JFrog Secrets Detection

Name: JFrog Secrets Detection
Brand: JFrog

Leader

On a mission to create a world of software delivered without friction from developer to device.

Est 2008|Valuation $11.7B|Raised $580M

LinkedIn 104K|Website|Web traffic 532K|FTEs 1,800|HQ Sunnyvale, California, US

MarketsApplication Security Testing (AST)Secret Scanning

01Competitive Landscape

Narrative competitive analysis

Where JFrog Secrets Detection is positioned to be stronger - Artifact and binary-centric scanning: the product explicitly includes scanning of text and binary files for secrets and targets detection in packaged outputs stored in artifact repositories. - Integrated supply chain metadata: integration with repository metadata, build information, and policy enforcement can support governance workflows. Where alternatives can be stronger - Dedicated SCM secrets workflows: products focused on source control management (SCM) secrets scanning typically provide more developed workflows for commit/PR scanning and developer remediation. - Cost-sensitive scanning: open-source scanners and lightweight commercial tools can provide basic coverage with lower upfront licensing and operational costs, at the expense of more internal operational overhead. Credibility check on vendor claims - Vendor marketing materials make strong claims about scope and novelty; these should be validated by pilots and reference checks. Independent benchmarks on detection precision and recall for secrets scanners are limited in vendor materials.

	JFrog Secrets Detection (via Xray/JAS)	GitGuardian	Sonatype Firewall
Starting Price	Sales-led or bundle-based licensing; secrets scanning listed as a capability within platform pricing materials	Published pricing information available from the vendor; enterprise purchases typically sales-led	Published pricing information available from the vendor; additional components may be required
Recommended for	Organizations already centralized on Artifactory/Xray that require detection in artifacts, binaries, and container images	Organizations that need organization-wide SCM secrets governance (repos, PRs, incident workflows)	Organizations prioritizing blocking risky components at the repository intake and supply chain boundary
Key Strength	Artifact- and binary-focused scanning integrated with repository metadata and policy enforcement	Dedicated secrets program features, remediation workflows, developer-facing tooling	Repository boundary controls and component intake governance; clear operational focus
Key Weakness	Often perceived as costly and may be tier-gated; operational complexity in some environments	May not provide the same artifact/binary scanning coverage tied to an artifact repository	Focus is on intake controls rather than secrets in binaries; different primary problem space

01Competitive Landscape

Narrative competitive analysis

Where JFrog Secrets Detection is positioned to be stronger

Artifact and binary-centric scanning: the product explicitly includes scanning of text and binary files for secrets and targets detection in packaged outputs stored in artifact repositories.
Integrated supply chain metadata: integration with repository metadata, build information, and policy enforcement can support governance workflows.

Where alternatives can be stronger

Dedicated SCM secrets workflows: products focused on source control management (SCM) secrets scanning typically provide more developed workflows for commit/PR scanning and developer remediation.
Cost-sensitive scanning: open-source scanners and lightweight commercial tools can provide basic coverage with lower upfront licensing and operational costs, at the expense of more internal operational overhead.

Credibility check on vendor claims

Vendor marketing materials make strong claims about scope and novelty; these should be validated by pilots and reference checks. Independent benchmarks on detection precision and recall for secrets scanners are limited in vendor materials.

	JFrog Secrets Detection (via Xray/JAS)	GitGuardian	Sonatype Firewall
Starting Price	Sales-led or bundle-based licensing; secrets scanning listed as a capability within platform pricing materials	Published pricing information available from the vendor; enterprise purchases typically sales-led	Published pricing information available from the vendor; additional components may be required
Recommended for	Organizations already centralized on Artifactory/Xray that require detection in artifacts, binaries, and container images	Organizations that need organization-wide SCM secrets governance (repos, PRs, incident workflows)	Organizations prioritizing blocking risky components at the repository intake and supply chain boundary
Key Strength	Artifact- and binary-focused scanning integrated with repository metadata and policy enforcement	Dedicated secrets program features, remediation workflows, developer-facing tooling	Repository boundary controls and component intake governance; clear operational focus
Key Weakness	Often perceived as costly and may be tier-gated; operational complexity in some environments	May not provide the same artifact/binary scanning coverage tied to an artifact repository	Focus is on intake controls rather than secrets in binaries; different primary problem space