JFrog Ltd. (NASDAQ: FROG) — The De-Facto Standard for Software Binaries, Re-Rated to Its Richest-Ever Price on Free Cash Flow That Isn’t Quite Free

Independent fundamental-research note. Report date: 2026-06-28. Price reference: $87.58 (2026-06-26 close).

⚡ Claude’s Take

This is the author’s own independent, subjective opinion. It is general information only and is not investment advice. The analysis that follows is deliberately position-free and sets no price target; this block is the single exception, fenced off as the author’s own judgment.

Verdict: HOLD / AVOID-buying-here — accumulate only on a meaningful pullback; NOT a short. Conviction: Medium. This is a genuinely excellent business — the category-defining, switching-cost-protected system of record for software binaries, now re-accelerating (+25.8% in Q1’26), with rising net dollar retention (120%), cloud past 50% of revenue, real operating leverage emerging, and a net-cash fortress. The problem is entirely the price. At ~$87.58 FROG sits at the 89th percentile of its own ~6-year valuation history (P/B at the 97th, never richer), at ~15.7x forward sales for a business management itself guides to grow ~18.5% — the second-richest forward multiple in the dev-tooling cohort on the slowest forward guide. The crux the bulls gloss over: the celebrated ~27% FCF margin is computed after adding back $156.7M of stock-based comp (29.5% of revenue — larger than the FCF itself), and with the share count still rising ~6%/yr (the first-ever buyback was only authorized in Feb-2026 and hasn’t bent the curve), owner free cash flow is roughly zero. You are paying a top-of-cohort multiple, in full, for cash flow that mostly accrues to employees rather than owners.

Framing: a quality-compounder-at-the-wrong-price / crowded-momentum setup — the mirror image of the cheap, abandoned quality names (Dynatrace, Atlassian) trading at single-digit own-history percentiles. The factor tape confirms it: beta 1.31, heavy Cloud-Computing (+0.72) and Growth (+0.53) loadings, +102% over twelve months, sitting essentially at its relative-strength peak — consensus long and crowded into strength behind a wall of June price-target raises ($88–$100). That is precisely the configuration where the embedded bar is highest and the asymmetry tilts down: the bull case is already fully in the price and the positioning. I’d put fair value around $60–75 (roughly 10–12x forward sales, where you’re paid for the quality without underwriting permanent re-acceleration and free SBC); I’d start accumulating sub-$65 and would not chase above the mid-$80s. It is not a short — shorting a net-cash, re-accelerating category leader at its momentum peak is a good way to get run over; this is a wait-for-the-pitch name, not a bet-against name. Tag: “the best binary repository in the world, priced as if its stock comp were free.”

Conviction: Medium. Flips bullish if SBC/revenue visibly falls toward the mid-teens and the diluted share count actually flattens (a real per-share owner-earnings inflection) while growth holds ~25% — at which point the multiple is defensible. Flips bearish if growth decelerates below ~18% for two-plus quarters or NDR rolls back toward ~115%, exposing the re-acceleration as a cyclical AI-capex pulse priced as permanent.

📈 Stock Price Action — Five-Year Event Map

Price moves below are FACT (from the five-year daily OHLC series); the attributed drivers are INTERPRETATION, cross-referenced to earnings dates, SEC 8-K events, and the news flow. No price target, no recommendation, no chart-pattern reading.

The five-year round-trip, in numbers. JFrog priced its IPO in September 2020 and first closed at ~$64.79 (2020-09-16, FACT). It then spent five years tracing a full bubble-and-recovery cycle: an early-2021 high of ~$69.93 (2021-01-27), a brutal 2022 collapse to an all-time-low close of ~$16.94 (2022-05-11) — a ~76% drawdown — followed by a slow three-year grind back (2023 high ~$34.93; 2024 high ~$47.64; 2025 high ~$68.98) that finally broke out in 2026 to an all-time-high close of ~$88.31 (2026-06-01). As of 2026-06-26 the stock sits at $87.58, roughly 0.8% off its all-time-high close, inside a 52-week range of ~$37.24–$89.16. In other words, FROG is not a falling knife or a recovering value name — it trades at the richest price of its entire public life, having essentially round-tripped its IPO-era valuation and then exceeded it. (All price points FACT.)

Cycle narrative.

1. IPO debut (Sep 2020). Priced at $44, opened ~$71 in the frothy 2020 software-IPO window, and first-closed at $64.79 — a valuation FROG would not durably revisit for over five years. (FACT on prices; INTERPRETATION that it was IPO-window euphoria.) 2–3. 2021–2022 collapse (−76% to the trough). A pure macro/multiple-compression event, not a business break — revenue grew +37% (FY21) and +35.5% (FY22) straight through the drawdown. The de-rate was the market repricing all unprofitable high-multiple SaaS as rates rose. (FACT: revenue grew; INTERPRETATION: macro, not fundamentals.) 4–5. 2023–2024 grind (FCF inflection). The stock’s recovery tracked the free-cash-flow inflection — FCF went $16.8M → $72.2M → $107.8M as the business demonstrated it could self-fund — but kept getting knocked back by software-wide drawdowns (Aug-2024). (FACT.) 6–7. 2025 surge then early-2026 dip. A +146% run off the April-2025 low on re-acceleration and rising NDR, reversed violently in a Jan–Feb-2026 software/AI-fear sell-off that took the stock from ~$60 to $34.75 with no company-specific catalyst. (FACT: the move; INTERPRETATION: cohort-driven.)
2. The Q1’26 print (+24% in one day, 2026-05-08). The single largest fundamental catalyst of the five years: revenue +25.8% YoY, NDR ticking to 120%, cloud crossing 50% of revenue, and the GAAP operating loss narrowing to −8.4%. This is the print that re-rated the stock. (FACT: print contents and the move; INTERPRETATION: causation.)
3. June analyst-PT wave to the all-time high. A clustered set of price-target raises (five desks to $88–$100) coincided with the broader software “Fab Five” momentum run, carrying FROG to its ATH close of $88.31 on 2026-06-01. (FACT: PT raises and the move.)
4. The 6/26 +11% spike. ~26M shares (≈8x the ~3.2M average) traded with no 8-K and no earnings — the fingerprint of a passive/index event; late-June timing points to the annual Russell index reconstitution layered on continued software momentum. (FACT: the volume and move; INTERPRETATION: Russell rebalance — no filing confirms the cause, OPEN QUESTION.)

1. Executive Summary

JFrog Ltd. sells the dominant universal binary/artifact repository — JFrog Artifactory, the de-facto “single source of truth” for the components from which modern software is assembled — and the security and AI/ML platform that has grown around it. It is a high-quality, ~97%-recurring subscription franchise: ~83% of the Fortune 100 are customers, the top-10 are only ~9% of revenue, and the product sits at the structural center of the build-and-release pipeline, where switching costs are high and rising. Revenue compounded from $151M (FY20) to $531.8M (FY25, +24.1%) and, after a multi-year deceleration to a +22.5% trough in FY24, re-accelerated to +25.8% in Q1’26 — an unusual and genuine inflection driven by the shift to consumption cloud (now >50% of revenue, +50% YoY) and security attach.

The business quality is real and improving on almost every axis that matters: net dollar retention rose to 119% (FY25) / 120% (Q1’26) — the cleanest evidence of captive customers spending more over time; the ≥$1M-ARR cohort grew +48% YoY; gross margin is ~77% GAAP / ~84% non-GAAP; and the GAAP operating loss, flat near ~$90M for years while revenue nearly tripled, narrowed to just −8.4% of revenue in Q1’26 — operating leverage finally arriving. The balance sheet is a fortress (~$692M net cash, negligible debt), and free cash flow has compounded from $16.8M (FY22) to $142.3M (FY25, ~27% margin), a Rule-of-40 score of ~51.

The two things to hold in tension are the quality of those earnings and the price. The GAAP loss is essentially 100% stock-based compensation, and SBC of $156.7M (29.5% of revenue) exceeds FCF itself. With the share count still rising ~5–6%/yr and the first-ever buyback (a $300M authorization in Feb-2026) not yet meaningfully executed, the celebrated 27% FCF margin overstates owner earnings substantially — on an SBC-adjusted basis JFrog generates roughly break-even distributable cash. The incentive plan compounds the issue: it rewards Net-New-ARR and operating margin but contains no per-share, FCF, or return-on-capital metric, so management is not paid to manage the dilution that is the stock’s central economic problem.

On valuation, FROG is at the richest point of its public life — 89th percentile of its own history, ~15.7x forward sales against an ~18.5% forward growth guide, the second-richest multiple in its cohort on the slowest guide. A reverse-DCF shows the ~$9.9B enterprise value already embeds a demanding three-part stack: durable high-teens-plus growth for most of a decade, a not-yet-evident owner-earnings inflection (SBC normalizing or a real buyback), and no multiple compression. That is the inverse of the abandoned-quality setups (Dynatrace, Atlassian) trading at single-digit own-history percentiles: FROG prices the bull case, with the asymmetry tilted down. The factor tape agrees — a high-beta (1.31) cloud-growth vehicle at its relative-strength peak, consensus long and crowded behind a wall of June price-target raises.

The structural debate is hyperscaler disintermediation: AWS, Azure, and GCP all ship native artifact registries (and are simultaneously JFrog’s partners). The honest read is that the commodity storage floor is commoditizing at the low/single-cloud end, but JFrog’s universal, multi-cloud, governance-and-security-led position is durable at the enterprise/hybrid tier — and the company is moving value upward into security and AI artifacts (Curation, Runtime, JFrog ML, the new MCP Registry, the NVIDIA AI-Q tie-in) faster than the floor erodes. The thesis depends on that race continuing to break its way.

Net: a category-defining franchise with a real moat, genuine re-acceleration, and emerging leverage — carrying a price that already capitalizes the bull case and rests partly on FCF that isn’t fully owners’. The business is better than ever; the stock is riskier than ever. (No recommendation and no price target appear in the body below; see Claude’s Take above for the single fenced-off opinion.)

2. Business Overview

What JFrog does — the “system of record for binaries.” JFrog Ltd. (NASDAQ: FROG; CIK 0001800667; FY ends Dec 31; HQ Sunnyvale CA, Israel-founded 2008) sells the dominant universal binary/artifact repository and the platform that has grown around it. Modern software is no longer hand-written source code shipped once a year; it is assembled — continuously — from thousands of pre-built components (open-source packages, container images, ML models, libraries) called “binaries” or “artifacts.” Somebody has to be the single place those artifacts are stored, versioned, secured, governed, and pushed out to production. JFrog’s thesis, branded “Liquid Software,” is that the binary repository is the natural single source of truth for everything a company builds and releases, and that whoever owns that chokepoint owns the software supply chain. (FACT: 10-K FY2025, “Our Platform,” filed 2026-02-13, https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001800667 — “The JFrog Platform connects all of the processes involved in building and releasing software, enabling trust by offering a single source of truth for all software release inputs and outputs.”)

Artifactory is the de-facto standard. The company “created the software package management category” with JFrog Artifactory, which “provides core functionality to the JFrog Platform as the ‘single source of truth’ for an organization’s software artifacts.” (FACT: 10-K FY2025, business section.) Artifactory is deliberately agnostic — “agnostic to the programming languages, source code repositories, public hubs, and development technologies that our customers use, as well as the type of production environments to which they deploy.” It natively supports 30+ package types (Maven, npm, Docker/OCI containers, PyPI, NuGet, Go, Helm, and ML model registries among them). Third-party industry estimates put JFrog at over ~40% share of the universal artifact-repository market as of early 2025 (INTERPRETATION, third-party market-survey aggregation, accessed 2026-06-28 — treat as directional, not audited). Customer reach is genuinely blue-chip: ~83% of the Fortune 100 and ~31% of the Forbes Global 2000 were customers as of 2025-12-31, including “8 of the top 10 healthcare organizations, and all of the top 7 telecommunications organizations in the Fortune 500.” (FACT: 10-K FY2025.)

The platform modules (the land-and-expand surface). Around Artifactory, JFrog has layered a set of attach-on modules, each addressing an adjacent job and each a separate upsell:

• JFrog Xray — continuously scans Artifactory at the binary level for vulnerabilities, license-compliance and policy violations, fed by a dedicated security-research team. (FACT: 10-K.)
• JFrog Advanced Security (optional add-on) — deeper SAST source-code scanning, secrets detection, contextual analysis, IaC scanning, container scanning, malicious-ML-model detection.
• JFrog Curation — a “package firewall” / guardian outside the pipeline that controls admission of OSS packages and AI models into the org, drawing on the JFrog Catalog of 4M+ unique packages and their metadata. JFrog AI Catalog extends Curation to secure/govern/consume AI models.
• JFrog Runtime Security — visibility/traceability into running environments (e.g., Kubernetes clusters), closing the loop from build to runtime.
• JFrog Distribution — reliable, scalable software-package distribution to multiple edge locations.
• JFrog Connect — IoT/edge connected-device fleet management (from the 2021 Upswift deal).
• JFrog ML (“JFrog ML,” built on the Qwak acquisition, 2024) — an integrated MLOps platform for data-science/AI teams to transform data, build/train/secure/deploy models and monitor ML/LLM pipelines.
• JFrog MCP Registry — newly launched (Q1’26), “the first enterprise-grade registry for MCP servers,” extending Artifactory’s system-of-record role into the agentic-AI ecosystem. (FACT: Q1’26 earnings call, 2026-05.) Other modules: Mission Control, Pipelines (CI/CD), Insight, Access Federation. The strategic shape is clear — Artifactory is the wedge; security (Xray/Advanced Security/Curation/Runtime) and AI/ML (JFrog ML, AI Catalog, MCP) are the expansion vectors.

How it makes money — subscription tiers + consumption cloud. Revenue is ~97% recurring subscription (FY2025 total subscription revenue $531.8M; of which subscription/SaaS $502.8M and a small self-managed license line $29.0M). (FACT: 10-K FY2025, results of operations.) Four paid tiers form the upgrade ladder: JFrog Pro (cloud-only, Artifactory + container/ML-model registry), Pro X (self-managed, adds Xray basic scanning + SLA), Enterprise X (adds HA clustering, federated repos, multi-region replication, Mission Control, GitHub Copilot/Advanced Security integrations), and Enterprise Plus (the full platform: Distribution, Access Federation, private CDN/edge nodes, AI/ML lifecycle management, AI Catalog). Enterprise Plus alone was ~56% of total revenue in FY2025 (up from ~51% FY2024) — i.e., the full-platform tier now drives the majority of the business, evidence the land-and-expand motion is working. (FACT: 10-K FY2025.)

Self-managed vs. cloud (the key mix shift). Customers deploy either self-managed (on-prem, private cloud, or hybrid — the customer runs it) or SaaS/cloud (JFrog-managed, consumption-metered). SaaS/cloud was 46% of total revenue in FY2025, up sharply from 39% in FY2024 — and in Q1’26 management announced cloud crossed 50% of total revenue for the first time, with cloud revenue growing +50% YoY. (FACT: 10-K FY2025; Q1’26 call.) Cloud is consumption-based (usage scales with the customer’s build/storage/transfer volume), which is why it both grows faster and carries lower gross margin than self-managed; management is “focused on cloud hosting cost optimization” as cloud mix rises. (FACT: Q1’26 call — gross margin 83.8% non-GAAP in Q1’26 vs. 82.5% prior-year; GAAP ~77%.)

Customers & verticals. ~6,600 total paying organizations across all industries (FACT: 10-K FY2025); the customer base spans individual developers up to the largest enterprises, with concentration low — the 10 largest customers were only ~9% of revenue, and ~40% of revenue is non-US. (FACT: 10-K FY2025.) Strongest verticals are technology, financial services, healthcare and telecom — i.e., regulated, code-heavy enterprises where supply-chain governance is non-negotiable.

Verdict: A high-quality, ~97%-recurring software business built on a genuine category-defining product (Artifactory) that sits at the center of the build-and-release pipeline, now successfully expanding from “store the binaries” into the higher-value security and AI/ML layers, with a mix shift toward faster-growing consumption cloud (>50% of revenue) and a healthy land-and-expand ladder (Enterprise Plus = 56% of revenue). Revenue concentration is low and the customer roster is blue-chip. The business model is structurally sound; the open questions live in industry structure (disintermediation) and valuation, not in what the company is.

3. Industry Dynamics

The market: DevOps / DevSecOps / software-supply-chain tooling. JFrog sits at the intersection of three overlapping markets: DevOps tooling (the broad build-test-release toolchain), DevSecOps / software-supply-chain security, and the emerging AI/MLOps and “DevGovOps” (governance) layers. Third-party sizing is wide and should be treated as directional only: the broad DevOps tools market is variously sized at ~$10–15B in 2025 growing ~20–26% CAGR to ~$57–73B by the early 2030s; the narrower software-supply-chain-security market is ~$2–5.5B in 2025 growing ~11–13% CAGR. (INTERPRETATION, third-party market-research aggregation, accessed 2026-06-28; ranges this wide are a tell that the category boundaries are unsettled — discount the absolute numbers, trust the direction.) Management’s own framing is a “system of record for trusted binaries, software packages and AI artifacts.” The directionally-correct point: the served market is large, growing double-digit-plus, and expanding as new artifact classes (containers, then ML models, now MCP servers / AI agents) keep arriving.

Structural tailwinds — why the binary problem keeps getting bigger.

1. Binary/artifact explosion. Every shift to microservices, containers, and continuous delivery multiplies the number of artifacts an org produces and the frequency it ships them. More artifacts, more often = more demand for a central, scalable system of record. (INTERPRETATION, well-supported.)
2. OSS dependency sprawl + supply-chain attacks. Modern apps are mostly assembled open-source; the JFrog Catalog alone tracks 4M+ unique packages. High-profile attacks (SolarWinds, Log4Shell, repeated npm/PyPI poisoning) made the provenance and integrity of every dependency a board-level concern. This directly created the Curation/Xray/Advanced Security demand — a “package firewall” at the gate. (FACT: 10-K; Q1’26 call — “customers subscribed to JFrog Curation were effectively protected from recent software supply chain attacks.”)
3. SBOM / security regulation. US Executive Order 14028 (May 2021) and follow-on federal guidance made Software Bills of Materials (SBOMs) and supply-chain attestations effectively mandatory for software sold to the US government, with the EU’s Cyber Resilience Act extending similar pressure. (FACT: EO 14028, widely documented; INTERPRETATION on the demand-pull to JFrog.) Regulation converts “nice-to-have governance” into a compliance line item — a durable, non-discretionary tailwind.
4. AI model artifacts / MLOps. This is the newest and possibly largest leg. ML models and LLMs are themselves binaries with dependencies — they need to be stored, versioned, scanned for malicious payloads, and governed exactly like code artifacts. JFrog’s pitch is that the system-of-record for binaries naturally extends to AI artifacts; the MCP Registry and AI Catalog launches operationalize that. (FACT: 10-K; Q1’26 call.) Management explicitly attributes the cloud +50% acceleration partly to “increased cloud usage across… AI workloads.” (INTERPRETATION on causation — management commentary, treat as hypothesis.)

Value chain & competitive intensity. In the software-delivery value chain, JFrog occupies the artifact-storage-and-governance node — downstream of source-code management (GitHub/GitLab) and CI (Jenkins, GitHub Actions, GitLab CI), upstream of deployment/runtime (Kubernetes, the cloud platforms). That central position is the moat thesis, but it also makes JFrog a target from both directions: SCM/CI vendors (GitHub, GitLab) bolt on package registries; the hyperscalers bundle native registries; and security point-solutions (Snyk, Aqua, Black Duck, Sonatype) attack the scanning layer.

The central bear risk — disintermediation by hyperscaler-native registries. This must be addressed head-on, because it is the single biggest structural question for the thesis. The threat: AWS CodeArtifact / ECR, Azure Artifacts / ACR, Google Cloud Artifact Registry, GitHub Packages, and GitLab’s built-in registry all offer a “good-enough,” deeply-integrated, often-cheaper artifact registry to customers already inside their ecosystem. JFrog’s own 10-K explicitly names them: “cloud providers, such as AWS, Microsoft Azure… and Google Cloud, may compete with a subset of JFrog functionality,” and “Microsoft’s GitHub, GitLab, Cloudsmith, and Sonatype” compete with “a limited set of JFrog offerings.” (FACT: 10-K FY2025, “Competition.”) The pricing gap is real: third-party comparisons note AWS effectively passes through infrastructure cost at a thin margin while JFrog charges ~$1.25/GB, Sonatype ~$0.90–1.10/GB (INTERPRETATION, third-party, accessed 2026-06-28) — i.e., the commodity storage layer is being competed toward cost.

Why the disintermediation risk is real but bounded (the rebuttal). Three points temper the bear case, though none kill it:

1. The hyperscaler registries are single-cloud and single-ecosystem; JFrog is the neutral, universal, multi-cloud/hybrid layer. A large enterprise running AWS + Azure + GCP + on-prem cannot use any one hyperscaler’s registry as its single source of truth without fragmenting governance — exactly the problem JFrog solves. The bigger and more multi-cloud the customer, the weaker the native-registry substitute. (INTERPRETATION, well-supported by the deployment-agnostic design and the 83%-of-Fortune-100 base.)
2. The value is migrating up the stack from storage to security/governance, where hyperscaler registries are weak. Native registries store and serve; they do not provide JFrog’s depth of cross-ecosystem scanning (Xray/Advanced Security), OSS admission control (Curation), or unified SBOM/governance. As the regulatory and AI-artifact tailwinds push value toward governance, the commoditizing storage layer becomes a smaller share of the wallet. (INTERPRETATION.)
3. Co-opetition, not pure competition. The hyperscalers are JFrog partners (cloud marketplace co-sell) as much as competitors; JFrog’s cloud is hosted on them. (FACT: 10-K — “While also partners, cloud providers… may compete with a subset of JFrog functionality.”) That said, the honest risk: at the low end and single-cloud SMB segment, native registries genuinely commoditize JFrog’s entry tiers and pressure pricing on the storage component. The thesis depends on JFrog continuing to move value upward to the multi-cloud enterprise and the security/AI layers faster than the storage floor erodes. This is the same shape as the AI-pricing debate hanging over the whole application-software cohort — a single overwhelming bundled competitor able to give adjacent functionality away is the recurring structural risk in dev tooling.

Capital-cycle lens. The category attracts heavy capital (every hyperscaler and SCM vendor is investing in registries), which is the classic mean-reversion pressure — but the neutral, cross-ecosystem niche is structurally harder for an ecosystem-locked incumbent to replicate, which is why JFrog has held ~40%+ share rather than mean-reverting toward commodity economics. The supply of competing capital is high; the supply of credible universal-neutral substitutes is low.

Verdict: A structurally good-not-great industry. Positives: large, double-digit-growing TAM with multiple durable, partly regulatory-mandated tailwinds (binary explosion, OSS sprawl, SBOM/EO 14028, AI artifacts), high gross margins, recurring revenue, and a genuine central chokepoint in the value chain. Negative: persistent, well-capitalized bundling/disintermediation pressure from hyperscalers and SCM platforms that commoditizes the storage floor and caps pricing at the low end. The industry structure is favorable for the universal, multi-cloud, governance-led player and unfavorable for a pure storage commodity — so, as with most software, firm-specific advantage (Section 4) must carry the thesis, not industry structure alone.

4. Competitive Position

Name the moat type: primarily SWITCHING COSTS / customer captivity, reinforced by an emerging metadata-scale advantage and brand. The three genuine sources of competitive advantage are supply/cost, demand/captivity (switching costs, habit, search costs), and economies-of-scale + captivity. JFrog’s advantage is squarely demand-side captivity via switching costs, with a secondary, growing scale-of-metadata element.

Why the switching costs are real (the mechanism, tied to a financial outcome). Artifactory is not a peripheral tool — it is wired into the center of the build pipeline. Every CI job, every developer, every deployment reads from and writes to it, across 30+ package types, often as the federated single source of truth across regions and clouds. Ripping it out means re-plumbing every pipeline, re-pointing every dependency, migrating years of versioned artifacts and their metadata, retraining every developer, and re-establishing security/governance policies — all without breaking production. The cost and risk of that migration rise with (a) the number of package ecosystems in use, (b) the number of pipelines/developers, and © the depth of security/governance built on Xray/Curation. The financial fingerprint of these switching costs:

• Net dollar retention 119% (FY2025) vs. 116% (FY2024) — and 120% on a 4-trailing-quarter basis in Q1’26 (+4 pts YoY, +1 pt QoQ). (FACT: 10-K FY2025; Q1’26 call.) NDR rising — not eroding — is the cleanest possible evidence that captive customers spend more over time, not less; commoditizing products see NDR decay toward 100%.
• Large-customer compounding: customers with ≥$100k ARR rose to 1,168 at FY2025 (from 1,018 FY2024) — 77% of total ARR (up from 72%); customers with ≥$1M ARR rose to 74 (from 52). In Q1’26 these reached 1,225 (≥$100k) and 80 (≥$1M, +48% YoY). (FACT: 10-K FY2025; Q1’26 call.) The base is concentrating into deeply-embedded large accounts — the hallmark of high switching costs.
• Gross margin ~77% GAAP / ~83–85% non-GAAP and FCF margin ~27% (FY2025) — pricing power and economics consistent with a captive, mission-critical product, not a commodity. (FACT: 10-K.)

The emerging scale/data advantage. Curation runs on the JFrog Catalog of 4M+ unique packages and their advanced metadata, and Xray draws on a dedicated security-research team’s proprietary vulnerability data. The more artifacts flow through JFrog and the more security telemetry it accumulates, the better its scanning/curation/governance — a data-network effect that a new entrant cannot bootstrap. (FACT: 10-K; INTERPRETATION on the network effect — it is real but not yet the dominant moat; the security data advantage trails specialists like Snyk/Black Duck in some dimensions.)

Direct competitive comparison — pressure-testing durability:

• Sonatype Nexus — the closest direct competitor in artifact management + security (Nexus Repository + Lifecycle). Sonatype claims 70% of the Fortune 100 use Nexus Repository; it competes hard on enterprise procurement and is often the “good starting point” for Java/Maven-centric shops. (FACT/INTERPRETATION: sonatype.com, accessed 2026-06-28.) JFrog’s edge is breadth (universal package support, multi-cloud/hybrid, the integrated security+AI stack) and its larger full-platform footprint; Sonatype is a credible #2 that keeps pricing honest but has not displaced Artifactory as the enterprise standard.
• GitHub Packages / GitLab registry — bundled into the SCM/DevOps platform. Convenient and “free-ish” for teams already standardized on GitHub/GitLab, but narrower in package-type breadth, weaker as a neutral cross-ecosystem source of truth, and not a serious governance layer. A real threat at the low/SMB end; a weak substitute at the multi-cloud enterprise. (FACT: 10-K names both; INTERPRETATION on segment exposure.)
• Hyperscaler-native registries (AWS CodeArtifact/ECR, Azure Artifacts, GCP Artifact Registry) — see Section 3; commoditize the single-cloud storage floor, weak on universal/governance. Partners as much as competitors.
• Cloudsmith — cloud-native SaaS challenger, modern UX, growing but small; competes at the SaaS-first SMB/mid-market end.
• Harness / Snyk / Aqua / Black Duck — adjacent: Harness in CI/CD pipelines, Snyk/Aqua/Black Duck in developer/runtime security. They attack slices of JFrog’s stack (especially the security upsell) rather than the core repository — JFrog’s counter is the integrated platform (scanning natively wired to the binary store) vs. bolt-on point tools.

Is the moat durable or commoditizing? The honest read. The core (Artifactory as the embedded, universal, multi-cloud source of truth for large enterprises) is durable — switching costs are high and rising, NDR is up, large-customer concentration is deepening, and the universal-neutral position is genuinely hard for ecosystem-locked rivals to replicate. But the moat is narrowing at the edges: the commodity storage layer faces real hyperscaler price pressure at the low end, and JFrog’s own 10-K concedes that “many of our competitors have greater financial, technical, and other resources, greater brand recognition, larger sales forces” — a candid acknowledgment that the giants can out-spend it. The durability of the advantage therefore rests on JFrog continuing to move value upward — into security (Curation/Xray/Advanced Security/Runtime) and AI/ML (JFrog ML, AI Catalog, MCP Registry) — faster than the storage floor commoditizes. So far the evidence (rising NDR, 56% Enterprise Plus mix, security and AI as the cited cloud-acceleration drivers) says it is winning that race.

Verdict: A durable, narrow-to-moderate moat built on real switching costs, validated by a financial signature that a commodity would not show — NDR 119–120% and rising, ~77% GAAP gross margin, ~27% FCF margin, deepening large-customer concentration, and ~40%+ category share. It is not an unassailable wide moat: the storage layer is commoditizing at the low end, the hyperscalers are bigger, and the moat’s durability is conditional on continued upward expansion into security and AI. But the core is genuinely captive, and the company is actively widening the moat where it matters (governance and AI artifacts) rather than defending a static storage position. Durable advantage — with a watch-item, not a crowded-commodity verdict.

5. Growth History and Forward Opportunities

Revenue history — deceleration, then re-acceleration. JFrog has compounded revenue ~4.5x in five years, but the path was not linear:

(FACT: 10-K FY2025; Q1’26 call.) Growth decelerated from the mid-30s% (2021–22) to a ~22.5% trough in FY2024, then re-accelerated to +24.1% in FY2025 and +25.8% in Q1’26 — a genuine and unusual inflection for a company this size, driven almost entirely by the cloud business. Note the tension with guidance: FY2026 guidance is $628–632M (~18.5% growth at midpoint) with non-GAAP operating income $112–116M and non-GAAP EPS $0.93–0.97 (FACT: Q1’26 call) — i.e., management is guiding to deceleration even as Q1’26 printed +25.8%. This is classic conservative-guide behavior (Q1 “exceeded the top end on every metric”), but it does flag that the +25%+ prints may not be the run-rate; the durable base is more likely high-teens-to-low-20s. (INTERPRETATION.)

Cloud is the growth engine. Cloud/SaaS revenue grew +50% YoY in Q1’26 and crossed >50% of total revenue for the first time, up from 46% (FY2025) and 39% (FY2024). (FACT: 10-K; Q1’26 call.) Because cloud is consumption-metered, it compounds with the customer’s own build/storage/AI-workload volume — a structurally faster, more durable growth vector than seat-based pricing, and one partly insulated from the “AI shrinks dev seats” fear that hangs over seat-priced peers. The mix shift toward cloud is the single most important growth driver and the reason for the re-acceleration.

NDR trend. NDR bottomed and turned: from a ~132% peak (2022), it troughed and recovered to 116% (FY2024) → 119% (FY2025) → 120% (Q1’26 4-trailing-quarter, +4 pts YoY), with management setting a 118% NDR floor for 2026 citing security-core contribution and higher baseline cloud growth. (FACT: 10-K; Q1’26 call.) Rising NDR is the cleanest leading indicator that the expansion motion is healthy.

Forward levers (the bull’s growth menu):

1. Cloud migration — only just past 50% of revenue; a long runway as the installed self-managed base shifts to consumption cloud, structurally lifting both growth and (eventually) the metered economics. The largest and highest-confidence lever.
2. Security attach — Advanced Security, Curation, Runtime, AI Catalog. Management cites “security core” as a primary driver of the NDR-floor raise and cloud acceleration; supply-chain attacks + SBOM/EO 14028 regulation make this a non-discretionary attach. High-confidence, high-margin upsell into an installed base that already has Artifactory.
3. AI/MLOps (Qwak → JFrog ML, AI Catalog, MCP Registry) — the optionality leg. The pitch: ML models and AI agents are binaries that need a system of record; JFrog extends Artifactory’s role to AI artifacts. Q1’26 cited “growing adoption among… AI labs” and the new MCP Registry. Genuine TAM expansion if it lands — but Qwak is recently acquired (2024, ~$157M), MLOps is crowded, and the AI-artifact monetization is still early/unproven. OPEN QUESTION: how much of the cloud +50% is durable AI-workload demand vs. one-time migration/comparison effects.
4. Enterprise full-platform deals — Enterprise Plus already 56% of revenue and growing +33% YoY (Q1’26); pushing more of the base onto the full platform is a proven, repeatable expansion path.
5. Federal / SBOM — government and regulated-industry demand driven by EO 14028; a durable, compliance-mandated tailwind, though JFrog discloses no federal revenue breakout (OPEN QUESTION on size).

Organic vs. acquired. Growth is predominantly organic. Acquisitions have been capability tuck-ins, not revenue-buying: Vdoo + Upswift (2021, ~$196M cash, security + IoT), and Qwak (2024, ~$157M cash, AI/MLOps). (FACT: 10-K cash-flow.) Goodwill jumped to $371.5M (FY2024) on Qwak. These added the security and AI/ML modules that now drive the attach motion, but the topline compounding is organic land-and-expand, not roll-up — a higher-quality growth profile than acquisition-driven peers.

Quality check. The growth scores well on the “Rule of 40” (FY2025: ~24% growth + ~27% FCF margin ≈ 51) and on retention (NDR 119–120% rising). The two honest caveats: (1) the +25%+ recent prints likely overstate the durable run-rate (FY26 guide ~18.5%); and (2) FCF is flattered by SBC (FY2025 SBC $156.7M = ~29.5% of revenue, exceeding FCF) — a quality-of-earnings issue that belongs to the Financials section but tempers the “high-quality” label. The growth itself, though, is high-quality in composition: recurring, organic, expansion-led, low-concentration, regulation- and AI-tailwinded.

Verdict: High-quality growth. It is recurring, organic, expansion-driven (NDR rising to 120%), broadening into higher-value security and AI layers, and just re-accelerated (+24% FY25, +25.8% Q1’26) on a durable cloud mix-shift with a long migration runway. The cautions are real — the run-rate likely settles in the high-teens-to-low-20s (per management’s own ~18.5% FY26 guide), the AI/MLOps leg is early/unproven, and the FCF is SBC-flattered — but none of these are growth-quality defects. The composition of this growth is among the best in the dev-tooling cohort.

6. Financial Quality

JFrog presents the classic “two-set-of-books” profile of a maturing software company: a persistent, structural GAAP operating loss sitting directly on top of a strongly positive and rapidly compounding free cash flow stream. The entire analytical question in this section is whether the second number is “real” — and the answer hinges almost entirely on one line item: stock-based compensation (SBC). Below, every figure is reconciled to the FY2025 10-K (filed 2026-02-13), the Q1 2026 10-Q (filed 2026-05-08), or the 2026 DEF 14A (filed 2026-04-07).

Revenue growth, composition, and durability

FACT. FY2025 revenue was $531.8M, +24.1% YoY (FY24 $428.5M; FY23 $349.9M; FY22 $280.0M; FY21 $206.7M) — a four-year revenue CAGR of ~26.6% with a strikingly smooth, only-gently-decelerating cadence (37% → 35% → 25% → 22.5% → 24%). The reacceleration in FY25 (24.1% vs 22.5% in FY24) is notable and is being driven by cloud and security. (Source: FY25 10-K, Results of Operations.)

FACT. Revenue mix is overwhelmingly recurring subscription. FY25 “Subscription self-managed and SaaS” was $502.8M (94.5% of revenue), with “License self-managed” only $29.0M. Within that, Cloud (SaaS) revenue was $243.3M, +45% YoY — i.e. cloud is now ~45.7% of total revenue and growing roughly double the corporate rate, the single most important compositional shift in the model (Source: 2026 DEF 14A, 2025 Business Highlights). Cloud carries lower gross margin (third-party hosting passes through), which is the structural drag on consolidated gross margin discussed below.

FACT. Net dollar retention (NDR) was 119% at FY25, up from 116% at FY24 — a three-point improvement, reversing the multi-year decline from the ~130%+ peak of 2021–22. Management guides NDR to “remain relatively stable” (FY25 10-K). Large-customer cohorts are expanding fast: 1,168 customers with ≥$100k ARR (up from 1,018; now 77% of ARR vs 72%) and 74 customers with ≥$1M ARR (up from 52, +42% YoY) (FY25 10-K). Customer concentration is low — top-10 customers ≈ 9% of revenue; ~40% of revenue is international (FY25 10-K).

INTERPRETATION. This is high-quality revenue: recurring, diversified, with re-accelerating NDR and a fast-growing high-margin-of-attention cloud tier and a deepening enterprise mix (the $1M+ cohort growing 42% is the clearest evidence that the land-and-expand motion is working at the top of the customer pyramid). The deceleration scare of 2023–24 has, for now, inflected the right way.

Gross margin: high, but structurally drifting down with cloud mix

FACT. GAAP gross margin has eased from 81.1% (FY20) → 79.8% (FY21) → 77.8% (FY22) → 78.0% (FY23) → 77.1% (FY24) → 76.8% (FY25) (10-K). Non-GAAP gross margin runs ~83–85% (the ~6–8 point gap is SBC in COGS plus amortization of acquired intangibles and acquisition-related items). The gentle GAAP erosion is mix, not pricing weakness: cloud’s third-party hosting cost (AWS/Azure/GCP) is a genuine variable COGS that self-managed software does not carry, and cloud is the fastest-growing tier. FY25 cost of revenue rose primarily on “$10.6M in third-party hosting costs” (FY25 10-K MD&A).

INTERPRETATION. A ~77% GAAP / ~84% non-GAAP gross margin is excellent and consistent with a true software franchise. The downward drift is benign and self-inflicted (selling more of a slightly-lower-margin-but-faster-growing product). It is not a sign of competitive price pressure — and Q1’26 gross margin actually ticked up to 78.2% (Q1’26 10-Q), arguing the mix drag is leveling.

The GAAP loss vs. compounding FCF — and the operating-leverage story

FACT. GAAP operating loss has been remarkably flat in absolute dollars while shrinking sharply as a percentage of revenue — the signature of emerging operating leverage:

(Sources: FY25 10-K; cash-flow statement. FCF = OCF − capex; capex is tiny, ~$3.5M/yr, an asset-light SaaS profile.)

FACT. The trajectory continues to improve: Q1’26 GAAP operating margin was -8.4% (vs -18.8% in Q1’25), the narrowest loss in the series, on +25.8% revenue growth (Q1’26 10-Q). Management’s own non-GAAP framing: FY25 non-GAAP operating income $92.1M (17.3% margin) and non-GAAP diluted EPS $0.82 vs GAAP net loss per share of $(0.62) (2026 DEF 14A).

FACT. FCF grew from $16.8M (FY22) → $72.2M → $107.8M → $142.3M (FY25), a ~27% FY25 FCF margin and ~+32% YoY growth (10-K; corroborated in the proxy: “over $142 million in FCF… a 32% increase year over year”). On a Rule of 40 basis, 24% growth + 27% FCF margin ≈ 51 — comfortably above the 40 threshold and strong for the cohort.

INTERPRETATION. Operating leverage is genuinely emerging. The op-loss flatlining at ~$90M while revenue nearly doubled (FY21→FY25) means incremental gross profit is increasingly dropping toward the bottom line. Q1’26’s -8.4% op margin suggests GAAP operating breakeven is plausibly within 12–24 months on the current trajectory. The cash engine is real, large, and compounding.

Quality-of-Earnings bridge: SBC is the whole story

This is the crux. The GAAP net loss is essentially 100% explained by SBC, and SBC is larger than FCF.

FACT. SBC expense: $68.7M (FY22) → $95.2M (FY23) → $131.1M (FY24) → $156.7M (FY25) — i.e. 29.5% of FY25 revenue (FY24 30.6%, FY23 27.2%) (FY25 10-K, SBC note). FY25 SBC by function: COGS $16.8M, R&D $58.2M, S&M $55.7M, G&A $25.9M. SBC of $156.7M is the single largest reconciling item between the $(71.8)M GAAP net loss and the $142.3M FCF, and it is larger than FCF itself ($156.7M SBC > $142.3M FCF).

INTERPRETATION — is the non-GAAP/FCF profitability “real”? Partially, with an important caveat that the company’s own framing understates.

• FCF is real cash in the sense that JFrog is not burning money — it generates $142M of actual cash that hits the balance sheet. The current ratio is 2.1x, net cash ~$692M, and the business self-funds. That is not in dispute.
• But SBC is a genuine economic cost, not a “non-cash” freebie. It is the cost of the labor that produced the revenue, settled in equity instead of cash. The cash isn’t spent, but the shareholder pays — through dilution. Treating SBC as an add-back (as both the FCF metric and management’s non-GAAP $92.1M operating income do) flatters the picture by pretending ~$157M of compensation expense doesn’t exist. The honest read: FCF overstates owner earnings by the portion of SBC not offset by buybacks — and JFrog runs zero buyback, so essentially the entire dilutive effect flows through to per-share value.
• The right mental adjustment: FY25 “FCF less SBC” is roughly $142.3M − $156.7M = negative ~$14M. That is too punitive (some SBC is a retention tool that would otherwise require cash comp, and the dilution rate is moderating), but it frames the issue: on an all-in economic basis, JFrog is roughly at the break-even line, not generating $142M of distributable owner earnings. The truth sits between the bullish “27% FCF margin” and the bearish “FCF − SBC ≈ 0.”

FACT — dilution. Weighted/period-end shares outstanding rose 97.3M (FY21) → 100.9M (FY22) → 106.1M (FY23) → 112.8M (FY24) → 119.6M (FY25) — roughly 5–6%/yr dilution, with no offsetting repurchases through FY25 (the first buyback was authorized Feb-2026 and has not yet bent the curve). As of 2026-03-13 there were 121.2M shares (proxy).

INTERPRETATION. This is the binding constraint on per-share value creation. Revenue compounds ~25%, FCF compounds ~30%+, but the share count compounds ~5–6%, so per-share cash generation grows materially slower than headline FCF — and the SBC that drives the dilution is the same item that produces the flattering GAAP-to-FCF bridge. You cannot have it both ways: the company that adds back $157M of SBC to report $142M of FCF is the same company issuing ~6M new shares a year to its employees.

Balance sheet, deferred revenue, and the “returns” question

FACT — balance sheet. Fortress: cash + short-term investments $704.4M, total debt only $12.5M (finance leases) → net cash ~$692M. Total equity $887.4M; goodwill $371.5M + intangibles ~$40M → tangible book value positive (~$476M). Accumulated deficit (retained earnings) is -$431.5M — the cumulative scar of years of GAAP losses, almost entirely SBC-driven, but offset by paid-in capital so equity remains solidly positive (FY25 10-K balance sheet).

FACT — deferred revenue / billings. Short-term deferred revenue was $309.6M at FY25, and the cash-flow statement shows a +$67.8M increase in deferred revenue in FY25 (a +$60.1M increase in FY24) — i.e. billings are running ahead of recognized revenue, a positive forward indicator and the mechanical reason OCF ($145.7M) exceeds reported net loss by so much (FY25 10-K MD&A). Growing deferred revenue is consistent with the re-accelerating NDR and the enterprise-cohort expansion.

INTERPRETATION — ROIC/ROE are not meaningful here; use the right lens. Traditional return ratios are garbage for FROG and should be ignored: GAAP net income is negative, so ROE, ROA, and ROIC are all negative (ROA -5.8%, op margin -16.9%, EBITDA margin -12.3% for FY25 — all negative, confirming the point), and they are uninformative rather than bad — they reflect the deliberate choice to expense growth investment (R&D ~37% of revenue, S&M heavy) through the P&L while the business is in land-grab mode. The correct lenses:

• FCF/EV yield: ~$142M FCF on ~$9.9B EV ≈ 1.4% — a rich price, but the right denominator.
• FCF on invested capital / incremental economics: with capex near zero and tangible invested capital low, incremental operating margins are clearly positive and rising (op loss flat while revenue +$103M in FY25 → incremental gross profit is dropping through). The unit economics improve with scale; the question is only how much of that improvement accrues to owners net of dilution.
• Cash-conversion check: OCF $145.7M vs GAAP net loss $(71.8)M — the divergence is fully explained by SBC ($156.7M) + D&A ($24.5M) + deferred-revenue/working-capital inflows ($33.5M), with no aggressive accruals or receivables build distorting the picture (DSO clean; AR rose $29.3M on higher sales). Earnings quality of the cash is good; the issue is dilution, not accrual games.

Verdict: Economics genuinely improve with scale — operating leverage is real and the cash engine is large, growing, and self-funding — but SBC dilution caps per-share value creation, and the company’s headline FCF/non-GAAP profitability materially overstates true owner earnings. This is a high-quality, asset-light recurring-revenue franchise with re-accelerating growth (24%), excellent gross margins (~77% GAAP/~84% non-GAAP), a fortress net-cash balance sheet, and Rule-of-40 of ~51. But the GAAP loss is ~100% SBC, SBC ($156.7M) exceeds FCF ($142.3M), and ~5–6%/yr dilution runs unchecked by buybacks. The honest characterization: the business is profitable in cash terms and improving; the per-share economics are roughly break-even once SBC is treated as the real cost it is. “Real,” yes — but not as real as the 27% FCF-margin headline implies.

7. Capital Allocation

JFrog has the rare luxury of a net-cash balance sheet ($692M) and positive, compounding FCF, yet its capital-allocation record is defined by what it does not do (no buyback, no dividend) and by a single large, recurring “expense” that functions as its dominant capital outflow: SBC-funded dilution. The use-of-funds story is otherwise straightforward — fund organic R&D/S&M and bolt-on M&A from operating cash, hoard the IPO proceeds, and let the share count drift up.

Use of IPO proceeds and the cash hoard

FACT. JFrog raised ~$393M net in its September 2020 IPO (IPO priced ~$44, first traded ~$64). Five years on, the company still sits on $704M of cash/investments — i.e. it has essentially never needed the IPO money operationally (the business funds itself) and has deployed it into M&A and the cash buffer rather than returning any. There is no dividend. On Feb 26, 2026 the board authorized the company’s first-ever share-repurchase program (up to $300M) (FACT: 8-K filed 2026-02-26, Item 8.01; Q1’26 call) — but it is essentially unexecuted: shares outstanding still rose (119.6M FY25 → 121.2M by 3/13/26), and no prior year shows any repurchase (cash-flow statements FY21–FY25). So for the entire period under review JFrog returned no capital, and the new authorization (~3% of the ~$10.6B cap) is, as yet, an intention rather than a shrinking share count.

INTERPRETATION. Carrying ~$700M of net cash earning roughly money-market yields, while issuing ~6M dilutive shares per year, is an internally inconsistent capital structure. The company is simultaneously over-capitalized (idle cash) and diluting owners (SBC). The Feb-2026 buyback authorization is the right direction — a belated step toward managing dilution — but it lands awkwardly: repurchasing at ~18x sales / an 89th-percentile own-history multiple is itself questionable capital allocation, and the program is too small and too new to have offset the SBC drift. Management has, until now, chosen balance-sheet conservatism and optionality over per-share discipline. The central capital-allocation tension — $700M idle while owners are diluted ~6%/yr — is being acknowledged, not yet resolved.

M&A history

FACT. Three meaningful acquisitions, all bolt-ons funded from cash, none impaired (no goodwill impairment recorded in any 10-K reviewed):

• 2021 — Vdoo (security) + Upswift (IoT/edge): ~$195.8M cash for acquisitions in FY21 (cash-flow statement); Vdoo’s total consideration was higher (~$300M incl. stock per press reporting). Vdoo became the backbone of Xray / JFrog Advanced Security; Upswift became JFrog Connect (IoT/edge device management). Security is now a primary growth vector, so Vdoo looks strategically well-spent.
• 2024 — Qwak (AI/MLOps): $156.7M cash (cash-flow line “acquisitions”); goodwill jumped $248M (FY23) → $371.5M (FY24) reflecting it. Qwak became “JFrog ML”, positioning the platform for the model/AI-artifact supply chain. FY25 SBC included “$5.4M… related to ordinary share holdbacks and replacement equity awards from the Qwak acquisition” (FY25 10-K) — i.e. part of the price is deferred, retention-linked equity.

INTERPRETATION. The M&A is disciplined in size (each <$200M, fundable from cash without leverage), thematically coherent (security, IoT, AI/MLOps — all extend the “universal system of record for software artifacts” thesis), and so far un-impaired. Vdoo is a clear win (security is now a core driver). Qwak is too recent to judge on returns; the risk is that AI/MLOps is a crowded, fast-moving category and the $157M could prove to be a feature-acquisition that needed continued equity to retain talent. Net: competent, accretive-to-strategy tuck-in M&A — not value-destructive empire-building. OPEN QUESTION: disclosed Qwak revenue/ARR contribution is thin; integration success is asserted, not yet provable in the numbers.

Reinvestment intensity (R&D and S&M)

FACT. R&D and S&M are the dominant uses of operating cash. R&D runs ~37% of revenue and S&M is similarly heavy (the proxy notes intent to “increase our investment in sales and marketing over the foreseeable future”). This is the deliberate choice that drives the GAAP loss — JFrog is expensing its growth.

INTERPRETATION. For a 24%-growth, ~84% non-GAAP-gross-margin platform with re-accelerating NDR, heavy R&D/S&M reinvestment is the correct allocation if the incremental returns are there — and the rising $1M+ customer cohort (+42%) and improving operating leverage suggest they are. The reinvestment is the value-creating use of capital; the buyback/dividend question is secondary.

SBC as the core capital-allocation issue

FACT. SBC of $156.7M (29.5% of revenue) drives ~5–6%/yr dilution, fully unoffset by buybacks. This is, in economic substance, the company’s largest single act of capital allocation — it is “paying” ~$157M/yr of value to employees in the form of newly issued ownership.

INTERPRETATION. Whether this is good capital allocation depends on whether the equity issued is buying labor that generates returns above its cost. At 24% growth and improving margins, the answer is plausibly yes — but the magnitude (SBC > FCF) means shareholders bear the full dilution. A best-in-class allocator with $700M of cash would have run a standing anti-dilution buyback years ago; JFrog only authorized its first (Feb-2026, $300M, as-yet unexecuted). This — the years of unchecked dilution and the still-untested commitment to offset it — is the single weakest element of the capital-allocation record.

Insider behavior (SEC Form 4 sweep)

FACT. From a review of the trailing ~15 months of Form 4 filings (130 filings, Mar 2025–Jun 2026; 257 non-derivative transactions parsed):

• Open-market purchases (code P): ZERO. Not a single insider has bought stock on the open market in the period.
• Open-market sales (code S): 216 transactions, ~3.40M shares sold, concentrated among the founders/officers: Frederic Simon (co-founder) ~1.08M sh, Yoav Landman (co-founder/CTO) ~0.98M sh, Shlomi Ben Haim (co-founder/CEO) ~0.72M sh, Tali Notman (CRO) ~0.29M sh, plus CFO Eduard Grabscheid ~0.09M sh and various directors.
• ~85 of the 126 filings reference Rule 10b5-1 trading plans — i.e. the bulk of the selling is pre-scheduled, automated diversification, not discretionary signaling. (CEO sales, e.g., are “pursuant to a Rule 10b5-1 trading plan adopted… March 3, 2025.”)
• Grants (code A): 26; option exercises (code M): only 4; gifts (G): 6.

INTERPRETATION. The signal is mildly negative but not alarming. The pattern is textbook founder-led-company-post-IPO: heavy, programmatic 10b5-1 selling by founders diversifying concentrated stakes, with zero conviction buying. The absence of any open-market purchase — even during the 2022–24 period when the stock traded as low as ~$17 and FCF was inflecting — is a real tell: insiders have shown no inclination to add at any price. That said, the founders retain large stakes (see ownership below), so alignment is intact; they are trimming, not exiting. The lack of a single code-P buy is the kind of fact that belongs in the “what would flip the view” column.

Ownership, governance, and incentive alignment (2026 DEF 14A)

FACT — ownership. Single class of ordinary shares — no dual-class structure (clean one-share-one-vote governance, a positive). Founder/insider ownership remains material: CEO Shlomi Ben Haim 4.25M sh (3.5%), CTO Yoav Landman 5.70M sh (4.7%), co-founder Frederic Simon 3.52M sh (2.9%) — the three founders together ~13.5M shares (~11.1%); all executive officers and directors as a group 14.34M sh (11.8%). The only >5% institutional holder disclosed is Vanguard at 7.8%. (2026 proxy, ownership as of 2026-03-13; 121.2M shares outstanding.)

FACT — incentive metrics. The 2025 annual bonus plan used Net New Annual Recurring Revenue (NNARR) as the primary metric (measured quarterly and annually), with annual Operating Margin added for 2025; senior executives’ bonuses are 100% corporate-financial-performance based, with a 0–200% payout scale (2026 proxy, Compensation Discussion). The company does not disclose NNARR targets/results (competitive sensitivity). For long-term equity, the 2025 PSU program required only that total shareholder return exceed the median of the compensation peer group (relative TSR) to vest — and, critically, the committee is replacing one-year-performance-metric PSUs with extended-term, time-based RSUs (“to prioritize long-term share price appreciation over short-term operational goals”). The company adopted its first formal Stock Ownership Guidelines in this cycle.

INTERPRETATION — alignment is moderate, with a notable gap. Positives: clean single-class governance; meaningful (if trimming) founder ownership; bonus tied to growth (NNARR) and — newly — operating margin, which is the right efficiency metric for this stage; new ownership guidelines. The gap: there is no FCF metric, no per-share metric (EPS/FCF-per-share), and no ROIC/return-on-capital metric anywhere in the incentive structure. Given that dilution is the company’s central shareholder issue, the absence of any per-share or capital-efficiency target is a real flaw — management is paid to grow ARR and (now) operating margin, but not to manage the share count or generate per-share value. The shift away from performance PSUs toward time-based RSUs is a step in the wrong direction for pay-for-performance rigor (more guaranteed equity → more dilution, less contingency), even if framed as “long-term alignment.” The reliance on relative-TSR-vs-median as the only market hurdle is a low bar.

SEC filings sweep — 8-K timeline and one-time items

FACT. The trailing-2-year 8-K cadence is routine: quarterly earnings (Item 2.02), annual shareholder votes (Item 5.07), and several governance items (Item 5.02 board appointments/resignations — Luis Visoso appointed director Jul-2024; Jessica Neal resigned from the board/comp-committee chair effective May-2025, stated as non-disagreement; Sigal Zarmi appointed director Nov-2025). The June-2024 Item 3.02 (unregistered equity issuance) relates to the Qwak acquisition consideration. A Feb-2026 Item 8.01 “Other Events” and the May-2026 8-Ks are the most recent. No litigation, restatement, debt issuance, or material adverse 8-K events in the window.

FACT — one-time items / run-rate. The income statement is clean of large one-time distortions: no asset-sale gains, no impairments, no restructuring charges of size. The only items to normalize are (a) SBC (the structural QoE adjustment, discussed at length) and (b) modest Qwak-related replacement-award/holdback equity (~$5.4M of FY25 SBC, FY25 10-K), which is acquisition-deal cost rather than ongoing run-rate comp. Working-capital inflows (deferred revenue +$67.8M) flatter OCF in any single year but are recurring for a growing subscription business, not a one-off.

Verdict: Capital allocation is competent on reinvestment and M&A, but flawed on returns-of-capital discipline and incentive design. Management funds high-return organic growth (R&D ~37%, heavy S&M) and disciplined, thematically coherent, un-impaired bolt-on M&A (Vdoo a clear win; Qwak unproven) entirely from cash, with a fortress net-cash balance sheet — all defensible. But the central failures are (1) years of ~6%/yr SBC-driven dilution unoffset by any buyback despite $692M net cash — only belatedly addressed by a first-ever $300M authorization (Feb-2026) that has not yet bent the share-count curve; (2) no per-share, FCF, or ROIC metric in executive comp, so management is not paid to manage the very dilution that is the stock’s core economic issue; and (3) a governance drift from performance PSUs toward time-based RSUs, weakening pay-for-performance just as dilution matters most. Founders retain meaningful aligned stakes and governance is clean (single class), but zero open-market insider buys against heavy 10b5-1 selling adds a mildly negative conviction signal. Net: management allocates capital adequately to grow the business, but has not yet shown the discipline that converts business value into per-share shareholder value.

8. Changes & Headwinds — Last Two Years

The two years from mid-2024 to mid-2026 are the most consequential of JFrog’s public life. The company exited a multi-year growth deceleration (revenue growth fell from +35% in FY2022 to a +22.5% trough in FY2024), re-accelerated to +24.1% in FY2025 and +25.8% in Q1’26, repositioned itself from a “DevOps binary repository” into a “software supply-chain + security + AI/MLOps platform,” and saw its equity re-rate to the richest valuation in its history. Below is the change ledger, sorted by thesis-weight.

8.1 Strategic shift #1 — Security as the second growth engine (the re-acceleration driver)

[FACT] JFrog has methodically built a security business on top of Artifactory: Xray (scanning), Curation (a package “firewall” that blocks malicious OSS at the door), Advanced Security (add-on), and Runtime security (launched into GA over FY2024–25, giving visibility into Kubernetes/runtime environments — closing the “shift-left to shift-right” loop into a single DevSecOps flow). Source: FY2025 10-K (filed 2026-02-13), product description. [INTERPRETATION] Management attributes the NDR inflection (116% FY24 → 119% FY25 → 120% trailing-4Q in Q1’26; the 2026 NDR floor was raised to 118% on the Q1’26 call) substantially to “security core” attach and a higher baseline cloud-growth assumption (Q1’26 call). Security is the mechanism converting Artifactory’s installed base into expansion dollars — it is the single most thesis-positive change of the period, because it is what reversed the deceleration. Source: Q1’26 earnings call (2026-05-07/08).

8.2 Strategic shift #2 — The AI/MLOps pivot (Qwak → JFrog ML, AI Catalog, MCP & Skills Registry)

[FACT] In June 2024 JFrog signed to acquire Qwak AI Ltd. (Israeli MLOps platform) for ~$230M total consideration — ~$157M cash plus ~$38M unregistered shares (≈1.15M shares) and ~$10M of RSUs; closed Q3 2024. Goodwill rose from $248M (FY23) to $371.5M (FY24). Re-branded “JFrog ML.” Source: 8-K filed 2024-06-25 (Item 3.02); FY2025 10-K. [FACT] On the AI side JFrog has since launched: the AI Catalog (governed model/dataset registry — Artifactory manages NVIDIA NIM and ML model/dataset metadata alongside 30+ traditional package types), the JFrog MCP Registry (Q1’26 — “first enterprise-grade registry for MCP servers”), and a Skills Registry announced in collaboration with NVIDIA at GTC, with Artifactory designated to serve as the registry for AI models and agent skills within NVIDIA’s AI-Q Blueprint. Source: Q1’26 call; FY2025 10-K. [INTERPRETATION] The strategic logic is the “AI-fueled tsunami of binaries”: AI coding agents make source code near-free and commoditized, so the compiled output (binaries, models, agent artifacts) multiplies — and JFrog’s pitch is that all of it needs a governed system of record, which “logically sits in Artifactory.” [ASSUMPTION] This is the core bull narrative behind the 2026 re-rating, but it is an early-innings, unproven monetization story; Qwak’s contribution is not separately disclosed and AI-specific revenue is not yet a reported KPI. The NVIDIA association is real and strategically valuable, but it is a partnership/integration, not a contracted revenue stream.

8.3 M&A and partnerships

[FACT] M&A is bolt-on and disciplined: Vdoo + Upswift (2021, ~$300M incl. stock / ~$196M cash; security + IoT) and Qwak (2024). No goodwill impairments in any year. Source: FY2025 10-K. [FACT] Partnerships beyond NVIDIA: deep GitHub integration (Enterprise X customers get JFrog + GitHub Copilot and GitHub Advanced Security integration); native support across all hyperscalers (AWS/Azure/GCP — simultaneously partners and competitors); cloud-marketplace availability. Source: FY2025 10-K. [OPEN QUESTION] A specific ServiceNow partnership was flagged in early research but is not found in the FY2025 10-K or the Q1’26 transcript — treat as unverified.

8.4 Leadership & board changes

[FACT] CFO transition: Jacob Shulman → Ed Grabscheid. Grabscheid’s confirmatory employment letter and equity side-letter date to Feb 2024; Shulman moved to a consulting agreement (dated Dec 16, 2023). So the handoff is now ~2 years seasoned, not a fresh-2026 risk. Source: FY2025 10-K exhibit index. [FACT] Board refresh: Luis Visoso appointed (Jul 2024, audit committee); director Neal resigned (May 2025, stated non-disagreement); Sigal Zarmi appointed (effective Nov 1, 2025, audit + nom/gov). CEO/co-founder Shlomi Ben Haim and CTO/co-founder Yoav Landman remain in place; the three founders still hold ~11.1%. Source: 8-Ks (2024-07-23, 2025-09-25); DEF 14A 2026-04-07.

8.5 Capital-allocation change — first-ever buyback (corrects prior “no buyback”)

[FACT] On Feb 26, 2026 the board authorized JFrog’s first-ever share repurchase program, up to $300M. Source: 8-K filed 2026-02-26 (Item 8.01); Q1’26 call. [INTERPRETATION] This is a genuine governance evolution toward returning capital and managing dilution — but as of the Q1’26 print, shares outstanding still rose (119.6M FY25 → 121.2M at 3/13/26), so execution appears minimal/just-begun; the authorization (~3% of the ~$10.6B cap) is, for now, an offset-dilution gesture rather than meaningful shrinkage. Whether it converts to per-share value is an open question (see the dilution risk in the Risk Analysis).

8.6 Regulatory tailwinds

[FACT/INTERPRETATION] The structural demand backdrop strengthened: U.S. Executive Order 14028 and the resulting SBOM (software bill-of-materials) mandates, the EU Cyber Resilience Act (CRA), and a steady drumbeat of high-profile software-supply-chain attacks (the SolarWinds, Log4j, and xz-utils backdoor episodes are the canonical demand-creators) all push enterprises toward exactly the curation/provenance/SBOM capabilities JFrog sells. The 10-K explicitly frames OSS repositories as “consistently subjected to novel supply chain attacks,” positioning Curation as a package “firewall.” Source: FY2025 10-K; EO 14028 (whitehouse.gov, 2021); EU CRA (Regulation (EU) 2024/2847). These are tailwinds, not company-specific catalysts, and benefit competitors (Sonatype, Snyk) equally.

8.7 The FY24 trough → FY25–26 re-acceleration and the 2026 re-rating

[FACT] Revenue growth: +35.5% (FY22) → +25.0% (FY23) → +22.5% (FY24, trough) → +24.1% (FY25) → +25.8% (Q1’26). Cloud crossed >50% of revenue in Q1’26 (was 46% FY25, +50% YoY). Enterprise Plus = 58% of revenue in Q1’26. RPO $574.9M, +36% YoY (larger multi-year commitments). Source: 10-K; Q1’26 call. [FACT] FY2026 guidance: revenue $628–632M (~18.5% midpoint growth), non-GAAP op income $112–116M, non-GAAP EPS $0.93–0.97, ~128M shares — i.e., management guides deceleration off the +25.8% Q1 print, the standard sandbag, but the explicit guide is high-teens. [FACT] The stock re-rated to ~89th percentile of its own ~6-year valuation history (P/B 11.4x/96.9th, P/S 18.3x/81.4th; P/E n/m on GAAP loss) and ~$87.58 (+101% LTM), an ATH-area print.

8.8 Verdict

On balance these changes strengthen the business but raise the risk embedded in the price. The operational changes are genuinely positive: the security engine reversed the deceleration, NDR is rising (rare among de-rating SaaS peers), cloud crossed 50%, the AI/MLOps and NVIDIA positioning give a credible second act, and the first buyback signals capital-allocation maturation. The thesis-weakening element is not operational — it is that the market has now priced all of this and more: the re-rating to the richest multiple in company history (see the Valuation section) means the changes that should reduce risk (durable growth, optionality) are offset by a price that leaves no margin for the AI narrative disappointing or growth settling into the high-teens the company itself guides. Net: business better, stock riskier.

9. Risk Analysis

9.1 Risk Matrix

Likelihood/Impact are Low/Med/High. The matrix is sorted by combined thesis-weight, not strictly by L×I.

9.2 Narrative — the top risks

Risk 1 — Valuation / multiple-compression (the dominant near-term risk). [INTERPRETATION] This is not a business risk; it is a price risk, and it is the single most important one. The stock sits at ~89th percentile of its own history after a +101% LTM move, with beta 1.31 and idiosyncratic volatility ~57% (only ~33% of variance explained by factors — a high-beta, high-idio momentum vehicle, factor-loaded to Cloud Computing +0.72 and Growth +0.53). The June 2026 analyst PT-raise wave (TD Cowen/BofA $100, UBS $92, KeyBanc $89) and the “Fab Five software” rally are momentum confirmation, not new fundamental information. [FACT] At ~18–19x trailing EV/sales (own-history range 5.8–15.3x), the multiple is above the top of its own band. A high-multiple, high-beta name that has doubled is structurally exposed to a sentiment reversal: the same momentum factor that drove it up unwinds violently (the FY21→FY22 episode took the stock from ~$80s to a ~$17 trough — a -66% max drawdown — when SaaS multiples compressed). The fundamentals can stay fine while the stock falls 30–40% on multiple alone.

Risk 2 — SBC and dilution (the quality-of-earnings crux). [FACT] SBC of $156.7M (29.5% of revenue) exceeds reported FCF of $142.3M, so “FCF less SBC” is roughly breakeven — the headline 27% FCF margin overstates owner earnings because SBC is a real economic cost flowing 100% to dilution. [FACT] Shares grew from 97.3M (FY21) to 121.2M (3/13/26), ~5–6%/yr, with no buyback offset until the Feb-2026 authorization, which is not yet meaningfully executed. [INTERPRETATION] Crucially, the comp plan contains no per-share, FCF, or ROIC metric (bonus on Net-New-ARR + operating margin; PSU on relative TSR) — management is not paid to manage dilution, and the plan has drifted from performance PSUs toward time-based RSUs. The $300M buyback is necessary but, at current valuation, repurchasing at ~18x sales is itself questionable capital allocation. Until per-share value compounds (not just business value), a large slice of FCF accrues to employees, not owners.

Risk 3 — Hyperscaler disintermediation & commoditization. [INTERPRETATION] The structural bear case: AWS, Azure, and GCP each ship a native artifact/container registry, and they are simultaneously JFrog’s distribution partners and its most dangerous competitors. The low end of the market (basic binary storage) is commoditizing toward free/bundled. JFrog’s defense is the universal/multi-cloud, 30+ package-type, security-and-AI-governance superset — a real switching-cost moat for the enterprise (top-10 = 9% of revenue, 83% of Fortune 100, NDR rising). [ASSUMPTION] The moat is durable at the enterprise/hybrid tier but narrowing at the commodity tier; this is a slow-bleed risk that caps the long-run TAM rather than a near-term cliff. The on-prem demand from “big AI labs building their own data centers” (per the Q1’26 call) is evidence the hybrid moat is holding, for now.

Risk 4 — Growth deceleration / AI-capex cyclicality. [FACT/INTERPRETATION] Management’s own FY26 guide (~18.5%) implies deceleration from the +25.8% Q1 print. The bull “tsunami of binaries” thesis explicitly ties JFrog’s growth to AI-driven software output — which is downstream of the AI-capex cycle. If AI infrastructure spending cools, the consumption tailwind JFrog is now leaning on cools with it, and a stock priced for re-acceleration would be exposed to a return to the early-20s/high-teens growth the company itself guides. Combined with Risk 1, deceleration-into-a-rich-multiple is the most plausible path to a sharp de-rating.

10. Valuation Discussion

JFrog is, on every conventional software-valuation lens, expensive in absolute terms and at the richest point of its own history — and the central analytical task is to separate the part of that richness the market is underwriting correctly (a durable, accelerating, cash-generative compounder) from the part it is underwriting on a flattering accounting convention (that stock-based-comp-adjusted free cash flow equals owner earnings). This section takes no position and sets no price target; it lays out the embedded expectations and the scenarios, and identifies what the price is and is not paying for.

Where the multiple sits

At $87.58 (2026-06-26), with ~119.6M shares the market cap is ~$10.6B, and with ~$700M net cash the enterprise value is ~$9.9B (FACT; net cash from FY25 cash+ST-investments $704.4M less $12.5M finance-lease debt). Against that EV:

• EV/Sales (trailing): ~$9.9B ÷ $531.8M FY25 revenue = ~18.6x. On the TTM base through Q1’26 (~$563M) it is ~17.6x. (FACT.)
• EV/Sales (forward): ~$9.9B ÷ FY26 guidance midpoint $630M = ~15.7x. (FACT; guidance $628–632M.)
• EV/FCF (trailing): ~$9.9B ÷ $142.3M FY25 FCF = ~70x. On TTM FCF (~$159M) ~62x. (FACT.)
• P/FCF: ~$10.6B ÷ $142.3M = ~75x trailing. (FACT.)
• GAAP P/E: not meaningful — GAAP net loss (−$0.62 dil EPS FY25). Forward non-GAAP P/E: $87.58 ÷ FY26 non-GAAP EPS midpoint $0.95 = ~92x. (FACT.)
• Rule of 40 (headline): 24.1% FY25 growth + 26.8% FCF margin = ~51 — comfortably above 40, the bull’s favorite single number. (FACT.)
• Own-history valuation percentile: composite 89.1th, P/S 18.34x / 81.4th, P/B 11.39x / 96.9th, P/E null (GAAP loss). The stock has rarely — and on P/B never — been valued this richly in its ~6-year public history. (FACT; multi-year valuation percentile.)

So FROG is valued at ~15.7x forward sales for a business management is guiding to grow ~18.5% — a multiple normally reserved for 25%+ consumption-model compounders. That is the first tension.

The comp table — FROG is priced like a faster grower than it is guiding to be

(Peer figures from current public sources — stockanalysis.com, multiples.vc, SEC filings, accessed 2026-06-27. FCF margins are headline, before SBC. FACT on the numbers; the row ordering is INTERPRETATION.)

The comp table is the single most damning piece of the valuation case. FROG trades at the second-highest forward EV/sales in the entire cohort — behind only Cloudflare — yet carries the slowest forward revenue guide (~18.5%). Datadog, at a comparable ~17–18x, is growing ~10 points faster. Snowflake and MongoDB grow faster and trade cheaper. Its nearest functional peer, GitLab (also a DevOps platform), trades at roughly one-third FROG’s EV/sales. And the two cohort names trading at FROG-like quality (DT, TEAM) sit at the 5th–6th percentile of their own histories while FROG sits at the 89th. The market is paying a top-of-cohort multiple for a company guiding to the bottom-of-cohort growth rate — bridged entirely by the re-acceleration print (+25.8% in Q1’26) and the bet that it persists rather than fading to the ~18.5% management itself guides. (INTERPRETATION, grounded in the FACTs above.)

The SBC nuance — the EV/FCF looks “merely-rich” only because SBC is added back

This is the crux of the quality-of-earnings case and it materially changes the valuation read. FROG’s headline FCF of $142.3M (FY25) — the denominator that makes “70x EV/FCF” sound almost reasonable for a software compounder — is computed after adding back $156.7M of stock-based compensation (29.5% of revenue). SBC is larger than FCF. On an owner-earnings basis (FCF minus SBC), FROG generated roughly −$14M in FY25 — i.e., approximately breakeven-to-negative real distributable cash to outside owners. (FACT: SBC $156.7M, FCF $142.3M; INTERPRETATION: the “owner FCF” frame.)

This matters because, unlike a mature compounder, FROG runs no buyback and the share count rises ~5–6% per year (97.3M → 119.6M over FY21–FY25; 121.2M by March 2026). The SBC is therefore not a non-cash bookkeeping entry that washes out — it flows 100% into permanent dilution of the per-share claim. The honest reads of the same business:

• Headline: ~27% FCF margin, Rule-of-40 ~51, ~70x EV/FCF — a high-quality cash compounder.
• Owner basis: ~0% (slightly negative) owner-FCF margin, Rule-of-40 ~24 (below the threshold), and EV/owner-FCF that is not meaningful (negative denominator). On this basis the entire ~$9.9B EV rests on growth and future margin expansion, with essentially no current owner cash flow to anchor it.

The truth sits between the two — the cash is real and self-funding (net cash, 2.1x current ratio, clean conversion), but the headline FCF margin overstates value creation to outside shareholders by roughly 27 percentage points. Any valuation that capitalizes the 27% headline margin as if it were owner earnings is double-counting. (INTERPRETATION.)

Embedded expectations — reverse-DCF

What must JFrog deliver to justify ~$9.9B EV? We solve for the implied trajectory rather than asserting a target.

A rough reverse-DCF (10% discount rate, ~25x terminal owner-FCF exit, FY25 revenue $531.8M base): to support ~$9.9B EV, FROG must reach roughly $1.6–1.9B of revenue by ~2032 (a ~17–20% revenue CAGR sustained for 6–7 years) and expand its owner-FCF margin (post-SBC) from ~0% today toward the low-20s% — which requires SBC/revenue to fall from 29.5% toward a mature-software ~10–12% while growth stays high. (ASSUMPTION-heavy; the point is the shape, not the decimal.)

Decomposed, the price embeds three things simultaneously, all of which must be true:

1. Durable high-teens-to-low-20s% growth for the better part of a decade (the guide is 18.5%; the market is paying for closer to the +25.8% Q1’26 print persisting).
2. A genuine owner-earnings inflection — SBC normalizing by ~half so that headline FCF actually converts to per-share cash, or the company beginning to buy back stock to neutralize dilution (it does neither today).
3. No multiple compression — i.e., the 89th-percentile own-history multiple holds, despite a guided deceleration.

That is a demanding stack. The asymmetry is the inverse of the DT/TEAM setups: those names price the bear case (5th–6th percentile, asymmetry to the upside); FROG prices the bull case (89th percentile, asymmetry to the downside if any leg slips).

Scenarios (illustrative; assumptions explicit; not a price target)

• Bear — growth fades to the low-teens as hyperscaler-native registries and the AI re-accel cools; SBC stays at ~25%+ so owner-FCF never inflects; multiple compresses toward the DT/GTLB ~5–6x zone. The market re-rates a slowing grower whose “FCF” was never owner cash. (ASSUMPTION.)
• Base — FROG holds high-teens growth, cloud mix and EntPlus drive incremental margin, SBC drifts to ~15% of revenue, and the multiple compresses only modestly toward ~9x (still a premium, justified by 80%+ gross margins and rising NDR). (ASSUMPTION.)
• Bull — the +25.8% Q1’26 print is the new structural rate (security + AI/MLOps + MCP registry attach), SBC normalizes to ~10% with a buyback neutralizing dilution, and FROG sustains a DDOG-like premium multiple. (ASSUMPTION.)

What the market is underwriting — correctly vs. incorrectly

• Correctly: a genuinely durable, ~80%±gross-margin, ~97%-recurring franchise with rising NDR (119%→120%), cloud crossing 50% and growing +50% YoY, a real switching-cost moat (Artifactory as pipeline center), emerging GAAP operating leverage (op loss −33%→−16.9% of revenue, −8.4% in Q1’26), a net-cash fortress, and credible security/AI optionality (Advanced Security, Runtime, JFrog ML, MCP registry). The business deserves a premium.
• Possibly incorrectly: (1) that SBC-flattered FCF equals owner earnings — on an owner basis the company throws off ~zero distributable cash and the 27% Rule-of-40 contribution is ~0%; (2) that the +25.8% re-acceleration is permanent and structural rather than partly a cyclical/AI-capex pulse — management’s own FY26 guide implies deceleration to ~18.5%; and (3) that an 89th-percentile own-history multiple is sustainable through a guided deceleration, when the rest of the cohort (DT, TEAM) re-rated to single-digit percentiles on similar quality. (INTERPRETATION.)

Verdict. A high-quality business carrying a price that already capitalizes the bull case. The headline metrics (Rule-of-40 ~51, ~70x EV/FCF) flatter the stock because they treat SBC as free; on owner economics the multiple is far richer and there is essentially no current cash return to anchor the EV. The embedded expectations require durable high-teens-plus growth and a not-yet-evident owner-earnings inflection and multiple persistence — a stack with downside asymmetry. No price target. No recommendation.

11. Variant Perception

Consensus. The sell-side is uniformly constructive and recently more so: a June-2026 cluster of price-target raises — TD Cowen Buy $100, BofA Buy $100, UBS Buy $92, KeyBanc OW $89, Barclays OW $88 — frames FROG as a re-accelerating, cloud-mix-shifting, security-and-AI-attach software compounder firmly inside the in-favor “Fab Five” software trade. The bullish case rests on the Q1’26 print (rev +25.8%, NDR 120%, cloud >50%) being the start of a durable second growth leg. Consensus is crowded long — five PT raises in weeks, the stock at its all-time high, zero notable bear flags in the public narrative.

Strongest bull case. Artifactory is the de-facto standard binary repository sitting at the center of the software-delivery pipeline — switching costs are measured in re-plumbed CI/CD and years of embedded workflow. On top of that base, JFrog is attaching higher-value, higher-margin modules (Advanced Security, Runtime, Curation, the 4M-package Catalog, JFrog ML, the first enterprise MCP-server registry) into a market with secular tailwinds (SBOM/EO-14028 software-supply-chain regulation, OSS sprawl, AI-artifact governance). Rising NDR (119→120%), cloud crossing 50% and growing +50% YoY, Enterprise Plus at 56% of revenue, and a fast-narrowing GAAP operating loss point to a 20%+ durable grower with genuine operating leverage — a franchise whose FCF compounds as it scales, deserving a premium multiple.

Strongest bear case. The moat is real but bounded, and the price already pays for the bull. (1) Disintermediation: AWS/Azure/GCP ship native artifact registries and bundle them; the low end of the storage layer is commoditizing, capping the take-rate over time (a risk JFrog’s own 10-K names). (2) The re-accel is cyclical, not structural: management itself guides FY26 to ~18.5%, a deceleration from the +25.8% Q1’26 print the bulls are extrapolating — the AI-attach surge may be a capex pulse, not a permanent rate. (3) SBC means no per-share earnings: at 29.5% of revenue with no buyback and ~5–6% annual dilution, “owner FCF” is ~breakeven; the headline 27% FCF margin overstates value to outside owners by ~27 points. (4) Richest-ever multiple = priced for perfection: at the 89th own-history percentile and second-highest fwd EV/sales in the cohort (on the slowest guide), there is no margin of safety — the inverse of the DT/TEAM setups.

The 3–5 assumptions that matter most, and what falsifies each side.

1. Growth durability (high-teens-plus, multi-year). Bull falsified by: two-plus quarters decelerating below ~18% / NDR slipping back toward ~115%. Bear falsified by: growth holding ~25% with NDR rising further — the Q1’26 print proving structural.
2. SBC normalization / owner-earnings inflection. Bull falsified by: SBC staying ≥25% of revenue with continued ~6% dilution and no buyback. Bear falsified by: SBC/revenue visibly falling toward the mid-teens and the diluted share count flattening (a real per-share cash inflection).
3. Moat vs. hyperscaler disintermediation. Bull falsified by: large accounts visibly shifting core artifact storage to native cloud registries / take-rate compression in the numbers. Bear falsified by: continued share gains and $1M±ARR cohort compounding (74→80, +48% YoY) — captivity holding at the high end.
4. Multiple persistence. Bull falsified by: a de-rate toward the cohort’s quality-name percentiles (DT/TEAM single digits) on any guidance wobble. Bear falsified by: the multiple holding at a DDOG-like premium as growth re-accelerates and owner-FCF inflects.

Factor-positioning read (a quantitative factor model, All-Factors model; FACT on the loadings/returns, INTERPRETATION on the regime). FROG is a crowded momentum/growth trade at its relative-strength peak — emphatically not a falling knife. Beta 1.31, alpha +0.235; loadings to Growth +0.525, Cloud-Computing +0.724, Tech-sector +0.599, with smaller Cybersecurity +0.151 and Software +0.120 tilts — the stock is, in factor terms, a high-beta cloud-growth vehicle. The track record confirms the momentum read: y1 return +101.9% / Sharpe 1.43, with rs_12m 100.92, rs_6m 31.09, and rs_peak −0.83 (essentially at its relative-strength peak). The 3-month figure annualizes to an outsized number reflecting the ~+95–100% raw quarterly surge (the May–June run). But idiosyncratic vol is 56.6% (R² only ~33%) — most of FROG’s variance is stock-specific, not factor-explained, so it whips on its own news. Factor-similar peers are cloud-growth/momentum names (WCLD/SKYY/CLOU ETFs, SNOW, NTNX, BRZE, DOCU) — a comp cross-check that confirms FROG is being traded as a cloud-momentum beta, not as a value or quality compounder.

What the tape is pricing. The factor signature, the all-time-high price (~0.8% off the ATH close), the five PT raises, and the Russell-driven 6/26 volume spike all point the same way: this is consensus long and crowded into strength, riding the in-favor Cloud/Growth factors at a relative-strength peak. That is precisely the configuration where the embedded bar is highest and the downside asymmetry greatest — the variant-perception edge, if there is one, is on the bear side (that the re-accel fades and/or SBC-flattered “FCF” is exposed as non-owner cash), because the bull case is already fully reflected in both the price and the positioning. (INTERPRETATION; regime-caveated — momentum persists until it doesn’t.)

12. Fact vs. Interpretation Table

13. Open Questions

1. How much of the cloud +50% / Q1’26 re-acceleration is durable AI-workload demand vs. a cyclical AI-capex pulse or one-time migration effect? Management’s own ~18.5% FY26 guide implies the +25.8% print is not the run-rate. (Resolution: the next 2–3 quarters of cloud growth and the FY26 NDR path.)
2. What is the actual revenue/ARR contribution of the AI/MLOps stack (JFrog ML, AI Catalog, MCP Registry)? Not separately disclosed; the entire “AI tsunami of binaries” re-rating rests on it.
3. Will the $300M buyback actually shrink the share count, or merely soak up a fraction of SBC? At ~18x sales, is repurchasing even the right use of cash? (Resolution: FY26 diluted share count trajectory.)
4. How fast is the commodity storage floor eroding to hyperscaler-native registries, and is any take-rate compression visible in cloud unit economics? The moat’s long-run TAM depends on this.
5. Is there a credible path for SBC/revenue to fall toward mid-teens without impairing the ~37%-of-revenue R&D engine and S&M hiring that drive the growth?
6. Federal/SBOM revenue size — driven by EO 14028 but not broken out; how large and how durable?
7. The unverified ServiceNow partnership flagged in early research but not found in the FY25 10-K or Q1’26 transcript — does it exist?

14. What Must Be True

Bull case — what must be true for the stock to compound from here:

• Growth holds in the low-20s%+ (not the guided ~18.5%), with NDR rising further — i.e., the Q1’26 print proves structural, carried by security attach and a real, durable AI-artifact demand cycle.
• Owner earnings inflect: SBC/revenue falls toward the mid-teens and the buyback actually flattens the diluted share count, so that headline FCF starts converting to per-share cash.
• The switching-cost moat holds at the enterprise/hybrid tier (large-customer cohorts keep compounding) while value migrates up to governance/AI faster than the storage floor commoditizes.
• The premium multiple persists, justified by sustained 20%+ growth and a genuine margin inflection.
• Falsification test: two-plus consecutive quarters of revenue growth decelerating below ~18%, or NDR slipping back toward ~115%, or SBC staying ≥25% of revenue with continued ~6% dilution into FY27. Any one breaks the bull case.

Bear case — what must be true for the stock to de-rate materially:

• The re-acceleration fades to the high-teens (as management guides) and is revealed as a cyclical AI-capex pulse rather than a structural rate.
• Hyperscaler/SCM disintermediation pressures the take-rate and caps long-run TAM, and/or the AI/MLOps optionality fails to monetize at scale.
• SBC stays elevated with no real per-share inflection, so the market eventually capitalizes owner (post-SBC) economics rather than headline FCF — and the 89th-percentile multiple compresses toward the cohort’s quality-name percentiles (Dynatrace/Atlassian re-rated to single digits on similar quality).
• Falsification test: revenue growth re-accelerates back above ~25% with NDR rising, and SBC/revenue visibly declines while the diluted share count flattens — i.e., a clear owner-earnings inflection. That would validate the premium and break the bear case.

15. Source Appendix

Primary sources first. URLs/dates as accessed 2026-06-28.

Primary — SEC filings

• Form 10-K, FY2025 — filed 2026-02-13. Business/product description, competitors, KPIs (NDR, $100k+/$1M+ ARR customers, cloud %, customer concentration), MD&A, SBC note, balance sheet, cash flow, risk factors (Israel/Gaza/Hezbollah/reserve duty, supply-chain attacks), exhibit index (CFO Grabscheid/Shulman letters). SEC EDGAR CIK 0001800667. https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001800667
• Form 10-Q, Q1 2026 — filed 2026-05-08. Q1’26 revenue $154.0M (+25.8%), op margin -8.4%, GM 78.2%, FCF $37.3M, cash+STI $741.2M.
• 8-K, 2026-02-26 — Item 8.01: first-ever $300M share repurchase authorization.
• 8-K, 2024-06-25 — Item 3.02: Qwak AI Ltd. acquisition, ~$230M total (~$157M cash + ~$38M shares/~1.15M shares + ~$10M RSUs); closed Q3 2024.
• 8-K, 2025-09-25 — Item 5.02: director Sigal Zarmi appointed (eff. 2025-11-01, audit + nom/gov).
• 8-K, 2024-07-23 — Item 5.02: director Luis Visoso appointed (audit committee).
• 8-K, 2025-05-22 / 2026-05-22 — Item 5.07: annual-meeting votes; share counts (114.56M record 3/26/25; 121.16M record 3/26/26).
• 8-K, 2025-08-07 / 2025-11-06 / 2026-02-12 / 2026-05-07 — Item 2.02 earnings releases (Q2’25, Q3’25, FY25/Q4’25, Q1’26).
• DEF 14A — filed 2026-04-07. Compensation metrics (Net-New-ARR + operating margin bonus; relative-TSR PSU; RSU drift; first stock-ownership guidelines; no FCF/per-share/ROIC metric), ownership (founders ~11.1%, single class, Vanguard 7.8%), business highlights (cloud rev, non-GAAP EPS/op income).
• Form 4 corpus (130 filings Mar 2025–Jun 2026) — insider transactions: zero open-market buys; ~3.40M shares sold, majority Rule 10b5-1.

Primary — earnings call transcript

• JFrog Q1 2026 earnings call (2026-05-07/08). NDR 120% trailing-4Q / 118% 2026 floor; cloud >50%; Enterprise Plus 58%; RPO $574.9M (+36%); $300M buyback commentary; NVIDIA GTC Skills Registry / AI-Q Blueprint; MCP Registry; AI Catalog; “tsunami of binaries” framing; on-prem demand from AI labs.

Data — third-party aggregated (reconciled to filings)

• Aggregated financial data — income statement, cash flow, balance sheet, profitability ratios (negative GAAP returns confirmed), enterprise value, valuation multiples (EV/sales own-history range 5.8–15.3x), earnings-call transcript. Accessed 2026-06-28.
• Own-history valuation percentiles — composite 89.1th pctile; P/B 11.39x/96.9th; P/S 18.34x/81.4th; P/E null on GAAP loss. Accessed 2026-06-28.
• Quantitative factor model — factor loadings (Cloud Computing +0.72, Growth +0.53, Tech +0.60; beta 1.31; idio vol ~57%, R² 33%); leaderboard (y1 +101.9%/Sharpe 1.43; y5 maxDD -65.9%); rs at peak. Accessed 2026-06-28.

Secondary / context

• June 2026 — analyst rating/PT actions (TD Cowen Buy $100, BofA Buy $100, UBS Buy $92, KeyBanc OW $89, Barclays OW $88); “‘Fab Five’ software up 30%” sector piece.
• U.S. Executive Order 14028 (“Improving the Nation’s Cybersecurity,” 2021) — SBOM mandate driving software-supply-chain demand. whitehouse.gov.
• EU Cyber Resilience Act — Regulation (EU) 2024/2847 — secure-software-supply-chain requirements.
• Software-supply-chain attack backdrop (SolarWinds 2020, Log4j 2021, xz-utils 2024) — category demand context (general financial/trade press).

APPENDIX A — Standard Diligence Questionnaire

Supplemental appendix. Fact / Interpretation / Assumption / Open Question labeled throughout. No price target, no buy/sell. Sources: FY2025 10-K (filed 2026-02-13), Q1’26 10-Q (2026-05-08) & earnings call, DEF 14A (2026-04-07), Form 4 corpus, public market/factor data.

General

What thoughtful questions have other investors asked about this company? [INTERPRETATION, from the Q1’26 call Q&A and sell-side framing] The recurring questions are: (1) Is the security attach durable enough to hold NDR above the 118% floor, or does it fade after the easy installed-base cross-sell? (2) When and how does the AI/MLOps positioning (AI Catalog, MCP/Skills Registry, Qwak) actually monetize — where in the customer journey do buyers realize they need JFrog governance for AI agents? (3) Does the hyperscalers’ native registries erode the low end / cap the TAM? (4) When does GAAP profitability arrive, and how much of “FCF” is real once SBC is charged? (5) Is the +101% LTM re-rating justified or a momentum/Russell-rebalance artifact? These map directly onto the bull/bear axes in the analysis.

Cyclicality & Earnings Nature

Are earnings at a cyclical high or low? [FACT/INTERPRETATION] On a GAAP basis JFrog is not yet profitable (FY25 net loss -$71.8M; GAAP op margin -16.9%, improving from -33.1% in FY21 and -18.8% in Q1’25 to -8.4% in Q1’26). So there is no “earnings cycle” to peak — the relevant frame is growth and FCF, which are near a high (FCF $142.3M/27% margin, growth re-accelerated to +24–26%). [INTERPRETATION] Both growth and FCF margin look closer to a high than a low — management guides FY26 to ~18.5% deceleration, and FCF is SBC-flattered.

Driven by the external environment or internal actions? [INTERPRETATION] Mostly internal: the re-acceleration is attributed to the company-built security engine and enterprise go-to-market (Enterprise Plus 58% of revenue, NDR up), not a macro tailwind. The AI demand layer is partly external (AI-capex cycle) and partly self-created (positioning Artifactory as the AI artifact system of record).

How stable are revenues? [FACT] Very stable: ~97% recurring (subscription + SaaS), NDR 119–120% (expansion-led), RPO $574.9M (+36% YoY) from multi-year commitments, top-10 customers only ~9% of revenue. This is among the more durable revenue bases in the SaaS universe.

Outlook for products/services? [FACT/INTERPRETATION] Expanding: cloud crossed >50% of revenue; security and AI/MLOps are the two growth vectors; the “binary tsunami” thesis (AI multiplies compiled artifacts needing governance) is the forward narrative. Credible but unproven on AI monetization.

How big will this market be — growing, shrinking, domestic or international? [FACT/INTERPRETATION] Growing double-digits (DevOps + software-supply-chain security + emerging AI/MLOps governance), supported by SBOM/EO 14028, EU CRA, and supply-chain-attack demand. ~40% of revenue is international, so it is a global market, not domestic-only.

Business Quality & Competitive Moat

Is the industry getting more or less competitive? [INTERPRETATION] More at the commodity tier (hyperscaler native registries, GitHub/GitLab bundling), but JFrog is moving up-stack into security and AI governance where competition is more fragmented. Net: competitive intensity rising at the bottom, differentiation holding at the enterprise top.

How profitable is the business (ROIC, ROE)? [FACT] GAAP ROIC/ROE/ROA are negative and not meaningful (FY25 ROA -5.8%, op margin -16.9%) — the correct SaaS analog is FCF margin (~27%, but ~breakeven after SBC), incremental operating leverage (op loss narrowing fast), and the Rule of 40 (~51). [INTERPRETATION] On a cash basis the business is self-funding and economically real; on an owner-earnings (post-SBC) basis it is roughly breakeven.

How profitable is the industry — how many competitors, what barriers to entry? [FACT/INTERPRETATION] Enterprise DevOps/SCM is a good-not-great industry: real barriers (deep pipeline integration, switching costs) at the top, low barriers at the bottom. Named competitors: GitHub, GitLab, Cloudsmith, Sonatype (DevOps); AWS/Azure/GCP (cloud, also partners); Aqua, Snyk, Sonatype, Black Duck (security). Sonatype Nexus is the closest direct repository competitor.

Can the business be easily understood? [FACT] Yes — it sells a subscription platform (Artifactory + Xray/security + JFrog ML) that is the system of record for software binaries/packages/models. Single reportable segment, two deployment modes (self-managed, cloud/SaaS).

Can it be undermined by foreign low-cost labor? [INTERPRETATION] Not directly applicable — this is enterprise software, not labor-arbitrage manufacturing. The relevant analog is AI-coding-agent commoditization of software development itself, which JFrog argues is a tailwind (more binaries to govern) rather than a threat, and hyperscaler bundling (the real competitive substitution risk).

Do brands matter? [INTERPRETATION] Moderately. “JFrog/Artifactory” is the de-facto standard in its category among developers — a genuine mind-share/standard-setter brand — but enterprise buying is driven by switching costs and platform breadth more than brand per se.

What is the nature of competition? [INTERPRETATION] Platform-breadth and embeddedness vs. point tools and bundled hyperscaler offerings. JFrog competes by being universal (multi-cloud, 30+ package types) and by extending from storage → security → AI governance, raising switching costs.

Customers’ switching costs? [FACT/INTERPRETATION] High at the enterprise tier — Artifactory sits at the center of the CI/CD pipeline, integrated across build tools, package types, and clouds; ripping it out disrupts every release. Evidenced by NDR 119–120% and 83% of Fortune 100 penetration. Lower at the commodity-storage low end.

Financial Condition & Balance Sheet

Assets not fully recognized on the balance sheet? [INTERPRETATION] Yes — the installed base / customer relationships and the metadata moat (JFrog Catalog, 4M+ packages) are economically valuable intangibles not capitalized. Internally developed software is largely expensed (R&D), understating book asset value.

Off-balance-sheet liabilities? [FACT] Minimal — operating-lease commitments (now on balance sheet under ASC 842), routine purchase obligations (cloud hosting). No material off-balance-sheet debt; debt is only $12.5M of finance leases.

How conservative is the accounting? [FACT/INTERPRETATION] Conservative/clean: OCF ($145.7M) tracks FCF; no restatements, no goodwill impairments across the 2021 and 2024 acquisitions, no aggressive capitalization (R&D expensed). The one genuine quality-of-earnings issue is SBC ($156.7M, 29.5% of revenue) being added back to FCF while flowing to dilution — a presentation generosity, not an accounting irregularity.

How CapEx-hungry is the business? [FACT] Very capital-light — capex ~$3.5M/yr (<1% of revenue), typical asset-light SaaS; growth is funded by R&D/S&M expense, not capex.

Capital Allocation & Management

How much FCF does the business generate, how does management use it, what is the philosophy? [FACT] FCF $142.3M FY25 (27% margin, +32% YoY). Historically retained entirely (no buyback, no dividend) to fund organic R&D/S&M and occasional bolt-on M&A. [FACT] Change: a first-ever $300M buyback was authorized Feb 26, 2026 — philosophy is shifting toward returning capital, though execution is nascent (shares still rose into Q1’26).

Significant acquisitions recently? [FACT] Qwak (AI/MLOps, ~$230M total, 2024 → “JFrog ML”); earlier Vdoo + Upswift (~$300M incl. stock, 2021 → security/IoT). Bolt-on, integrated, no impairments. Growth is predominantly organic.

Buying back shares? [FACT] Authorized ($300M, Feb 2026) but not yet meaningfully executed — net share count increased (119.6M FY25 → 121.2M at 3/13/26).

Issuing large amounts of new shares to insiders? [FACT] Yes via SBC — ~5–6%/yr dilution, SBC 29.5% of revenue; ~$48M of the Qwak consideration was equity. This is the central per-share-value concern.

Compensation policy of directors/management? [FACT, DEF 14A 2026-04-07] Cash bonus on Net-New-ARR (primary) + operating margin; PSUs on relative TSR vs. peer median; drift toward time-based RSUs; first-ever stock-ownership guidelines adopted. [INTERPRETATION — KEY FLAW] No FCF, no per-share, and no ROIC/return metric anywhere — management is incentivized to grow ARR, not to manage dilution or compound per-share value.

Motivations of management? [INTERPRETATION] Founder-led (CEO Ben Haim, CTO Landman; three founders ~11.1%; single share class), category-vision-driven, growth-and-market-leadership oriented. Aligned on long-term franchise value via founder equity, but not on per-share discipline via the comp plan. Zero insider open-market purchases at any price (incl. the ~$17 trough) — diversification-mode sellers, not conviction buyers.

Valuation & Market Data

Is the stock an ADR, MLP, or K-1 issuer? [FACT] No. Despite Israeli incorporation (JFrog Ltd.), it lists directly on Nasdaq as ordinary shares (FROG) — it is not an ADR, not an MLP, and issues a 1099, not a K-1. Single share class, no dual-class structure. (HQ Sunnyvale, CA; majority of R&D in Israel.)

Dividend policy? [FACT] No dividend; none expected — capital is retained for growth (and now buyback).

How profitable is the business? [FACT] GAAP-unprofitable; FCF-profitable (~27% margin, ~breakeven post-SBC). See Business Quality above.

Is net income diverging from cash from operations? [FACT] Yes, and benignly — GAAP net loss -$71.8M vs. OCF +$145.7M, a ~$217M gap explained almost entirely by SBC ($156.7M) plus D&A/working-capital. [INTERPRETATION] The divergence is structural SBC, not accrual manipulation; cash generation is real, but owner earnings (post-SBC) are far below the OCF/FCF headline.

Risks & Downside

What factors would cause the stock to decline? [INTERPRETATION] (1) Multiple compression from the 89th-percentile/own-history valuation on any growth or AI-narrative wobble (beta 1.31, high idio vol — a momentum-unwind candidate); (2) growth decelerating toward the company’s own ~18.5% FY26 guide vs. the +25.8% Q1 print; (3) NDR slipping back below the 118% floor; (4) hyperscaler/native-registry commoditization pressure; (5) a broad SaaS/AI-capex sentiment reversal.

Risk of a catastrophic loss? [INTERPRETATION] Low. Fortress balance sheet (~$692M net cash, FCF-positive, self-funding, no debt maturities), diversified customers (top-10 = 9%), recurring ~97% revenue. The plausible bad outcome is a large valuation drawdown (the 2021→2022 episode was -66% peak-to-trough), not insolvency. A self-inflicted security breach (ironic for a supply-chain-security vendor) is the lower-probability tail that could be acutely reputational.

Chance of a total loss? [INTERPRETATION] Negligible — net-cash, FCF-positive, profitable-on-cash software with a durable enterprise installed base. Total-loss risk is effectively nil; the real risk is overpaying.

Recent News & Events

Has the business environment changed recently? [FACT/INTERPRETATION] Yes, favorably on fundamentals and richly on price. Operationally: re-acceleration (+25.8% Q1’26), cloud >50%, NDR rising to 120%, security and AI/MLOps engines maturing, NVIDIA GTC partnership (Skills Registry / AI-Q Blueprint), MCP Registry launch, RPO +36%. Market: a June-2026 wave of analyst PT raises (TD Cowen/BofA $100, UBS $92, KeyBanc $89, Barclays $88) and a “Fab Five software” sector rally, with a +11% single-day spike on 6/26/2026 on ~8x volume and no 8-K — [INTERPRETATION] most consistent with late-June Russell index reconstitution flows plus the software-sector momentum bid, not new fundamental information.

Significant acquisitions? [FACT] Qwak (2024) is the most recent material deal; nothing material in 2025; no new deal in 2026 to date.

Change in accounting policies? [FACT] None material/no restatements identified in the FY25 10-K.

Recent changes — new markets, facilities, management? [FACT] CFO transition (Shulman → Grabscheid, seasoned since early 2024); board additions (Visoso Jul-2024, Zarmi Nov-2025; Neal resigned May-2025, non-disagreement); first-ever $300M buyback authorized (Feb-2026); ongoing geographic expansion (~40% intl). [FACT] Geopolitical backdrop: ongoing Israel conflict (Gaza/Hezbollah) and extended military reserve duty for Israeli staff are disclosed operational risks given the R&D footprint.

APPENDIX B — Source Appendix

Primary sources first. URLs/dates as accessed 2026-06-28.

Primary — SEC filings

• Form 10-K, FY2025 — filed 2026-02-13. Business/product description, competitors, KPIs (NDR, $100k+/$1M+ ARR customers, cloud %, customer concentration), MD&A, SBC note, balance sheet, cash flow, risk factors (Israel/Gaza/Hezbollah/reserve duty, supply-chain attacks), exhibit index (CFO Grabscheid/Shulman letters). SEC EDGAR CIK 0001800667. https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001800667
• Form 10-Q, Q1 2026 — filed 2026-05-08. Q1’26 revenue $154.0M (+25.8%), op margin -8.4%, GM 78.2%, FCF $37.3M, cash+STI $741.2M.
• 8-K, 2026-02-26 — Item 8.01: first-ever $300M share repurchase authorization.
• 8-K, 2024-06-25 — Item 3.02: Qwak AI Ltd. acquisition, ~$230M total (~$157M cash + ~$38M shares/~1.15M shares + ~$10M RSUs); closed Q3 2024.
• 8-K, 2025-09-25 — Item 5.02: director Sigal Zarmi appointed (eff. 2025-11-01, audit + nom/gov).
• 8-K, 2024-07-23 — Item 5.02: director Luis Visoso appointed (audit committee).
• 8-K, 2025-05-22 / 2026-05-22 — Item 5.07: annual-meeting votes; share counts (114.56M record 3/26/25; 121.16M record 3/26/26).
• 8-K, 2025-08-07 / 2025-11-06 / 2026-02-12 / 2026-05-07 — Item 2.02 earnings releases (Q2’25, Q3’25, FY25/Q4’25, Q1’26).
• DEF 14A — filed 2026-04-07. Compensation metrics (Net-New-ARR + operating margin bonus; relative-TSR PSU; RSU drift; first stock-ownership guidelines; no FCF/per-share/ROIC metric), ownership (founders ~11.1%, single class, Vanguard 7.8%), business highlights (cloud rev, non-GAAP EPS/op income).
• Form 4 corpus (130 filings Mar 2025–Jun 2026) — insider transactions: zero open-market buys; ~3.40M shares sold, majority Rule 10b5-1.

Primary — earnings call transcript

• JFrog Q1 2026 earnings call (2026-05-07/08). NDR 120% trailing-4Q / 118% 2026 floor; cloud >50%; Enterprise Plus 58%; RPO $574.9M (+36%); $300M buyback commentary; NVIDIA GTC Skills Registry / AI-Q Blueprint; MCP Registry; AI Catalog; “tsunami of binaries” framing; on-prem demand from AI labs.

Data — third-party aggregated (reconciled to filings)

• Aggregated financial data — income statement, cash flow, balance sheet, profitability ratios (negative GAAP returns confirmed), enterprise value, valuation multiples (EV/sales own-history range 5.8–15.3x), earnings-call transcript. Accessed 2026-06-28.
• Own-history valuation percentiles — composite 89.1th pctile; P/B 11.39x/96.9th; P/S 18.34x/81.4th; P/E null on GAAP loss. Accessed 2026-06-28.
• Quantitative factor model — factor loadings (Cloud Computing +0.72, Growth +0.53, Tech +0.60; beta 1.31; idio vol ~57%, R² 33%); leaderboard (y1 +101.9%/Sharpe 1.43; y5 maxDD -65.9%); rs at peak. Accessed 2026-06-28.

Secondary / context

• June 2026 — analyst rating/PT actions (TD Cowen Buy $100, BofA Buy $100, UBS Buy $92, KeyBanc OW $89, Barclays OW $88); “‘Fab Five’ software up 30%” sector piece.
• U.S. Executive Order 14028 (“Improving the Nation’s Cybersecurity,” 2021) — SBOM mandate driving software-supply-chain demand. whitehouse.gov.
• EU Cyber Resilience Act — Regulation (EU) 2024/2847 — secure-software-supply-chain requirements.
• Software-supply-chain attack backdrop (SolarWinds 2020, Log4j 2021, xz-utils 2024) — category demand context (general financial/trade press).