Cuộc họp công bố kết quả kinh doanh quý 3/2026 của JFrog (FROG): Doanh thu đám mây tăng 60%, nâng định hướng

Điểm nhấn chính

• JFrog báo cáo doanh thu quý 3/2026 đạt 179,2 triệu USD, tăng 31% so với cùng kỳ năm trước và vượt cận trên trong phạm vi dự báo của ban lãnh đạo.
• Doanh thu đám mây tăng 60% lên 101,5 triệu USD, chiếm 57% tổng doanh thu. Ban lãnh đạo cho biết mức tăng trưởng này đến từ việc các cam kết của khách hàng gia tăng, mức độ sử dụng tăng lên và việc áp dụng các giải pháp bảo mật diễn ra rộng rãi hơn.
• Tỷ lệ duy trì doanh thu thuần trong 4 quý gần nhất tăng lên 124%, tăng 6 điểm phần trăm so với cùng kỳ năm trước và tăng 3 điểm phần trăm so với quý trước. Tỷ lệ duy trì gộp đạt 97%.
• Nghĩa vụ thực hiện còn lại đạt 812 triệu USD, tăng 60%, nhờ các cam kết lớn hơn từ khách hàng doanh nghiệp. JFrog đã ký hợp đồng SaaS nhiều năm trị giá 76 triệu USD với một khách hàng viễn thông.
• Biên lợi nhuận hoạt động non-GAAP mở rộng từ 18,7% lên 22,7%, trong khi dòng tiền tự do tăng lên 66,5 triệu USD, tương ứng với biên dòng tiền tự do đạt 37%.
• Ban lãnh đạo đã nâng dự báo doanh thu cả năm 2026 lên 680 triệu - 682 triệu USD, đồng thời nâng dự báo tăng trưởng đám mây cơ sở lên 52% - 54%.

Kết quả tài chính cốt lõi

Cuộc họp báo cáo kết quả kinh doanh có thảo luận về các chỉ số tài chính non-GAAP, với các đối chiếu được dẫn chiếu trong thông cáo báo chí của JFrog.

Hiệu quả kinh doanh và hoạt động

Mảng đám mây tiếp tục là động lực tăng trưởng chính của JFrog. Công ty duy trì việc chuyển đổi mức sử dụng vượt hạn mức hợp đồng của khách hàng thành các cam kết lớn hơn theo năm hoặc nhiều năm. Khách hàng cũng có thể tiếp tục sử dụng theo nhu cầu, nhưng doanh thu vượt mức cam kết tối thiểu không được đưa vào dự báo của ban lãnh đạo.

Giao dịch lớn nhất được nhấn mạnh là hợp đồng SaaS nhiều năm trị giá 76 triệu USD với một công ty viễn thông lớn. Hợp đồng này thể hiện mức tăng trưởng 167% về lượng tiêu thụ dữ liệu đám mây cam kết so với cam kết trước đó của khách hàng, đồng thời bao gồm cả các sản phẩm bảo mật và quản trị. Ban lãnh đạo cho biết không có khách hàng đơn lẻ nào chiếm hơn 3% tổng doanh thu.

JFrog liên kết mức tiêu thụ nền tảng gia tăng với việc phát triển phần mềm có sự hỗ trợ của AI. Ban lãnh đạo cho biết các tác nhân AI đang tạo ra nhiều tệp nhị phân truyền thống hơn cũng như các artifact mới hơn, bao gồm mô hình, tập dữ liệu, máy chủ MCP, kỹ năng và plugin. Công ty định vị Artifactory là hệ thống ghi nhận chung để lưu trữ, bảo mật và quản trị các tài sản này.

Việc áp dụng các giải pháp bảo mật cũng hỗ trợ đà mở rộng. Ban lãnh đạo đã viện dẫn nhu cầu đối với JFrog Curation, JFrog Advanced Security và Xray khi các doanh nghiệp ứng phó với các mối đe dọa chuỗi cung ứng phần mềm. Ford Motor Company đã di chuyển hơn một petabyte artifact sang Artifactory, trong khi JFrog Curation đã đánh giá 47 triệu yêu cầu gói mã nguồn mở mới cho Ford chỉ trong một quý.

Tăng trưởng khách hàng doanh nghiệp tiếp tục duy trì mạnh mẽ. Số lượng khách hàng có doanh thu định kỳ hàng năm trên 1 triệu USD tăng 58% lên 112 khách hàng từ mức 71 khách hàng cùng kỳ năm trước. Số lượng khách hàng có ARR vượt 100.000 USD tăng 21% lên 1.357 từ mức 1.121.

Dự báo của ban lãnh đạo

Ban lãnh đạo cho biết triển vọng cập nhật này phản ánh việc áp dụng các giải pháp bảo mật, mức độ sử dụng nền tảng rộng rãi hơn và các cam kết đám mây hàng năm cao hơn. Công ty tiếp tục không đưa mức sử dụng đám mây vượt mức tối thiểu theo hợp đồng cũng như các cơ hội lớn nhất vào dự báo do tính không chắc chắn về mặt thời điểm.

Rủi ro và các điểm cần theo dõi

• Dự báo không bao gồm mức sử dụng vượt mức cam kết tối thiểu hàng năm, khiến thời điểm và việc chuyển đổi phần sử dụng vượt mức thành doanh thu theo hợp đồng trở thành một biến số quan trọng.
• JFrog cũng loại trừ các cơ hội lớn nhất khỏi triển vọng do ngày chốt hợp đồng có thể chưa chắc chắn. Ban lãnh đạo lưu ý rằng trong lịch sử, các hợp đồng rất lớn thường có xu hướng được chốt vào nửa cuối năm.
• Khách hàng đã có phần do dự trong nửa đầu năm 2026 khi đánh giá tính bền vững của khối lượng công việc AI. Ban lãnh đạo cho biết quá trình ra quyết định đã trở nên rõ ràng hơn trong quý 3, đặc biệt là ở nhóm khách hàng lớn, nhưng thời điểm chuyển đổi vẫn phụ thuộc vào từng trường hợp cụ thể.
• Biên lợi nhuận gộp đạt 83,6%, thấp hơn một chút so với mức 83,9% cùng kỳ năm trước, do mảng đám mây chiếm tỷ trọng doanh thu lớn hơn. Ban lãnh đạo dự kiến biên lợi nhuận gộp cả năm đạt 83% - 83,5%.
• JFrog hiện vẫn chưa cung cấp số liệu chi tiết định lượng về doanh thu hoặc mức sử dụng đến từ riêng các artifact liên quan đến AI hay các sản phẩm bảo mật.

Điểm nhấn phiên hỏi đáp với chuyên gia phân tích

Ban lãnh đạo cho biết các khách hàng tăng cam kết sử dụng đám mây cũng đang bổ sung thêm các sản phẩm bảo mật và quản trị. Việc gắn kèm thêm nhiều sản phẩm này hỗ trợ các hợp đồng nhiều năm và góp phần nâng cao tỷ lệ duy trì doanh thu thuần.

Về tiến độ chuyển đổi hợp đồng, ban lãnh đạo cho biết quy trình cơ bản không rút ngắn đáng kể. Thay vào đó, các khách hàng lớn hơn đã nhận định rõ ràng hơn trong quý 3 rằng khối lượng công việc AI và mức tiêu thụ dữ liệu liên quan sẽ tiếp tục tăng trưởng.

JFrog mô tả nền tảng tích hợp của mình là điểm khác biệt cạnh tranh chính trong lĩnh vực bảo mật chuỗi cung ứng phần mềm. Ban lãnh đạo lập luận rằng các sản phẩm bảo mật đơn lẻ đòi hỏi quyền truy cập vào Artifactory, trong khi JFrog kết hợp cả quản lý artifact, bảo mật và quản trị trong một nền tảng duy nhất.

Liên quan đến hợp đồng viễn thông trị giá 76 triệu USD, ban lãnh đạo nhấn mạnh mối quan hệ hợp tác này đã phát triển qua nhiều năm thông qua việc chuyển đổi sang Artifactory, áp dụng đám mây, gia tăng mức sử dụng dữ liệu cũng như bổ sung các tính năng bảo mật và quản trị. Công ty cho biết danh mục cơ hội tiềm năng có thêm nhiều cơ hội trị giá hàng triệu USD trên nhiều khu vực và ngành nghề khác nhau, nhưng không đưa ra dự báo cụ thể.

Ban lãnh đạo cũng làm rõ rằng các khách hàng thuần AI chủ yếu sử dụng mô hình tự lưu trữ. JFrog đang theo dõi mức sử dụng kho lưu trữ và artifact liên quan đến AI nhưng hiện chưa đưa ra số liệu phân tích định lượng cụ thể.

Toàn văn biên bản cuộc họp báo cáo kết quả kinh doanh

Toàn văn cuộc gọi công bố kết quả kinh doanh

Phần trình bày của ban lãnh đạo

Operator

Ladies and gentlemen, thank you for joining us, and welcome to JFrog's Third Quarter 2026 Earnings Conference Call. [Operator Instructions] I'll now hand the call over to Shanti Ariker, JFrog's Chief Legal Officer. Shanti, please go ahead.

Shanti Ariker

Thank you, Warren. Good afternoon, and thank you for joining us as we review JFrog's Third Quarter 2026 financial results, which were announced following the market close today via press release. Leading the call today will be JFrog's CEO and Co-Founder, Shlomi Ben Haim; and Ed Grabscheid, JFrog's CFO.

During this call, we may make statements related to our business that are forward-looking under federal securities laws and are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995, including statements related to our future financial performance and including our outlook for the fourth quarter and full year of 2026. The words anticipate, believe, continue, estimate, expect, intend, will and similar expressions are intended to identify forward-looking statements or similar indications of future expectations. You are cautioned not to place undue reliance on these forward-looking statements, which reflect our views only as of today and not as of any subsequent date.

Please keep in mind that we are not obligating ourselves to revise or publicly release the results of any revision to these forward-looking statements in light of new information or future events. These statements are subject to a variety of risks and uncertainties that could cause actual results to differ materially from expectations. For a discussion of material risks and other important factors that could affect our actual results, please refer to our Form 10-Q for the quarter ended June 30, 2026, which is available on the Investor Relations section of our website and the earnings press release issued earlier today. Additional information will be made available in our Form 10-Q for the quarter ended September 30, 2026, and other filings and reports that we may file from time to time with the SEC.

Additionally, non-GAAP financial measures will be discussed on this conference call. These non-GAAP financial measures, which are used as measures of JFrog's performance, should be considered in addition to, not as a substitute for or in isolation from GAAP measures. Please refer to the tables in our earnings release for a reconciliation of these measures to their most directly comparable GAAP financial measures. A replay of this call will be available on the JFrog Investor Relations website for a limited time.

With that, I'd like to turn the call over to JFrog's CEO, Shlomi Ben Haim. Shlomi?

Shlomi Haim

Thank you, Shanti. Good afternoon, everyone, and thank you for joining our call. In the past few quarters, we've been sharing how AI is changing the way software gets built and that every line of AI-generated code, whether prompted by a human developer or by agents becomes an artifact, a binary that has to be stored, secured, governed and delivered with trust and control. This quarter, again, this shift is reflected in our results. We are pleased with our third quarter results, the solid growth and the consistent execution by our team. In Q3, revenue was above the high end of our guidance at $179.2 million, representing 31% year-over-year growth. Cloud revenue grew 60% year-over-year, driven by a higher consumption and growing security adoption reflected in our 4 trailing quarters net dollar retention rate of 124%.

Our durable growth continued to be supported by converting customers to higher annual cloud commitments and by the strong customers value reflected in software supply chain security adoption across our portfolio. As enterprises increasingly standardize on JFrog as their system of record for software packages, binaries and other AI assets, software supply chain security becomes a top priority. Reflecting this, our enterprise go-to-market strategy delivered strong results among our high-end customer base. Customers exceeding $1 million in ARR grew to 112, up from 71 a year ago, representing 58% year-over-year growth. Customers spending more than $100,000 in ARR grew to 1,357 compared to 1,121 in the prior year, an increase of 21% year-over-year. On today's call, I will walk you through the third quarter in deeper detail, and Ed will then follow with additional financial insights and our outlook for the year.

First, addressing our cloud growth. We will discuss the ongoing partnership with our customers that are converting overusage into larger commitments with JFrog SaaS. Second, I will discuss how AI is increasing demand for JFrog solutions. Last, I will cover how rising adoption of our holistic software supply chain security solutions, together with our platform expansion into governance, further deepens enterprise reliance on JFrog. Starting with the cloud. JFrog cloud revenue growth reflects our strategy to migrate self-managed customers by offering a flexible migration path that fits their needs. JFrog SaaS is not only powering the software supply chains of the world's biggest companies, we are also providing them with a secure cloud solution that fits the scalability, reliability and control that AI-driven software supply chains need. In Q3, our cloud business continued to accelerate.

This growth has been consistent over the past several quarters and driven by 2 main trends. First, the ongoing adoption of AI tools and agents by developers continues to accelerate customer usage across our platform, increasing the demand for binary management and security enforcement. Second, the continuing rise of AI-specific artifacts such as skills, MCP servers, plug-ins and others, which customers naturally manage, store and secure alongside their other binaries in the same system of record. In Q3, JFrog secured a $76 million multiyear SaaS agreement with one of the world's leading telecommunications companies. This deal represents 167% growth in cloud data consumption compared to the customer's prior usage commitment. Additionally, these customers expanded into AI security and governance solutions, adopting full platform capabilities.

This demonstrates the durable growth in both usage and business value that enterprise customers gain from our platform. It's important to mention that even at this scale, as of the end of Q3, no single customer represents more than 3% of JFrog's total revenue. During the quarter, our sales team continued to successfully convert cloud usage overages into annual and multiyear commitments across our portfolio. We remain focused on partnering with our customers as they scale, offering them usage on-demand flexibility alongside a discounted price offering for higher annual commitments. As noted previously, any usage above contractual annual commitments is excluded from our guidance. Ed will later discuss our cloud outlook for the remainder of the year. Now to the momentum we are seeing in AI-powered software supply chain.

We believe AI is increasing demand for the JFrog platform, supporting not only our enterprise customers, but also powering the major AI labs that create AI with AI. As we have shared over the past several quarters, the tsunami of binaries that AI-powered software creation was expected to produce has materialized and is now accelerating. Coding agents are empowering human developers and the creation of source code, which is then compiled into more binaries than ever before. Binaries have become the desired outcome of AI-powered development and every one of them must be stored, secured and governed. AI also introduces entirely new artifacts such as models, datasets, MCP servers, skills and AI-generated packages.

This requires a system of record just like every other binary in the software supply chain. They are not a separate category outside the software supply chain. They belong in the same governed flow with the same traceability, versioning, security and policy controls. Next, AI demands a system of record that can scale rapidly to meet enterprise needs.

As the tsunami surges, customers are looking for a reliable software supply chain platform with a system of record at its centers so they can standardize on a trusted and scalable solution. At swampUP, our annual user conference, we were honored to share the keynote stage with speakers from Anthropic, Cursor, CoreWeave and other innovative leaders driving the AI transformation. Their messages aligned on 2 pillars upon which a modern software supply chain platform must be built. First, on a secure system of record that serves as the single source of truth for the binaries created by both AI agents and human developers. And second, scalability at a volume the world hasn't yet seen and it's about to experience over the next few years. We believe JFrog is uniquely positioned to meet these needs and our Q3 performance following H1's numbers shows the growing impact of AI on our business.

Finally, to the growth engine of JFrog Security Solutions. CISOs tell us that integrating software supply chain security with their single source of truth is enabling their development teams to move confidently at the speed of AI. Security growth is driven by a few key factors. We continue to see an increase in software supply chain security incidents and malicious campaigns across the industry that drive the need to adopt more comprehensive solutions at scale. In Q3, JFrog Curation customers continued to be protected from novel supply chain attacks. By tightly integrating Curation with Artifactory, JFrog provides software supply chain firewall protection for malicious and risky packages before they enter the organization, enabling developers and AI agents to move fast with trust.

Last quarter, we shared our security momentum and impact on our large customer spending. This increase in security product adoption continued in Q3, contributing to our increasing net dollar retention and RPO, which Ed will describe in more detail on today's call. The market is looking for a trusted security solution that holistically covers software supply chain needs and ties it to a system of record in one platform. For example, Ford Motor Company recently migrated over a petabyte of artifacts to be hosted in Artifactory. By utilizing JFrog security solutions like JFrog Curation and JFrog Advanced Security, they have been able to adopt a fix-what-matters approach to reduce incoming technical debt and malicious threats with Curation evaluating 47 million new open-source packages request in a single quarter.

In another example, Credit Karma, due to their use of JFrog Curation across 100% of their remote repository can now catch risk at the gates before they ever reach a build, enabling a measurable shift from reactive to proactive security that has supported zero detected supply chain attacks since implementation. These stories share a pattern. Customers choose to consolidate their security solutions alongside the system of record with one platform that holistically covers modern software supply chain needs. We continue to work with leading security partners, AI labs, cyber tools and the community to ensure that our customers' software delivery life cycle remains secure. I'd like to discuss our opportunities in governance and the emerging DevGovOps domain. The voice of our customers at our recent swampUP conference was clear.

AI will only be adopted at enterprise scale if trust through governance is embedded in the software supply chain. Enterprises building with AI face a fundamental operational challenge. Autonomous agents and AI-assisted developers can plan, code, test and deploy in hours. Manual governance processes take weeks or months. At our investor event in New York, we were pleased to welcome Christophe Romatier, the VP of PathWave Software at Keysight Technologies to talk about DevGovOps. On stage, he noted that with JFrog AppTrust, his teams no longer need to make the trade-off between compliance and speed with governance now baked into their pipelines. Keysight is not the only enterprise seeing these needs. Governance, compliance and reliable auditability must be part of the DevGovOps workflow at AI speed.

What agents are trusted to accomplish, the evidence and resources they use and the governance of their behavior and output is increasingly the concern of every company.

Last comment before I hand it over to Ed. AI reshaping how software gets built is no longer news. What is clear is that this evolution needs solid infrastructure, a control plane that brings trust to every development workflow. Our Q3 results show consistent execution of our strategy and growing market demand across our growth pillars.

And with that, I will hand it over to Ed for a detailed review of our third quarter financials and our updated outlook for the fourth quarter and full year of 2026. Ed?

Ed Grabscheid

Thank you, Shlomi, and good afternoon, everyone. We are extremely pleased by our third quarter results, which exceeded the top end of our guidance range across every key metric. These results continue to showcase our consistent strategic execution and operational discipline. During the third quarter, total revenues equaled $179.2 million, up 31% year-over-year. These results demonstrate the continued execution of our go-to-market strategy, fueled by our cloud revenues, growing demand for our security core products and expansion of our Enterprise+ portfolio. Cloud revenues in the third quarter accelerated to $101.5 million, up 60% year-over-year, now representing 57% of total revenues versus 46% in the prior year. Our strong performance in the cloud was driven by successfully converting customer overages into higher annual contracts and increased adoption of our security core products.

During the third quarter, our self-managed or on-prem revenues were $77.7 million, up 6% year-over-year. We continue to proactively engage our on-prem customers to migrate workloads to our cloud or hybrid offerings as they explore solutions better aligned with the rapidly changing security environment. In Q3, 61% of total revenues came from Enterprise+ subscriptions, up from 56% in the prior year. Driven by the ongoing execution of our enterprise go-to-market strategy and broader customer adoption of the JFrog platform, revenue contributions from Enterprise+ subscriptions grew 42% year-over-year this quarter. Net Dollar Retention for the trailing 4 quarters was 124%, representing a year-over-year increase of 6 percentage points and a 3 percentage point improvement sequentially. These results continue to highlight the strong adoption of our security core products, increased cloud usage and conversion of customers into higher annual contracts.

We continue to demonstrate the strategic value of JFrog as a mission-critical trusted system of record for our customer software supply chain with gross retention of 97% as of the third quarter of 2026. Now I'll review the income statement in more detail. Gross profit in the quarter was $149.8 million, representing a gross margin of 83.6% versus 83.9% in the year ago period. Our proactive focus on cloud hosting cost optimization allowed us to deliver stable gross margins throughout the year, even as the cloud became an increasingly larger share of our revenues. We now project annual gross margins to be in the range of 83% to 83.5% for 2026. Operating expenses in the third quarter were $109.1 million, equaling 61% of revenues. This compares to $89.3 million or 65% of revenues in the year ago period.

Our operating profit in Q3 was $40.7 million or an operating margin of 22.7% compared to an 18.7% operating margin in the third quarter of 2025. The continued balance between strategic investment and operational efficiency demonstrates our ongoing commitment to quality growth. Cash flow from operations equaled $69.3 million in the third quarter. After taking into consideration CapEx requirements, our free cash flow reached $66.5 million or 37% margin compared to $28.8 million or 21% margin in the year ago period. Now turning to the balance sheet. We ended the third quarter with $880.9 million in cash and short-term investments compared to $704.4 million at the end of 2025. As of September 30, 2026, our RPO totaled $812 million, a 60% increase year-over-year.

This record performance highlights the successful execution of our go-to-market strategy as enterprise customers continue to trust JFrog and make larger commitments to the JFrog platform, reinforcing our long-term revenue durability. As a reminder, RPO excludes any benefit from customers' usage over contractual minimum commitments. And now let's turn to our outlook and guidance for the fourth quarter and full year of 2026. We're entering the fourth quarter with confidence in our strategy and strength in our pipeline. Our updated 2026 guidance range reflects continued contributions from our security core products, ongoing adoption of our full platform and cloud growth driven by higher annual customer commitments. We continue to derisk our outlook by excluding our largest opportunities due to timing uncertainties. Taking into account our strong year-to-date results, we are once again raising our estimated full year 2026 baseline cloud growth to be in the range of 52% to 54%.

Cloud revenue guidance continues to exclude any contribution from usage above our annual customers' minimum commitments. Given the anticipated contribution from our security core products and increased baseline cloud growth assumptions, we now expect our trailing 4-quarter Net Dollar Retention floor to be 122% for 2026.

Turning to operating expenses. We continue to focus investments on innovation across our entire platform. We remain committed to a disciplined spending philosophy and are confident in our ability to drive ongoing operating efficiency in line with prior execution. For Q4, we anticipate revenues to be in the range of $183 million and $185 million with a non-GAAP operating profit anticipated between $36.2 million and $38.2 million and non-GAAP earnings per diluted share of $0.28 to $0.30, assuming a share count of approximately 131 million shares.

For the full year of 2026, we are again raising our revenue guidance, now anticipating a range of $680 million to $682 million, representing 28% year-over-year growth at the midpoint. Non-GAAP operating income is expected to be between $142.5 million and $144.5 million and non-GAAP diluted earnings per share of $1.14 to $1.16, assuming a share count of approximately 129 million shares.

Now I'll turn the call back to Shlomi for some closing remarks before we take your questions.

Shlomi Haim

Thank you, Ed. At swampUP, our customers told us the adoption of our solution is critical and that the road map ahead is aligned with their future needs and positions JFrog as the anchor of today's AI-powered software supply chain. The world needs a scalable, hybrid, reliable solution to holistically power the modern software delivery life cycle, one that is secure and governed whether it serves developers, AI agents or both. JFrog has become the control plane that enterprise depends on as they power their software supply chains in the era of AI. We are proud of this quarter's results and remain focused on execution as we close out 2026 and plan for the future.

To my team, every frog across the globe, thank you. Few companies have the privilege of shaping the future of software infrastructure, and you do it every day. Your devotion, dedication and unstoppable spirit delivered another record-breaking quarter. I'm proud to stand alongside you, honoring our commitments to customers and to shareholders every day. May the frog be with you as we keep leaping forward.

Operator, we are ready for questions.

Operator

[Operator Instructions]

Your first question comes from the line of Sanjit Singh with Morgan Stanley.

Phần hỏi đáp

Sanjit Singh

Congrats on an awesome quarter. There's so many things to talk about with these set of Q3 results. Where I wanted to start was just those customers that have been exceeding commitment and then stepped up to, say, take on a new contract, a higher commitment contract. As they do that, Shlomi, are you seeing any evidence of attach of the security portfolio or other parts of the product portfolio? As these -- as they sign up, make larger commitments with JFrog, are you seeing that sort of product portfolio attach?

Shlomi Haim

Sanjit, thank you for your question. The answer is absolutely yes. Our customers are not just exceeding their commitments with more data transfer and storage of new artifacts coming in the world of AI and therefore, raise their consumption base, but also adopting more solutions from the platform. As I mentioned on the call, some of them are coming with more security demands, others with more governance demand and therefore, are feeling more comfortable not only to raise their commitment, but also to sign on a multiyear deal, seeing the future growth together with JFrog.

Operator

Your next question comes from the line of Radi Sultan with UBS.

Radi Sultan

If I think about the rate of cyber incidents that we're seeing just being structurally higher going forward, your customers are getting a lot more value out of your security offering. So how do you think about monetizing more of that maybe in terms of pricing model changes, price increases or adding more security SKUs to capture more of that security wallet? Maybe just walk us through like what are the levers you have to capture more security wallet at existing customers? Would love to get both your perspectives on this.

Shlomi Haim

Yes, Radi. We see more and more software supply chain attack coming from everywhere. Attacker became far more sophisticated in the world of AI. So obviously, this increases the demand for our security solutions, starting from JFrog Curation at the gate as a firewall all the way to JFrog Advanced Security, Xray and other solutions. Currently, we are not yet sharing the results of our security numbers in 2026. We will do it at the end of the year. But we are very, very pleased with the impact it made on our total growth and the expansion into a whole new world of software supply chain protection. We will look at 2027 and the opportunities next to the risk, and we will take decision then.

Operator

Your next question comes from the line of Miller Jump with Truist.

William Miller Jump

Congrats on another great set of results here. I think kind of along the same lines of the questions we've heard, but last quarter, it did sound like security was a standout driver of the upside you saw. I'm curious like it really sounds like everything was clicking this quarter. So how do you really highlight what was the biggest driver of upside between the AI tailwinds that you called out and security? And then Ed, if you could just remind us how we should think about the Q4 security pipeline this year versus prior years?

Ed Grabscheid

Thanks for the question, Miller. Why don't I go ahead and start? I'll talk a little bit about what to expect from a pipeline perspective. This is no longer a situation where we're seeing an event and then you're building a pipeline based on an event. This has been sustained. We've had now multiple quarters of really strong security outcomes. We talked about it at the end of Q2, and we saw that momentum carry into Q3. As Shlomi mentioned previously, we'll provide you with those results at the end of the year. But we continue to see this momentum in security. And it's a very healthy purchasing environment at the moment when it comes to security, in particular, with the amount of attacks that are happening in the open source and with the protection that's needed with AI.

Operator

Your next question comes from the line of Mike Cikos with Needham.

Michael Cikos

I'll echo the congratulations on just a fantastic quarter that you guys posted. I wanted to come back to the commitments for a second, and it's a bit of a 2-parter. But one, can you help us think about the timing for when these customers sign these larger commitments? Was it -- was there anything to note from a linearity standpoint if we think about Q3 and when these commitments were signed? And then the follow-up on that commitment, it just I'd love to hear, but it feels like customers are coming back to you at a faster pace versus historical precedent in terms of reengaging JFrog and then willingness to sign a larger commitment. Can you give us any data points around that, my assumption there?

I just want to see if we can validate that or confirm that in any capacity because it does feel like between the go-to-market traction that you guys have, the expanded platform, the customer outreach to you, it does feel like they're coming back at a faster pace, but would just love to get your insight.

Shlomi Haim

Thank you, Mike. So there is nothing new about the methodology and the strategy that we're following, right? So it's been more than 2 years that we are converting overusage into commitments coming to the customers proactively and offering them a better deal for a higher commitment. This helps us not only to stabilize the cloud usage, but also to build a long-term partnership with our customers. So some of them are reaching out to us, understanding that the volume of AI introduces them to a completely new demand on the cloud and others are reaching out to us or we are reaching out to them proactively to discuss their future needs as we see their overusage on a monthly basis.

This is an ongoing discussion with our customers. As we mentioned on the call, the flexibility model -- the flexibility in the model is super important because there is no pressure there. They can't keep on going with the on demand. And this will be usage over commitment that we will not guide you for. But if they are willing to take a higher commitment for a longer year, then obviously, we are working with them, and this is what we report as part of our guidance, and you see the consistent growing and the durable growth every quarter.

Operator

Your next question comes from the line of Jason Celino with KeyBanc Capital Markets.

Jason Celino

Wow, absolutely phenomenal quarter. I wanted to take the time to ask maybe a higher-level question. So it's been widely publicized that Anthropic spent 6 to 9 months developing their own internal version control system. So coming from a person who isn't a developer and most investors are not developers, but presumably some might think that with AI coding, a company like this could spend another 6 to 9 months to develop more in the software development stack. So on this forum, I wanted to give you Shlomi the opportunity to discuss why it doesn't make sense or why it would be incrementally more difficult to develop like a complete gating Artifactory solution.

Shlomi Haim

Yes, absolutely. Well, Jason, we were honored to have Anthropic on stage at swampUP just last month in New York and then again in Barcelona, stating what we keep saying, the world is demanding for more trust and control over the software supply chain. And this can only come with a system of record. We see and we use the products that Anthropic or OpenAI provides and both of them are honored customers of JFrog. But there would be no developer nirvana in the age of AI if it will be just for a faster model or a smarter agent.

It's only reachable with a scalable, universal governed system of record, one trusted source of truth for everything that goes from the build to the consume to the ship. You cannot trust what you ship if you don't have a system of record. And if it's not universal, then it will be a one vendor or one agent focused solution. So actually, when we see what they are building, it goes complementary with what we provide. And I think that our customers see the same. That's the growth that we keep on delivering.

Operator

Your next question comes from the line of Mark Cash with Raymond James.

Mark Cash

Shlomi, a question for you. So I know we've talked a lot about the AI driving a tsunami of binaries. So I guess I want to ask or I want to know, as the frontier models accelerate vulnerability discoveries, are you seeing that translate into more artifact rebuilds, transfer storage and security scans, which in turn helps drive a surge in cloud results and guidance? And I guess if you are seeing that tailwind, does this also create a natural upsell conversation for security and governance for you as well?

Shlomi Haim

Yes. So Mark, the facts are that there are new artifacts introduced to us by AI, right? None of us spoke about MCP skills and others a year ago. These artifacts belong to the same place as you manage the rest of your binary. You have to manage their dependencies, their security, their governance and everything that comes along that. So yes, we see it as a tailwind in terms of storage and data transfer. Not only that, we also see Artifactory, the system of record expand to become your MCP Registry, your skill registry. And this is how our customers are looking at it. So what would be the impact of it on the long run? Will it be more than your Python or NPM or Docker? I don't know. But for sure, more and more artifacts, binaries and software packages are added to the solution we provide.

Operator

Your next question comes from the line of Shrenik Kothari with Baird.

Shrenik Kothari

Echoing my congrats on the great results. So just stepping back, your results and some of the customer examples do suggest you are becoming more deeply embedded in enterprise-wide infrastructure, especially with the Ford migration that you talked about with a petabyte of artifacts. It seems customers are increasingly consolidating security around you as a single system of record. So my question is like beyond the new AI-generated binaries and the tsunami of binaries you mentioned, Shlomi, as AI is seemingly accelerating modernization of these legacy applications and it looks like there are some examples. Just wanted to understand like broadly, are you seeing these legacy software assets already creating this another significant adoption cycle? And are there evidences building of more enterprise-wide standardization coming from that?

Shlomi Haim

Yes, Shrenik, thank you for the question. As I mentioned on the call, and we gave 3 examples of giant organizations that are scaling, a, with new artifacts, as I mentioned before; but b, with the fact that every developer is now powered by an agent, and have more to produce. The desired outcome of the world of AI results in a binary, a software package, whether it's a new artifact or something that belongs to the previous world of NPM, Python, Docker, Maven and 40 other technologies that are supported in JFrog. JFrog Artifactory is the Switzerland of system of record. We support all technologies as long as they are binaries. And the fact that you are now powered by agent provide us with one challenge is to scale to where you want us to go. And you mentioned Ford and others, we are scaling with them to infinity.

Operator

Your next question comes from the line of Howard Ma with Guggenheim Securities.

Howard Ma

Incredible quarter. I wanted to ask about the massive telco deal. And Shlomi, could you talk about the characteristics of this expansion that you believe are repeatable versus not repeatable with other similar type -- very large enterprises.

And for Ed, on a related note, you kind of gave us the numbers to do the math. We calculate it to like a $40 million expansion. And if you assume 5 years, and maybe it's like ratable $2 million a quarter. And if I back that out from Q3, I think you would have still accelerated cloud revenue in Q3 even without this massive deal. So any color to help investors do the math would be helpful.

Ed Grabscheid

Why don't I go ahead and start, and then Shlomi can talk about the construct of the large telco deal and why we won that deal. But first off, we're not going to go into the math of what we saw in that deal. It was a very strong deal. You saw it was a capture of a commitment, 167% in terms of data consumption and storage. So we're capturing overusage as a commitment. And it also showed the power of the platform. We were able to not only capture an expansion of security, but we also captured governance in that deal. And it turned out to be a very, very strong outcome, a $76 million deal, multiyear deal, and that will be reflected as a commitment going forward. And this is why you saw the confidence that we're showing in our guidance as we head into Q4.

Shlomi Haim

Yes. Well, first, I'll mention again that none of our customers represent more than 3% of our total revenue. That's a very diverse portfolio, and we are very disciplined with that. Second, we were honored to sign this contract and to scale with this customer, covering tens of thousands of developers that are powered by tens of thousands of agents. That generated more consumption, more data consumption on Azure Cloud. And it also introduced this organization to new needs of governance. The fact that you are faster and stronger powered by AI doesn't mean that you are scaling at the same pace with your governance system. So the adoption of AppTrust was very important leap forward with this customer.

And the second thing is obviously the security iron dome that we managed to put on top of the software supply chain and scale with them. So having this size of customers with this size of contract, it's not only the platform, it's not only the technology, it's not only the environment. It's the trust that our customer success, our sales team, our product team is building with these customers, and we are very, very honored to scale to these limits of contracts.

Operator

Your next question comes from the line of George McGreehan with Bank of America Securities.

George McGreehan

This is George McGreehan on for Koji Ikeda. I wanted to also ask a bit of a theoretical one. So obviously, we're seeing the tsunami binaries and kind of upstream of that. How much has production-ready code improved today in terms of code quality versus a year ago? And how much better do you think it can get over the next few years? And specifically, why?

Shlomi Haim

Yes, George, that's a great question. We are not necessarily breaking down the numbers now to how much of it was produced by this specifically. But what I can tell you is what I also said on the call is that developers are now running much faster. They become more product managers than developers. They are managing tens or hundreds of agents and produce more and more. The result of everything they build, if it's a quality result, will end as a binary. A binary that needs to be governed, that needs to be secured, that needs to be deployed, that needs to be managed from versioning perspective and so on. So we see more and more of it coming.

And on the other hand, what we see and you probably read the news in the last weeks that source code becoming commoditized. So on one hand, there is a lot of efforts to secure your primary asset, which is the binary. On the other hand, generating source code by agents or developers becoming commoditized. So that obviously raises the volume and the demand for the JFrog platform.

Operator

Your next question comes from the line of Brian Essex with JPMorgan.

Brian Essex

Great to see the acceleration with margin expansion, really nice results. Maybe Shlomi, for you, would love to understand how your budget environment has evolved throughout the year? Have you maintained the same stakeholders or with the elevated threat environment and some of the vulnerabilities that we've seen, some of the incidents that we've seen, has that scope of stakeholders within enterprises expanded?

And then as part B of that, are you -- is awareness of your platform moving up to CIO C-suites more frequently and garnering more stakeholder support within the enterprises? Just trying to get a sense of the momentum that you have. Are your budgets -- is your budget visibility expanding as you kind of head into the end of the year and think about the setup for next year?

Shlomi Haim

Yes, Brian, thank you for the question. I believe that we all understand that a $76 million deal is not being signed by a developer. So of course, the introduction to the C-suite of our customers is something that enable us to scale. And we report quarter after quarter the growth of our over $1 million in ARR customers that are betting more and more on JFrog. So that's obviously a great achievement of our strategic and sales team that managed to build this relationship with the C-suite of our customers, which, by the way, are the biggest organizations in the world.

The second thing, to your point, you are very much right. This is not just the CIO or CTO that used to pay for DevOps. A lot of our new customers are coming from the CISO office, the CISO itself, whether it's for governance and compliance or security demand. And the security momentum that we see and the adoption of the JFrog Security solution that contributed to the growth of the net dollar retention, as we mentioned, this comes with the larger checks that are being signed only by the C-suite. So the answer is yes on the C-suite and yes, on the expansion of the C-suite.

Operator

Your next question comes from the line of Matt Hedberg with RBC.

[Operator Instructions]

Matthew Hedberg

Congrats on the quarter from me as well. Maybe just to follow up on that last question on expansion. Obviously, it's great to see the tick up both year-on-year and sequentially here. I guess, Ed, you guys have a lot of drivers of that, and we talked about a lot of them on the call tonight. But I guess how should we think about the guardrails for like where NRR could go, especially as you kind of start to think about calibrating our models for next year as we think about 4Q and into next year?

Ed Grabscheid

Yes. Thanks for the question, Matt. Really, today, we're seeing a very, very healthy buying environment, and we're focused on that momentum just to continue to build with execution in 2026. We've seen strong usage over minimum commitment. We've been able to capture some of those customers into higher annual commitments. We're also seeing usage broadly across our platform above minimum commitments. It was sustained usage during Q3. So the focus today is really around the execution in 2026. We set the floor for 2026, and we'll provide some insights next quarter when we close out Q4 and the full year.

Operator

Your next question comes from the line of Jonathan Ruykhaver with Cantor.

Jonathan Ruykhaver

Once again, very impressive print. I'm just curious, when you look at the AI and ML model development trends, I mean, it does sound like, Shlomi, based on some of your comments that you're seeing incremental usage. Any way to quantify that use case and usage trends versus traditional software development? And our AI-related repositories growing faster than traditional software repositories. And then just finally, how does AI model development compare to software as it relates to data usage?

Shlomi Haim

Yes. Well, that's obviously something that we track closely. We are looking at the data, not only in our cloud, but also when we speak with our self-hosted customers to understand the level of adoption of AI. Obviously, the more progressed companies are adopting MCP skills, datasets, plug-ins and other new artifacts that were introduced during the era of AI. We are not yet ready to disclose the breakdown of the numbers. But for sure, this is increasing. This is the first thing.

The second thing, by using those tools, skills and MCP more specifically, it enables agents as first-level citizens on JFrog platform, using JFrog as a system of record, being protected by our security. So this generates not only those new packages, but also the usage of others such as the legacy binaries that we all know from the open source environment. So we are collecting the information. Once we would be ready and feel comfortable with it, we will share, of course, more information about it.

Operator

Your next question comes from the line of Yi Fu Lee with StoneX.

Yi Fu Lee

Congratulations, Shlomi and the JFrog team. Such a master quarter, obviously, 60% RPO growth, et cetera. Just want to get a sense on the AI native customers. I understand the biggest debate was like converting the overage to long-term commitments, which you guys have done. I was wondering what was it that this quarter drove the -- you could say like customer crossing the chasm, right, to sign longer term with you. Is there certain things that drove this behavior?

And then Ed, I know you're not going to give, but like I'm going to try anyway. On the longer term, right, in the back of the deck, obviously, we have our long-term model. After this monster beat, is there anything you could like comment on that? Any changes?

Ed Grabscheid

Thanks for the question, Yi Fu. I'll go ahead and start. First, let me remind you that the AI native customers are primarily self-hosted customers. We did talk about one that we closed in Q2, which is a hybrid customer. That just started. It's very early in the life cycle with JFrog. And so we're not going to necessarily comment on anything around conversion or capture for that particular customer. Again, reminding you that there's not one single customer that represents more than 3% of our revenues. But in terms of what we saw in a very, very strong quarter, as you mentioned, RPO was strong, capture of some customers to higher annual commitments.

When we look at the investor deck, I think you're referring probably to the long-term model. We're tracking very nicely against that. We will come back to you at the end of the year, and we can talk a little bit more about 2027. We're not ready to disclose anything at this point. But we're building momentum. We're building strength. As I mentioned, it's a healthy purchase environment, and we're capturing through the execution of our strategy, very strong outcome and results. And Shlomi can talk a little bit about what we saw in terms of those customers that we did capture bigger commitments.

Shlomi Haim

Yes. Well, Yi Fu, the commitment of these customers is obviously growing by the self-hosted demand, which is more projects, more departments, more regions. And we are very happy to see the collaboration with them. Some of them shared on stage at swampUP the partnership that they are building with JFrog. We are not commenting on one by one, but we are very honored to have those that are building AI with AI using JFrog as the system of record.

Operator

Your next question comes from the line of Jason Ader with William Blair.

Jason Ader

Can you talk, Shlomi, a little bit about the competitive landscape in supply chain security? Who do you see the most in bake-offs? And related to that, it seems like GitLab and GitHub are at least talking about security more, maybe investing more maybe because their repo business is under pressure. But maybe just talk about that picture for us.

Shlomi Haim

Yes. Well, Jason, the landscape -- the competitive landscape is very diverse. On the landscape of security, obviously, we see point solutions trying to provide a scalable solution for artifact firewall and for SBOM, AI BOM solutions, software composition analysis and things like that. I think that JFrog is well positioned as it differentiates itself by having those security solution very tightly integrated with Artifactory, the system of record. So what our customers keep telling us that there is no complete security solution and no complete governance solution without the very tight integration with Artifactory.

Now if you look at the point solution that I just mentioned, all of them need an access to Artifactory. And this is something that we look at and we consider every day. But it gives us a very strong reason to believe that our customers will prefer one platform over point solutions. Regarding the system of record landscape, the players there, most of them are providing solutions that are not hybrid, not universal and for sure, not scalable to the level of Artifactory. Therefore, the world of enterprise trust JFrog and scale with us.

Operator

Your next question comes from the line of Raimo Lenschow with Barclays.

Eamon Coughlin

This is Eamon Coughlin on for Raimo. I guess, Ed, on the commentary of converting some of those overusage into higher annual commitments, has that time line shortened over time as customers gain more confidence in AI workload durability? Or do procurement and forecasting uncertainty still make these conversions primarily on a case-by-case basis? And then is there any way to rank higher consumption, security adoption and self-managed migrations contribution to cloud growth this quarter? Congrats on the quarter.

Ed Grabscheid

Yes. Let me start, and then Shlomi can fill in if there's anything that I'm missing here. But what we saw in the first half of 2026 was a hesitation, and we saw customers almost like an insurance policy spending more than their minimum commitments. That trend is continuing even still today in Q3, but what we saw is some of our largest customers with clarity that AI workloads are continuing to grow and that they need to make commitments to JFrog, not only with their offerings to increase data consumption, but also with security and governance. It's not necessarily that those time lines have shortened, but the clarity around the decision-making became much clearer in Q3. So this is why we saw some of those customers converting and it was more of those large customers.

Operator

Your next question comes from the line of Nick Altmann with BTIG.

Nicholas Altmann

I wanted to circle back to the $76 million TCV contract. And the question is, could you just kind of give us a flavor of where that sort of compares to your other deals that have historically been very large on like an ACV basis? And I guess what I'm trying to get at is, it seems like you guys are kind of in a different atmosphere in terms of the deal sizes that you were really in even a year ago.

And so Ed, I know that you guys don't include these large transactions in the guidance, but maybe just talk us through how long that deal sort of took to close, whether there's other transactions of a similar size opportunity in the pipeline or whether this deal had maybe some anomalous -- anomalies that maybe leads it to an outsized opportunity versus what you guys see?

Shlomi Haim

Thank you, Nick. I'll start and Ed can chime in with more details about it. Signing an $80 million deal is not something that is based on a product or on a sales maneuver. It's an investment, a long-term investment, building trust with the customer for many years. It started with the migration from Sonatype Nexus to Artifactory, then the scalability, then the migration to the cloud, then the additional security solution, then more and more petabyte of usage and then AI came and changed everything in terms of the attack surface and the governance requirement.

So I think that this specific customer found a partner that could scale with it and provide the flexibility of a universal solution that will support several vendors, several agents, several solutions that they are adopting and using at the scale of AI. It's not necessarily different from other customers we see. Obviously, the magnitude is different. But we see more and more multimillion dollar deals, not only in 2026 results, but also in our pipeline. And therefore, we felt comfortable to raise the guidance for the year as we looked at the pipeline. This comes not only from one region, not only from one sector, not only from one side, it's across our portfolio, and we have a very strong confidence in our pipeline.

Ed Grabscheid

And just to close out, Shlomi's what he was saying here, in terms of the timing and the cadence, we see these very large deals typically come in the back half of the year. So if you recall, we had 3 of the largest deals a few years ago in Q3. This seems to be more of the theme where these type of deals close towards the back half of the calendar year.

Operator

There are no further questions at this time. I will now turn the call back to Shlomi for closing remarks.

Shlomi Haim

Thank you, everyone, for joining the call. We are very, very pleased with our Q3 results. We are looking forward to seeing you at the end of 2026 and make the frog be with you.

Operator

This concludes today's call. Thank you for attending. You may now disconnect.