Hi everyone. Welcome to the Barclays 2025 TMT Conference. I'm Eamon Colvin, Software and Research Analyst here at Barclays. Very excited to have Jeff Schreiner, Vice President of Investor Relations at JFrog. Thanks for being here, Jeff. Thank you, man. Thank you for having us. I guess to just set the stage, JFrog has been quite an incredible story for 2025. I guess set the stage for anyone in the room that maybe is new to the story. Like, how has the year been? What are the key takeaways for you? What have been the key drivers for growth, acceleration throughout the year? Anything you maybe you'd point out? Yeah. So I think as it relates to JFrog and 2025, it certainly, you know, as it relates to the stock price and certainly the execution we've been able to deliver has been quite strong, and those are all great things that coincide with one another. I think that when you look at 2025, it's been somewhat unique for us as relative to the last few years where within our cloud business, there's two ways in which we can really grow. There's either migration or consumption, and over the last two years, in 2023 and 2024, it was very heavily weighted to winning a few big deals to make the year related to very large customer migration activity. Whereas in 2025, what we've seen is much more of a consumption-driven contribution to revenue. There we go. We got the tech. Oh, there we go. Technical aspects solved. All right. Now you guys can hear me better, but so I think that the drivers this year have been different than the drivers we've seen in the past. Migrations have played some role, but not the role of the magnitude that we saw, let's say, in Q3 of last year, where the three biggest deals in the company's history were signed and then the full value of those recognized in Q4. This year has been a year of increasing consumption as our customers look and experiment with AI and ML, and also are starting, in our view, to experiment with the use of coding assistant tools, which then use more of the traditional type of open-source packages. And the fact that we're seeing a strong interest in adoption in a lot of our security offerings. And as we've moved through the year, and I'm sure we'll talk about some incidents that have happened in the industry, but as of a recent industry attack on a repository has generated a significant amount of interest in one of our security products to protect those organizations. I guess just unpacking. There's a lot to unpack there, but as you think about, like, the right pricing model for some of the influx of demand that you're seeing from your customer base, like, is consumption the right pricing model? Is it more of like a, I don't know, there's like a server model that you may move to full, like, for across your platform, but I guess, like, I guess how do you think about that going forward? Yeah, so today, JFrog monetizes in two ways, so we have self-managed or self-hosted in which, you know, you're having a team of IT professionals manage your software development organization, which is probably on the cloud, but you're managing that, or there's our cloud offering in which you're turning that management over to JFrog and putting that stuff into our cloud, and as it relates to the monetization of each of those methodologies, in the cloud, it's based on data transfer or consumption of the data package that you commit to JFrog in which you get a pricing benefit for doing so. In self-hosted, it's based on an incremental server, generally project-based, where I take that server, I've now increased my usage or increased the development team, so I need another new server. In the world of AI and ML, we've found that obviously a seat-based model may not work. We've seen the headcount reductions talked about. Obviously, there's a lot of bugaboo or concern, I think, this year for some of those more exposed to seat-based models. We know that consumption works for JFrog, in the sense that if you're now using JFrog and your cloud consumption contract to move large language models that can be 10X the size of packages you moved before, you're quickly starting to consume at a higher rate the amount of data consumption that you've committed to JFrog. So I think it's begun a discussion, at least in an initial sense. There's nothing that JFrog is going to lead, but I think in an initial sense, there may be a discussion among the titans of the industry, the hyperscalers, that is there another way - and we could go 100 different variables with what that may be of monetizing the AI/ML world that may not be consumption-based. But, you know, that's to be determined and something that'll be discussed. And I think what JFrog will do is look to how the industry handles any changes and try to tailor that model to our own model. No, and absolutely. I think over time, especially over the last three quarters, you've seen that increased commitment from some of the overages from consumption. Can you just walk through maybe how you saw those overages in Q1, Q2, Q3, how they played throughout the year, and how they might impact the fourth quarter? Sure. So, as you noted, you know, we get the benefit typically if, if you are a customer, you come to us, and the benefit to JFrog versus working with other maybe consumption model guys, out there that are pure consumption-based, you're coming to us and you're committing to a usage level in which that we will then give you a better pricing mechanism for the more consumption you commit to. And of that commitment, you are ratably recognizing that on a, let's say, if it's a 12-month contract, to be quite simple to use round numbers for everyone here, if I have a $1.2 million contract with customer X, I'm ratably recognizing that at about $100,000 a month, and until they use above that commitment. Now, this use-it-or-lose-it mechanism that Eamon's talking about, tends to be the fact that I'm committing to you annually for, let's say, 10 TB, but then that's recognized on a use-it-or-lose-it basis each month. And so to the extent that I start to accelerate my usage and go over commitment, I start to pay a penalty rate that can be somewhere anywhere between 20% to 25% higher than the negotiated rate that you may have with JFrog. And what that leads to is, as you're building into that, we certainly try to approach you and engage with you to say, "Hey, look, your usage is starting to climb. Good for you. We hope things are working well with your organization, but you may wanna look at upping your commitment with JFrog, and so you can see aspects that happen where Q1 we saw strong usage that we felt was really driven from experimentation of AI and ML. The reason we say that is we saw a strong increase off a small base in packages such as Hugging Face and PyPI and Conda. Q2, the usage kind of flattened out, but the benefit was that we captured some of that overusage into higher committed contracts from some of those customers. In Q3, we saw an influx now again in usage and the revenue generation that it delivered, but we haven't yet been able to reflect the benefit of what we may be able to do in signing higher committed contracts, which once those are signed, then they become something in our CRPO, whereas the overusage is just recognized in revenue and is not something that's captured in CRPO. So a little bit of a lag for. It can be. Yeah. It can be, you know, a 1/4, 2/4. It also times very well with where you are in your renewal cycle. You know, with the resources we have, we typically talk about the fact that we go after the guys that are three, six, maybe nine months at the longest away from their renewal, maybe overusers, because they are most likely the ones to be most acquiescent to say, "Yes, okay. I see I'm overusing. I have a vision that I'm gonna continue using at this level or higher. Let's go ahead and renegotiate. I guess let's take a step back at something you said earlier. Just understanding, like, why JFrog has a right to win in security. Mm-hmm. And then maybe some of the recent news with the npm attack. Maybe just dive into the first question and then some of the takeaways that you have from the recent npm attack. Sure, so security was something that is new to JFrog. Last year was the first year that we disclosed the contribution from security, and it was really the first year that we saw really meaningful acceleration of that product, and that was a product brought about by an acquisition that was done in 2021, then initially when done, I think the Street had looked at it kind of skeptically, saying at that time, "Hey, you're a DevOps company. There's security companies. Why don't you just stay in DevOps?", and didn't see the vision we saw that eventually the world was going to be much more based on core platforms and core assets that then needed to be secured. And that's the reason we feel the reason that we have the right to win, let's say, in security, and as it relates really to the security of the software supply chain and binaries, is because we are the core manager of that asset. It's what we do. It's all we do. And so when you are a CISO and you've brought on all these disparate point solutions to possibly protect your software supply chain and your development organization, you've got many disparate databases that are all signaling different vulnerabilities for you. You're almost frozen in place as to what to do. With JFrog, what you're able to do is consolidate, you know, those seven of those tools within the technologies we offer into one solution. And if you combine it with our relationship with GitHub and utilize their GitHub Advanced Security for, let's say, source code and static code analysis, you basically can take seven to 10 tools, consolidate it to two, but you as the customer looks as if I'm using only one tool. There's one pane of glass in which I can interface all and receive vulnerabilities and then remediate those vulnerabilities. So I think the uniqueness that we have brought and shown that we do have a right to win after the numbers we disclosed in 2024, which was 3% of revenue, 5% of ARR, 12% of RPO, and we'll update those again here as we report 2025, you know, we've shown that there's a real interest for the products that we do. And I think alluding to it and transferring to your question about npm and the impact that security's had for us there, there's been a recent coordinated attack, a very malicious attack, that has had various, multiple attacks over the last two months that began in August 28th of this year, and that was a hack of the npm package, which is, if you look at our website at jfrog.com, we have a report called, you know, State of the Union. I think we released it about mid-year, and we tell you in there, you know, a lot about what's going on with binaries, and we show you what are the most used programming languages among our customers in Artifactory, and npm is one of the top three open-source programming languages. So this group, who must be very sophisticated in how they've developed and orchestrated this attack, went after one of the leading packages out there utilized by enterprises and organizations to build software today, and they did so that created a very fear-based, or fear-driven, want for customers to look at one of our security products in general, and that product is Curation, and the reason that is because Curation is essentially a firewall for your software development organization. It's a centralized policy in where I, as the CISO, can set a centralized policy for that product to say, "I will only interface with these repositories and these packages," and so Curation is actively managing and scanning those repositories and looking for any discrepancies or vulnerabilities that may be introduced into those to protect the organization. And since this npm event, which, again, it started out as more of a basic attack where they were targeting specific repositories and looking just to steal, to moving now towards the one that happened in the end of closer to Thanksgiving, adjusting that attack to be random to any repository. And if there's nothing to steal, wipe everything out. It's got a fear-driven demand in our pipeline growing for our curation product. Now, that being said, that demand is certainly growing, and we're excited about that, but there's a need for our customers to find budget. And I think that's the challenge that we're hearing as a pushback from our customers. I really want it, but I need to find budget because many of these customers had committed to their organizations that this was a product that they may, in fact, deploy in the second half of 2026. We, in fact, had a customer, a large financial services company that was scheduled to deploy in Q2 or Q3 of next year, closing two weeks in Q3 because of this npm event and the need that they felt that curation brought to them. And so I would say, when you look at our security product and where it's gone, since introduction, deployment and pipeline has probably been 50/50 between our Advanced Security, which is kind of protecting the inside of the castle and looking for good citizens gone bad, and Curation, the firewall or the wall around the castle, you know, keeping the savages out. It is about 50/50 in terms of deployment and pipeline. I think post-npm in September, it's substantially much more weighted to Curation today. Yeah. That's incredible. I mean, when you're thinking about some of these customer-based, like, are they using security today for their binary management, or are they not using any tool at all? Or, like, so how do you think about. Everyone has security. Are you displacing another tool that maybe is not strong enough to handle the npm attack? As it relates to npm and that attack, curation has no alternative. Okay. There was not an alternative to Curation. It was a product that we developed at the behest of some of our customers because why was it created originally? It was created because I, as an organization, did binaries in one of two ways. I either brought in everything and scanned them through Xray and knew what was malicious and what wasn't malicious and then went from there. Or in some of these large financial institutions, I allowed nothing in, and the developer had to, you know, make an application to have this package approved and hope it was approved by the time the software that he was building was done. And they came to us and said, "Hey, it would be great if we could have some type of centralized control over what packages are brought in an organization." And the other thing I'm kind of alluding to you guys that you should watch curation for is the fact that as code quality starts to get better from these coding assistants, and I think there was some impact from that. I can't point to it or show you what code was created by a machine or a human, but I think we know publicly some of our customers are starting to experiment in utilizing these coding assistants. If I want to start turning the machines more free in my organization, Curation is certainly a step I need to go in because at that point then, I have Curation. It's integrated with my IDEs in GitHub. It's integrated with AI Catalog and Artifactory, and I know that to the extent that the machine is building, it's only going to be building with packages that I allowed into the organization. So yeah, we recently hosted a call with the CEO of Sonar. Mm-hmm. A code quality tool. Is that, I mean, obviously there's a key difference between, like, code security and code quality? Mm-hmm. Would that ever be an interesting aspect of expansion for JFrog? One of the technologies that we offer in our advanced security, it's static code analysis, the SAST technology, which is generally a source code-based security. You know, that being said, I think that our chops are still much more binary-based, and you know, in the relationship we have with GitHub, we're not conceding anything, but certainly when 80% of our customers use GitHub and JFrog, the easier lift, and I don't have, you know, Ed doesn't have a contra account to basically make this as a revenue equation, right? But the easier lift is to say, "Hey, Joe, CISO, replace all these tools with GitHub and JFrog security and let GitHub do what it does really well in source code and let JFrog do what it does really well in binaries." And I think you heard something similar to that out of GitHub Universe over the last few weeks where, you know, the GitHub employees by no means are waving any white flag publicly to say that we've conceded binaries to JFrog. But I think there was rumblings if you were there and you were attending and speaking to those individuals that, you know, we recognize that JFrog is, in fact, a binary expert and does those very well, which allows us to turn and focus on the business that we do, which is source code. Yeah. No, actually, I was there too, and that's the only thing I heard. I guess just going back to SwampUp, there was a ton of announcements at the conference. Like, definitely one of the more exciting conferences and SwampUps in JFrog's history. Maybe can you just walk through some of those announcements? So JFrog Fly I thought was really interesting. Mm-hmm. And diving into the SMB customer base, which is a little bit absent from your enterprise queue historically, and then maybe AppTrust and then AI Catalog. Maybe what could that drive in 2026? Obviously still early on in this customer journey with some of these products, but how do we think about some of the motions with each of those products? Yeah. I know. Thanks for bringing that up, Eamon. I mean, I think it was a very successful wrap-up. I mean, let's start with Fly where there's been a lot of questions about it. Excuse me, but there's, I think, that's probably the furthest from revenue contribution, and what is Fly? Fly is something that we're creating so that we can better understand software development in the agentic world, and what we mean by that is that you could now, binaries are for companies that have very complex software development organizations that become a pain point, but you could become a very. Excuse me. I got a little phlegm in my throat, but you could very much become a complex development organization as an agentic firm. A firm that is a startup last year with 50 guys, that could be a startup now with two guys and 48 machines in the future in the world of agentic AI. And what we want to understand is how they're utilizing, interfacing with Artifactory open-source packages. Are they complex in nature but only using a few programming languages? So an Artifactory like that could be tied with Fly is the right method forward. I think what Fly is going to do for us is have real-world deployments, real-world kind of knowledge about how to handle some of these agentic capabilities, and then bring them into the enterprise and say, "We've already done this with this customer over here. And what you're talking about trying to do, let us bring and help it to you and bring it into the Enterprise Plus program." Maybe later, a few years down the road, there may be some way to monetize that as an add-on or something additional to the JFrog Platform. I think that, as you know, the biggest thing that got back to me even in not being able to attend SwampUp this year but was AppTrust. And that after that presentation, the customer feedback that many of you heard in speaking with our customers about that DevGovOps product, right? It's now bringing the operations organization into the JFrog Platform and putting inside the development process the checks to know that each of these gates have, in fact, been completed and that there's a digital record of that, not the way it's done today manually through Excel or, "Yeah, I think it's good enough, so Eamon, let me sign that DocuSign and say it's good enough." you know, as it relates to AI Catalog, that's, you know, you heard me talk about that earlier. Why is that important? That's going to be very important for large language models and software development in general because that's your Wikipedia of binaries. So in that scenario I talked about where you integrate Curation and Copilot, and maybe that could be other coding assistants in the future, and that's integrated into your CI/CD flow. You're able to go into the Catalog and say, "Okay, here's my build. What were the last five builds? Okay, this is the package that I was using." And so now go into Artifactory and grab that package. So basically, AI Catalog is the world exploding in terms of the volume of packages used and code creation is going to give you a constant evolving database of what is going on in the world of open-source packages. So as you do move to more of a machine-generated type code generation, this machine will have a database of which to go back and check, you know. What is this package? What was it used for? How have we used it in the past? Is that applicable to the application I'm building today? I guess to my knowledge, there's no other company innovating on those types of products today. Like, how should we think about the initial pipeline generation that you've seen and then, particularly for AppTrust and AI Catalog, how should we think about the pricing and monetization aspect of that? Yeah. Good question. We'd love your feedback on that because those are things that we're still working on right now, better trying to understand how we, in fact, monetize AppTrust to generate this groundswell that seems to be growing post-SwampUp for this product given there really wasn't a product such as this, this AppTrust product. I don't know that it's going to be a major contributor to 2026. I don't think AI Catalog is either. I still see 2026 being very similar to the fact that as long as we continue to execute, I think the drivers remain somewhat constant. You know, we are in a very fast-changing world. Things could evolve in a quarter two. but as we sit here today, I think it's going to be much more consumption-driven if we're moving more to, you know, code development through coding assistance and the adoption of our security. Yeah. I mean, I think as you think about the future, maybe the next 18 to 24 months, how might that growth levers look like compared to maybe the first three months of this year? They were primarily driven by, I guess, security, commitment above, like, usage above your commitment. Yeah. And then maybe some larger deals. Like, any change in momentum that you could expect or? No. I think we chug along, and I came up with this, and it may be just, you know, basic, but, you know, it's our Lego strategy, right, where you have the base platform as your core Lego, and now you're adding on to those Legos to add not only new incremental revenue opportunities for JFrog, but value to the customer and incremental value to retention for us as well, so I can add on security. I can add on AppTrust. I may take MLOps out of the subscription at some point in the future and monetize that separate as an add-on. I might do that with Fly, so I think what we're trying to do is constantly evolve and become more to our customers than just the basic infrastructure level. The way that you retain and keep customers and maintain a gross retention rate of 97% like we do is you are that core plumbing, but you want to make sure there's no reason that they ever want to look to replace you because you continue to add value each year with new technology that you add to that platform. Is that platformization like the key driver of the strong retention that you're not just the binary management product? Security aspect, there's scanning, there's vulnerability management. Like, is that the key aspect, the architectural moat that I think we talked about a lot with JFrog compared to something like a GitLab package or even like the package offering that GitHub has or even like a Sonatype. I think it is. And the reason I say that is even, you know, us. I mean, three years ago it was a totally different sale process. We were selling the Artifactory into a group, and that's how the industry kind of was purchasing things to where now we had seen this evolving nature turning to a platform of the key aspects of software delivery, you know, source code, binaries, observability runtime. And I think now the difference in buying is, and you see it. And in Q3, we landed a new oil and gas logo customer that was a seven-figure land. That is a whole new world for us. And why was that? Because when customers start to buy on platforms, they already kind of have an idea of who the leaders are in each of those sectors. And thus they know that they're going to likely need to commit and use those leaders, and they're willing to commit at a bigger land than they would have when it was a JFrog Artifactory product that I'm testing out in my group to demonstrate that it offers productivity gains. And that's kind of what I'm buying is a point product versus now I'm buying a platform. And what has platforms also done? It's recognized that you're the leader, so I'm willing to sign a three-year deal with you as well that has incremental step-ups for the use of either developers in terms of the seat count for security or my commitment to consumption in the cloud. That's what happens when you start centralizing on platforms and consolidating these point solutions. Yeah. Definitely. Which I'm a little bit like a multi-product story for JFrog in the last 12 months. I guess just thinking about some of the recent momentum with, like becoming an LLM repository of record. Mm-hmm. I think you mentioned earlier this week like 3/5 of the big native AI companies are customers of JFrog. Yep. Can you just talk a little bit about that sale, what they're adopting? Initially, I know that one of the customers doubled their license with JFrog in Q2 after signing in Q1. Mm-hmm. I guess just talk about that sale a little bit and where that could go. Yeah, so I'll quickly try to cover that here in the time we have, and, you know, yes, we do have three of the five kind of native AI, you know, foundational model type companies that you all know as customers. I tend to say that one, people ask me now about the other two where I don't think I have as much visibility as to where they're headed, and that's something for me to go back and speak with the team about a little bit more, but I think one's obviously, you know, led to much more excitement and interest, within not only in the investor group, but certainly with what they brought to JFrog and what they're looking to do, and that particular native AI customer had tried originally to build something Artifactory-like on their own and failed. Thus we didn't even know that they would be an opportunity and approached us in January and started talking to us about what their vision was of where they wanted to drive, what they were going to do, and how they would use Artifactory. The nerds inside JFrog started hip-hopping around all across the lily pads because of all the new exciting things that these guys were talking about, you know, doing with Artifactory. It was very unique in nature. You know, we see these guys, which ironically, you know, a lot of these native AI guys for other people are in the cloud. For us, it's a self-hosted deployment because the ultimate goal for this customer is to build their own data center. And if we're able to continue on and keep winning and prove out that we are in fact the model registry of choice for them, building a model as a service type offering to where they will maintain how secure and constantly train and update, you know, thousands of large language models, which will then be utilized by other corporations in kind of a build versus buy scenario in which I may take a few of their models because those models work very well in writing the source code for my organization. And those models will be trained constantly. And what's the core aspect there is JFrog Artifactory, keeping track of every change, every update, every movement, every security aspect. So when things go wrong, where am I going to go? I'm going to go directly to Artifactory to see if I'm at risk. This is the few minutes we have left, the upcoming 2026 guide. Mm-hmm. Recently got a Q4. Can you just help me understand maybe how you're thinking about, with all this momentum, how you're thinking about your guidance philosophy? I know you've added as changed the philosophy over the last six quarters to not guide above-use commitments and then not include some of the large cloud migrations. Yep. Will that continue? Any color maybe you could provide for the upcoming guide? Yeah. Sure. No. You did a great job on the interlude there in terms of, yeah, I think that what we have found to be beneficial for us is that, and Ed kind of taking hold of the guidance philosophy and making it his own as he took the reins in 2024 as the CFO of the company is that, you know, guiding to commits is what we really have the core visibility to because in our usage-based model, you could go over, but you could say, "Hey, I still bought the right amount of cloud. We just had a new project," or in this case, the npm attack. And that caused me to go over, "I'll pay the overage, JFrog, but then I'm going to go back to my minimum commit." And so that's why it's very hard for us to try to predict usage, not to mention that there's a disconnect between the procurement team negotiating the contract, the developer doing what he's told, and just developing and consuming the consumption. There's no real, you know, correlation between all of those groups and what's going on. So we think the best way to guide you guys now is to guide you on what we have signed or committed in contracts. And, you know, you saw us talk about a floor as it relates to our net dollar retention of 116. Well, we're at 118. Why would you say 116? 116 gives you an idea of the fact of what the business looks like if we have no overusage and no real uptake of incremental security. 118 is a year of 2025 in which we've benefited from strong security adoption and strong consumption trends. Now, as we guide 2026, those strong consumption trends may in fact continue. This is debate I have with investors sometimes, but it's not something that we're going to forecast. We are going to continue to stay towards the commitments and to the extent that we think that there's opportunities, then deliver upside through overages. Awesome. Well, Jeff, thanks for being here. As Schreiner says, may the fog be with you. Thank you. Thank you for having us, Eamon. Yeah. Absolutely, man. Good to see you.