About JFrog
JFrog provides a platform described as the single source of truth for the agentic software supply chain. It includes functions for securing software, governing AI agents, and automating compliance.
Used for
- Detecting secrets with a fine-tuned AI model that reads application context.
- Applying the DORA compliance framework to pipelines automatically.
- Replacing vulnerable packages automatically with verified patched versions.
- Detecting AI assets such as MCP servers and agent skills running on developer workstations.
Who it is for
- Built for companies of all sizes, including large enterprises.
- Used by customers across multiple industries.
- Used by over 80% of the Fortune 100.
From JFrog's own website, read 2026-10-23. How we build listings.
How to evaluate Artifact & Package Management
This is how the CIOPages Research Team evaluates this category. It is not an assessment of JFrog. It comes from our Container Registry & Artifact Management buyer guide.
25%
Supply-Chain Security & Provenance
Built-in vulnerability scanning (and whether it scans the binary or just the manifest), Cosign/Notation signing with content-trust enforcement, SBOM generation and storage (CycloneDX / SPDX), SLSA-style build provenance and attestation, and proactive quarantine of malicious or typosquatted dependencies before they enter
20%
Artifact & Format Breadth
Container/OCI plus the language ecosystems you actually use (npm, Maven/Gradle, PyPI, NuGet, RubyGems, Go, Helm, Debian/RPM); OCI-artifact support for non-image content; remote/proxy and virtual (aggregating) repositories; and whether one platform covers everything or you stitch several together
15%
Access Control, Multi-Tenancy & Governance
SSO/SAML/OIDC and SCIM, fine-grained and project-scoped RBAC, immutable tags and retention/cleanup policies, environment-promotion gates (dev→staging→prod), tamper-evident audit logging, and compliance posture (SOC 2 Type II, ISO 27001, FedRAMP where relevant)
15%
Distribution, Performance & Availability
Pull-through caching of upstream registries, geo-replication / edge distribution to your runtime regions, deduplication and storage efficiency, high availability and DR, and pull latency and throughput under CI burst and large-image load
15%
CI/CD & Platform Integration
Native hooks into your CI (GitHub Actions, GitLab, Jenkins, Argo), Kubernetes admission-control and OIDC-based keyless auth, webhooks/events, a complete REST API and Terraform provider for IaC, and cloud IAM integration if you live in one provider
10%
Operations & Cost Model
Self-managed vs. SaaS effort, upgrade and HA burden for self-hosted options, and how the meter works — per-user, storage, egress/data-transfer, or per-scan — because the unit of billing, not the headline rate, decides what you pay as pulls and image counts grow
Other Artifact & Package Management Vendors
View allCIOPages put this listing together from public sources. It’s information, not an endorsement. How we build listings. Work here? Claim this listing or .
Quick Facts
jfrog.com Pricing pageCategoryDevOps & Platform Engineering
SubcategoryArtifact & Package Management
DeploymentOpen-source, On-premise, Cloud
We publish a detail only when we can point at the page it came from. Know when JFrog was founded or where it is based? Send it to us, free.