JFrog Unveils First Runtime Security Solution to Deliver Complete Software Integrity and Lineage from Code to Cloud

Rhea-AI Summary

JFrog (Nasdaq: FROG) has unveiled JFrog Runtime, a new security solution that integrates security throughout the entire software development lifecycle. This addition to the JFrog Platform enables organizations to:

1. Monitor Kubernetes clusters in real-time
2. Identify and address security incidents based on actual risk
3. Ensure image integrity and meet compliance requirements

The solution aims to bridge the gap between developers and security teams, automating DevSecOps tasks to save time and strengthen security for cloud-native applications. According to an IDC survey, organizations spend an average of $542 per week per developer on security-related tasks, totaling $1.89 million annually. JFrog Runtime addresses this by offering features such as real-time vulnerability visibility, accelerated triage, and comprehensive analytics for Kubernetes clusters.

Positive

• Introduction of JFrog Runtime, enhancing end-to-end security capabilities
• Real-time monitoring and security incident prioritization for Kubernetes clusters
• Potential time and cost savings for organizations in security-related tasks
• Integration of AI/ML model curation and secure OSS catalog features

Negative

• None.

Insights

Tech Expert

JFrog's new Runtime security solution marks a significant advancement in DevSecOps. By integrating security across the entire software development lifecycle, it addresses critical gaps in cloud-native application protection. The real-time vulnerability visibility and advanced prioritization features are particularly noteworthy, potentially reducing incident response times and improving overall security posture.

The solution's focus on Kubernetes cluster analytics is timely, given the growing adoption of containerized applications. This could be a game-changer for organizations struggling with cloud security complexities. However, the true test will be in its seamless integration with existing workflows and its ability to minimize false positives, which often plague security tools.

Financial Analyst

JFrog's expansion into runtime security could positively impact its market position and financial performance. The IDC survey cited in the article suggests a substantial market opportunity, with companies spending an average of $1.89 million annually on security-related tasks. If JFrog can capture even a small portion of this market, it could lead to significant revenue growth.

Moreover, by offering a more comprehensive security solution, JFrog may increase its customer retention and upselling opportunities. However, investors should monitor adoption rates and the competitive landscape, as the DevSecOps market is rapidly evolving and highly competitive.

Market Research Analyst

JFrog's Runtime solution addresses a critical market need, as evidenced by the statistic that 20% of applications have high to critical issues during execution. This aligns with the industry trend towards more integrated, 'shift-left and shift-right' security approaches. The emphasis on automating DevSecOps tasks and improving collaboration between developers and security teams is particularly relevant given current market demands.

However, JFrog will need to differentiate its offering in a crowded market. The success of this product will likely depend on its ability to demonstrate tangible time and cost savings for development teams, as well as its effectiveness in reducing security incidents in real-world deployments.

Complete software lifecycle security enables organizations to simultaneously shift left & right, helping developers save time with quick threat detection and risk remediation

SUNNYVALE, Calif. & AUSTIN, Texas--(BUSINESS WIRE)-- JFrog swampUP— JFrog Ltd. (“JFrog”) (Nasdaq: FROG), the Liquid Software company and creators of the JFrog Software Supply Chain Platform, today announced the addition of JFrog Runtime to its suite of security capabilities, empowering enterprises to seamlessly integrate security into every step of the development process, from writing source code to deploying binaries into production. The JFrog Platform streamlines collaboration between developers and security teams, automating DevSecOps tasks to save time and strengthen security for modern, cloud-native application development. It equips teams to monitor Kubernetes clusters in real time, enabling them to identify, prioritize, and quickly address security incidents based on actual risk. Additionally, it helps ensure image integrity and helps meet compliance requirements effectively.

First Runtime Security Solution with Integrity & Lineage from Code to Cloud (Photo: Business Wire)

“As organizations increasingly shift left to combat today’s growing threat landscape, the disconnect among siloed tools places additional strain on developers, security, and MLOps teams,” said Asaf Karas, CTO of JFrog Security. “Companies can alleviate this burden by adopting a unified platform that provides end-to-end visibility, remediation, and traceability across the development and security processes. By empowering DevOps, Data Scientists, and Platform engineers with an integrated solution that spans from secure model scanning and curation on the left to JFrog Runtime on the right, organizations can significantly enhance the delivery of trusted software at scale.”

A recent IDC survey sponsored by JFrog found that organizations spend an average of $542 per week per developer on security-related or DevSecOps tasks, equating to $1.89 million annually. Developers want to focus on coding, while security teams prioritize risk mitigation. JFrog Runtime empowers users to track and manage packages from various origins, organize repositories by environment types, and activate JFrog Xray policies, ultimately fortifying security from code to runtime. As part of the JFrog Platform, Runtime also addresses the visibility and alignment gaps among teams, optimizing version control and package development, while ensuring R&D, DevOps, and security teams can collaborate effectively and efficiently, saving developers hours of valuable time.

“Runtime security is critical for our customers as it ensures that their applications remain protected while in operation. With the increasing complexity of cloud environments and the rise of containerized applications, real-time visibility into potential vulnerabilities is essential,” said Paul Goldman, CEO, iTMethods. “JFrog Runtime will help enhance our customers' security posture by allowing them to rapidly detect and respond to threats, thus safeguarding their data and maintaining trust in their cloud services.”

Industry research shows that one in five applications contain runtime exposure, with 20 percent of all applications having high, critical, or apocalyptic issues during the execution stage. By automating security for fast-moving, dynamic applications like those that run in containers, JFrog Runtime security addresses the unique visibility and insight needs of cloud-native environments.

Key features and benefits of JFrog Runtime include:

• Real-Time Vulnerability Visibility: Gain real-time insights into vulnerabilities within your runtime environment.
• Accelerated Triage with Advanced Prioritization: Streamline the identification and prioritization of security incidents based on their business impact.
• Reduced Risk Through Exposure Management: Quickly identify the source and ownership of vulnerable packages, enabling faster risk mitigation.
• Protection for Cloud-Based Workloads: Aid in safeguarding applications with continuous monitoring for post-deployment threats such as malware attacks and privilege escalation.
• Comprehensive Analytics for Kubernetes clusters: Enable continuous runtime evaluation of workloads and containers for real-time vulnerability detection and alignment to the corresponding processes and files within JFrog Artifactory.
• Centralized Incident Awareness: Maintain a consolidated view of your runtime environment to facilitate accurate incident identification and response.

"A platform that unifies security across the software supply chain from development to production can provide critical visibility and traceability that developers and DevSecOps teams need to manage and remediate risks effectively," said Katie Norton, research manager, DevSecOps and Software Supply Chain Security at IDC. "JFrog's addition of runtime security supports a shift-left and shift-right strategy, fostering comprehensive protection and streamlined processes that lessen the strain on development and security teams.”

JFrog Runtime complements JFrog’s already robust suite of advanced security capabilities including:

• AI/ML Model Curation: JFrog Curation helps defend your software supply chain by enabling early detection and blocking of malicious ML Models retrieved from open-source repositories like Hugging Face before they even enter your organization. JFrog’s universal, scalable security platform also natively proxies Hugging Face allowing developers to access open source AI/ML models while simultaneously detecting malicious models, block their use if needed, and enforcing license compliance to enable safer use of AI.
• Secure OSS Catalog: The JFrog open-source software (OSS) package catalog provides a “search engine for software packages” using the JFrog UI or via API. Backed by both public and JFrog data, the OSS Catalog gives users quick insight into the security and risk metadata associated with all OSS packages.

For additional information on JFrog Runtime and the entire suite of JFrog security solutions visit https://jfrog.com/runtime. You can also read this blog and register to join JFrog security experts for a webinar deep diving into JFrog Runtime capabilities on October 2 and 15, 2024 at a time that works best for you.

Like this story? Post this on X (formerly Twitter): .@jfrog unveils industry’s first Runtime solution that integrates #security at every development stage, from source code to production. Learn more: https://jfrog.co/3THB7Lp #SoftwareSupplyChain #DevSecOps #SDLC

About JFrog

JFrog Ltd. (Nasdaq: FROG) is on a mission to create a world of software delivered without friction from developer to device. Driven by a “Liquid Software” vision, the JFrog Software Supply Chain Platform is a single system of record that powers organizations to build, manage, and distribute software quickly and securely, to aid in making it available, traceable, and tamper-proof. The integrated security features also help identify, protect, and remediate against threats and vulnerabilities. JFrog’s hybrid, universal, multi-cloud platform is available as both self-hosted and SaaS services across major cloud service providers. Millions of users and 7K+ customers worldwide, including a majority of the Fortune 100, depend on JFrog solutions to securely embrace digital transformation. Once you leap forward, you won’t go back! Learn more at jfrog.com and follow us on Twitter: @jfrog.

Cautionary Note About Forward-Looking Statements

This press release contains “forward-looking” statements, as that term is defined under the U.S. federal securities laws, including, but not limited to, statements regarding our expectations with respect to the runtime security product to its suite of security capabilities to integrate security into the development process.

These forward-looking statements are based on our current assumptions, expectations and beliefs and are subject to substantial risks, uncertainties, assumptions and changes in circumstances that may cause JFrog’s actual results, performance or achievements to differ materially from those expressed or implied in any forward-looking statement. There are a significant number of factors that could cause actual results, performance or achievements to differ materially from statements made in this press release, including but not limited to risks detailed in our filings with the Securities and Exchange Commission, including in our annual report on Form 10-K for the year ended December 31, 2023, our quarterly reports on Form 10-Q, and other filings and reports that we may file from time to time with the Securities and Exchange Commission. Forward-looking statements represent our beliefs and assumptions only as of the date of this press release. We disclaim any obligation to update forward-looking statements except as required by law.

View source version on businesswire.com: https://www.businesswire.com/news/home/20240910827937/en/

Media Contact:

jfrog@bocacommunications.com



Investor Contact:

Jeff Schreiner, VP of Investor Relations, jeffS@jfrog.com

Source: JFrog Ltd.

FAQ

What is JFrog Runtime and how does it enhance software security?

JFrog Runtime is a new security solution that integrates security throughout the entire software development lifecycle. It enables real-time monitoring of Kubernetes clusters, helps identify and address security incidents based on actual risk, and ensures image integrity while meeting compliance requirements.

How much do organizations typically spend on security-related tasks according to the IDC survey mentioned in the JFrog (FROG) press release?

According to the IDC survey sponsored by JFrog, organizations spend an average of $542 per week per developer on security-related or DevSecOps tasks, which amounts to $1.89 million annually.

What are some key features of JFrog Runtime announced by JFrog (FROG)?

Key features of JFrog Runtime include real-time vulnerability visibility, accelerated triage with advanced prioritization, reduced risk through exposure management, protection for cloud-based workloads, comprehensive analytics for Kubernetes clusters, and centralized incident awareness.

How does JFrog (FROG) address AI/ML security in its platform?

JFrog addresses AI/ML security through JFrog Curation, which enables early detection and blocking of malicious ML Models from open-source repositories like Hugging Face. It also provides a secure OSS catalog that offers insight into the security and risk metadata associated with all OSS packages.