Mid-to-large engineering orgs Multi-language artifact management Compliance-driven, regulated teams Teams wanting built-in supply-chain security

Who is JFrog not for?

Solo devs and tiny teams — pure overkill Startups needing predictable, transparent pricing Teams without dedicated DevOps/platform staff Anyone who just needs simple package hosting

shouldiuse.io

JFrog Review

Depends

Should I use JFrog?

Software supply chain platform (Artifactory, Xray, security scanning) - jfrog.com

Analyzed September 19, 2026 · 1 month ago

Buy if you're a mid-to-large engineering org needing scalable, centralized artifact management with built-in security scanning. Small teams and budget-sensitive startups should pick a simpler, cheaper repository tool.

Confidence

Medium. Based on 20+ public sources (reviews, CVE databases, pricing aggregators, vendor case studies). Pricing and quote snippets were partially truncated in sources.

Ratings

Value for money
Ease of use
Feature depth
Support qualityNo support-quality evidence found
Security posture

Pricing

Free trial

ModelNot disclosed

Monthly feesNot disclosed

HardwareNot disclosed

Pro$50/user/month (per G2)

EnterpriseCustom quote

Best for

Mid-to-large engineering orgs
Multi-language artifact management
Compliance-driven, regulated teams
Teams wanting built-in supply-chain security

Not for

Solo devs and tiny teams — pure overkill
Startups needing predictable, transparent pricing
Teams without dedicated DevOps/platform staff
Anyone who just needs simple package hosting

Gotchas - check before you buy

high

Pricing is not public; users report hard negotiations and sudden pricing-model changes

high

Critical auth-bypass CVE (CVSS 9.8) reportedly exploited — patch immediately or use SaaS

medium

Self-hosted means real ops burden — that's why fully-managed alternatives market against it

medium

Advanced Security is a separate paid module; some reviewers call it just 'decent'

Pros

Scales extremely well with enterprise-grade capabilities
Users consistently praise centralized artifact management
Xray security scanning called 'definitely worth it' by users
Ahead of the game on regulatory/compliance needs
Trusted at bank scale — HDFC Bank, SAS, Monster case studies

Cons

Critical CVSS 9.8 auth-bypass vulnerability reportedly exploited in the wild
Users report painful pricing negotiations and pricing-model changes
Self-hosting is operationally heavy enough to spawn managed competitors
Some users find Advanced Security add-on merely 'decent'

Sources & method

Analyzed September 19, 2026 - 16 sources - Patch-sensitive: two 2026 Artifactory auth-bypass CVEs, one CVSS 9.8 reportedly exploited in the wild.

official x1review x8security x3news x4

CVE-2026-82329 — critical authentication bypass (CVSS 9.8), Reportedly exploited; JFrog has released fixes — verify you're on a patched version.
CVE-2026-65616 — Artifactory authentication bypass, Disclosed July 30, 2026; patch available per JFrog advisories.

Key stats

Value for money: 2/5
Rating
$0
Starting price
16
Sources
September 19, 2026
Analyzed

Value for money: 2/5. Opaque pricing; users report tough negotiations
Ease of use: 3/5. Powerful but operationally heavy
Feature depth: 5/5. Scales extremely well; deep enterprise features
Support quality. No support-quality evidence found
Security posture: 2/5. Two 2026 auth-bypass CVEs; one exploited

4.2/5 G2 rating 167 reviews (JFrog Ltd)
$50/mo Starting price Pro plan, per G2 listing
Yes Free trial Artifactory + Xray trial
4,500+ Customers Claimed enterprise customers

Pricing

Free trial

Trial of Artifactory and Xray
Explore full platform

Pro

$50/user/month (per G2)

Centralized artifact repository
Self-hosted or cloud

Enterprise

Not disclosed

Advanced Security add-on
Bank-scale deployments

Security

Patch-sensitive: two 2026 Artifactory auth-bypass CVEs, one CVSS 9.8 reportedly exploited in the wild.

CVE-2026-82329 — critical authentication bypass (CVSS 9.8)Reportedly exploited; JFrog has released fixes — verify you're on a patched version.^⁹
CVE-2026-65616 — Artifactory authentication bypassDisclosed July 30, 2026; patch available per JFrog advisories.¹⁰

What users say

Users praise JFrog's scale and centralized artifact management while complaining about pricing and add-on value.

“Jfrog Xray is definitely worth it”

Reddit, r/devops

“Scales extremely well”

TrustRadius reviewer

“JFrog is pretty ahead of the game”

Reddit, r/devops

Alternatives

Compare JFrog with each alternative.

Sonatype Nexus Repository
Mature repo manager; some users find it better designed
JFrog vs Sonatype Nexus Repository
Cloudsmith
Fully-managed Artifactory alternative; far less ops burden
JFrog vs Cloudsmith
GitHub Packages
Bundled with code hosting; enough for lighter needs

Artifact Keeper
Open-source, self-hosted repo for budget teams

Companies that use it

HDFC Bank
SAS Institute
Monster
Zeta

Full analysis

Based on 20+ public sources (reviews, CVE databases, pricing aggregators, vendor case studies). Pricing and quote snippets were partially truncated in sources.

Powerful, scalable enterprise DevOps platform — but opaque pricing, ops weight, and a critical exploited CVE. Overkill for small teams.

Methodology

Based on 20+ public sources (reviews, CVE databases, pricing aggregators, vendor case studies). Pricing and quote snippets were partially truncated in sources.

Read how a report is made.

Sources

JFrog Artifactory Reviews — TrustRadiustrustradius.com
review
JFrog Ltd — G2 (167 reviews)g2.com
review
JFrog Reviews — G2g2.com
review
Share your experience using JFrog Xray — Redditreddit.com
review
What is so special about JFrog? — Redditreddit.com
review
JFrog Advanced Security — Redditreddit.com
review
JFrog pricing change — Redditreddit.com
review
JFrog Artifactory alternatives — Redditreddit.com
review
Critical JFrog Artifactory vulnerability exploited — SecurityWeeksecurityweek.com
security
CVE-2026-65616 — SentinelOnesentinelone.com
security
JFrog Security Advisoriesdocs.jfrog.com
security
Start free trial — JFrogjfrog.com
official
JFrog pricing — Vendrvendr.com
news
Cloudsmith vs JFrog Artifactorycloudsmith.com
news
JFrog — Insight Partnersinsightpartners.com
news
Sonatype Nexus vs JFrog Artifactorysonatype.com
news

Add this review to your site

This check for JFrog says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends JFrog Independent review on Should I Use It

Badge code

<!-- Should I Use It badge. Keep this link. -->
<a href="https://shouldiuse.io/r/jfrog" target="_blank" style="display:inline-flex;flex-direction:column;align-items:flex-start;gap:8px;max-width:420px;box-sizing:border-box;padding:14px 16px;border:1px solid #d5dde4;border-radius:14px;background:#ffffff;color:#111111;font-family:Segoe UI,system-ui,sans-serif;line-height:1.25;text-decoration:none;box-shadow:0 8px 20px rgba(17,17,17,0.08);">
  <span style="display:flex;align-items:center;gap:10px;min-width:0;">
    <span style="display:inline-flex;align-items:center;flex:0 0 auto;border-radius:999px;padding:4px 10px;font-size:11px;font-weight:700;letter-spacing:0.06em;text-transform:uppercase;line-height:1.3;background:#fef7e0;color:#7a5510;">Depends</span>
    <span style="font-size:15px;font-weight:700;color:#111111;overflow-wrap:anywhere;">JFrog</span>
  </span>
  <span style="font-size:12px;font-weight:500;color:#516271;">Independent review on Should I Use It</span>
</a>

Text link

<a href="https://shouldiuse.io/r/jfrog">JFrog review on Should I Use It: Depends</a>

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

No comments yet.

Categories

JFrog Review

Confidence

Ratings

Pricing