JFrog Security

End-to-End Software Supply Chain Security
powered by the JFrog Platform
Start Free Book a Demo

Holistic Software Supply Chain Security

One platform to control and secure from code to edge
Defend.
Protect yourself from the known
and unknown, across your software
supply chain
Remediate.
Advanced Security Features
for Trusted Code and
Prioritized Remediation
Govern.
Centralized control and visibility
with automated security
and compliance

Defend From the Known and Unknown
With JFrog Curation

Centralize visibility and control of 3rd party package downloads. Protect against known and unknown threats, allowing only trusted packages into your SDLC.

Save time by eliminating noise and focusing on what matters. Our engine examines the applicability of CVEs by analyzing the code and its attributes (the way an attacker would). It checks if the first-party code calls the vulnerable function and scans additional configurations and attributes for CVE exploitation prerequisites.

Provide your developers with a trusted source of software components, with seamlessly-integrated, active vetting of 3rd party packages that works with your existing software development pipeline.

Explore the metadata of the open-source packages you want to use with JFrog Catalog. Discover their version history, security vulnerabilities, OpenSSF score, license data, operational risk, and if they have any dependencies and transitive vulnerabilities. Over 4 million OSS packages have been cataloged for easy reference.

Reduce the cost of 3rd party package validation, with a shift left approach to blocking unwanted dependencies at the gate of your software supply chain. Transparency and accountability ensure the quality of the 3rd party building blocks for development teams.

Centralized Visibility and Control

Centralize visibility and control of 3rd party package downloads. Protect against known and unknown threats, allowing only trusted packages into your SDLC.

Frictionless Package Consumption by Developers

Save time by eliminating noise and focusing on what matters. Our engine examines the applicability of CVEs by analyzing the code and its attributes (the way an attacker would). It checks if the first-party code calls the vulnerable function and scans additional configurations and attributes for CVE exploitation prerequisites.

Automate Curation Of 3rd Party Packages

Provide your developers with a trusted source of software components, with seamlessly-integrated, active vetting of 3rd party packages that works with your existing software development pipeline.

Open Source Package Catalog

Explore the metadata of the open-source packages you want to use with JFrog Catalog. Discover their version history, security vulnerabilities, OpenSSF score, license data, operational risk, and if they have any dependencies and transitive vulnerabilities. Over 4 million OSS packages have been cataloged for easy reference.

Improved DevSecOps Experience

Reduce the cost of 3rd party package validation, with a shift left approach to blocking unwanted dependencies at the gate of your software supply chain. Transparency and accountability ensure the quality of the 3rd party building blocks for development teams.

Learn More

Advanced Security Features for Trusted Code
and Prioritized Remediation

Trusted Builds Need Trusted Code

Enable development teams to develop and commit trusted code with a seamless developer-focused experience. Fast and accurate security-focused engines deliver scans that minimize false positives and won’t slow down development.

Deep Contextual Analysis combining real-world exploitability and CVEs applicability

Save time by eliminating noise and focusing on what matters. Our engine examines the applicability of CVEs by analyzing the code and its attributes (the way an attacker would). It checks if the first-party code calls the vulnerable function and scans additional configurations and attributes for CVE exploitation prerequisites.

Secrets Detection for source code and binary files based on predefined patterns and heuristics

Do you know if you have exposed keys or credentials stored in containers or other artifacts? JFrog's secrets detection searches for known structures and completely random credentials (using suspicious variable matching), ensuring that you have minimal false positives.

Identify security exposures in your IaC

Secure your IaC files by checking the configurations critical to keeping your cloud deployment safe and secure. JFrog's IaC security scanner provides a comprehensive, proactive solution to IaC security.

Don't Leave Your Apps Open to Attack

Go beyond the surface level to scan the configuration and usage methods of common OSS libraries and services, such as Django, Flask, Apache, and Nginx. Identify misuse and misconfigurations that could be leaving your software vulnerable to attack.

Trusted Builds Need Trusted Code

Enable development teams to develop and commit trusted code with a seamless developer-focused experience. Fast and accurate security-focused engines deliver scans that minimize false positives and won’t slow down development.

Deep Contextual Analysis combining real-world exploitability and CVEs applicability

Save time by eliminating noise and focusing on what matters. Our engine examines the applicability of CVEs by analyzing the code and its attributes (the way an attacker would). It checks if the first-party code calls the vulnerable function and scans additional configurations and attributes for CVE exploitation prerequisites.

Secrets Detection for source code and binary files based on predefined patterns and heuristics

Do you know if you have exposed keys or credentials stored in containers or other artifacts? JFrog's secrets detection searches for known structures and completely random credentials (using suspicious variable matching), ensuring that you have minimal false positives.

Identify security exposures in your IaC

Secure your IaC files by checking the configurations critical to keeping your cloud deployment safe and secure. JFrog's IaC security scanner provides a comprehensive, proactive solution to IaC security.

Don't Leave Your Apps Open to Attack

Go beyond the surface level to scan the configuration and usage methods of common OSS libraries and services, such as Django, Flask, Apache, and Nginx. Identify misuse and misconfigurations that could be leaving your software vulnerable to attack.

Learn More

Control Everything, Govern Everywhere
With JFrog Xray SCA

Software Composition Analysis for source code and binary files

The definitive DevOps-centric SCA solution for identifying and resolving security vulnerabilities and license compliance issues in your open source dependencies.

  • Enhanced CVE Detection - Detect, prioritize & mitigate OSS security issues in binaries, builds and release bundles
  • FOSS License Clearance - detect, prioritize & mitigate license compliance issues, and accelerate clearing
  • Automated SBOM - Automatically create and export industry std SPDX, CycloneDX (VEX) SBOMs
  • Enhanced CVE Data -
    Up-to-date proprietary info on High-profile CVEs from JFrog’s Security research team

Malicious package detection based on automated scanning of public repositories

Discover and eliminate unwanted or unexpected packages, using JFrog’s unique database of identified malicious packages. The database is sourced with thousands of packages identified by our research team in common repositories alongside continuously-aggregated malicious package information from global sources.

Operational risk policies to block undesired packages

Enable easy handling of risks like package maintenance issues & technical debt. Enable automated package-blocking using policies where you decide risk thresholds, based on soft attributes such as number of maintainers, maintenance cadence, release age, number of commits and more.

Shift as far left as possible with JFrog developer tools

Scan early in your SDLC for security vulnerabilities & license violations with developer-friendly tools. See vulnerabilities with remediation options and applicability right inside your IDE. Automate your pipeline with our CLI tool and do dependency, container & on-demand scans. Minimize threats, reduce risk, fix faster and save costs.

Ensure Integrity and Security of ML Models

Manage your models in a system that detects malicious models, ensures license compliance and introduces important controls so that ML, Security, and DevOps teams feel confident in the open source models used and that you’re ready for the inevitable regulations to come.

Software Composition Analysis for source code and binary files

The definitive DevOps-centric SCA solution for identifying and resolving security vulnerabilities and license compliance issues in your open source dependencies.

  • Enhanced CVE Detection - Detect, prioritize & mitigate OSS security issues in binaries, builds and release bundles
  • FOSS License Clearance - detect, prioritize & mitigate license compliance issues, and accelerate clearing
  • Automated SBOM - Automatically create and export industry std SPDX, CycloneDX (VEX) SBOMs
  • Enhanced CVE Data -
    Up-to-date proprietary info on High-profile CVEs from JFrog’s Security research team

Malicious package detection based on automated scanning of public repositories

Discover and eliminate unwanted or unexpected packages, using JFrog’s unique database of identified malicious packages. The database is sourced with thousands of packages identified by our research team in common repositories alongside continuously-aggregated malicious package information from global sources.

Operational risk policies to block undesired packages

Enable easy handling of risks like package maintenance issues & technical debt. Enable automated package-blocking using policies where you decide risk thresholds, based on soft attributes such as number of maintainers, maintenance cadence, release age, number of commits and more.

Shift as far left as possible with JFrog developer tools

Scan early in your SDLC for security vulnerabilities & license violations with developer-friendly tools. See vulnerabilities with remediation options and applicability right inside your IDE. Automate your pipeline with our CLI tool and do dependency, container & on-demand scans. Minimize threats, reduce risk, fix faster and save costs.

Ensure Integrity and Security of ML Models

Manage your models in a system that detects malicious models, ensures license compliance and introduces important controls so that ML, Security, and DevOps teams feel confident in the open source models used and that you’re ready for the inevitable regulations to come.

Software Supply Chain Security & Compliance Use Cases

SBOM & Regulatory
Compliance
Container
Security
IaC
Security
Vulnerability
Management 
FOSS Compliance
& License Clearing

SBOM & Regulatory Compliance

Save time by simplifying the generation of SPDX, CycloneDX and VEX standard-format SBOMs. Ensure comprehensive SBOM accuracy with binary analysis, going well beyond standard metadata.

Effortlessly meet regulatory requirements by fully monitoring and controlling vulnerabilities across the SDLC. Keep malicious packages out of your SBOM with an extensive malicious package database. Automate the publication of your SBOM and associated CVEs whenever needed.

Get Started SBOM & Regulatory Compliance

Container Security

Reduce risks by analyzing at the binary level, even looking at “binaries within binaries” and through all the layers of your containers.

Reduce blind spots with deep analysis that sees your configurations and the way your 1st party code interacts with OSS for accurate context.

Save time with advanced scanning capabilities to identify security vulnerabilities, and actively prioritize those which are actually exploitable in your containers.

Get Started Container Security

IaC Security

Validate your IaC configurations early and scan for potential configuration issues. Don't put your cloud or hybrid infrastructure at risk of exploitation!

Significantly reduce deployment risk and ensure that your systems remain safe and secure.

Get Started IaC Security

Vulnerability Management

Effortlessly meet regulatory requirements by monitoring and controlling vulnerabilities across the SDLC and responding quickly to incidents with confidence.

CVEs - Triage, prioritize and mitigate identified CVEs with our extensive research expertise

Malicious Packages - Reduce the workload on your appsec teams by automating the detection of malicious packages and stop them before they can do any harm.

Get Started Vulnerability Management

FOSS Compliance & License Clearing

Export Control - Reduce risk by monitoring, controlling and validating that your products are being shipped with only approved licenses for the correct project, team, customer and destination.

FOSS License Clearing - Save time by automating previously manual labor-intensive license clearing processes, ensuring your development teams are using fully-approved licenses that aren’t exposing your organization to legal risk.

Get Started FOSS Compliance & License Clearing

How are we different?

Continuously analyze your software in its production context. End-to-end scanning from source code to binaries helps you safeguard modern, always-evolving software artifacts. Binaries are what get attacked across the software supply chain, so scanning binaries and images (“binaries of binaries”) ensures you expose and fortify against blind spots not discovered by source code analysis alone.

JFrog’s industry-leading security research division is comprised of some of the world’s top experts in discovering and remediating software vulnerabilities. This means JFrog products are continuously and uniquely updated with highly-detailed and thoroughly-analyzed information about zero-days, CVEs, malicious packages and other types of exposures. Releasing hundreds of publications annually, our research team is leading the industry in discoveries and smart actions. More information on our research arm can be found at research.jfrog.com.

JFrog is a pioneer in software supply chain management, allowing control of all of your software artifacts from a single point. By understanding every asset in your pipeline, JFrog scanners have unique visibility into richer data, delivering more accurate results and more comprehensive context to allow smooth, risk-based remediation across your entire process. The unique combination of security and management of the supply chain itself eliminates integration ownership and myriad point solutions.

Binaries, Not
Only Code

Continuously analyze your software in its production context. End-to-end scanning from source code to binaries helps you safeguard modern, always-evolving software artifacts. Binaries are what get attacked across the software supply chain, so scanning binaries and images (“binaries of binaries”) ensures you expose and fortify against blind spots not discovered by source code analysis alone.

Security Research Driven

JFrog’s industry-leading security research division is comprised of some of the world’s top experts in discovering and remediating software vulnerabilities. This means JFrog products are continuously and uniquely updated with highly-detailed and thoroughly-analyzed information about zero-days, CVEs, malicious packages and other types of exposures. Releasing hundreds of publications annually, our research team is leading the industry in discoveries and smart actions. More information on our research arm can be found at research.jfrog.com.

Control & Secure: One Platform

JFrog is a pioneer in software supply chain management, allowing control of all of your software artifacts from a single point. By understanding every asset in your pipeline, JFrog scanners have unique visibility into richer data, delivering more accurate results and more comprehensive context to allow smooth, risk-based remediation across your entire process. The unique combination of security and management of the supply chain itself eliminates integration ownership and myriad point solutions.

Wondering how JFrog Security is different from typical AST and AppSec solutions?
See a comparison of JFrog vs. SCA, IaC, Container & Configuration Security, Secrets Detection and more.

Why Customers Trust JFrog

“Most large companies have multiple sites and it is critical for those companies to manage authentication and permission efficiently across locations. JFrog Enterprise+ will provide us with an ideal setup that will allow us to meet our rigorous requirements from the get go. It's advanced capabilities, like Access Federation, will reduce our overhead by keeping the users, permissions, and and groups in-sync between sites.”
Siva Mandadi
DevOps - Autonomous Driving, Mercedes
“JFrog Enterprise+ increases developer productivity and eliminates frustration. JFrog Distribution is basically a CDN On-Prem that enables us to distribute software to remote locations in a reliable way. Whereas, JFrog Access Federation gives us the ability to share credentials, access and group memebers across different locations with ease.”
Artem Semenov
Senior Manager for DevOps and Tooling,
Align Technology
"Instead of a 15-month cycle, today we can release virtually on request.”
Martin Eggenberger
Chief Architect,
Monster
“As a long-time DevOps engineer, I know how difficult it can be to keep track of the myriad of package types – legacy and new – that corporations have in their inventory. JFrog has always done a phenomenal job at keeping our team supported, efficient and operational – because if JFrog goes out, we might as well go home. Thankfully, with AWS infrastructure at our backs as well, we know we can develop and deliver with confidence anywhere our business demands today, and in the future.”
Joel Vasallo
Head of Cloud DevOps,
Redbox
“The capabilities of Artifactory are what allow us to do what we can do today…With Xray, [security] is a no-brainer – it’s built in, just turn it on, wow! I’ll take that all day long.”
Larry Grill,
DevSecOps Sr. Manager,
Hitachi Vantara
“When we had that issue with log4j, it was announced on Friday afternoon and [using JFrog] by Monday at noon we had all cities rolled out with the patch.”
Hanno Walischewski
Chief System Architect,
Yunex Traffic
“Among the lessons we learned from this compromise is, in general, you should arrange your system so you never build directly from the internet without any intervening scanning tool in place to validate the dependencies you bring into your builds. To this end, we use an instance of JFrog® Artifactory®, not the cloud service, to host our dependencies, which is the only valid source for any software artifacts bound for staging, production, or on-premises releases.”
Setting the New Standard in Secure Software Development:
The SolarWinds Next-Generation Build System
SolarWinds
"Since moving to Artifactory, our team has been able to cut down our maintenance burden significantly…we’re able to move on and be a more in depth DevOps organization."
Stefan Krause
Software Engineer,
Workiva
“Over 300,000 users around the world rely on PRTG to monitor vital parts of their different-sized networks. Therefore, it is our obligation to develop and enhance not only our software itself but also the security and release processes around it. JFrog helps us do this in the most efficient manner.”
Konstantin Wolff
Infrastructure Engineer,
Paessler AG
“JFrog Connect, for me, is really a scaling tool so I can deploy edge IoT integrations much quicker and manage them at a larger scale. There’s less manual, one-off intervention when connecting to different customer sites with different VPNs and firewall requirements.”
Ben Fussell
Systems Integration Engineer,
Ndustrial
"We wanted to figure out what can we really use instead of having five, six different applications. Maintaining them. Is there anything we can use as a single solution? And Artifactory came to the rescue. It really turned out to be a one-stop shop for us. It really provided everything that we need."
Keith Kreissl
Principal Developer,
Cars.com
“Most large companies have multiple sites and it is critical for those companies to manage authentication and permission efficiently across locations. JFrog Enterprise+ will provide us with an ideal setup that will allow us to meet our rigorous requirements from the get go. It's advanced capabilities, like Access Federation, will reduce our overhead by keeping the users, permissions, and and groups in-sync between sites.”
Siva Mandadi
DevOps - Autonomous Driving, Mercedes
“JFrog Enterprise+ increases developer productivity and eliminates frustration. JFrog Distribution is basically a CDN On-Prem that enables us to distribute software to remote locations in a reliable way. Whereas, JFrog Access Federation gives us the ability to share credentials, access and group memebers across different locations with ease.”
Artem Semenov
Senior Manager for DevOps and Tooling,
Align Technology
"Instead of a 15-month cycle, today we can release virtually on request.”
Martin Eggenberger
Chief Architect,
Monster
“As a long-time DevOps engineer, I know how difficult it can be to keep track of the myriad of package types – legacy and new – that corporations have in their inventory. JFrog has always done a phenomenal job at keeping our team supported, efficient and operational – because if JFrog goes out, we might as well go home. Thankfully, with AWS infrastructure at our backs as well, we know we can develop and deliver with confidence anywhere our business demands today, and in the future.”
Joel Vasallo
Head of Cloud DevOps,
Redbox
“The capabilities of Artifactory are what allow us to do what we can do today…With Xray, [security] is a no-brainer – it’s built in, just turn it on, wow! I’ll take that all day long.”
Larry Grill,
DevSecOps Sr. Manager,
Hitachi Vantara
“When we had that issue with log4j, it was announced on Friday afternoon and [using JFrog] by Monday at noon we had all cities rolled out with the patch.”
Hanno Walischewski
Chief System Architect,
Yunex Traffic
“Among the lessons we learned from this compromise is, in general, you should arrange your system so you never build directly from the internet without any intervening scanning tool in place to validate the dependencies you bring into your builds. To this end, we use an instance of JFrog® Artifactory®, not the cloud service, to host our dependencies, which is the only valid source for any software artifacts bound for staging, production, or on-premises releases.”
Setting the New Standard in Secure Software Development:
The SolarWinds Next-Generation Build System
SolarWinds
"Since moving to Artifactory, our team has been able to cut down our maintenance burden significantly…we’re able to move on and be a more in depth DevOps organization."
Stefan Krause
Software Engineer,
Workiva
“Over 300,000 users around the world rely on PRTG to monitor vital parts of their different-sized networks. Therefore, it is our obligation to develop and enhance not only our software itself but also the security and release processes around it. JFrog helps us do this in the most efficient manner.”
Konstantin Wolff
Infrastructure Engineer,
Paessler AG
“JFrog Connect, for me, is really a scaling tool so I can deploy edge IoT integrations much quicker and manage them at a larger scale. There’s less manual, one-off intervention when connecting to different customer sites with different VPNs and firewall requirements.”
Ben Fussell
Systems Integration Engineer,
Ndustrial
"We wanted to figure out what can we really use instead of having five, six different applications. Maintaining them. Is there anything we can use as a single solution? And Artifactory came to the rescue. It really turned out to be a one-stop shop for us. It really provided everything that we need."
Keith Kreissl
Principal Developer,
Cars.com

Discover More About JFrog Advanced security

 

Book a demo with a JFrog Security expert

  • Learn how to block malicious or risky packages from ever entering your organization
  • Make developers security pros with IDE plugins, CLI, and Git scanning tools
  • See the seamless developer experience to secure code & builds
  • See holistic security in one platform with Curation, SAST, SCA, IaC, Secrets and Container security solutions
  • See how simple it is to get started with JFrog Security in your ecosystem

 

Additional Resources on Security

Solution Sheet
JFrog Security
READ MORE >
Security Research Report
In-Depth Analysis of The Top Open Source Security Vulnerabilities
READ REPORT >
Webinar
Software supply chain security with Xray Essentials & Advanced Security
WATCH NOW >
Blog
Save time fixing only the applicable vulnerable dependencies in your IDE
READ MORE >
Git OSS Scanning Tool
Frogbot - The JFrog Security Git Bot
Learn More >
Security Research Blog
Scale and improve security posture while shifting left!
READ MORE >

Securing the Software
that Powers the World

It’s our Liquid Software vision to automatically deliver software packages seamlessly and securely from any source to any device.

Start Free Book a Demo