Research · Sep 3, 2026
[FROG] JFrog Thesis 2026: Artifactory Becomes the System of Record for the Software Supply Chain
JFrog Ltd. (NASDAQ: FROG) is an Israel-founded, US-listed DevOps / software-supply-chain platform company, founded ~2008-2009 by Shlomi Ben Haim, Yoav Landman and Fred Simon, NASDAQ-listed since 2020, headquartered in Sunnyvale California and Netanya Israel. FROG enters FY2026 with FY2025 revenue ~$0.42-0.52B (+18-28% YoY off ~$0.43B FY2024) and adj. EPS ~$0.55-0.85 (non-GAAP; approaching/at GAAP profitability), reflecting self-managed (on-prem/private-cloud) subscription revenue plus JFrog Cloud (SaaS) subscription revenue (the growth vector) plus security (Xray, Advanced Security, Curation) attach plus JFrog ML (MLOps) revenue, all under co-founder-CEO Shlomi Ben Haim (~14-16 year tenure, architect of the 'liquid software'/DevOps-platform strategy, the cloud transition, the security upsell and the Qwak/JFrog ML acquisition). The first thesis pillar is the Artifactory + JFrog Cloud Platform pipeline (~$0.36-0.45B revenue, ~80-88% revenue mix): Artifactory — the universal binary/artifact repository, the 'system of record' for software packages, container images, Helm charts and ML models across all package types (Maven, npm, PyPI, Docker, NuGet, Go, Conda, Cargo, Hugging Face models and more), the central node in the software supply chain that every build pulls dependencies from and pushes artifacts to, deployed hybrid/multi-cloud (self-managed on-prem/private cloud or JFrog Cloud SaaS) with enterprise-grade HA, replication and access control — plus JFrog Cloud, the SaaS deployment that is the growth vector (cloud revenue growing faster than self-managed, cloud mix rising toward ~40%+, hybrid consumption+subscription pricing, lower friction to adopt and expand), Distribution/Pipelines/CI-CD adjacencies and the unified JFrog Platform (DevOps + DevSecOps + MLOps); net revenue retention runs ~115-120%+ (the expansion engine — seats, package types, cloud, security modules), $100K+ and $1M+ ARR customer cohorts grow (the latter faster), and non-GAAP gross margin is ~75-80%+; FY2026 catalyst is ~$0.43-0.55B platform subscription revenue (+18-26%) with cloud mix toward ~40-45% and AI/ML model artifacts as a new package class. The second pillar is the Security (Xray + Advanced Security + Curation) + JFrog ML pipeline (~$0.06-0.10B+ revenue, the high-growth high-value upsell layer): Xray (software composition analysis — vulnerability/CVE and license scanning, deep recursive dependency scanning, 'shift-left' security on the binaries Artifactory already holds), Advanced Security (secrets detection, IaC security, container/contextual analysis on which CVEs are actually exploitable, malicious-package detection — the premium DevSecOps tier), Curation (proactively blocking known-malicious open-source packages at the proxy/download layer — addressing typosquatting, dependency confusion and malicious updates) and JFrog ML (the Qwak acquisition ~2024 — MLOps/model management, storing/versioning/serving/monitoring ML models alongside software artifacts, the AI/ML supply-chain extension with AI-model curation/security); security-module penetration of the Artifactory base is still low (a large runway), with SBOM mandates, US executive orders on software supply chain and the EU Cyber Resilience Act as regulatory tailwinds, and JFrog ML cross-selling into the enterprise AI buildout; FY2026 catalyst is security ARR outpacing the platform plus JFrog ML AI cross-sell lifting NRR and ARR-per-customer. The capital story: no dividend (growth-reinvestment, capital efficiency), no/minimal buybacks (early-stage; a small SBC-offset buyback is possible as cash flow matures), a net-cash position (~$0.4-0.6B+ cash and investments; no/minimal debt — IPO proceeds plus cash generation), ~$0+ net leverage, a non-rated/self-funded credit profile, ~115-125M diluted shares (SBC-driven dilution plus the Qwak equity — a watch item) and positive free cash flow; the GAAP-profitability inflection (operating leverage plus SBC discipline) is the FY2026 lever. At ~$25-50 per share on ~115-125M shares (~$3-6B equity, ~$2.5-5.5B EV) FROG trades at ~6-12x EV/Sales and ~30-60x non-GAAP P/E versus developer-tools/DevSecOps/infra-software peers GitLab, Atlassian, Datadog, HashiCorp, Confluent, Sonatype (the direct Nexus Repository/Nexus Lifecycle competitor), Snyk, GitHub and the cloud-provider native registries. FY2026 base case is ~$0.50-0.62B revenue (+18-26%) + ~$0.55-0.85 non-GAAP EPS + ~115-120%+ NRR + cloud mix toward ~40-45% + positive FCF + the GAAP-profitability inflection; bull case ~$0.55-0.70B revenue + a multiple re-rating toward a 'system-of-record-for-the-software-supply-chain' valuation on faster cloud growth, NRR holding ~118-122%, $1M+ ARR cohort expansion, AI/ML model artifacts as a new class, sharply rising security penetration with SBOM/regulatory tailwinds, Curation high growth, JFrog ML riding the AI buildout and operating leverage delivering durable GAAP profitability; bear case ~$0.48-0.55B revenue + ~$0.40-0.60 non-GAAP EPS on GitHub/GitLab platform-consolidation and cloud-provider native-registry bundling commoditizing the standalone repository value prop, Sonatype/Snyk competition on both repository and security, NRR deceleration toward ~108-112% on IT-budget pressure, the cloud-mix gross-margin headwind, Qwak/MLOps execution misses in a crowded space, AI-coding-agent workflow disruption and SBC-driven share-count creep. The thesis depends on the Artifactory + JFrog Cloud Platform pipeline plus the Security (Xray + Advanced Security + Curation) + JFrog ML pipeline plus Artifactory as the software-supply-chain system of record plus all package types plus the JFrog Cloud SaaS growth vector plus ~115-120%+ NRR plus the security/ML upsell plus SBOM/regulatory tailwinds plus the AI/ML supply-chain extension plus the net-cash balance sheet plus the path to durable GAAP profitability and Shlomi Ben Haim's platform, cloud and security execution.