortunately we found in the world of ai that will lead to you being penetrated Because while you may not say you program in a certain language, the model inherently is looking to be efficient. because while you may not say you program in a certain language the model inherently is looking to be efficient It is going to say, I am building X. it is going to say i am building x The most efficient package for X is Y. the most efficient package for x is y Just because you don't program in it, doesn't mean it won't go get Y, and now you've been penetrated. just because you don't program in it doesn't mean it won't go get y and now you've been penetrated In the world of AI, our ability to scale and scale with AI is becoming a big differentiator for us, as binaries are now becoming much more of the asset of focus. I n the world of AI, our ability to scale and scale with AI is becoming a big differentiator for us, as binaries are now becoming much more of the asset of focus. i n the world of ai our ability to scale and scale with ai is becoming a big differentiator for us as binaries are now becoming much more of the asset of focus

Speaker 2: Yeah. I feel like that naturally brings up security. Yeah. yeah I feel like that naturally brings up security. i feel like that naturally brings up security You guys had in your State of the Union report, malicious NPM packages grew by over 400% in 2025. Feels like that trend is continuing in 2026. That tends to create a catalyst for Curation adoption with you guys, and would you expect that to remain a long-term secular tailwind for you? You guys had in your State of the Union report, malicious NPM packages grew by over 400% in 2025. you guys had in your state of the union report malicious npm packages grew by over 400% in 2025 Feels like that trend is continuing in 2026. feels like that trend is continuing in 2026 That tends to create a catalyst for Curation adoption with you guys, and would you expect that to remain a long-term secular tailwind for you? that tends to create a catalyst for curation adoption with you guys and would you expect that to remain a long-term secular tailwind for you

Speaker 1: Very good question. I think it's changed relative to maybe if you'd asked this question four years ago, I think you would be going down the right path, that it used to be that we would have an event like Log4j. That was the last major software supply chain attack. Enterprises would rush and spend to patch and fix, and then there would be a lull, and two years, three years would pass, and then maybe another software supply chain. Now it's happening daily, if not multiple times a day. They're all happening at the binary level. Thus, I think that people are starting to realize that a product like Curation, which is essentially a firewall for your software development organization. Very good question. very good question I think it's changed relative to maybe if you'd asked this question four years ago, I think you would be going down the right path, that it used to be that we would have an event like Log4j. i think it's changed relative to maybe if you'd asked this question four years ago i think you would be going down the right path that it used to be that we would have an event like log4j That was the last major software supply chain attack. that was the last major software supply chain attack Enterprises would rush and spend to patch and fix, and then there would be a lull, and two years, three years would pass, and then maybe another software supply chain. enterprises would rush and spend to patch and fix and then there would be a lull and two years three years would pass and then maybe another software supply chain Now it's happening daily, if not multiple times a day. now it's happening daily if not multiple times a day They're all happening at the binary level. they're all happening at the binary level Thus, I think that people are starting to realize that a product like Curation, which is essentially a firewall for your software development organization. thus i think that people are starting to realize that a product like curation which is essentially a firewall for your software development organization It sits outside the developer IDE station, and it curates various repositories and packages that you, as the central CISO or policymaker, have designated okay to utilize in your organization. I think the pipeline has remained very strong because the attacks continue to be in your face as a CISO, and it's something that you are now having to take note of. It's also becoming more important because there was an alternative you might've been looking at or looking to evaluate for Curation that had told you that if you only utilize a few packages, utilize this, you're better off. You now don't have that as an alternative, and people realize that, and I think it's just continued to fuel the demand and keep the pipeline strong for our sales team. It sits outside the developer IDE station, and it curates various repositories and packages that you, as the central CISO or policymaker, have designated okay to utilize in your organization. it sits outside the developer ide station and it curates various repositories and packages that you as the central ciso or policymaker have designated okay to utilize in your organization I think the pipeline has remained very strong because the attacks continue to be in your face as a CISO, and it's something that you are now having to take note of. i think the pipeline has remained very strong because the attacks continue to be in your face as a ciso and it's something that you are now having to take note of It's also becoming more important because there was an alternative you might've been looking at or looking to evaluate for Curation that had told you that if you only utilize a few packages, utilize this, you're better off. it's also becoming more important because there was an alternative you might've been looking at or looking to evaluate for curation that had told you that if you only utilize a few packages utilize this you're better off You now don't have that as an alternative, and people realize that, and I think it's just continued to fuel the demand and keep the pipeline strong for our sales team. you now don't have that as an alternative and people realize that and i think it's just continued to fuel the demand and keep the pipeline strong for our sales team

Speaker 2: Yeah. As the attack surface shifts upstream, how would you say your security conversations are trending from a budget perspective, and maybe compare and contrast the demand between JFrog Advanced Security and Curation? Yeah. yeah As the attack surface shifts upstream, how would you say your security conversations are trending from a budget perspective, and maybe compare and contrast the demand between JFrog Advanced Security and Curation? as the attack surface shifts upstream how would you say your security conversations are trending from a budget perspective and maybe compare and contrast the demand between jfrog advanced security and curation

Speaker 1: Yeah. A very good question. I think that, let's start with the second part first. Curation and JFrog Advanced Security. We've been quite open in the fact that we said, before the first Log4Shell event in Q3 of last year, the pipeline and the deployment was probably roughly 50/50, both Curation and JFrog Advanced Security. Since then, it's obviously skewed very heavy to Curation because industries are obviously seeing the need to have somewhat of a firewall type security out there protecting you, and those that had it in Log4Shell can tell you what it did for them in protecting their organization when the first Log4Shell attack happened, and the packages that were being blocked that you referenced in our State of the Union Artifactory report went up exponentially, right? That protected those organizations. Yeah. yeah A very good question. a very good question I think that, let's start with the second part first. i think that let's start with the second part first Curation and JFrog Advanced Security. curation and jfrog advanced security We've been quite open in the fact that we said, before the first Log4Shell event in Q3 of last year, the pipeline and the deployment was probably roughly 50/50, both Curation and JFrog Advanced Security. we've been quite open in the fact that we said before the first log4shell event in q3 of last year the pipeline and the deployment was probably roughly 50/50 both curation and jfrog advanced security Since then, it's obviously skewed very heavy to Curation because industries are obviously seeing the need to have somewhat of a firewall type security out there protecting you, and those that had it in Log4Shell can tell you what it did for them in protecting their organization when the first Log4Shell attack happened, and the packages that were being blocked that you referenced in our State of the Union Artifactory report went up exponentially, right? since then it's obviously skewed very heavy to curation because industries are obviously seeing the need to have somewhat of a firewall type security out there protecting you and those that had it in log4shell can tell you what it did for them in protecting their organization when the first log4shell attack happened and the packages that were being blocked that you referenced in our state of the union artifactory report went up exponentially right That protected those organizations. that protected those organizations Other organizations, think of it if you're a CISO who has now been given software supply chain, and that's now in your wheelhouse, but you've never dealt with it before. You've dealt with networking firewall security. You understand the concept there. A firewall-like product then for Curation, to your point, seems very likely to have to basically stop the inflow of what I will allow from a central location, then tell the organization, I don't want to interrupt your productivity. Be very productive and creative, but just do so with the products you have today in Curation. Thus, it's become very popular, and our CTO snaps at Ed and I sometimes saying that, you speak a lot about Curation to the investment community as security, but it's actually governance, if they don't see it yet, they will. Other organizations, think of it if you're a CISO who has now been given software supply chain, and that's now in your wheelhouse, but you've never dealt with it before. other organizations think of it if you're a ciso who has now been given software supply chain and that's now in your wheelhouse but you've never dealt with it before You've dealt with networking firewall security. you've dealt with networking firewall security You understand the concept there. you understand the concept there A firewall-like product then for Curation, to your point, seems very likely to have to basically stop the inflow of what I will allow from a central location, then tell the organization, I don't want to interrupt your productivity. a firewall-like product then for curation to your point seems very likely to have to basically stop the inflow of what i will allow from a central location then tell the organization i don't want to interrupt your productivity Be very productive and creative, but just do so with the products you have today in Curation. be very productive and creative but just do so with the products you have today in curation Thus, it's become very popular, and our CTO snaps at Ed and I sometimes saying that, you speak a lot about Curation to the investment community as security, but it's actually governance, if they don't see it yet, they will. thus it's become very popular and our cto snaps at ed and i sometimes saying that you speak a lot about curation to the investment community as security but it's actually governance if they don't see it yet they will What I would say to you is that some mind you may be seeing from maybe some of the smarter organizations could in fact be those looking to purchase Curation not only for security, but for the governance aspect of it down the road. We equate Curation to more of a caffeine-like high, right? It sits outside your developer organization. You'll want to put as many contributing developers, those who interface with Artifactory, behind that right away. What I would say to you is that some mind you may be seeing from maybe some of the smarter organizations could in fact be those looking to purchase Curation not only for security, but for the governance aspect of it down the road. what i would say to you is that some mind you may be seeing from maybe some of the smarter organizations could in fact be those looking to purchase curation not only for security but for the governance aspect of it down the road We equate Curation to more of a caffeine-like high, right? we equate curation to more of a caffeine-like high right It sits outside your developer organization. it sits outside your developer organization You'll want to put as many contributing developers, those who interface with Artifactory, behind that right away. you'll want to put as many contributing developers those who interface with artifactory behind that right away It's a seat sale, just like security is, so the number of developers. Quickly, you can get a high level of developer seats right away with Curation. Advanced Security, on the other hand, is for good actors gone bad inside the castle. With that, I'm taking a tool. I have seven disparate point solutions. I want to consolidate all of them into the JFrog Advanced Security platform. I do so in year one with one solution. I run it in parallel for 9 to 12 months. I replace it. I get to year two. I'm running one tool. Now I'm doing another one or two for replacement. We'll have to see over a multi-year timeframe if some of these customers even replace all seven or eight in their first three-year, multi-year agreement. It's a seat sale, just like security is, so the number of developers. it's a seat sale just like security is so the number of developers Quickly, you can get a high level of developer seats right away with Curation. quickly you can get a high level of developer seats right away with curation Advanced Security, on the other hand, is for good actors gone bad inside the castle. advanced security on the other hand is for good actors gone bad inside the castle With that, I'm taking a tool. with that i'm taking a tool I have seven disparate point solutions. i have seven disparate point solutions I want to consolidate all of them into the JFrog Advanced Security platform. i want to consolidate all of them into the jfrog advanced security platform I do so in year one with one solution. i do so in year one with one solution I run it in parallel for 9 to 12 months. i run it in parallel for 9 to 12 months I replace it. i replace it I get to year two. i get to year two I'm running one tool. i'm running one tool Now I'm doing another one or two for replacement. now i'm doing another one or two for replacement We'll have to see over a multi-year timeframe if some of these customers even replace all seven or eight in their first three-year, multi-year agreement. we'll have to see over a multi-year timeframe if some of these customers even replace all seven or eight in their first three-year multi-year agreement A much longer tail aspect where it's just the early innings of this consolidation trend playing out for Advanced Security. A much longer tail aspect where it's just the early innings of this consolidation trend playing out for Advanced Security. a much longer tail aspect where it's just the early innings of this consolidation trend playing out for advanced security

Speaker 2: Yeah. You brought up governance, I want to shift to that. You guys released at JFrog swampUP last year AppTrust and AI Catalog. Those were exciting and received well. How would you characterize that opportunity for investors and maybe any timeline for when that might start to become more significant? Yeah. yeah You brought up governance, I want to shift to that. you brought up governance i want to shift to that You guys released at JFrog swampUP last year AppTrust and AI Catalog. you guys released at jfrog swampup last year apptrust and ai catalog Those were exciting and received well. those were exciting and received well How would you characterize that opportunity for investors and maybe any timeline for when that might start to become more significant? how would you characterize that opportunity for investors and maybe any timeline for when that might start to become more significant

Speaker 1: I would say that for all the investors listening out there, that's where you want to start shifting your focus. If you talk to our customers, they will tell you a lot of the same things that you'll hear coming out of my mouth. That is the fact that right now today, I'm very much concerned with make AI work. I'm not so worried about the cost, things of this nature. Once AI is working, I'm going to be very concerned with governing AI. You referenced AppTrust and AI Catalog. Those, along with Curation, along with things that we've now added, such as MCP Registry and Skills Registry, which is scalability on the revenue side, adding new revenue opportunities in Artifactory without any real investment, will be part of our governance bundle. I would say that for all the investors listening out there, that's where you want to start shifting your focus. i would say that for all the investors listening out there that's where you want to start shifting your focus If you talk to our customers, they will tell you a lot of the same things that you'll hear coming out of my mouth. if you talk to our customers they will tell you a lot of the same things that you'll hear coming out of my mouth That is the fact that right now today, I'm very much concerned with make AI work. that is the fact that right now today i'm very much concerned with make ai work I'm not so worried about the cost, things of this nature. i'm not so worried about the cost things of this nature Once AI is working, I'm going to be very concerned with governing AI. once ai is working i'm going to be very concerned with governing ai You referenced AppTrust and AI Catalog. you referenced apptrust and ai catalog Those, along with Curation, along with things that we've now added, such as MCP Registry and Skills Registry, which is scalability on the revenue side, adding new revenue opportunities in Artifactory without any real investment, will be part of our governance bundle. those along with curation along with things that we've now added such as mcp registry and skills registry which is scalability on the revenue side adding new revenue opportunities in artifactory without any real investment will be part of our governance bundle The team is meeting in an offsite this week to start our initial thoughts for 2027, and certainly, I think governance is going to be a topic du jour about how we will bring this to bear and the monetization strategy that we will use. We've seen a high degree of interest in AppTrust, AI Catalog. I think AppTrust is still being worked with customers in developing that product and bringing that product to bear so it's ready for primetime when we really have it as part of the full governance platform. AI Catalog has been doing quite well and seen a lot of interest. The team is meeting in an offsite this week to start our initial thoughts for 2027, and certainly, I think governance is going to be a topic du jour about how we will bring this to bear and the monetization strategy that we will use. the team is meeting in an offsite this week to start our initial thoughts for 2027 and certainly i think governance is going to be a topic du jour about how we will bring this to bear and the monetization strategy that we will use We've seen a high degree of interest in AppTrust, AI Catalog. we've seen a high degree of interest in apptrust ai catalog I think AppTrust is still being worked with customers in developing that product and bringing that product to bear so it's ready for primetime when we really have it as part of the full governance platform. i think apptrust is still being worked with customers in developing that product and bringing that product to bear so it's ready for primetime when we really have it as part of the full governance platform AI Catalog has been doing quite well and seen a lot of interest. ai catalog has been doing quite well and seen a lot of interest I would even tell you this, Lucky, that the MCP Registry and Skills Registry, while not a driver today, we've been seeing successful POCs close down in several weeks for this product, with people saying, yes, it does what it does, and it does it well, and we'd like to move forward. I think it shows you that the governance Lego, as we like to call our Lego strategy, with Artifactory being kind of your base Lego. Now you add security on for more value. You add governance on for more value. This is what continues to make us very strategic within the enterprise. We think that governance is the key. Why is that? I would even tell you this, Lucky, that the MCP Registry and Skills Registry, while not a driver today, we've been seeing successful POCs close down in several weeks for this product, with people saying, yes, it does what it does, and it does it well, and we'd like to move forward. i would even tell you this lucky that the mcp registry and skills registry while not a driver today we've been seeing successful pocs close down in several weeks for this product with people saying yes it does what it does and it does it well and we'd like to move forward I think it shows you that the governance Lego, as we like to call our Lego strategy, with Artifactory being kind of your base Lego. i think it shows you that the governance lego as we like to call our lego strategy with artifactory being kind of your base lego Now you add security on for more value. now you add security on for more value You add governance on for more value. you add governance on for more value This is what continues to make us very strategic within the enterprise. this is what continues to make us very strategic within the enterprise We think that governance is the key. we think that governance is the key Why is that? why is that Because as I was going, in another answer, kind of alluding to, the machines are going to learn that they are only using source code because they have to speak with us humans, and they don't really need source code. What do they really want? They want to produce binaries because that's what's going to be inevitably put into production. Even in that scenario, when a model is building at the binary level, governance will be critical because the creators and the governors will always be separate in the organization. Because as I was going, in another answer, kind of alluding to, the machines are going to learn that they are only using source code because they have to speak with us humans, and they don't really need source code. because as i was going in another answer kind of alluding to the machines are going to learn that they are only using source code because they have to speak with us humans and they don't really need source code What do they really want? what do they really want They want to produce binaries because that's what's going to be inevitably put into production. they want to produce binaries because that's what's going to be inevitably put into production Even in that scenario, when a model is building at the binary level, governance will be critical because the creators and the governors will always be separate in the organization. even in that scenario when a model is building at the binary level governance will be critical because the creators and the governors will always be separate in the organization

Speaker 2: I want to tie this to your go-to-market and talk about net new logos. I want to tie this to your go-to-market and talk about net new logos. i want to tie this to your go-to-market and talk about net new logos You guys have historically shifted to targeting the largest enterprises. You guys have historically shifted to targeting the largest enterprises. you guys have historically shifted to targeting the largest enterprises On the flip side, I think what you're alluding to, a lot of enterprises are reaching a certain scale where they have to adopt JFrog moving forward. Maybe how do you think about net new logo growth moving forward with all this new product? On the flip side, I think what you're alluding to, a lot of enterprises are reaching a certain scale where they have to adopt JFrog moving forward. on the flip side i think what you're alluding to a lot of enterprises are reaching a certain scale where they have to adopt jfrog moving forward Maybe how do you think about net new logo growth moving forward with all this new product? maybe how do you think about net new logo growth moving forward with all this new product

Speaker 1: It's a focus, and we've got a new CMO in Genefa Murphy, and I think she's definitely got that as one of her tasks in which she's trying to help drive logo count. I would always say that we can always drive logo count. It's a focus, and we've got a new CMO in Genefa Murphy, and I think she's definitely got that as one of her tasks in which she's trying to help drive logo count. it's a focus and we've got a new cmo in genefa murphy and i think she's definitely got that as one of her tasks in which she's trying to help drive logo count I would always say that we can always drive logo count. i would always say that we can always drive logo count

Speaker 2: Yeah. Yeah. yeah

Speaker 1: That it's quality logo count that you're after. I think what you're seeing from us is that the last two years we've been going through kind of this year's theme for JFrog, ironically, is a rebirth. It's rebirth in the sense that some of the logos that had fallen off were logos that were in our lower price subscription tiers, had never really grown, liked JFrog, but were never really intent on upscaling their subscription or utilizing more JFrog. Were sitting at subscription layers that just weren't going to lead to that land and expand type of customer we've shown you in the slide deck. I think that we've seen a roll-off of a customer that came to JFrog four or five years ago when I joined, when we were selling you Artifactory as a product, hoping that Jeff's organization takes Artifactory. T hat it's quality logo count that you're after. t hat it's quality logo count that you're after I think what you're seeing from us is that the last two years we've been going through kind of this year's theme for JFrog, ironically, is a rebirth. i think what you're seeing from us is that the last two years we've been going through kind of this year's theme for jfrog ironically is a rebirth It's rebirth in the sense that some of the logos that had fallen off were logos that were in our lower price subscription tiers, had never really grown, liked JFrog, but were never really intent on upscaling their subscription or utilizing more JFrog. it's rebirth in the sense that some of the logos that had fallen off were logos that were in our lower price subscription tiers had never really grown liked jfrog but were never really intent on upscaling their subscription or utilizing more jfrog Were sitting at subscription layers that just weren't going to lead to that land and expand type of customer we've shown you in the slide deck. were sitting at subscription layers that just weren't going to lead to that land and expand type of customer we've shown you in the slide deck I think that we've seen a roll-off of a customer that came to JFrog four or five years ago when I joined, when we were selling you Artifactory as a product, hoping that Jeff's organization takes Artifactory. i think that we've seen a roll-off of a customer that came to jfrog four or five years ago when i joined when we were selling you artifactory as a product hoping that jeff's organization takes artifactory He's successful, he's productive. Lucky sees it. He wants to bring it into his organization. It was more product driven, bottoms up from the developer. Circa today, we're being sold top-down. It's strategically placed inside the enterprise that the developer's told what they will use, JFrog has become a strategic partner. I think that's what you've seen in terms of logo as it relates to count. I would tell you that the ASP is up materially in the five years that I've been here from a new cloud land to what we see today. That's just because I have customers now landing in the platform, and if you land on the basic version of Enterprise+ in the cloud, you're going to already be in that 100,000 cohort just with that. He's successful, he's productive. he's successful he's productive Lucky sees it. lucky sees it He wants to bring it into his organization. he wants to bring it into his organization It was more product driven, bottoms up from the developer. it was more product driven bottoms up from the developer Circa today, we're being sold top-down. circa today we're being sold top-down It's strategically placed inside the enterprise that the developer's told what they will use, JFrog has become a strategic partner. it's strategically placed inside the enterprise that the developer's told what they will use jfrog has become a strategic partner I think that's what you've seen in terms of logo as it relates to count. i think that's what you've seen in terms of logo as it relates to count I would tell you that the ASP is up materially in the five years that I've been here from a new cloud land to what we see today. i would tell you that the asp is up materially in the five years that i've been here from a new cloud land to what we see today That's just because I have customers now landing in the platform, and if you land on the basic version of Enterprise+ in the cloud, you're going to already be in that 100,000 cohort just with that. that's just because i have customers now landing in the platform and if you land on the basic version of enterprise+ in the cloud you're going to already be in that 100,000 cohort just with that That's the difference that is what's happening, is that the logos are not maybe accelerating in terms of a high number, the contribution per logo is certainly growing, and certainly for new logos, it's growing. T hat's the difference that is what's happening, is that the logos are not maybe accelerating in terms of a high number, the contribution per logo is certainly growing, and certainly for new logos, it's growing. t hat's the difference that is what's happening is that the logos are not maybe accelerating in terms of a high number the contribution per logo is certainly growing and certainly for new logos it's growing

Speaker 2: Yeah. I want to talk about some of those high-quality lands, specifically the AI natives. You guys have three out of the five. Maybe first, level set, how do you define an AI native? There's a lot of definitions out there. Two, I think most investors would assume they would build a solution like this internally. What was the catalyst on their end for adopting you guys? Yeah. yeah I want to talk about some of those high-quality lands, specifically the AI natives. i want to talk about some of those high-quality lands specifically the ai natives You guys have three out of the five. you guys have three out of the five Maybe first, level set, how do you define an AI native? maybe first level set how do you define an ai native There's a lot of definitions out there. there's a lot of definitions out there Two, I think most investors would assume they would build a solution like this internally. two i think most investors would assume they would build a solution like this internally What was the catalyst on their end for adopting you guys? what was the catalyst on their end for adopting you guys

Speaker 1: Yeah. Look, I say there's probably seven, you can interchange the last three for every person, depending on what they view as the models. When we talk about the frontier models, I think you can be safe to assume that we're talking about many of the models that we are all using or all hearing about in the news today, some of the major model companies out there. While there have been talk by many, and I think that that was a concern earlier this year, that perhaps inevitably these things are so large that they will encompass and take over so much in software and even binaries. Yeah. yeah Look, I say there's probably seven, you can interchange the last three for every person, depending on what they view as the models. look i say there's probably seven you can interchange the last three for every person depending on what they view as the models When we talk about the frontier models, I think you can be safe to assume that we're talking about many of the models that we are all using or all hearing about in the news today, some of the major model companies out there. when we talk about the frontier models i think you can be safe to assume that we're talking about many of the models that we are all using or all hearing about in the news today some of the major model companies out there While there have been talk by many, and I think that that was a concern earlier this year, that perhaps inevitably these things are so large that they will encompass and take over so much in software and even binaries. while there have been talk by many and i think that that was a concern earlier this year that perhaps inevitably these things are so large that they will encompass and take over so much in software and even binaries What we learned is that there was one that tried to do just that, and that was one of our first frontier model customers who had tried to build JFrog on their own without benevolence to JFrog, and failed at doing so for that very key word I have said many times today, scalability, thus came to JFrog and began working in tandem with us. Now they are also one that has us on a moonshot-like project, which would lead to the management in a model as a package type of business architect that you would have at almost line rate speed, thousands of large language models being trained, secured, stored, transferred, all of this information being transferred to and maintained from Artifactory. What we learned is that there was one that tried to do just that, and that was one of our first frontier model customers who had tried to build JFrog on their own without benevolence to JFrog, and failed at doing so for that very key word I have said many times today, scalability, thus came to JFrog and began working in tandem with us. what we learned is that there was one that tried to do just that and that was one of our first frontier model customers who had tried to build jfrog on their own without benevolence to jfrog and failed at doing so for that very key word i have said many times today scalability thus came to jfrog and began working in tandem with us Now they are also one that has us on a moonshot-like project, which would lead to the management in a model as a package type of business architect that you would have at almost line rate speed, thousands of large language models being trained, secured, stored, transferred, all of this information being transferred to and maintained from Artifactory. now they are also one that has us on a moonshot-like project which would lead to the management in a model as a package type of business architect that you would have at almost line rate speed thousands of large language models being trained secured stored transferred all of this information being transferred to and maintained from artifactory The unique aspect of the way AI looks at Artifactory and the system of record has changed dramatically the way the intelligent people inside JFrog look at Artifactory versus maybe the restrictions of the software world before. I think if anything, what investors should take away is that there has been a significant intangible benefit to working with these guys and becoming very close with the frontier models and where they want to go, and solving the pain points on the binary aspect of getting there. The unique aspect of the way AI looks at Artifactory and the system of record has changed dramatically the way the intelligent people inside JFrog look at Artifactory versus maybe the restrictions of the software world before. the unique aspect of the way ai looks at artifactory and the system of record has changed dramatically the way the intelligent people inside jfrog look at artifactory versus maybe the restrictions of the software world before I think if anything, what investors should take away is that there has been a significant intangible benefit to working with these guys and becoming very close with the frontier models and where they want to go, and solving the pain points on the binary aspect of getting there. i think if anything what investors should take away is that there has been a significant intangible benefit to working with these guys and becoming very close with the frontier models and where they want to go and solving the pain points on the binary aspect of getting there

Speaker 2: Yeah. On that front, how do you target these companies moving forward? Does the go-to-market look different? Maybe in terms of the deployment, any nuances between cloud versus self-managed? Yeah. yeah On that front, how do you target these companies moving forward? on that front how do you target these companies moving forward Does the go-to-market look different? does the go-to-market look different Maybe in terms of the deployment, any nuances between cloud versus self-managed? maybe in terms of the deployment any nuances between cloud versus self-managed

Speaker 1: Well, let us start with the second first, because the three we have today, as of the March quarter, have all chosen to go self-hosted initially. I do not think that precludes them from becoming hybrid at some point and moving to private or public cloud, what have you. Well, let us start with the second first, because the three we have today, as of the March quarter, have all chosen to go self-hosted initially. well let us start with the second first because the three we have today as of the march quarter have all chosen to go self-hosted initially I do not think that precludes them from becoming hybrid at some point and moving to private or public cloud, what have you. i do not think that precludes them from becoming hybrid at some point and moving to private or public cloud what have you A fourth model that we hope to sign during the second quarter, nothing is ever official until it happens, but to the extent that it does happen, the uniqueness that we have been trying to communicate to you guys, because we will not be issuing a press release, we cannot talk about these types of companies, but the uniqueness is that this particular one would like to engage with JFrog on a hybrid basis, which would bring cloud into the frontier model contribution, not just self-hosted in terms of how they are doing it. That is how the major models today have chosen. A fourth model that we hope to sign during the second quarter, nothing is ever official until it happens, but to the extent that it does happen, the uniqueness that we have been trying to communicate to you guys, because we will not be issuing a press release, we cannot talk about these types of companies, but the uniqueness is that this particular one would like to engage with JFrog on a hybrid basis, which would bring cloud into the frontier model contribution, not just self-hosted in terms of how they are doing it. a fourth model that we hope to sign during the second quarter nothing is ever official until it happens but to the extent that it does happen the uniqueness that we have been trying to communicate to you guys because we will not be issuing a press release we cannot talk about these types of companies but the uniqueness is that this particular one would like to engage with jfrog on a hybrid basis which would bring cloud into the frontier model contribution not just self-hosted in terms of how they are doing it That is how the major models today have chosen. that is how the major models today have chosen You had a group that says self-hosted is the right route, and what gets back to management myself from the sales team is as simple as, I have something special I don't want to share with the public cloud yet. Okay, understood. You can understand from one, the one that's working on the moonshot, why they want to get to building the data center, because that's inevitably where they're trying to go. Right? I think that each one of them, and I do it akin to the buy side when I have these events at conferences, right, that they all are asking the same question. They're asking it a different way, all trying to get to the same answer. Right? You had a group that says self-hosted is the right route, and what gets back to management myself from the sales team is as simple as, I have something special I don't want to share with the public cloud yet. you had a group that says self-hosted is the right route and what gets back to management myself from the sales team is as simple as i have something special i don't want to share with the public cloud yet Okay, understood. okay understood You can understand from one, the one that's working on the moonshot, why they want to get to building the data center, because that's inevitably where they're trying to go. you can understand from one the one that's working on the moonshot why they want to get to building the data center because that's inevitably where they're trying to go Right? right I think that each one of them, and I do it akin to the buy side when I have these events at conferences, right, that they all are asking the same question. i think that each one of them and i do it akin to the buy side when i have these events at conferences right that they all are asking the same question They're asking it a different way, all trying to get to the same answer. they're asking it a different way all trying to get to the same answer Right? right It's just a matter of preference for the model guys of trying to get to the same, solve the same problem, but we may do it different ways. I t's just a matter of preference for the model guys of trying to get to the same, solve the same problem, but we may do it different ways. i t's just a matter of preference for the model guys of trying to get to the same solve the same problem but we may do it different ways

Speaker 2: Yeah. I think shifting gears just a touch, going back to the overages in the cloud, how has customers' willingness to commit to multi-year deals maybe changed today? What are customers telling you, and how are they approaching it? Yeah. yeah I think shifting gears just a touch, going back to the overages in the cloud, how has customers' willingness to commit to multi-year deals maybe changed today? i think shifting gears just a touch going back to the overages in the cloud how has customers' willingness to commit to multi-year deals maybe changed today What are customers telling you, and how are they approaching it? what are customers telling you and how are they approaching it

Speaker 1: It's changed quite dramatically, and I would say that's just over 12 months. A year ago, we were going through the same thing in essence, in that we had strong usage in Q1. Agents were just starting to be introduced to the enterprise. We saw this tick up in usage in Q1 last year, and it was still very much the behavior of the historical trend of that was more of an oopsie, and let me come back now and capture economic value by signing a higher commit, a new commit with you that has a higher commitment of consumption, and thus I'm no longer utilizing that overage. That's captured in the new commitment I've made with JFrog. What's different today is that our customers are saying, I don't know what my cloud usage is two days from now, two weeks from now, or two months from now. It's changed quite dramatically, and I would say that's just over 12 months. it's changed quite dramatically and i would say that's just over 12 months A year ago, we were going through the same thing in essence, in that we had strong usage in Q1. a year ago we were going through the same thing in essence in that we had strong usage in q1 Agents were just starting to be introduced to the enterprise. agents were just starting to be introduced to the enterprise We saw this tick up in usage in Q1 last year, and it was still very much the behavior of the historical trend of that was more of an oopsie, and let me come back now and capture economic value by signing a higher commit, a new commit with you that has a higher commitment of consumption, and thus I'm no longer utilizing that overage. we saw this tick up in usage in q1 last year and it was still very much the behavior of the historical trend of that was more of an oopsie and let me come back now and capture economic value by signing a higher commit a new commit with you that has a higher commitment of consumption and thus i'm no longer utilizing that overage That's captured in the new commitment I've made with JFrog. that's captured in the new commitment i've made with jfrog What's different today is that our customers are saying, I don't know what my cloud usage is two days from now, two weeks from now, or two months from now. what's different today is that our customers are saying i don't know what my cloud usage is two days from now two weeks from now or two months from now Signing an agreement for two years, I don't know if that's right because I don't know whether my cloud usage may change, the way I use cloud could change. If I move from experimentation to productivity, does that change things? I try to equate it for you guys on Wall Street is to think about, is your PM asking you for a table-pounding idea? If he's not and you walk in there with one and it blows up, did you do yourself any service? Probably not, because procurement office right now is not feeling the pressure from the office of the CFO to go out and rein in costs or be my cloud expert and buy me the exact amount of cloud and don't get it wrong. Think about it. Signing an agreement for two years, I don't know if that's right because I don't know whether my cloud usage may change, the way I use cloud could change. signing an agreement for two years i don't know if that's right because i don't know whether my cloud usage may change the way i use cloud could change If I move from experimentation to productivity, does that change things? if i move from experimentation to productivity does that change things I try to equate it for you guys on Wall Street is to think about, is your PM asking you for a table-pounding idea? i try to equate it for you guys on wall street is to think about is your pm asking you for a table-pounding idea If he's not and you walk in there with one and it blows up, did you do yourself any service? if he's not and you walk in there with one and it blows up did you do yourself any service Probably not, because procurement office right now is not feeling the pressure from the office of the CFO to go out and rein in costs or be my cloud expert and buy me the exact amount of cloud and don't get it wrong. probably not because procurement office right now is not feeling the pressure from the office of the cfo to go out and rein in costs or be my cloud expert and buy me the exact amount of cloud and don't get it wrong Think about it. think about it If you're that procurement guy and you're Joe Procurement and you think you're the best at buying cloud ever, you go in, do a two-year commitment, and in four months you've used it up and you're back hat in hand to the CFO, you didn't do yourself any favor in the environment you're in. I think right now, customers feel that running hot is the better choice. Inevitably at renewal, they will have to make a choice, and we'll see what that choice may in fact be. There has been a shift and change where typically an overusage would lead quickly to a new commitment, and we aren't seeing that just yet. If you're that procurement guy and you're Joe Procurement and you think you're the best at buying cloud ever, you go in, do a two-year commitment, and in four months you've used it up and you're back hat in hand to the CFO, you didn't do yourself any favor in the environment you're in. if you're that procurement guy and you're joe procurement and you think you're the best at buying cloud ever you go in do a two-year commitment and in four months you've used it up and you're back hat in hand to the cfo you didn't do yourself any favor in the environment you're in I think right now, customers feel that running hot is the better choice. i think right now customers feel that running hot is the better choice Inevitably at renewal, they will have to make a choice, and we'll see what that choice may in fact be. inevitably at renewal they will have to make a choice and we'll see what that choice may in fact be There has been a shift and change where typically an overusage would lead quickly to a new commitment, and we aren't seeing that just yet. there has been a shift and change where typically an overusage would lead quickly to a new commitment and we aren't seeing that just yet

Speaker 2: Yeah. I think historically, you guys spoke to seasonality being more back half weighted with the large deals in the pipeline. It feels like with the 24/7 nature of coding agents, seasonality is changing a little bit. I guess, how would you characterize seasonality moving forward? Yeah. yeah I think historically, you guys spoke to seasonality being more back half weighted with the large deals in the pipeline. i think historically you guys spoke to seasonality being more back half weighted with the large deals in the pipeline It feels like with the 24/7 nature of coding agents, seasonality is changing a little bit. it feels like with the 24/7 nature of coding agents seasonality is changing a little bit I guess, how would you characterize seasonality moving forward? i guess how would you characterize seasonality moving forward

Speaker 1: Not to be flippant, I'd probably crush it up and throw it out that window. The reason I say that, right, Lucky, is because to your point, when I first joined here a few years back and cloud migration was the monetization mechanism for cloud, it was that I spent the first half really planning that deployment. The second half executing that deployment, and thus the second half more waiting typically in terms of our business. Last year, being consumption-driven, it was more steady Q1, Q3. The dynamics of Q4, which will always have this dynamic, at least for the near term, is that we all have holidays to celebrate and we work less. There's less development work, so there's typically rarely if ever any usage above commitment in Q4. Not to be flippant, I'd probably crush it up and throw it out that window. not to be flippant i'd probably crush it up and throw it out that window The reason I say that, right, Lucky, is because to your point, when I first joined here a few years back and cloud migration was the monetization mechanism for cloud, it was that I spent the first half really planning that deployment. the reason i say that right lucky is because to your point when i first joined here a few years back and cloud migration was the monetization mechanism for cloud it was that i spent the first half really planning that deployment The second half executing that deployment, and thus the second half more waiting typically in terms of our business. the second half executing that deployment and thus the second half more waiting typically in terms of our business Last year, being consumption-driven, it was more steady Q1, Q3. last year being consumption-driven it was more steady q1 q3 The dynamics of Q4, which will always have this dynamic, at least for the near term, is that we all have holidays to celebrate and we work less. the dynamics of q4 which will always have this dynamic at least for the near term is that we all have holidays to celebrate and we work less There's less development work, so there's typically rarely if ever any usage above commitment in Q4. there's less development work so there's typically rarely if ever any usage above commitment in q4 That seasonal trend will stay, but that could even go out the door eventually someday. If Agent 101 is working while we are celebrating the holidays, that could change. That could change the dynamics of seasonality, but not this year, not anytime soon. I think as it relates to the consumption trends, it certainly seems like it is a steady as she goes for the first three, and then we have a seasonal trend of more of a slowdown in work, slowdown in development in Q4. T hat seasonal trend will stay, but that could even go out the door eventually someday. t hat seasonal trend will stay but that could even go out the door eventually someday If Agent 101 is working while we are celebrating the holidays, that could change. if agent 101 is working while we are celebrating the holidays that could change That could change the dynamics of seasonality, but not this year, not anytime soon. that could change the dynamics of seasonality but not this year not anytime soon I think as it relates to the consumption trends, it certainly seems like it is a steady as she goes for the first three, and then we have a seasonal trend of more of a slowdown in work, slowdown in development in Q4. i think as it relates to the consumption trends it certainly seems like it is a steady as she goes for the first three and then we have a seasonal trend of more of a slowdown in work slowdown in development in q4

Speaker 2: Yeah. Anything to call out in terms of sales compensation with overages being a bigger piece of this quarter? How are you thinking about that moving forward? Yeah. yeah Anything to call out in terms of sales compensation with overages being a bigger piece of this quarter? anything to call out in terms of sales compensation with overages being a bigger piece of this quarter How are you thinking about that moving forward? how are you thinking about that moving forward

Speaker 1: I think that our salespeople are kicking dirt right now. That is the way that works for us, and I think it is the right way. It is akin to paying you, the PM, for a high watermark, right, for something that could evaporate. They will not get compensated, our reps, until they are able to sign that higher usage into, in fact, a commitment. That commitment goes into RPO. Usage is captured today via revenue, and we can capture that, but inevitably, we would like to capture that into a longer-term agreement to have better visibility for ourselves and the customer, and the rep would obviously like to do it because that would help them in their comp structure. I think that our salespeople are kicking dirt right now. i think that our salespeople are kicking dirt right now That is the way that works for us, and I think it is the right way. that is the way that works for us and i think it is the right way It is akin to paying you, the PM, for a high watermark, right, for something that could evaporate. it is akin to paying you the pm for a high watermark right for something that could evaporate They will not get compensated, our reps, until they are able to sign that higher usage into, in fact, a commitment. they will not get compensated our reps until they are able to sign that higher usage into in fact a commitment That commitment goes into RPO. that commitment goes into rpo Usage is captured today via revenue, and we can capture that, but inevitably, we would like to capture that into a longer-term agreement to have better visibility for ourselves and the customer, and the rep would obviously like to do it because that would help them in their comp structure. usage is captured today via revenue and we can capture that but inevitably we would like to capture that into a longer-term agreement to have better visibility for ourselves and the customer and the rep would obviously like to do it because that would help them in their comp structure

Speaker 2: Yeah. Maybe taking a step back, how do you think investors should think about your long-term growth, the algorithm between cloud versus self-managed security and some of the newer AI products? Yeah. yeah Maybe taking a step back, how do you think investors should think about your long-term growth, the algorithm between cloud versus self-managed security and some of the newer AI products? maybe taking a step back how do you think investors should think about your long-term growth the algorithm between cloud versus self-managed security and some of the newer ai products

Speaker 1: I'll take security out right away because security's always going to fall, whether you're self-hosted or cloud, in the cloud. We maintain that database now, so that it is always updated, and you get five updates over the cloud through the day. That's the delivery mechanism, we recognize all security, whether self-hosted or cloud, in the cloud. Certainly a large driver for us. At only 7% of revenue, 10% of ARR as of last year, it's the new growth driver for us on top of cloud growth that we're seeing. I think longer term, you're going to add governance on to that growth mechanism as that next Lego of growth that will be additive to both the cloud and the security aspect of what we do. I'll take security out right away because security's always going to fall, whether you're self-hosted or cloud, in the cloud. i'll take security out right away because security's always going to fall whether you're self-hosted or cloud in the cloud We maintain that database now, so that it is always updated, and you get five updates over the cloud through the day. we maintain that database now so that it is always updated and you get five updates over the cloud through the day That's the delivery mechanism, we recognize all security, whether self-hosted or cloud, in the cloud. that's the delivery mechanism we recognize all security whether self-hosted or cloud in the cloud Certainly a large driver for us. certainly a large driver for us At only 7% of revenue, 10% of ARR as of last year, it's the new growth driver for us on top of cloud growth that we're seeing. at only 7% of revenue 10% of arr as of last year it's the new growth driver for us on top of cloud growth that we're seeing I think longer term, you're going to add governance on to that growth mechanism as that next Lego of growth that will be additive to both the cloud and the security aspect of what we do. i think longer term you're going to add governance on to that growth mechanism as that next lego of growth that will be additive to both the cloud and the security aspect of what we do Over a longer term, certainly we've now achieved 51% as of Q1, the business in terms of cloud mix, so cloud has now finally become the larger portion, and I think that that will continue. However, there will be a cohort that will remain in self-hosted, self-managed, either through regulation or through a choice to do hybrid architecture. We will continue to support those customers, and I think you're going to see a lot of federal type of penetration. We had some success in federal last year. I think that's a new opportunity in self-hosted for us. A lot of work is done in those regulated industries within the government. O ver a longer term, certainly we've now achieved 51% as of Q1, the business in terms of cloud mix, so cloud has now finally become the larger portion, and I think that that will continue. o ver a longer term certainly we've now achieved 51% as of q1 the business in terms of cloud mix so cloud has now finally become the larger portion and i think that that will continue However, there will be a cohort that will remain in self-hosted, self-managed, either through regulation or through a choice to do hybrid architecture. however there will be a cohort that will remain in self-hosted self-managed either through regulation or through a choice to do hybrid architecture We will continue to support those customers, and I think you're going to see a lot of federal type of penetration. we will continue to support those customers and i think you're going to see a lot of federal type of penetration We had some success in federal last year. we had some success in federal last year I think that's a new opportunity in self-hosted for us. i think that's a new opportunity in self-hosted for us A lot of work is done in those regulated industries within the government. a lot of work is done in those regulated industries within the government To the extent that others that don't move over time in self-hosted, I think that those are the areas where we continue to add a lot of value, and we'll have to see how we can maybe extrapolate additional value, whether it be pricing or other things, into self-hosted, as that becomes more of the niche business and cloud becomes the real growth driver. To the extent that others that don't move over time in self-hosted, I think that those are the areas where we continue to add a lot of value, and we'll have to see how we can maybe extrapolate additional value, whether it be pricing or other things, into self-hosted, as that becomes more of the niche business and cloud becomes the real growth driver. to the extent that others that don't move over time in self-hosted i think that those are the areas where we continue to add a lot of value and we'll have to see how we can maybe extrapolate additional value whether it be pricing or other things into self-hosted as that becomes more of the niche business and cloud becomes the real growth driver

Speaker 2: Yeah. You talked about governance, I want to bring up again the report that some enterprises are maybe a little overconfident with their AI usage and not as well prepared on governance. Yeah. yeah You talked about governance, I want to bring up again the report that some enterprises are maybe a little overconfident with their AI usage and not as well prepared on governance. you talked about governance i want to bring up again the report that some enterprises are maybe a little overconfident with their ai usage and not as well prepared on governance Is it going to take something bad happening, or what maybe is the catalyst for customers to recognize this? Is it going to take something bad happening, or what maybe is the catalyst for customers to recognize this? is it going to take something bad happening or what maybe is the catalyst for customers to recognize this

Speaker 1: They recognize it. I just don't think we're at the point where they're trying to What are they going to govern? The agents aren't there yet to govern, so to speak. We haven't trained the agent, or we haven't turned it loose. To your point, could there be some that don't see the importance? Sure. I think that what I'm hearing back from my own team, and then in conversations with the likes of investors and others, is that they're very much hearing back the governance conversation from other companies, and that this is very much a concern for them. I think more so you've seen the behavior you're describing happening somewhat on the security side with the, I'll try it good enough, I get penetrated, or, I haven't worried about binaries before. Why do I need to worry about securing them now? Something happens. T hey recognize it. t hey recognize it I just don't think we're at the point where they're trying to What are they going to govern? i just don't think we're at the point where they're trying to what are they going to govern The agents aren't there yet to govern, so to speak. the agents aren't there yet to govern so to speak We haven't trained the agent, or we haven't turned it loose. we haven't trained the agent or we haven't turned it loose To your point, could there be some that don't see the importance? to your point could there be some that don't see the importance Sure. sure I think that what I'm hearing back from my own team, and then in conversations with the likes of investors and others, is that they're very much hearing back the governance conversation from other companies, and that this is very much a concern for them. i think that what i'm hearing back from my own team and then in conversations with the likes of investors and others is that they're very much hearing back the governance conversation from other companies and that this is very much a concern for them I think more so you've seen the behavior you're describing happening somewhat on the security side with the, I'll try it good enough, I get penetrated, or, I haven't worried about binaries before. i think more so you've seen the behavior you're describing happening somewhat on the security side with the i'll try it good enough i get penetrated or i haven't worried about binaries before Why do I need to worry about securing them now? why do i need to worry about securing them now Something happens. something happens Okay, now I'm wanting to step up to the table and talk to you more about Curation and the JFrog security products. Okay, now I'm wanting to step up to the table and talk to you more about Curation and the JFrog security products. okay now i'm wanting to step up to the table and talk to you more about curation and the jfrog security products

Speaker 2: Yeah. Maybe one more question and I'll open it up to investors if they're interested in asking a question. In terms of the share buyback that you announced recently, that was nice to see. How do you guys think about capital allocation moving forward and maybe the build versus buy equation, especially given your successful past acquisitions? Yeah. yeah Maybe one more question and I'll open it up to investors if they're interested in asking a question. maybe one more question and i'll open it up to investors if they're interested in asking a question In terms of the share buyback that you announced recently, that was nice to see. in terms of the share buyback that you announced recently that was nice to see How do you guys think about capital allocation moving forward and maybe the build versus buy equation, especially given your successful past acquisitions? how do you guys think about capital allocation moving forward and maybe the build versus buy equation especially given your successful past acquisitions

Speaker 1: Yeah. We've had success, as you noted, thank you, with two large acquisitions in Vdoo. That was the security that you're seeing today. In Qwak in 2024, which has emerged into really just AI and MLOps together, and those guys are the core of AI Catalog and AppTrust, delivering a lot of value to us today. I think that when we look overall in terms of where we're going with the business and how we see each one of these playing out, is that we're really looking at the business as taking security and driving it on top of Artifactory. They're going to be sold together at all times. The go-to-market there is never that we needed to go and hire a security staff to sell security. Yeah. yeah We've had success, as you noted, thank you, with two large acquisitions in Vdoo. we've had success as you noted thank you with two large acquisitions in vdoo That was the security that you're seeing today. that was the security that you're seeing today In Qwak in 2024, which has emerged into really just AI and MLOps together, and those guys are the core of AI Catalog and AppTrust, delivering a lot of value to us today. in qwak in 2024 which has emerged into really just ai and mlops together and those guys are the core of ai catalog and apptrust delivering a lot of value to us today I think that when we look overall in terms of where we're going with the business and how we see each one of these playing out, is that we're really looking at the business as taking security and driving it on top of Artifactory. i think that when we look overall in terms of where we're going with the business and how we see each one of these playing out is that we're really looking at the business as taking security and driving it on top of artifactory They're going to be sold together at all times. they're going to be sold together at all times The go-to-market there is never that we needed to go and hire a security staff to sell security. the go-to-market there is never that we needed to go and hire a security staff to sell security We were lucky enough that the industry started to shape a security sale to a panel, and we would bring in an overlay. We treat the customer has one main rep that you interface with, but you bring in overlays for security. We'll bring in overlays for governance because now at the panel level, you're selling to the CISO, the CIO, the chief risk officer. I think on a go-to-market basis, that's one of the changes that we've been seeing in terms of how things have been getting done and how we're approaching things and how the industry is looking at things from a top-down aspect. We were lucky enough that the industry started to shape a security sale to a panel, and we would bring in an overlay. we were lucky enough that the industry started to shape a security sale to a panel and we would bring in an overlay We treat the customer has one main rep that you interface with, but you bring in overlays for security. we treat the customer has one main rep that you interface with but you bring in overlays for security We'll bring in overlays for governance because now at the panel level, you're selling to the CISO, the CIO, the chief risk officer. we'll bring in overlays for governance because now at the panel level you're selling to the ciso the cio the chief risk officer I think on a go-to-market basis, that's one of the changes that we've been seeing in terms of how things have been getting done and how we're approaching things and how the industry is looking at things from a top-down aspect. i think on a go-to-market basis that's one of the changes that we've been seeing in terms of how things have been getting done and how we're approaching things and how the industry is looking at things from a top-down aspect

Speaker 2: Yeah. Any questions from the audience? Hi, Matt. Yeah. Any questions from the audience? yeah. any questions from the audience Hi, Matt. hi matt

Speaker 3: I'm curious, so what do you view as your biggest competitive risk today? Maybe differently asked, three years from now, what would be like, hey, we've got to monitor this. If this were to happen, we'd have to I'm curious, so what do you view as your biggest competitive risk today? i'm curious so what do you view as your biggest competitive risk today Maybe differently asked, three years from now, what would be like, hey, we've got to monitor this. maybe differently asked three years from now what would be like hey we've got to monitor this If this were to happen, we'd have to if this were to happen we'd have to

Speaker 1: Yeah. Thank you for the question. The question was what is our biggest concerns today in terms of maybe competitive concerns, and what might it be for three years from now? I would say to that question, sir, that it may sound simple, but it is very much true. This is an opportunity that this management team and these founders have focused on in the binary diametrically for 18 years. One asset that they have told you was going to be of utter importance, and it never really seemed that way for some time because it was not where humans interfaced with software. However, in the world of AI, it has become very inherent that the binary is, in fact, that asset. I think that execution is our biggest risk in the near term, that we have a very large opportunity that has come to us. Yeah. yeah Thank you for the question. thank you for the question The question was what is our biggest concerns today in terms of maybe competitive concerns, and what might it be for three years from now? the question was what is our biggest concerns today in terms of maybe competitive concerns and what might it be for three years from now I would say to that question, sir, that it may sound simple, but it is very much true. i would say to that question sir that it may sound simple but it is very much true This is an opportunity that this management team and these founders have focused on in the binary diametrically for 18 years. this is an opportunity that this management team and these founders have focused on in the binary diametrically for 18 years One asset that they have told you was going to be of utter importance, and it never really seemed that way for some time because it was not where humans interfaced with software. one asset that they have told you was going to be of utter importance and it never really seemed that way for some time because it was not where humans interfaced with software However, in the world of AI, it has become very inherent that the binary is, in fact, that asset. however in the world of ai it has become very inherent that the binary is in fact that asset I think that execution is our biggest risk in the near term, that we have a very large opportunity that has come to us. i think that execution is our biggest risk in the near term that we have a very large opportunity that has come to us The market has come to us, the asset that we have focused on, and I think that it is execution. I think three years from now, it is does someone else try to work the binary in a way that we did not conceivably think. I think that is the biggest risk to us, not others that have tried the old way of I will support a certain amount of languages, and that is good enough to compete against JFrog. The market has come to us, the asset that we have focused on, and I think that it is execution. the market has come to us the asset that we have focused on and i think that it is execution I think three years from now, it is does someone else try to work the binary in a way that we did not conceivably think. i think three years from now it is does someone else try to work the binary in a way that we did not conceivably think I think that is the biggest risk to us, not others that have tried the old way of I will support a certain amount of languages, and that is good enough to compete against JFrog. i think that is the biggest risk to us not others that have tried the old way of i will support a certain amount of languages and that is good enough to compete against jfrog Maybe is there somebody that thinks about doing binaries in a way that we did not, and does that create disruption? I would say that there has also been disruption in the five years I have been here. Right before I joined, they bought Vdoo and Security, and that was something that could have disrupted the business. Buying Qwak and MLOps, that could have been something that would have taken over binaries and possibly disrupted JFrog. Maybe is there somebody that thinks about doing binaries in a way that we did not, and does that create disruption? maybe is there somebody that thinks about doing binaries in a way that we did not and does that create disruption I would say that there has also been disruption in the five years I have been here. i would say that there has also been disruption in the five years i have been here Right before I joined, they bought Vdoo and Security, and that was something that could have disrupted the business. right before i joined they bought vdoo and security and that was something that could have disrupted the business Buying Qwak and MLOps, that could have been something that would have taken over binaries and possibly disrupted JFrog. buying qwak and mlops that could have been something that would have taken over binaries and possibly disrupted jfrog That is the other thing that we try to do as well, is run fast and see these holes that could be there in three to five years and use to your capital allocation conversation. Sorry, I got lost a little bit on that answer there. On the capital allocation, why we have used it to be inorganic when we need to, now we are using our strong cash balance as a way to help us maintain the merit increases within the corporation. T hat is the other thing that we try to do as well, is run fast and see these holes that could be there in three to five years and use to your capital allocation conversation. t hat is the other thing that we try to do as well is run fast and see these holes that could be there in three to five years and use to your capital allocation conversation Sorry, I got lost a little bit on that answer there. sorry i got lost a little bit on that answer there On the capital allocation, why we have used it to be inorganic when we need to, now we are using our strong cash balance as a way to help us maintain the merit increases within the corporation. on the capital allocation why we have used it to be inorganic when we need to now we are using our strong cash balance as a way to help us maintain the merit increases within the corporation We have shifted last year to higher merit increases from cash since we have such a strong cash-generating business and less in equity since we are a little bit more of a We have become a larger organization and now public for five years, and thus, we are trying to start to manage the burn rate. To come back, I guess I woke back up. We have shifted last year to higher merit increases from cash since we have such a strong cash-generating business and less in equity since we are a little bit more of a We have become a larger organization and now public for five years, and thus, we are trying to start to manage the burn rate. we have shifted last year to higher merit increases from cash since we have such a strong cash-generating business and less in equity since we are a little bit more of a we have become a larger organization and now public for five years and thus we are trying to start to manage the burn rate To come back, I guess I woke back up. to come back i guess i woke back up The capital allocation is the cash will always be favorable to us. We get a very good return on that cash. We can use cash to be very quick and nimble in an inorganic fashion, as you noted, and I just noted with the two acquisitions we have made. It is not that something that it will burn a hole in our pocket. It is something that we see as valuable, and we will utilize it as best we can. The $300 million buyback that we put in place was put in place to be a buyer of last resort, as I think we need to have when we saw the disruption from what we call on February 20th, Anthropic Day. The capital allocation is the cash will always be favorable to us. the capital allocation is the cash will always be favorable to us We get a very good return on that cash. we get a very good return on that cash We can use cash to be very quick and nimble in an inorganic fashion, as you noted, and I just noted with the two acquisitions we have made. we can use cash to be very quick and nimble in an inorganic fashion as you noted and i just noted with the two acquisitions we have made It is not that something that it will burn a hole in our pocket. it is not that something that it will burn a hole in our pocket It is something that we see as valuable, and we will utilize it as best we can. it is something that we see as valuable and we will utilize it as best we can The $300 million buyback that we put in place was put in place to be a buyer of last resort, as I think we need to have when we saw the disruption from what we call on February 20th, Anthropic Day. the $300 million buyback that we put in place was put in place to be a buyer of last resort as i think we need to have when we saw the disruption from what we call on february 20th anthropic day That will be that if we feel the market has disconnected in some way, we may be active in purchasing the stock, and we will certainly communicate what we were able to do with that initial authorization, after Q2 and with the Q2 results. That's how we're going to be looking at that, but that can also be a tool, not that that was created for, but the fact that if we're able to buy some treasury shares and use those in the future for employee issuance, well, that takes off the plate then of coming hat in hand to you guys asking for more shares, asking for dilution to continue to enhance and merit those employees that are helping drive the business higher. That will be that if we feel the market has disconnected in some way, we may be active in purchasing the stock, and we will certainly communicate what we were able to do with that initial authorization, after Q2 and with the Q2 results. that will be that if we feel the market has disconnected in some way we may be active in purchasing the stock and we will certainly communicate what we were able to do with that initial authorization after q2 and with the q2 results That's how we're going to be looking at that, but that can also be a tool, not that that was created for, but the fact that if we're able to buy some treasury shares and use those in the future for employee issuance, well, that takes off the plate then of coming hat in hand to you guys asking for more shares, asking for dilution to continue to enhance and merit those employees that are helping drive the business higher. that's how we're going to be looking at that but that can also be a tool not that that was created for but the fact that if we're able to buy some treasury shares and use those in the future for employee issuance well that takes off the plate then of coming hat in hand to you guys asking for more shares asking for dilution to continue to enhance and merit those employees that are helping drive the business higher

Speaker 2: Yeah. Any other questions from the audience? Great. Well, maybe, on the profitability side of things, you guys have always had strong profitability. Where do you see additional leverage in the business, and how do you manage the push and pull between investments and maintaining your market leadership position? Yeah. yeah Any other questions from the audience? any other questions from the audience Great. great Well, maybe, on the profitability side of things, you guys have always had strong profitability. well maybe on the profitability side of things you guys have always had strong profitability Where do you see additional leverage in the business, and how do you manage the push and pull between investments and maintaining your market leadership position? where do you see additional leverage in the business and how do you manage the push and pull between investments and maintaining your market leadership position

Speaker 1: Yes. We very much see margins and the rule of, recently it's been a rule of 50, it's been nice. It's been a rule of 40, as how we kind of manage the finance organization is managing and running the business. I think that there's leverage still inherent because what we've done today with our guidance philosophy is that we provide you with a conservative, in our view, more of what has been contractually obligated to the customer. That's what we guide you on revenue, but we're not doing that with OpEx. We're giving you what we believe will be our essentially full OpEx. To the extent that we can continue to outperform on the top line, a good portion of that should flow through down to the margin line, and we should continue to expand margins. Yes. yes We very much see margins and the rule of, recently it's been a rule of 50, it's been nice. we very much see margins and the rule of recently it's been a rule of 50 it's been nice It's been a rule of 40, as how we kind of manage the finance organization is managing and running the business. it's been a rule of 40 as how we kind of manage the finance organization is managing and running the business I think that there's leverage still inherent because what we've done today with our guidance philosophy is that we provide you with a conservative, in our view, more of what has been contractually obligated to the customer. i think that there's leverage still inherent because what we've done today with our guidance philosophy is that we provide you with a conservative in our view more of what has been contractually obligated to the customer That's what we guide you on revenue, but we're not doing that with OpEx. that's what we guide you on revenue but we're not doing that with opex We're giving you what we believe will be our essentially full OpEx. we're giving you what we believe will be our essentially full opex To the extent that we can continue to outperform on the top line, a good portion of that should flow through down to the margin line, and we should continue to expand margins. to the extent that we can continue to outperform on the top line a good portion of that should flow through down to the margin line and we should continue to expand margins Certainly, we've had a long-term target out there, issued that target in May of 2023 when we were coming off a year of half a percent of EBIT profitability. Not a lot of profitability to speak of at the time, but told you that we saw a model that could grow to 21%-23% EBITDA margin on a non-GAAP basis. Well, in the first quarter of this year, we reported over 21% EBIT margin. We're along that target, and because the EBIT margin has been expanding, and also due to the fact of things like the cloud marketplace and customers paying multi-year deals up front with strong collections. We've also had strong cash generation and thus strong free cash flow margins due to the fact that profitability has been enhanced over the last few years as well. Certainly, we've had a long-term target out there, issued that target in May of 2023 when we were coming off a year of half a percent of EBIT profitability. certainly we've had a long-term target out there issued that target in may of 2023 when we were coming off a year of half a percent of ebit profitability Not a lot of profitability to speak of at the time, but told you that we saw a model that could grow to 21%-23% EBITDA margin on a non-GAAP basis. not a lot of profitability to speak of at the time but told you that we saw a model that could grow to 21%-23% ebitda margin on a non-gaap basis Well, in the first quarter of this year, we reported over 21% EBIT margin. well in the first quarter of this year we reported over 21% ebit margin We're along that target, and because the EBIT margin has been expanding, and also due to the fact of things like the cloud marketplace and customers paying multi-year deals up front with strong collections. we're along that target and because the ebit margin has been expanding and also due to the fact of things like the cloud marketplace and customers paying multi-year deals up front with strong collections We've also had strong cash generation and thus strong free cash flow margins due to the fact that profitability has been enhanced over the last few years as well. we've also had strong cash generation and thus strong free cash flow margins due to the fact that profitability has been enhanced over the last few years as well

Speaker 2: Yeah. Maybe final question, the NVIDIA Skills product, you guys were able to create that fairly quickly, and NVIDIA asked you to. How do you feel like that helps from a marketing sense and some of these strong partnerships and endorsements that you have in the ecosystem? Yeah. yeah Maybe final question, the NVIDIA Skills product, you guys were able to create that fairly quickly, and NVIDIA asked you to. maybe final question the nvidia skills product you guys were able to create that fairly quickly and nvidia asked you to How do you feel like that helps from a marketing sense and some of these strong partnerships and endorsements that you have in the ecosystem? how do you feel like that helps from a marketing sense and some of these strong partnerships and endorsements that you have in the ecosystem

Speaker 1: Yeah. Well, I think that that's a key, right? Is I think that any one partnership shouldn't be looked at as the partnership. We've had partnerships with many companies, and I think if you look at the history of the company, if we had tied ourself to any one of those horses at one time, it might have looked like the right decision then, but down the road it might have not been. I think this universality is what really separates us and why our customers love us because we sit at that center that you want to choose what you plug in. You don't want to be told what you use and how you build your organization. Yeah. yeah Well, I think that that's a key, right? well i think that that's a key right Is I think that any one partnership shouldn't be looked at as the partnership. is i think that any one partnership shouldn't be looked at as the partnership We've had partnerships with many companies, and I think if you look at the history of the company, if we had tied ourself to any one of those horses at one time, it might have looked like the right decision then, but down the road it might have not been. we've had partnerships with many companies and i think if you look at the history of the company if we had tied ourself to any one of those horses at one time it might have looked like the right decision then but down the road it might have not been I think this universality is what really separates us and why our customers love us because we sit at that center that you want to choose what you plug in. i think this universality is what really separates us and why our customers love us because we sit at that center that you want to choose what you plug in You don't want to be told what you use and how you build your organization. you don't want to be told what you use and how you build your organization The holistic nature of JFrog has been a competitive advantage for us in how we sit and can see holistically the entire software build and bring more value to you or as the organization from where we sit. The holistic nature of JFrog has been a competitive advantage for us in how we sit and can see holistically the entire software build and bring more value to you or as the organization from where we sit. the holistic nature of jfrog has been a competitive advantage for us in how we sit and can see holistically the entire software build and bring more value to you or as the organization from where we sit

Speaker 2: Awesome. I think that does it. We're out of time, Jeff. Thanks very much for coming. Awesome. awesome I think that does it. i think that does it We're out of time, Jeff. we're out of time jeff Thanks very much for coming. thanks very much for coming

Speaker 1: Thank you, sir. Thank you, sir. thank you sir