JFrog Runtime Security

Name: JFrog Runtime Security
Brand: JFrog
Rating: 4.2 (116 reviews)

Leader

On a mission to create a world of software delivered without friction from developer to device.

Est 2008|Valuation $11.7B|Raised $580M

LinkedIn 104K|Website|Web traffic 532K|FTEs 1,800|HQ Sunnyvale, California, US

MarketsCloud-Native Application Protection Platform (CNAPP)

01Competitive Landscape

Narrative competitive analysis

Where JFrog Runtime Security appears to provide advantages - Supply chain lineage and runtime visibility: JFrog’s platform approach enables mapping artifacts and builds to runtime instances, which supports traceability and governance. - Integrity monitoring: JFrog positions Runtime Security to verify that expected images and digests are running and to detect unauthorized changes. - Integrated platform approach: For organizations already standardized on JFrog, adding runtime capabilities may simplify integration compared with deploying a separate runtime vendor. Where competitors can be stronger - Runtime threat detection depth: Vendors such as Sysdig, Aqua, and Prisma Cloud have longer-established runtime detection capabilities, behavioral analytics, and response playbooks. - Broader CNAPP coverage: Some competitors provide a wider cloud asset graph and cross-service context beyond the artifact layer. Pricing and value comparison (what’s known) - Sysdig Secure: Quote-based; licensing often depends on number of hosts or compute instances. - Snyk: Public per-contributor pricing is available for developer-focused AppSec offerings; enterprise pricing is custom. - JFrog: Public entry-level pricing exists for the platform, but runtime/security add-ons are generally quote-based; some security pricing is tied to contributing-developer metrics for Advanced Security. Buyer consideration: Organizations that prefer predictable per-developer AppSec pricing may find products with published per-user metrics easier to estimate. Organizations that prioritize unified artifact and runtime coverage may value JFrog’s platform integration but should plan for a sales engagement to obtain precise pricing. Market adoption signals - Third-party review volume and sentiment are stronger for Artifactory than for Runtime specifically. - Runtime was launched recently; independent review coverage specific to Runtime is therefore still emerging.

	JFrog Runtime Security	Sysdig Secure	Palo Alto Prisma Cloud
Starting Price	Runtime pricing not publicly listed; published platform pricing is available; runtime described as an enterprise add-on	Quote-based (host-based licensing model)	Quote-based (enterprise offerings)
Recommended for	Existing JFrog platform customers seeking supply-chain lineage and runtime integrity in Kubernetes	Organizations prioritizing runtime insights, container/Kubernetes threat detection, and CNAPP workflows	Large enterprises seeking broad CNAPP coverage (posture, workload protection, code integration)
Key Strength	Linkage between running workloads and artifact/build provenance; emphasis on integrity verification	Established runtime threat detection and CNAPP capabilities	Broad platform breadth and enterprise consolidation capabilities
Key Weakness	Limited independent benchmarking for runtime threat detection coverage compared with long-established runtime vendors; pricing transparency is limited	Pricing models can be opaque and may require operational security expertise to manage	Quote complexity and potential platform complexity for some teams

01Competitive Landscape

Narrative competitive analysis

Where JFrog Runtime Security appears to provide advantages

Supply chain lineage and runtime visibility: JFrog’s platform approach enables mapping artifacts and builds to runtime instances, which supports traceability and governance.
Integrity monitoring: JFrog positions Runtime Security to verify that expected images and digests are running and to detect unauthorized changes.
Integrated platform approach: For organizations already standardized on JFrog, adding runtime capabilities may simplify integration compared with deploying a separate runtime vendor.

Where competitors can be stronger

Runtime threat detection depth: Vendors such as Sysdig, Aqua, and Prisma Cloud have longer-established runtime detection capabilities, behavioral analytics, and response playbooks.
Broader CNAPP coverage: Some competitors provide a wider cloud asset graph and cross-service context beyond the artifact layer.

Pricing and value comparison (what’s known)

Sysdig Secure: Quote-based; licensing often depends on number of hosts or compute instances.
Snyk: Public per-contributor pricing is available for developer-focused AppSec offerings; enterprise pricing is custom.
JFrog: Public entry-level pricing exists for the platform, but runtime/security add-ons are generally quote-based; some security pricing is tied to contributing-developer metrics for Advanced Security.

Buyer consideration: Organizations that prefer predictable per-developer AppSec pricing may find products with published per-user metrics easier to estimate. Organizations that prioritize unified artifact and runtime coverage may value JFrog’s platform integration but should plan for a sales engagement to obtain precise pricing.

Market adoption signals

Third-party review volume and sentiment are stronger for Artifactory than for Runtime specifically.
Runtime was launched recently; independent review coverage specific to Runtime is therefore still emerging.

	JFrog Runtime Security	Sysdig Secure	Palo Alto Prisma Cloud
Starting Price	Runtime pricing not publicly listed; published platform pricing is available; runtime described as an enterprise add-on	Quote-based (host-based licensing model)	Quote-based (enterprise offerings)
Recommended for	Existing JFrog platform customers seeking supply-chain lineage and runtime integrity in Kubernetes	Organizations prioritizing runtime insights, container/Kubernetes threat detection, and CNAPP workflows	Large enterprises seeking broad CNAPP coverage (posture, workload protection, code integration)
Key Strength	Linkage between running workloads and artifact/build provenance; emphasis on integrity verification	Established runtime threat detection and CNAPP capabilities	Broad platform breadth and enterprise consolidation capabilities
Key Weakness	Limited independent benchmarking for runtime threat detection coverage compared with long-established runtime vendors; pricing transparency is limited	Pricing models can be opaque and may require operational security expertise to manage	Quote complexity and potential platform complexity for some teams