JFrog Ltd (FROG) Stock Analysis and Metrics

JFrog

NASDAQ: FROG

$80.21 ▼ -1.04 (-1.27%)

At close: Jul 24, 2026 · 3:59 PM UTC

Financial Ratios

Market Cap9.76 Bn

P/E-169.61

P/S17.33

Div. Yield0.00

Revenue Growth (1y) (Qtr)25.79

Add ratio to table…

About

JFrog Ltd provides a system of record for the software supply chain in the Artificial Intelligence era. The company offers a unified platform that delivers governance, security, and trust to enterprise software organizations. JFrog’s platform enables companies to unify development speed, volume, security, governance, and delivery of software applications across hybrid teams of developers, security professionals, AI/ML engineers, and AI agents. JFrog generates revenue…

Investment Thesis

▲ Bull case

JFrog's Q1 2026 results reveal a structural inflection point in enterprise software management driven by AI-generated binaries, where consumption-based cloud revenues grew 50% year over year and now represent 51% of total revenue, exceeding contractual minimums due to surging demand from AI coding agents accelerating binary production across customer portfolios. This trend is not a temporary spike but a durable shift, as management emphasized the acceleration in compiled software volume flowing through its platform is driven by two persistent forces: AI supercharging developer output and increasing open source consumption by both humans and agents, positioning JFrog as the indispensable system of record for governing this AI-fueled tsunami of binaries. The company's guidance philosophy of conservatism—excluding usage above contractual commitments from forward-looking estimates—means current cloud growth guidance of 33%-35% for FY26 significantly understates the underlying momentum, as customers routinely spend above minimums and are being actively converted to higher annual commitments through enterprise sales efforts, creating a latent revenue acceleration engine not yet reflected in guidance. This is further bolstered by the 33% year-over-year growth in Enterprise Plus mix (now 58% of revenue), indicating deepening penetration into high-value, regulated enterprise segments that value JFrog's unified governance of AI artifacts, legacy binaries, and open source components under a single platform, with gross retention at 97% underscoring mission-critical product stickiness. The company's strategic innovations—such as the JFrog MCP Registry for AI agent orchestration and Skills Registry for reusable agent capabilities—directly address emerging customer needs in the AI era, with NVIDIA collaboration validating its role in securing agentic workflows within the AICube Blueprint, thereby expanding its total addressable market beyond traditional DevSecOps into the rapidly growing AI infrastructure layer where demand for trusted binary governance is outpacing point solution adoption. Net dollar retention of 120%, up four points year over year, and rising RPO of $574.9 million (36% growth) reflect successful conversion of usage strength into multi-year commitments, while the $741.2 million cash balance and newly authorized $300 million share repurchase program signal financial flexibility to capitalize on durable growth opportunities without dilution.
JFrog's security business is experiencing a fundamental, long-term tailwind from the evolving software supply chain threat landscape, where attackers are increasingly weaponizing AI development tools and hijacking CI/CD pipelines before code exists—a dynamic underscored in the 2026 Software Supply Chain Security State of the Union report showing 451% surge in malicious npm packages and 97% of organizations claiming AI governance while 53% still pull models from public registries containing malicious payloads. This creates a critical and widening AI governance gap that JFrog is uniquely positioned to close, as its platform provides automated, platform-native governance that curates every software asset—whether introduced by agents or developers—and continuously monitors releases containing those assets, directly addressing the report's conclusion that moving to such governance is no longer optional but the only way to secure intelligent systems creating and distributing today's software. Unlike point solutions focused on scanning or vulnerability management—which management acknowledged could be subsumed by model labs over time—JFrog's moat lies in its role as the universal system of record for all binaries, including AI-generated artifacts, open source packages, and legacy binaries, enabling deterministic protection through policy-driven guardrails at the point of entry (via Curation) and ongoing governance (via Xray and Advanced Security) across multi-agent environments, a capability no single point solution can replicate. The company's emphasis that scanners are important but insufficient without a trusted system of record to host, manage, and govern artifacts in a world where agents build, scan, and fix code at scale highlights a structural advantage: as AI adoption expands, the need for a centralized source of truth across multi-agent environments becomes more critical, not less, and JFrog's 17 years of scalability in serving the world's largest organizations provides an unmatched foundation for this shift. Furthermore, the monetization of security products like Curation is seat-based and driven by demand from attacks and new customer adoption—not data consumption—meaning increased attack frequency directly fuels higher-value, recurring revenue streams independent of usage volatility, with management noting Curation customers were protected during recent industry incidents, reinforcing product efficacy and driving organic pipeline growth. This security momentum is not cyclical but structural, as threats evolve with AI adoption, ensuring sustained demand for JFrog's end-to-end platform that unifies security, governance, and universality for all binary types in the AI era.

JFrog's Q1 2026 results reveal a structural inflection point in enterprise software management driven by AI-generated binaries, where consumption-based cloud revenues grew 50% year over year and now represent 51% of total revenue, exceeding contractual minimums due to surging demand from AI coding agents accelerating binary production across customer portfolios. This trend is not a temporary spike but a durable shift, as management emphasized the acceleration in compiled software volume flowing through its platform is driven by two persistent forces: AI supercharging developer output and increasing open source consumption by both humans and agents, positioning JFrog as the indispensable system of record for governing this AI-fueled tsunami of binaries. The company's guidance philosophy of conservatism—excluding usage above contractual commitments from forward-looking estimates—means current cloud growth guidance of 33%-35% for FY26 significantly understates the underlying momentum, as customers routinely spend above minimums and are being actively converted to higher annual commitments through enterprise sales efforts, creating a latent revenue acceleration engine not yet reflected in guidance. This is further bolstered by the 33% year-over-year growth in Enterprise Plus mix (now 58% of revenue), indicating deepening penetration into high-value, regulated enterprise segments that value JFrog's unified governance of AI artifacts, legacy binaries, and open source components under a single platform, with gross retention at 97% underscoring mission-critical product stickiness. The company's strategic innovations—such as the JFrog MCP Registry for AI agent orchestration and Skills Registry for reusable agent capabilities—directly address emerging customer needs in the AI era, with NVIDIA collaboration validating its role in securing agentic workflows within the AICube Blueprint, thereby expanding its total addressable market beyond traditional DevSecOps into the rapidly growing AI infrastructure layer where demand for trusted binary governance is outpacing point solution adoption. Net dollar retention of 120%, up four points year over year, and rising RPO of $574.9 million (36% growth) reflect successful conversion of usage strength into multi-year commitments, while the $741.2 million cash balance and newly authorized $300 million share repurchase program signal financial flexibility to capitalize on durable growth opportunities without dilution.
JFrog's security business is experiencing a fundamental, long-term tailwind from the evolving software supply chain threat landscape, where attackers are increasingly weaponizing AI development tools and hijacking CI/CD pipelines before code exists—a dynamic underscored in the 2026 Software Supply Chain Security State of the Union report showing 451% surge in malicious npm packages and 97% of organizations claiming AI governance while 53% still pull models from public registries containing malicious payloads. This creates a critical and widening AI governance gap that JFrog is uniquely positioned to close, as its platform provides automated, platform-native governance that curates every software asset—whether introduced by agents or developers—and continuously monitors releases containing those assets, directly addressing the report's conclusion that moving to such governance is no longer optional but the only way to secure intelligent systems creating and distributing today's software. Unlike point solutions focused on scanning or vulnerability management—which management acknowledged could be subsumed by model labs over time—JFrog's moat lies in its role as the universal system of record for all binaries, including AI-generated artifacts, open source packages, and legacy binaries, enabling deterministic protection through policy-driven guardrails at the point of entry (via Curation) and ongoing governance (via Xray and Advanced Security) across multi-agent environments, a capability no single point solution can replicate. The company's emphasis that scanners are important but insufficient without a trusted system of record to host, manage, and govern artifacts in a world where agents build, scan, and fix code at scale highlights a structural advantage: as AI adoption expands, the need for a centralized source of truth across multi-agent environments becomes more critical, not less, and JFrog's 17 years of scalability in serving the world's largest organizations provides an unmatched foundation for this shift. Furthermore, the monetization of security products like Curation is seat-based and driven by demand from attacks and new customer adoption—not data consumption—meaning increased attack frequency directly fuels higher-value, recurring revenue streams independent of usage volatility, with management noting Curation customers were protected during recent industry incidents, reinforcing product efficacy and driving organic pipeline growth. This security momentum is not cyclical but structural, as threats evolve with AI adoption, ensuring sustained demand for JFrog's end-to-end platform that unifies security, governance, and universality for all binary types in the AI era.

▼ Bear case

Despite strong headline growth, JFrog faces significant near-term execution risks in converting its current cloud usage strength into durable, higher-value annual commitments, as management explicitly acknowledged that much of Q1's 50% cloud revenue growth was driven by consumption above contractual minimums and that guidance remains deliberately conservative by excluding such overage from forward-looking estimates. The company's philosophy of only guiding on committed revenue creates a inherent lag between actual platform utilization and reported financial performance, meaning the current acceleration in binary production from AI coding agents may not translate into proportional revenue growth if customers delay formalizing higher commitments due to uncertainty around long-term AI usage patterns or budgetary constraints, particularly as CFOs question 'commit to what?' when faced with top-down AI adoption mandates without clear ROI frameworks. This conversion risk is amplified by the broad-based nature of the cloud strength—spread across geographies and industries—which, while reducing concentration risk, also suggests the trend may be more reflective of widespread experimentation than entrenched enterprise adoption, with management noting customers are still in an experimental mode where human developers collaborate with coding agents rather than fully autonomous AI processes, implying the binary tsunami may lack the predictability needed for rapid commitment conversion. Additionally, the rising mix of Enterprise Plus subscriptions (now 58% of revenue) growing at 33% year over year could be masking slower growth in core cloud consumption, as Enterprise Plus includes non-consumption-based elements like security seats and platform features that may not scale as predictably with AI-driven binary volume, potentially creating a misleading impression of cloud momentum strength.
JFrog's long-term competitive position is vulnerable to encroachment from AI-native players and cloud hyperscalers who are increasingly integrating security and governance capabilities directly into their AI development toolchains, a threat highlighted by management's own concern that things like scanning, vulnerability management, and posture management could be subsumed by model labs over time as they build more sophisticated agentic workflows that handle code protection internally. While JFrog argues its system of record for binaries provides an irreplaceable moat, the accelerating capability of AI agents to generate, scan, fix, and govern code at scale—coupled with the trend toward end-to-end AI platforms that manage the full lifecycle from model training to deployment—could diminish the need for a separate binary management layer, especially if hyperscalers like Microsoft, Google, or Amazon embed Artifactory-equivalent functionality within their AI Foundry or SageMaker offerings, leveraging existing customer relationships and infrastructure scale. Furthermore, the company's reliance on a hybrid cloud/on-prem model, while currently a strength for regulated customers, may become a liability as AI-native organizations increasingly favor pure-play cloud solutions for speed and scalability, potentially eroding the premium attached to JFrog's deployment flexibility if cloud providers offer comparable governance with lower friction and deeper integration into AI workflows. The $300 million share repurchase program, while signaling confidence, also represents a significant allocation of capital that could otherwise be used to accelerate product innovation or strategic acquisitions to counter these platform-level threats, particularly as the company's R&D expenses remain elevated at $36.5 million on a non-GAAP basis in Q1, suggesting ongoing investment is needed to maintain its innovation edge against well-resourced competitors who may move faster in bundling security and governance into their core AI platforms.

Despite strong headline growth, JFrog faces significant near-term execution risks in converting its current cloud usage strength into durable, higher-value annual commitments, as management explicitly acknowledged that much of Q1's 50% cloud revenue growth was driven by consumption above contractual minimums and that guidance remains deliberately conservative by excluding such overage from forward-looking estimates. The company's philosophy of only guiding on committed revenue creates a inherent lag between actual platform utilization and reported financial performance, meaning the current acceleration in binary production from AI coding agents may not translate into proportional revenue growth if customers delay formalizing higher commitments due to uncertainty around long-term AI usage patterns or budgetary constraints, particularly as CFOs question 'commit to what?' when faced with top-down AI adoption mandates without clear ROI frameworks. This conversion risk is amplified by the broad-based nature of the cloud strength—spread across geographies and industries—which, while reducing concentration risk, also suggests the trend may be more reflective of widespread experimentation than entrenched enterprise adoption, with management noting customers are still in an experimental mode where human developers collaborate with coding agents rather than fully autonomous AI processes, implying the binary tsunami may lack the predictability needed for rapid commitment conversion. Additionally, the rising mix of Enterprise Plus subscriptions (now 58% of revenue) growing at 33% year over year could be masking slower growth in core cloud consumption, as Enterprise Plus includes non-consumption-based elements like security seats and platform features that may not scale as predictably with AI-driven binary volume, potentially creating a misleading impression of cloud momentum strength.
JFrog's long-term competitive position is vulnerable to encroachment from AI-native players and cloud hyperscalers who are increasingly integrating security and governance capabilities directly into their AI development toolchains, a threat highlighted by management's own concern that things like scanning, vulnerability management, and posture management could be subsumed by model labs over time as they build more sophisticated agentic workflows that handle code protection internally. While JFrog argues its system of record for binaries provides an irreplaceable moat, the accelerating capability of AI agents to generate, scan, fix, and govern code at scale—coupled with the trend toward end-to-end AI platforms that manage the full lifecycle from model training to deployment—could diminish the need for a separate binary management layer, especially if hyperscalers like Microsoft, Google, or Amazon embed Artifactory-equivalent functionality within their AI Foundry or SageMaker offerings, leveraging existing customer relationships and infrastructure scale. Furthermore, the company's reliance on a hybrid cloud/on-prem model, while currently a strength for regulated customers, may become a liability as AI-native organizations increasingly favor pure-play cloud solutions for speed and scalability, potentially eroding the premium attached to JFrog's deployment flexibility if cloud providers offer comparable governance with lower friction and deeper integration into AI workflows. The $300 million share repurchase program, while signaling confidence, also represents a significant allocation of capital that could otherwise be used to accelerate product innovation or strategic acquisitions to counter these platform-level threats, particularly as the company's R&D expenses remain elevated at $36.5 million on a non-GAAP basis in Q1, suggesting ongoing investment is needed to maintain its innovation edge against well-resourced competitors who may move faster in bundling security and governance into their core AI platforms.

Product and Service Breakdown of Revenue (2025)

Peer Comparison

Companies in the Software - Application

S.No.	Ticker	Company	Market Cap	P/E	P/S	Total Debt (Qtr)
1	SAP	Sap Se	208.91 Bn	20.22	4.86	7.05 Bn
2	YMM	Full Truck Alliance Co. Ltd.	188.77 Bn	322.09	-	0.00 Bn
3	SHOP	Shopify Inc.	145.98 Bn	109.59	11.80	-
4	UBER	Uber Technologies, Inc	141.48 Bn	16.32	2.64	10.51 Bn
5	CRM	Salesforce, Inc.	128.51 Bn	16.95	3.00	39.28 Bn
6	NOW	ServiceNow, Inc.	98.38 Bn	54.17	7.05	7.52 Bn
7	ADP	Automatic Data Processing Inc	97.56 Bn	22.45	4.52	3.98 Bn
8	SNOW	Snowflake Inc.	91.55 Bn	-76.63	18.19	-

Research Tools

Developers

About

Investment Thesis

Geographical Breakdown of Revenue (2025)

Product and Service Breakdown of Revenue (2025)

Peer Comparison

Research Tools

Developers

About

Investment Thesis

Geographical Breakdown of Revenue (2025)

Product and Service Breakdown of Revenue (2025)

Peer Comparison

Create an account

Sign In

Reset Password