JFrog Xray

Name: JFrog Xray
Brand: JFrog
Rating: 4.2 (149 reviews)

Leader

On a mission to create a world of software delivered without friction from developer to device.

Est 2008|Valuation $11.7B|Raised $580M

LinkedIn 104K|Website|Web traffic 532K|FTEs 1,800|HQ Sunnyvale, California, US

MarketsApplication Security Testing (AST)SCA

Published May 16, 2026

01Common complaints

1) Small teams or startups with constrained budgets - For organizations with limited budgets and low artifact volumes, the platform and tiering model may not be cost-effective relative to simpler or open-source solutions. 2) If the primary need is basic container/image scanning - If the main requirement is periodic container scanning without centralized governance, a combination of registry and open-source scanners may be a lower-cost option. 3) If you require a single, unified AppSec product covering SCA, SAST, IaC, and DAST from one vendor - Xray is focused on artifact-centric SCA and policy enforcement; organizations seeking a single-vendor application security suite should evaluate alternative vendors for coverage and pricing. 4) If your organization is highly sensitive to unpredictable usage-based bills - Organizations with large or volatile artifact download volumes should model consumption pricing or consider vendors with fixed-price models. 5) If the team cannot tolerate initial gating disruption - If false positives or policy tuning overhead would significantly slow releases, consider starting with advisory scanning and maturing policies before enforcing blocking actions.

Disqualifiers (poor fit)

Very small teams with limited compliance needs and low artifact volumes.
Organizations that do not use Artifactory and are unwilling to adopt a platform approach.

Limitations from vendor materials and documentation gaps

Public vendor materials provided more on marketing and how-to guidance than explicit limitations. Clear vendor-published documentation about upper scale bounds, known false-positive classes, or data residency guarantees was not retrieved in this run.

Practical limitations inferred from customer discussions

Cost and packaging: Community discussions frequently raise pricing and tiering as concerns.
Operational friction: Users report variable support responsiveness and UI/UX critiques.
Scanner disagreement: Differences in findings between scanners can require an explicit policy about which tool is authoritative and processes for reconciling discrepancies.

Roadmap / future features

Not captured in the sources used for this research run; buyers should request a product roadmap or roadmap briefing under NDA if roadmap alignment is a procurement requirement.

Why some customers left for competitors (churn reasons)

Community discussions and some case anecdotes indicate cost, tiering changes, and preferences for simpler cloud-native registries or different ecosystems as reasons to change platforms. Specific drivers include pricing increases, negotiation friction, and efforts to reduce platform complexity.

02Why they buy

Unique selling points observed in vendor materials and customer feedback

Integration with artifact repositories and build metadata: The platform integration enables policy checks tied to stored artifacts and build information, which customers often cite as an operational benefit.
Policy enforcement mechanics (watches/actions, build-fail responses): The ability to configure automated responses to policy violations supports governance that goes beyond reporting-only approaches.

Vendor-claimed unique selling points that require validation

Vendor materials claim improved scanning performance and greater policy flexibility in some migration stories; organizations should validate these claims through a proof-of-concept with measurable criteria (scan duration, false-positive rate, developer friction).

Where competitors have advantages

Snyk: Offers publicly documented entry pricing and a developer-focused application security suite.
Sonatype: Offers a free repository tier and potentially lower-cost entry for repository management needs.

Why customers chose Xray over alternatives (as stated in vendor material)

Vendor-published material indicates customers sometimes consolidate tools to centralize governance and reduce integration work, citing policy management, developer workflow considerations, and performance in vendor-authored migration stories. Independent validation of such claims is advised.

03Field reports

Review platforms (Gartner Peer Insights, G2, PeerSpot)

Gartner Peer Insights (Software Supply Chain Platform / SCA markets) - Excerpts available indicate customers value Xray’s integration with Artifactory and continuous dependency scanning. Access to full review text may be gated. G2 (JFrog Software Supply Chain Platform reviews) - Excerpts indicate some users view Xray as an advantage for security and license compliance, while some reviewers note the user interface could be improved. PeerSpot (JFrog Xray reviews and comparisons) - PeerSpot’s dataset indicates a research interest skew toward large enterprises in their sample. PeerSpot comparisons suggest Snyk is often selected for pricing and support considerations, while Xray is selected for its artifact-centric governance and integration with repository tooling. PeerSpot is a market data provider and its summaries should be treated as input rather than definitive market truth.

Community / Social (practitioner quotes)

Below are representative practitioner quotes and paraphrases reflecting both positive and negative experiences. Community posts are anecdotal; patterns across many posts are more informative than single comments. Positive / affirmative comments - Some users report that integrating Xray with Artifactory helped them enforce download or deployment policies and reduce risk from compromised packages. - Practitioners have described scenarios where Artifactory proxying combined with Xray filtering allowed them to block problematic packages and reduce exposure. Critical / skeptical comments - Pricing and perceived value are frequent points of concern, with some practitioners advising that the platform may be cost-prohibitive for smaller organizations. - Support responsiveness during incidents or outages has been called out as inconsistent in some community threads. - Some users report a learning curve for interpreting scan results and configuring policies, and that scan-result discrepancies between tools can cause workflow friction.

Vendor-published migration story (from competing tools to JFrog)

Vendor-published materials describe organizations that evaluated other SCA providers and consolidated on JFrog for policy management, integration, and operational reasons. Critical evaluation: - Pros: These stories provide selection criteria and describe integration and process outcomes. - Cons: They are vendor-authored, often anonymized, and typically lack independently verifiable metrics (for example, specific reductions in vulnerability exposure or quantified TCO savings). Treat vendor case studies as directional evidence and validate with an impartial proof-of-concept where possible.

Financial services case study

A financial services case study indicates use of Xray for artifact security scanning in a regulated environment.

Critical evaluation:

Pros: Confirms adoption in regulated sectors.
Cons: The available material does not provide quantified outcome metrics (such as mean time to remediation improvements); buyers should request implementation details, rollout timelines, and measurable outcomes.

Government / platform-level validation

A vendor press release references verification for a Department of Defense DevSecOps initiative.

Critical evaluation:

Pros: Signals that the product has been evaluated for certain government programs.
Cons: Press releases are vendor communications; procurement teams should obtain the underlying artifacts and confirm scope, versioning, and applicability to SaaS vs self-hosted deployments.

04Best fit

Company sizes

Best fit: Mid-market to large enterprises with multi-team engineering organizations and significant artifact volumes.

Industries/verticals

Financial services, government-adjacent, and other regulated sectors appear in customer materials and reviews.

Roles/personas

Decision makers: Heads of DevOps/Platform Engineering, AppSec leads, and security leadership.
End users: Platform engineers managing artifact pipelines, developers receiving early dependency feedback, and security teams defining policy.

Pain points addressed

Centralizing vulnerability and license policy enforcement across many package types.
Reducing unknown component risk by scanning artifacts, containers, and builds continuously.
Enforcing release gates based on defined policies rather than advisory-only scans.

05The pitch

What the product does (objective core value proposition)

JFrog Xray is a Software Composition Analysis (SCA) and artifact security tool designed to continuously scan binaries and dependencies, including container images and build artifacts, for known vulnerabilities and license compliance risks as they move through the software delivery lifecycle. It is integrated with the JFrog Platform and Artifactory so security and compliance policies can be applied directly at the artifact repository level rather than using a separate stand-alone scanner.

Target market and market positioning

- Primary buyers: DevSecOps, Application Security (AppSec), Platform/DevOps teams that standardize on artifact management and CI/CD governance. - Typical fit: Mid-market to large enterprises with multiple package formats, multiple teams, and a need for centralized policy enforcement across artifacts, builds, and container images. - Positioning theme: Provides scanning earlier in the development lifecycle through IDE/CLI integrations and scanning tied to Artifactory metadata and build information, focusing on continuous scanning rather than point-in-time checks.

Get a comprehensive analysis of JFrog Xray including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published May 16, 2026

01Common complaints

Small teams or startups with constrained budgets

For organizations with limited budgets and low artifact volumes, the platform and tiering model may not be cost-effective relative to simpler or open-source solutions.

If the primary need is basic container/image scanning

If the main requirement is periodic container scanning without centralized governance, a combination of registry and open-source scanners may be a lower-cost option.

If you require a single, unified AppSec product covering SCA, SAST, IaC, and DAST from one vendor

Xray is focused on artifact-centric SCA and policy enforcement; organizations seeking a single-vendor application security suite should evaluate alternative vendors for coverage and pricing.

If your organization is highly sensitive to unpredictable usage-based bills

Organizations with large or volatile artifact download volumes should model consumption pricing or consider vendors with fixed-price models.

If the team cannot tolerate initial gating disruption

If false positives or policy tuning overhead would significantly slow releases, consider starting with advisory scanning and maturing policies before enforcing blocking actions.

Disqualifiers (poor fit)

Very small teams with limited compliance needs and low artifact volumes.
Organizations that do not use Artifactory and are unwilling to adopt a platform approach.

Limitations from vendor materials and documentation gaps

Public vendor materials provided more on marketing and how-to guidance than explicit limitations. Clear vendor-published documentation about upper scale bounds, known false-positive classes, or data residency guarantees was not retrieved in this run.

Practical limitations inferred from customer discussions

Cost and packaging: Community discussions frequently raise pricing and tiering as concerns.
Operational friction: Users report variable support responsiveness and UI/UX critiques.
Scanner disagreement: Differences in findings between scanners can require an explicit policy about which tool is authoritative and processes for reconciling discrepancies.

Roadmap / future features

Not captured in the sources used for this research run; buyers should request a product roadmap or roadmap briefing under NDA if roadmap alignment is a procurement requirement.

Why some customers left for competitors (churn reasons)

Community discussions and some case anecdotes indicate cost, tiering changes, and preferences for simpler cloud-native registries or different ecosystems as reasons to change platforms. Specific drivers include pricing increases, negotiation friction, and efforts to reduce platform complexity.

02Why they buy

Unique selling points observed in vendor materials and customer feedback

Integration with artifact repositories and build metadata: The platform integration enables policy checks tied to stored artifacts and build information, which customers often cite as an operational benefit.
Policy enforcement mechanics (watches/actions, build-fail responses): The ability to configure automated responses to policy violations supports governance that goes beyond reporting-only approaches.

Vendor-claimed unique selling points that require validation

Vendor materials claim improved scanning performance and greater policy flexibility in some migration stories; organizations should validate these claims through a proof-of-concept with measurable criteria (scan duration, false-positive rate, developer friction).

Where competitors have advantages

Snyk: Offers publicly documented entry pricing and a developer-focused application security suite.
Sonatype: Offers a free repository tier and potentially lower-cost entry for repository management needs.

Why customers chose Xray over alternatives (as stated in vendor material)

Vendor-published material indicates customers sometimes consolidate tools to centralize governance and reduce integration work, citing policy management, developer workflow considerations, and performance in vendor-authored migration stories. Independent validation of such claims is advised.

03Field reports

Review platforms (Gartner Peer Insights, G2, PeerSpot)

Gartner Peer Insights (Software Supply Chain Platform / SCA markets)

Excerpts available indicate customers value Xray’s integration with Artifactory and continuous dependency scanning. Access to full review text may be gated.

G2 (JFrog Software Supply Chain Platform reviews)

Excerpts indicate some users view Xray as an advantage for security and license compliance, while some reviewers note the user interface could be improved.

PeerSpot (JFrog Xray reviews and comparisons)

PeerSpot’s dataset indicates a research interest skew toward large enterprises in their sample. PeerSpot comparisons suggest Snyk is often selected for pricing and support considerations, while Xray is selected for its artifact-centric governance and integration with repository tooling. PeerSpot is a market data provider and its summaries should be treated as input rather than definitive market truth.

Community / Social (practitioner quotes)

Positive / affirmative comments

Some users report that integrating Xray with Artifactory helped them enforce download or deployment policies and reduce risk from compromised packages.
Practitioners have described scenarios where Artifactory proxying combined with Xray filtering allowed them to block problematic packages and reduce exposure.

Critical / skeptical comments

Pricing and perceived value are frequent points of concern, with some practitioners advising that the platform may be cost-prohibitive for smaller organizations.
Support responsiveness during incidents or outages has been called out as inconsistent in some community threads.
Some users report a learning curve for interpreting scan results and configuring policies, and that scan-result discrepancies between tools can cause workflow friction.

Vendor-published migration story (from competing tools to JFrog)

Vendor-published materials describe organizations that evaluated other SCA providers and consolidated on JFrog for policy management, integration, and operational reasons.

Critical evaluation:

Pros: These stories provide selection criteria and describe integration and process outcomes.
Cons: They are vendor-authored, often anonymized, and typically lack independently verifiable metrics (for example, specific reductions in vulnerability exposure or quantified TCO savings). Treat vendor case studies as directional evidence and validate with an impartial proof-of-concept where possible.

Financial services case study

A financial services case study indicates use of Xray for artifact security scanning in a regulated environment.

Critical evaluation:

Pros: Confirms adoption in regulated sectors.
Cons: The available material does not provide quantified outcome metrics (such as mean time to remediation improvements); buyers should request implementation details, rollout timelines, and measurable outcomes.

Government / platform-level validation

A vendor press release references verification for a Department of Defense DevSecOps initiative.

Critical evaluation:

Pros: Signals that the product has been evaluated for certain government programs.
Cons: Press releases are vendor communications; procurement teams should obtain the underlying artifacts and confirm scope, versioning, and applicability to SaaS vs self-hosted deployments.

04Best fit

Company sizes

Best fit: Mid-market to large enterprises with multi-team engineering organizations and significant artifact volumes.

Industries/verticals

Financial services, government-adjacent, and other regulated sectors appear in customer materials and reviews.

Roles/personas

Decision makers: Heads of DevOps/Platform Engineering, AppSec leads, and security leadership.
End users: Platform engineers managing artifact pipelines, developers receiving early dependency feedback, and security teams defining policy.

Pain points addressed

Centralizing vulnerability and license policy enforcement across many package types.
Reducing unknown component risk by scanning artifacts, containers, and builds continuously.
Enforcing release gates based on defined policies rather than advisory-only scans.

05The pitch

What the product does (objective core value proposition)

Target market and market positioning

Primary buyers: DevSecOps, Application Security (AppSec), Platform/DevOps teams that standardize on artifact management and CI/CD governance.
Typical fit: Mid-market to large enterprises with multiple package formats, multiple teams, and a need for centralized policy enforcement across artifacts, builds, and container images.
Positioning theme: Provides scanning earlier in the development lifecycle through IDE/CLI integrations and scanning tied to Artifactory metadata and build information, focusing on continuous scanning rather than point-in-time checks.

Get a comprehensive analysis of JFrog Xray including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →