4.2/5
G2 rating
167 reviews (JFrog Ltd)
Report
Should I Use JFrog?
Software supply chain platform (Artifactory, Xray, security scanning)
Depends
DependsBuy if you're a mid-to-large engineering org needing scalable, centralized artifact management with built-in security scanning.
Powerful, scalable enterprise DevOps platform — but opaque pricing, ops weight, and a critical exploited CVE. Overkill for small teams.
Confidence: Medium
$50/mo
Starting price
Pro plan, per G2 listing
Yes
Free trial
Artifactory + Xray trial
4,500+
Customers
Claimed enterprise customers
Value for money
2
Opaque pricing; users report tough negotiations
Ease of use
3
Powerful but operationally heavy
Feature depth
5
Scales extremely well; deep enterprise features
Security posture
2
Two 2026 auth-bypass CVEs; one exploited
Pros
Cons
Gotchas
- highPricing is not public; users report hard negotiations and sudden pricing-model changes⁷
- highCritical auth-bypass CVE (CVSS 9.8) reportedly exploited — patch immediately or use SaaS⁹
- mediumSelf-hosted means real ops burden — that's why fully-managed alternatives market against it14
- mediumAdvanced Security is a separate paid module; some reviewers call it just 'decent'⁶
Best for
- Mid-to-large engineering orgs
- Multi-language artifact management
- Compliance-driven, regulated teams
- Teams wanting built-in supply-chain security
Not for
- Solo devs and tiny teams — pure overkill
- Startups needing predictable, transparent pricing
- Teams without dedicated DevOps/platform staff
- Anyone who just needs simple package hosting
Companies that use it
- HDFC Bank
- SAS Institute
- Monster
- Zeta
Pricing
Free trial
$0
- Trial of Artifactory and Xray
- Explore full platform
Pro
$50/user/month (per G2)
- Centralized artifact repository
- Self-hosted or cloud
Enterprise
Not disclosed
- Advanced Security add-on
- Bank-scale deployments
Security
Patch-sensitive: two 2026 Artifactory auth-bypass CVEs, one CVSS 9.8 reportedly exploited in the wild.
What users say
Users praise JFrog's scale and centralized artifact management while complaining about pricing and add-on value.
“Jfrog Xray is definitely worth it”
“Scales extremely well”
“JFrog is pretty ahead of the game”
Alternatives
Compare JFrog with each alternative.
Sonatype Nexus Repository
Mature repo manager; some users find it better designed
JFrog vs Sonatype Nexus RepositoryCloudsmith
Fully-managed Artifactory alternative; far less ops burden
JFrog vs CloudsmithGitHub Packages
Bundled with code hosting; enough for lighter needs
Artifact Keeper
Open-source, self-hosted repo for budget teams
Full analysis
Based on 20+ public sources (reviews, CVE databases, pricing aggregators, vendor case studies). Pricing and quote snippets were partially truncated in sources.
Sources
- JFrog Artifactory Reviews — TrustRadiustrustradius.comreview
review
- JFrog Reviews — G2g2.comreview
review
- What is so special about JFrog? — Redditreddit.comreview
- JFrog Advanced Security — Redditreddit.comreview
- JFrog pricing change — Redditreddit.comreview
- JFrog Artifactory alternatives — Redditreddit.comreview
security
- CVE-2026-65616 — SentinelOnesentinelone.comsecurity
- JFrog Security Advisoriesdocs.jfrog.comsecurity
- Start free trial — JFrogjfrog.comofficial
- JFrog pricing — Vendrvendr.comnews
- Cloudsmith vs JFrog Artifactorycloudsmith.comnews
- JFrog — Insight Partnersinsightpartners.comnews
- Sonatype Nexus vs JFrog Artifactorysonatype.comnews
Rate this review
Anonymous. You can change your vote.
Loading votes…
Ask a follow-up
Ask if a use case fits. Answers stay inside this report and its sources.
Comments
One queue. No replies. Give a display name first. Limit: 7 comments per day.
No comments yet.