JFrog Runtime Security

Name: JFrog Runtime Security
Brand: JFrog
Rating: 4.2 (116 reviews)

Leader

On a mission to create a world of software delivered without friction from developer to device.

Est 2008|Valuation $11.7B|Raised $580M

LinkedIn 104K|Website|Web traffic 532K|FTEs 1,800|HQ Sunnyvale, California, US

MarketsCloud-Native Application Protection Platform (CNAPP)

Published May 16, 2026

01Common complaints

1. An organization needs a specialized runtime threat detection solution with mature response tooling - Consider Sysdig Secure, Prisma Cloud, Wiz, or Aqua—these vendors position runtime capabilities as core functionality. 2. The primary requirement is shift-left SCA/SAST with predictable per-developer pricing - Tools with published per-developer pricing may be easier to estimate and adopt for developer-focused AppSec programs. 3. The organization is highly sensitive to enterprise pricing, upsells, or consumption-based SaaS costs - Community feedback and review commentary frequently indicate higher costs at scale for some security add-ons. 4. The organization has limited operational capacity for platform administration - Initial configuration and policy governance for platform-centric security modules can require dedicated resources. 5. The primary need is only an artifact repository and minimal security features - Lower-cost artifact registries or cloud-native registries may satisfy basic needs depending on format support and availability requirements.

Deal disqualifiers (poor fit)

Small teams that only require basic vulnerability scanning
Organizations that prioritize specialized runtime threat detection or CNAPP-first capabilities over integrated artifact management
Teams with strict budget constraints that prioritize transparent, low-cost pricing models

Limitations evidenced in public sources (mostly about the platform / Xray)

UI and reporting limitations are frequently cited for Xray in third-party summaries.
Support responsiveness is noted as a concern in some reviews and community commentary.
Pricing transparency for runtime and security add-ons is limited, requiring sales engagement for accurate estimates.

Roadmap / feature availability

JFrog is iterating on runtime capabilities (e.g., Runtime Scope and Runtime Impact are described as distinct capabilities), but detailed timelines and maturity levels are not consistently published.

Security/compliance gaps

While JFrog provides platform-level compliance documentation (SOC 2, ISO references), runtime-specific security architecture details are less visible publicly; procurement should request detailed whitepapers, data flow diagrams, and threat models.

02Why they buy

Unique selling points with reasonable evidence

- Code-to-runtime lineage: The platform enables mapping from source and build artifacts to running workloads, supporting traceability and governance. - Runtime integrity verification: The product emphasizes verifying expected image digests and detecting changes or unauthorized images in runtime. - Integrated platform approach: For organizations already using JFrog products, adding runtime functionality can centralize artifact and runtime data within the same platform.

Where competitors have clearer advantages

Independent validation of runtime detection efficacy: Limited third-party benchmarking exists for JFrog Runtime Security versus longer-established runtime vendors.
Broader cloud context: CNAPP vendors often provide more extensive cross-cloud asset graphs and cloud service context.

Why customers chose JFrog (themes across reviews)

Centralized artifact repository across many package formats.
Integration between Artifactory and security scanning (Xray/Advanced Security).
Enterprise scaling features (replication, high availability) and governance capabilities.

03Field reports

Important limitation: Dedicated third-party review coverage for JFrog Runtime Security specifically is limited at the time of research, likely because Runtime launched recently. Most public reviews focus on Artifactory and Xray/Advanced Security rather than Runtime alone.

Gartner Peer Insights (direct quotes)

Excerpts for the JFrog platform convey generally positive sentiment alongside setup complexity: - Positive: Users reference Xray integration with Artifactory and enhanced vulnerability management by scanning dependencies in real time and generating SBOMs. - Critical/neutral: Some reviewers note initial setup is complex and requires dedicated effort before operational value is realized. (These comments pertain to the broader JFrog platform and software supply chain security, not runtime-only functionality.)

TrustRadius (direct quotes; pros & cons)

TrustRadius reviews for Artifactory highlight strengths for enterprise use and notable negatives:

Positive: Enterprise scale and scalability for large production environments.
Common con: User interface has room for improvement.
Negative: Some reviewers report slow or inadequate support responsiveness, and that certain features are restricted to higher-tier licenses.

G2 (indicators; limited direct Runtime specificity)

G2 product reviews commonly cite centralized repository capabilities, CI/CD integrations, broad package type support, and security add‑ons as strengths. Critiques include UI complexity for new users. An industry vendor/grid report lists JFrog as a contender and notes that review volume and satisfaction metrics vary versus category leaders.

PeerSpot (direct quotes; critiques)

PeerSpot summaries for Xray note issues such as UI limitations, reporting and dashboard constraints, documentation gaps, performance/API limitations, and database support concerns (some users mention PostgreSQL stability concerns).

Reddit / community sentiment (direct quotes)

Community comments—often not Runtime-specific—highlight buyer friction points:

Price sensitivity: Comments indicate concerns about cost when deploying JFrog across many servers.
Cost/upsell concerns: Some participants report being encouraged toward higher tiers and note price increases.
Support/outage frustration: Community threads reference scenarios where users were dissatisfied with support during incidents.

Hacker News

Searches did not surface prominent Hacker News threads focused specifically on JFrog Runtime Security during this research pass; discussions may exist under broader event or partnership threads.

Why some customers leave / consider alternatives (themes)

Cost escalation and tier gating of certain features.
Support responsiveness complaints in some reviews.
UI and usability concerns.
Some organizations opt to retain JFrog for artifact management but adopt a dedicated runtime or CNAPP vendor for runtime detection and response.

Vendor case studies mentioning runtime/security outcomes

- JFrog publishes customer stories and solution materials that reference code-to-runtime security implementations, including examples from Financial Services customers deploying the platform components together with Kubernetes/runtime elements. Critical evaluation: - Vendor-published case studies often include success metrics that lack detailed methodology (sample size, baseline, control groups, duration). Such ROI and time-saving claims should be treated as directional unless corroborated by independent evaluations.

Research/analyst-style claims

Vendor materials and press coverage highlight features such as contextual analysis and prioritization; analyst commentary has noted benefits of platform consolidation.

Methodology gaps:

Claims about reductions in noise or false positives require independent benchmarking; outcomes will vary by workload composition and policy configuration.

04Best fit

Company size

Mid-market to enterprise — organizations with sizable engineering organizations managing many repositories and multiple package ecosystems.

Industries

Software and technology
Financial services
Regulated industries that require audit trails and SBOMs

Roles/personas

Economic buyers: VP Engineering, CISO/Head of AppSec, Platform Engineering leadership
Champions: DevSecOps leads, platform engineers, security architects
End users: Developers (consumers of curated/secured packages), SREs, SOC or AppSec triage teams

Key pain points addressed

Visibility into what is actually running in production and risk prioritization for active workloads
Linking runtime findings back to artifact provenance and ownership
Compliance and audit traceability needs (SBOMs, image integrity checks)

Qualification criteria (good fit)

Existing deployment or planned adoption of Artifactory + Xray/Advanced Security
Kubernetes deployment at scale across multiple clusters or namespaces
Strong need for artifact-level governance and runtime integrity verification

05The pitch

What the product does (core value proposition)

JFrog Runtime Security (referred to on JFrog’s site as JFrog Runtime) is a Kubernetes-focused shift-right capability within the broader JFrog Software Supply Chain Platform. Its primary functionality is real-time monitoring of Kubernetes clusters to: - Identify and prioritize runtime security incidents based on contextual risk - Verify image integrity (detect unintended or unauthorized modifications) - Improve code-to-production traceability by linking running workloads back to artifacts, builds, and owners JFrog states that Runtime Security is intended to complement platform components such as Artifactory and JFrog Security/Advanced Security for scanning and policy enforcement across the SDLC, rather than serving as a standalone CNAPP.

Target market and market positioning

- Target users: Platform engineering, DevOps, DevSecOps, and security teams operating Kubernetes at scale. - Positioning: JFrog positions Runtime Security to emphasize software supply chain lineage—because JFrog manages binaries, runtime visibility can be mapped back to provenance, build pipelines, and artifact metadata. - Recommended environments: Enterprises or larger mid-market organizations already using Artifactory/Xray that seek runtime coverage and integrity monitoring within the same platform.

Get a comprehensive analysis of JFrog Runtime Security including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →