JFrog Curation Redefines “Shift Left” Security for Enterprise Software Supply Chains

New product delivers centralized governance for automatically blocking malicious open-source packages and vulnerabilities from entering organizations

SUNNYVALE, Calif.--(BUSINESS WIRE)-- JFrog Ltd. (Nasdaq: FROG), the Liquid Software company and creators of the JFrog Software Supply Chain Platform, today introduced JFrog Curation, an automated DevSecOps solution designed to thoroughly vet and block malicious open source or third-party software packages and their respective dependencies before entering an organization’s software development environment. Natively integrated with JFrog Artifactory binary repository, JFrog Curation is unique in its use of binary metadata for identification of malicious packages with higher-severity CVEs, operational, or license compliance issues - removing the need to download each package for scanning before use, which preserves developer speed and ease.

JFrog Curation Redefines "Shift Left" Security for Enterprise Software (Graphic: Business Wire)

"Software developers use millions of open source components to accelerate project delivery and gain a competitive edge, but this practice could be abused to inject malicious packages and vulnerabilities to the code - increasing the risk of software supply chain attacks,” said Asaf Karas, CTO of Security, JFrog. “Application security must be taken seriously and looked at holistically from the point of creation through runtime on edge devices. JFrog Curation takes the ‘shift left’ concept to the next level by automatically blocking use of risky open source software packages before entry to an organization, drastically reducing a company’s overall attack surface without compromising on speed or the developer experience.”

The use of open source software for development of commercial applications is now mainstream, with 87 percent of respondents to an IDC survey indicating open source would be their first choice over other commercial options.¹ However, in 2022, more than 10 million people were impacted by software supply chain attacks targeting roughly 1,700 entities worldwide – nearly all of which included some element of faulty or nefarious open source code.²

"Security incidents such as log4Shell, Spring4Shell, etc., have taught us that what's safe today may not be safe tomorrow when using public open source libraries," said Jim Mercer, IDC Research Vice President of DevOps and DevSecOps. "A tool that simplifies the developer experience while ensuring packages comply with established, regularly updated security policies, and are validated against relevant vulnerability databases, is essential for securing modern DevOps workflows."

JFrog Curation also validates incoming software packages against JFrog’s Security Research library of recorded Critical Vulnerabilities Exposures (CVE) and publicly available information to help establish a trusted repository of pre-approved, third-party software components for use in development. By effectively bridging public package repositories, developers, production, and security personas, JFrog Curation helps improve efficiency while preventing time-consuming and costly remediation efforts later.

JFrog Curation is designed to enable developers, security leaders, and DevSecOps engineers to:

• Vet and block open source software components without compromising the developer experience or speed.
• Have central visibility and governance of every open source package requested by a developer or build tool with accurate, metadata-based insights on all infected packages, with actionable advice on ways to remediate.
• Create a comprehensive and transparent audit trail to help organizations comply with current and emerging regulatory requirements.
• Optimize the developer experience with frictionless, validated software component retrieval.
• Avoid the unruly sprawl of various tool suites through its integration with the JFrog Software Supply Chain Platform, which provides consistent, automated processes across development environments.

To learn more about how JFrog Curation defends your software supply chain read this blog, visit https://jfrog.com/curation, or join us for an informative product overview webinar, “Seamlessly Curate Software Packages Entering Your Organization,” on Tuesday, July 25, 2023, at 10 a.m. PDT / 1 p.m. EDT. Interested parties can also see JFrog Curation in action at booth 1781 during Black Hat Las Vegas, taking place Aug. 5-10, 2023 at the Mandalay Bay Convention Center. Follow us @JFrogSecurity for more details on JFrog Curation and activities during the show.

Like this story? Tweet this: .@jfrog unveils JFrog Curation - redefining #shiftleft #security for enterprise #softwaresupplychains. Learn more: http://bit.ly/46LSe3y #developers #DevOps

About JFrog

JFrog Ltd. (Nasdaq: FROG), is on a mission to create a world of software delivered without friction from developer to device. Driven by a “Liquid Software” vision, the JFrog Software Supply Chain Platform is a single system of record that powers organizations to build, manage, and distribute software quickly and securely, ensuring it is available, traceable, and tamper-proof. The integrated security features also help identify, protect, and remediate against threats and vulnerabilities. JFrog’s hybrid, universal, multi-cloud platform is available as both self-hosted and SaaS services across major cloud service providers. Millions of users and 7K+ customers worldwide, including a majority of the Fortune 100, depend on JFrog to secure their mission-critical software supply chains. Once you leap forward, you won’t go back! Learn more at jfrog.com and follow us on Twitter: @jfrog.

Cautionary Note About Forward-Looking Statements

This press release contains “forward-looking” statements, as that term is defined under the U.S. federal securities laws, including but not limited to statements regarding JFrog Curation and its technology, capabilities, advantages, and features, as well as statements made by JFrog’s executives and customers. These forward-looking statements are based on our current assumptions, expectations and beliefs and are subject to substantial risks, uncertainties, assumptions and changes in circumstances that may cause JFrog’s actual results, and the performance or achievements of its products, to differ materially from those expressed or implied in any forward-looking statement. There are a significant number of factors that could cause actual results, performance or achievements, to differ materially from statements made in this press release, including but not limited to risks detailed in our filings with the Securities and Exchange Commission, including in our annual report on Form 10-K for the year ended December 31, 2022, our quarterly reports on Form 10-Q, and other filings and reports that we may file from time to time with the Securities and Exchange Commission. Forward-looking statements represent our beliefs and assumptions only as of the date of this press release. We disclaim any obligation to update forward-looking statements.

^{___________________________
1} IDC, “DevOps and Accelerated Application Delivery Survey”, IDC #US47225621, January 2022.
² https://www.idtheftcenter.org/wp-content/uploads/2023/01/ITRC_2022-Data-Breach-Report_Final-1.pdf

View source version on businesswire.com: https://www.businesswire.com/news/home/20230712412540/en/

Media Contact:

Siobhan Lyons, Sr. MarComm Manager, JFrog, siobhanL@jfrog.com

Investor Contact:

Jeff Schreiner, VP of Investor Relations, jeffS@jfrog.com

Source: JFrog Ltd.