JFrog (FROG) 2026年第3季法說會：雲端營收成長 60%，調升財測指引

重點摘要

• JFrog 公布 2026 年第三季營收為 1.792 億美元，年增 31%，高於管理層財測高標。
• 雲端業務營收成長 60% 至 1.015 億美元，佔總營收的 57%。管理層將此成長歸因於客戶承諾合約金額提高、使用量增加，以及資安產品採用率擴大。
• 過去四季的淨金額留存率升至 124%，年增 6 個百分點，季增 3 個百分點。毛保留率則為 97%。
• 受大型企業合約承諾帶動，剩餘履約義務達 8.12 億美元，年增 60%。JFrog 與一家電信客戶簽署了價值 7,600 萬美元的多年期 SaaS 協議。
• 非 GAAP 營業利益率自 18.7% 擴增至 22.7%，自由現金流增至 6,650 萬美元，利潤率達 37%。
• 管理層上調 2026 全年營收財測至 6.8 億至 6.82 億美元，並將基準雲端營收成長預估上調至 52% 至 54%。

核心財務業績

法說會中討論了非 GAAP 財務指標，相關調節資訊請參閱 JFrog 的財報新聞稿。

業務與營運表現

雲端業務仍是 JFrog 的主要成長引擎。該公司持續將超出合約水準的客戶使用量，轉化為規模更大的年度或多年期承諾合約。客戶亦可選擇維持隨選使用模式，但超出最低承諾額度的營收並未納入管理層財測中。

本季重點強調的最大單筆交易，是與一家大型電信公司簽訂的 7,600 萬美元多年期 SaaS 協議。該合約承諾的雲端資料用量較客戶先前承諾成長 167%，並涵蓋資安與治理產品。管理層表示，單一客戶佔總營收比重均未超過 3%。

JFrog 將平台使用量增加與 AI 輔助軟體開發連結。管理層表示，AI 代理正在生成更多傳統二進位檔案以及較新的軟體構件，包括模型、資料集、MCP 伺服器、技能（skills）與外掛程式。該公司將 Artifactory 定位為儲存、保護與治理這些資產的統一記錄系統。

資安產品的採用亦推動了業務擴展。管理層指出，隨著企業積極因應軟體供應鏈威脅，JFrog Curation、JFrog Advanced Security 與 Xray 的需求持續增溫。福特汽車（Ford Motor Company）已將超過 1 PB 的軟體構件遷移至 Artifactory，且 JFrog Curation 在單季內為福特評估了 4,700 萬次新增開源套件請求。

企業客戶成長依舊強勁。年經常性收入（ARR）超過 100 萬美元的客戶數從去年同期的 71 家增加 58% 至 112 家；ARR 超過 10 萬美元的客戶數則從 1,121 家增加 21% 至 1,357 家。

管理層財測

管理層表示，更新後的財測展望反映了資安產品採用、平台使用範圍擴大，以及年度雲端承諾金額的提高。基於時程上的不確定性，該公司仍未將高於合約最低額度的雲端使用量以及最大型潛在交易機會納入財測。

風險與觀察重點

• 財測排除了超出年度最低承諾額度的使用量，因此超額使用量轉化為合約營收的時機與進度成為一項重要變數。
• 由於結案簽約日期可能存在不確定性，JFrog 亦將其最大型交易機會排除在財測展望之外。管理層指出，歷史經驗顯示超大型合約通常傾向在下半年完成簽署。
• 客戶在 2026 年上半年因評估 AI 工作負載的持久性而略顯猶豫。管理層表示，第三季的決策過程已更加明朗，特別是大型客戶，但具體的合約轉換時機仍視個別情況而定。
• 隨著雲端業務佔營收比重提高，毛利率為 83.6%，略低於去年同期的 83.9%。管理層預期全年毛利率將介於 83% 至 83.5% 之間。
• JFrog 目前尚未提供專門歸因於 AI 相關構件或資安產品的營收或使用量量化細分數據。

分析師問答重點

管理層表示，提高雲端承諾合約額度的客戶同時也加購了資安與治理產品。這種更廣泛的產品搭售帶動了多年期合約的簽署，並促進淨金額留存率提升。

關於合約轉換的速度，管理層表示底層流程並未實質縮短。而是大型客戶在第三季更明確地確信 AI 工作負載與相關資料消耗量將持續成長。

JFrog 將其整合平台視為軟體供應鏈安全領域的主要競爭優勢。管理層認為，單點資安產品需要存取 Artifactory，而 JFrog 則將構件管理、安全與治理整合在單一平台中。

關於這項 7,600 萬美元的電信合約，管理層強調，雙方合作關係是歷經數年逐步建立而成，涵蓋遷移至 Artifactory、採用雲端、資料使用量增加，以及增購資安與治理功能。該公司表示，其潛在銷售案管線中還包含跨地區與產業的更多數百萬美元規模機會，但並未提供具體預測。

管理層亦澄清，AI 原生客戶主要採自託管（self-hosted）模式。JFrog 正密切追蹤 AI 相關儲存庫與構件的使用情況，但尚未提供量化細分數據。

完整法說會逐字稿

---

完整財報電話會議逐字稿

管理層陳述

Operator

Ladies and gentlemen, thank you for joining us, and welcome to JFrog's Third Quarter 2026 Earnings Conference Call. [Operator Instructions] I'll now hand the call over to Shanti Ariker, JFrog's Chief Legal Officer. Shanti, please go ahead.

Shanti Ariker

Thank you, Warren. Good afternoon, and thank you for joining us as we review JFrog's Third Quarter 2026 financial results, which were announced following the market close today via press release. Leading the call today will be JFrog's CEO and Co-Founder, Shlomi Ben Haim; and Ed Grabscheid, JFrog's CFO.

During this call, we may make statements related to our business that are forward-looking under federal securities laws and are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995, including statements related to our future financial performance and including our outlook for the fourth quarter and full year of 2026. The words anticipate, believe, continue, estimate, expect, intend, will and similar expressions are intended to identify forward-looking statements or similar indications of future expectations. You are cautioned not to place undue reliance on these forward-looking statements, which reflect our views only as of today and not as of any subsequent date.

Please keep in mind that we are not obligating ourselves to revise or publicly release the results of any revision to these forward-looking statements in light of new information or future events. These statements are subject to a variety of risks and uncertainties that could cause actual results to differ materially from expectations. For a discussion of material risks and other important factors that could affect our actual results, please refer to our Form 10-Q for the quarter ended June 30, 2026, which is available on the Investor Relations section of our website and the earnings press release issued earlier today. Additional information will be made available in our Form 10-Q for the quarter ended September 30, 2026, and other filings and reports that we may file from time to time with the SEC.

Additionally, non-GAAP financial measures will be discussed on this conference call. These non-GAAP financial measures, which are used as measures of JFrog's performance, should be considered in addition to, not as a substitute for or in isolation from GAAP measures. Please refer to the tables in our earnings release for a reconciliation of these measures to their most directly comparable GAAP financial measures. A replay of this call will be available on the JFrog Investor Relations website for a limited time.

With that, I'd like to turn the call over to JFrog's CEO, Shlomi Ben Haim. Shlomi?

Shlomi Haim

Thank you, Shanti. Good afternoon, everyone, and thank you for joining our call. In the past few quarters, we've been sharing how AI is changing the way software gets built and that every line of AI-generated code, whether prompted by a human developer or by agents becomes an artifact, a binary that has to be stored, secured, governed and delivered with trust and control. This quarter, again, this shift is reflected in our results. We are pleased with our third quarter results, the solid growth and the consistent execution by our team. In Q3, revenue was above the high end of our guidance at $179.2 million, representing 31% year-over-year growth. Cloud revenue grew 60% year-over-year, driven by a higher consumption and growing security adoption reflected in our 4 trailing quarters net dollar retention rate of 124%.

Our durable growth continued to be supported by converting customers to higher annual cloud commitments and by the strong customers value reflected in software supply chain security adoption across our portfolio. As enterprises increasingly standardize on JFrog as their system of record for software packages, binaries and other AI assets, software supply chain security becomes a top priority. Reflecting this, our enterprise go-to-market strategy delivered strong results among our high-end customer base. Customers exceeding $1 million in ARR grew to 112, up from 71 a year ago, representing 58% year-over-year growth. Customers spending more than $100,000 in ARR grew to 1,357 compared to 1,121 in the prior year, an increase of 21% year-over-year. On today's call, I will walk you through the third quarter in deeper detail, and Ed will then follow with additional financial insights and our outlook for the year.

First, addressing our cloud growth. We will discuss the ongoing partnership with our customers that are converting overusage into larger commitments with JFrog SaaS. Second, I will discuss how AI is increasing demand for JFrog solutions. Last, I will cover how rising adoption of our holistic software supply chain security solutions, together with our platform expansion into governance, further deepens enterprise reliance on JFrog. Starting with the cloud. JFrog cloud revenue growth reflects our strategy to migrate self-managed customers by offering a flexible migration path that fits their needs. JFrog SaaS is not only powering the software supply chains of the world's biggest companies, we are also providing them with a secure cloud solution that fits the scalability, reliability and control that AI-driven software supply chains need. In Q3, our cloud business continued to accelerate.

This growth has been consistent over the past several quarters and driven by 2 main trends. First, the ongoing adoption of AI tools and agents by developers continues to accelerate customer usage across our platform, increasing the demand for binary management and security enforcement. Second, the continuing rise of AI-specific artifacts such as skills, MCP servers, plug-ins and others, which customers naturally manage, store and secure alongside their other binaries in the same system of record. In Q3, JFrog secured a $76 million multiyear SaaS agreement with one of the world's leading telecommunications companies. This deal represents 167% growth in cloud data consumption compared to the customer's prior usage commitment. Additionally, these customers expanded into AI security and governance solutions, adopting full platform capabilities.

This demonstrates the durable growth in both usage and business value that enterprise customers gain from our platform. It's important to mention that even at this scale, as of the end of Q3, no single customer represents more than 3% of JFrog's total revenue. During the quarter, our sales team continued to successfully convert cloud usage overages into annual and multiyear commitments across our portfolio. We remain focused on partnering with our customers as they scale, offering them usage on-demand flexibility alongside a discounted price offering for higher annual commitments. As noted previously, any usage above contractual annual commitments is excluded from our guidance. Ed will later discuss our cloud outlook for the remainder of the year. Now to the momentum we are seeing in AI-powered software supply chain.

We believe AI is increasing demand for the JFrog platform, supporting not only our enterprise customers, but also powering the major AI labs that create AI with AI. As we have shared over the past several quarters, the tsunami of binaries that AI-powered software creation was expected to produce has materialized and is now accelerating. Coding agents are empowering human developers and the creation of source code, which is then compiled into more binaries than ever before. Binaries have become the desired outcome of AI-powered development and every one of them must be stored, secured and governed. AI also introduces entirely new artifacts such as models, datasets, MCP servers, skills and AI-generated packages.

This requires a system of record just like every other binary in the software supply chain. They are not a separate category outside the software supply chain. They belong in the same governed flow with the same traceability, versioning, security and policy controls. Next, AI demands a system of record that can scale rapidly to meet enterprise needs.

As the tsunami surges, customers are looking for a reliable software supply chain platform with a system of record at its centers so they can standardize on a trusted and scalable solution. At swampUP, our annual user conference, we were honored to share the keynote stage with speakers from Anthropic, Cursor, CoreWeave and other innovative leaders driving the AI transformation. Their messages aligned on 2 pillars upon which a modern software supply chain platform must be built. First, on a secure system of record that serves as the single source of truth for the binaries created by both AI agents and human developers. And second, scalability at a volume the world hasn't yet seen and it's about to experience over the next few years. We believe JFrog is uniquely positioned to meet these needs and our Q3 performance following H1's numbers shows the growing impact of AI on our business.

Finally, to the growth engine of JFrog Security Solutions. CISOs tell us that integrating software supply chain security with their single source of truth is enabling their development teams to move confidently at the speed of AI. Security growth is driven by a few key factors. We continue to see an increase in software supply chain security incidents and malicious campaigns across the industry that drive the need to adopt more comprehensive solutions at scale. In Q3, JFrog Curation customers continued to be protected from novel supply chain attacks. By tightly integrating Curation with Artifactory, JFrog provides software supply chain firewall protection for malicious and risky packages before they enter the organization, enabling developers and AI agents to move fast with trust.

Last quarter, we shared our security momentum and impact on our large customer spending. This increase in security product adoption continued in Q3, contributing to our increasing net dollar retention and RPO, which Ed will describe in more detail on today's call. The market is looking for a trusted security solution that holistically covers software supply chain needs and ties it to a system of record in one platform. For example, Ford Motor Company recently migrated over a petabyte of artifacts to be hosted in Artifactory. By utilizing JFrog security solutions like JFrog Curation and JFrog Advanced Security, they have been able to adopt a fix-what-matters approach to reduce incoming technical debt and malicious threats with Curation evaluating 47 million new open-source packages request in a single quarter.

In another example, Credit Karma, due to their use of JFrog Curation across 100% of their remote repository can now catch risk at the gates before they ever reach a build, enabling a measurable shift from reactive to proactive security that has supported zero detected supply chain attacks since implementation. These stories share a pattern. Customers choose to consolidate their security solutions alongside the system of record with one platform that holistically covers modern software supply chain needs. We continue to work with leading security partners, AI labs, cyber tools and the community to ensure that our customers' software delivery life cycle remains secure. I'd like to discuss our opportunities in governance and the emerging DevGovOps domain. The voice of our customers at our recent swampUP conference was clear.

AI will only be adopted at enterprise scale if trust through governance is embedded in the software supply chain. Enterprises building with AI face a fundamental operational challenge. Autonomous agents and AI-assisted developers can plan, code, test and deploy in hours. Manual governance processes take weeks or months. At our investor event in New York, we were pleased to welcome Christophe Romatier, the VP of PathWave Software at Keysight Technologies to talk about DevGovOps. On stage, he noted that with JFrog AppTrust, his teams no longer need to make the trade-off between compliance and speed with governance now baked into their pipelines. Keysight is not the only enterprise seeing these needs. Governance, compliance and reliable auditability must be part of the DevGovOps workflow at AI speed.

What agents are trusted to accomplish, the evidence and resources they use and the governance of their behavior and output is increasingly the concern of every company.

Last comment before I hand it over to Ed. AI reshaping how software gets built is no longer news. What is clear is that this evolution needs solid infrastructure, a control plane that brings trust to every development workflow. Our Q3 results show consistent execution of our strategy and growing market demand across our growth pillars.

And with that, I will hand it over to Ed for a detailed review of our third quarter financials and our updated outlook for the fourth quarter and full year of 2026. Ed?

Ed Grabscheid

Thank you, Shlomi, and good afternoon, everyone. We are extremely pleased by our third quarter results, which exceeded the top end of our guidance range across every key metric. These results continue to showcase our consistent strategic execution and operational discipline. During the third quarter, total revenues equaled $179.2 million, up 31% year-over-year. These results demonstrate the continued execution of our go-to-market strategy, fueled by our cloud revenues, growing demand for our security core products and expansion of our Enterprise+ portfolio. Cloud revenues in the third quarter accelerated to $101.5 million, up 60% year-over-year, now representing 57% of total revenues versus 46% in the prior year. Our strong performance in the cloud was driven by successfully converting customer overages into higher annual contracts and increased adoption of our security core products.

During the third quarter, our self-managed or on-prem revenues were $77.7 million, up 6% year-over-year. We continue to proactively engage our on-prem customers to migrate workloads to our cloud or hybrid offerings as they explore solutions better aligned with the rapidly changing security environment. In Q3, 61% of total revenues came from Enterprise+ subscriptions, up from 56% in the prior year. Driven by the ongoing execution of our enterprise go-to-market strategy and broader customer adoption of the JFrog platform, revenue contributions from Enterprise+ subscriptions grew 42% year-over-year this quarter. Net Dollar Retention for the trailing 4 quarters was 124%, representing a year-over-year increase of 6 percentage points and a 3 percentage point improvement sequentially. These results continue to highlight the strong adoption of our security core products, increased cloud usage and conversion of customers into higher annual contracts.

We continue to demonstrate the strategic value of JFrog as a mission-critical trusted system of record for our customer software supply chain with gross retention of 97% as of the third quarter of 2026. Now I'll review the income statement in more detail. Gross profit in the quarter was $149.8 million, representing a gross margin of 83.6% versus 83.9% in the year ago period. Our proactive focus on cloud hosting cost optimization allowed us to deliver stable gross margins throughout the year, even as the cloud became an increasingly larger share of our revenues. We now project annual gross margins to be in the range of 83% to 83.5% for 2026. Operating expenses in the third quarter were $109.1 million, equaling 61% of revenues. This compares to $89.3 million or 65% of revenues in the year ago period.

Our operating profit in Q3 was $40.7 million or an operating margin of 22.7% compared to an 18.7% operating margin in the third quarter of 2025. The continued balance between strategic investment and operational efficiency demonstrates our ongoing commitment to quality growth. Cash flow from operations equaled $69.3 million in the third quarter. After taking into consideration CapEx requirements, our free cash flow reached $66.5 million or 37% margin compared to $28.8 million or 21% margin in the year ago period. Now turning to the balance sheet. We ended the third quarter with $880.9 million in cash and short-term investments compared to $704.4 million at the end of 2025. As of September 30, 2026, our RPO totaled $812 million, a 60% increase year-over-year.

This record performance highlights the successful execution of our go-to-market strategy as enterprise customers continue to trust JFrog and make larger commitments to the JFrog platform, reinforcing our long-term revenue durability. As a reminder, RPO excludes any benefit from customers' usage over contractual minimum commitments. And now let's turn to our outlook and guidance for the fourth quarter and full year of 2026. We're entering the fourth quarter with confidence in our strategy and strength in our pipeline. Our updated 2026 guidance range reflects continued contributions from our security core products, ongoing adoption of our full platform and cloud growth driven by higher annual customer commitments. We continue to derisk our outlook by excluding our largest opportunities due to timing uncertainties. Taking into account our strong year-to-date results, we are once again raising our estimated full year 2026 baseline cloud growth to be in the range of 52% to 54%.

Cloud revenue guidance continues to exclude any contribution from usage above our annual customers' minimum commitments. Given the anticipated contribution from our security core products and increased baseline cloud growth assumptions, we now expect our trailing 4-quarter Net Dollar Retention floor to be 122% for 2026.

Turning to operating expenses. We continue to focus investments on innovation across our entire platform. We remain committed to a disciplined spending philosophy and are confident in our ability to drive ongoing operating efficiency in line with prior execution. For Q4, we anticipate revenues to be in the range of $183 million and $185 million with a non-GAAP operating profit anticipated between $36.2 million and $38.2 million and non-GAAP earnings per diluted share of $0.28 to $0.30, assuming a share count of approximately 131 million shares.

For the full year of 2026, we are again raising our revenue guidance, now anticipating a range of $680 million to $682 million, representing 28% year-over-year growth at the midpoint. Non-GAAP operating income is expected to be between $142.5 million and $144.5 million and non-GAAP diluted earnings per share of $1.14 to $1.16, assuming a share count of approximately 129 million shares.

Now I'll turn the call back to Shlomi for some closing remarks before we take your questions.

Shlomi Haim

Thank you, Ed. At swampUP, our customers told us the adoption of our solution is critical and that the road map ahead is aligned with their future needs and positions JFrog as the anchor of today's AI-powered software supply chain. The world needs a scalable, hybrid, reliable solution to holistically power the modern software delivery life cycle, one that is secure and governed whether it serves developers, AI agents or both. JFrog has become the control plane that enterprise depends on as they power their software supply chains in the era of AI. We are proud of this quarter's results and remain focused on execution as we close out 2026 and plan for the future.

To my team, every frog across the globe, thank you. Few companies have the privilege of shaping the future of software infrastructure, and you do it every day. Your devotion, dedication and unstoppable spirit delivered another record-breaking quarter. I'm proud to stand alongside you, honoring our commitments to customers and to shareholders every day. May the frog be with you as we keep leaping forward.

Operator, we are ready for questions.

Operator

[Operator Instructions]

Your first question comes from the line of Sanjit Singh with Morgan Stanley.

分析師問答

Sanjit Singh

Congrats on an awesome quarter. There's so many things to talk about with these set of Q3 results. Where I wanted to start was just those customers that have been exceeding commitment and then stepped up to, say, take on a new contract, a higher commitment contract. As they do that, Shlomi, are you seeing any evidence of attach of the security portfolio or other parts of the product portfolio? As these -- as they sign up, make larger commitments with JFrog, are you seeing that sort of product portfolio attach?

Shlomi Haim

Sanjit, thank you for your question. The answer is absolutely yes. Our customers are not just exceeding their commitments with more data transfer and storage of new artifacts coming in the world of AI and therefore, raise their consumption base, but also adopting more solutions from the platform. As I mentioned on the call, some of them are coming with more security demands, others with more governance demand and therefore, are feeling more comfortable not only to raise their commitment, but also to sign on a multiyear deal, seeing the future growth together with JFrog.

Operator

Your next question comes from the line of Radi Sultan with UBS.

Radi Sultan

If I think about the rate of cyber incidents that we're seeing just being structurally higher going forward, your customers are getting a lot more value out of your security offering. So how do you think about monetizing more of that maybe in terms of pricing model changes, price increases or adding more security SKUs to capture more of that security wallet? Maybe just walk us through like what are the levers you have to capture more security wallet at existing customers? Would love to get both your perspectives on this.

Shlomi Haim

Yes, Radi. We see more and more software supply chain attack coming from everywhere. Attacker became far more sophisticated in the world of AI. So obviously, this increases the demand for our security solutions, starting from JFrog Curation at the gate as a firewall all the way to JFrog Advanced Security, Xray and other solutions. Currently, we are not yet sharing the results of our security numbers in 2026. We will do it at the end of the year. But we are very, very pleased with the impact it made on our total growth and the expansion into a whole new world of software supply chain protection. We will look at 2027 and the opportunities next to the risk, and we will take decision then.

Operator

Your next question comes from the line of Miller Jump with Truist.

William Miller Jump

Congrats on another great set of results here. I think kind of along the same lines of the questions we've heard, but last quarter, it did sound like security was a standout driver of the upside you saw. I'm curious like it really sounds like everything was clicking this quarter. So how do you really highlight what was the biggest driver of upside between the AI tailwinds that you called out and security? And then Ed, if you could just remind us how we should think about the Q4 security pipeline this year versus prior years?

Ed Grabscheid

Thanks for the question, Miller. Why don't I go ahead and start? I'll talk a little bit about what to expect from a pipeline perspective. This is no longer a situation where we're seeing an event and then you're building a pipeline based on an event. This has been sustained. We've had now multiple quarters of really strong security outcomes. We talked about it at the end of Q2, and we saw that momentum carry into Q3. As Shlomi mentioned previously, we'll provide you with those results at the end of the year. But we continue to see this momentum in security. And it's a very healthy purchasing environment at the moment when it comes to security, in particular, with the amount of attacks that are happening in the open source and with the protection that's needed with AI.

Operator

Your next question comes from the line of Mike Cikos with Needham.

Michael Cikos

I'll echo the congratulations on just a fantastic quarter that you guys posted. I wanted to come back to the commitments for a second, and it's a bit of a 2-parter. But one, can you help us think about the timing for when these customers sign these larger commitments? Was it -- was there anything to note from a linearity standpoint if we think about Q3 and when these commitments were signed? And then the follow-up on that commitment, it just I'd love to hear, but it feels like customers are coming back to you at a faster pace versus historical precedent in terms of reengaging JFrog and then willingness to sign a larger commitment. Can you give us any data points around that, my assumption there?

I just want to see if we can validate that or confirm that in any capacity because it does feel like between the go-to-market traction that you guys have, the expanded platform, the customer outreach to you, it does feel like they're coming back at a faster pace, but would just love to get your insight.

Shlomi Haim

Thank you, Mike. So there is nothing new about the methodology and the strategy that we're following, right? So it's been more than 2 years that we are converting overusage into commitments coming to the customers proactively and offering them a better deal for a higher commitment. This helps us not only to stabilize the cloud usage, but also to build a long-term partnership with our customers. So some of them are reaching out to us, understanding that the volume of AI introduces them to a completely new demand on the cloud and others are reaching out to us or we are reaching out to them proactively to discuss their future needs as we see their overusage on a monthly basis.

This is an ongoing discussion with our customers. As we mentioned on the call, the flexibility model -- the flexibility in the model is super important because there is no pressure there. They can't keep on going with the on demand. And this will be usage over commitment that we will not guide you for. But if they are willing to take a higher commitment for a longer year, then obviously, we are working with them, and this is what we report as part of our guidance, and you see the consistent growing and the durable growth every quarter.

Operator

Your next question comes from the line of Jason Celino with KeyBanc Capital Markets.

Jason Celino

Wow, absolutely phenomenal quarter. I wanted to take the time to ask maybe a higher-level question. So it's been widely publicized that Anthropic spent 6 to 9 months developing their own internal version control system. So coming from a person who isn't a developer and most investors are not developers, but presumably some might think that with AI coding, a company like this could spend another 6 to 9 months to develop more in the software development stack. So on this forum, I wanted to give you Shlomi the opportunity to discuss why it doesn't make sense or why it would be incrementally more difficult to develop like a complete gating Artifactory solution.

Shlomi Haim

Yes, absolutely. Well, Jason, we were honored to have Anthropic on stage at swampUP just last month in New York and then again in Barcelona, stating what we keep saying, the world is demanding for more trust and control over the software supply chain. And this can only come with a system of record. We see and we use the products that Anthropic or OpenAI provides and both of them are honored customers of JFrog. But there would be no developer nirvana in the age of AI if it will be just for a faster model or a smarter agent.

It's only reachable with a scalable, universal governed system of record, one trusted source of truth for everything that goes from the build to the consume to the ship. You cannot trust what you ship if you don't have a system of record. And if it's not universal, then it will be a one vendor or one agent focused solution. So actually, when we see what they are building, it goes complementary with what we provide. And I think that our customers see the same. That's the growth that we keep on delivering.

Operator

Your next question comes from the line of Mark Cash with Raymond James.

Mark Cash

Shlomi, a question for you. So I know we've talked a lot about the AI driving a tsunami of binaries. So I guess I want to ask or I want to know, as the frontier models accelerate vulnerability discoveries, are you seeing that translate into more artifact rebuilds, transfer storage and security scans, which in turn helps drive a surge in cloud results and guidance? And I guess if you are seeing that tailwind, does this also create a natural upsell conversation for security and governance for you as well?

Shlomi Haim

Yes. So Mark, the facts are that there are new artifacts introduced to us by AI, right? None of us spoke about MCP skills and others a year ago. These artifacts belong to the same place as you manage the rest of your binary. You have to manage their dependencies, their security, their governance and everything that comes along that. So yes, we see it as a tailwind in terms of storage and data transfer. Not only that, we also see Artifactory, the system of record expand to become your MCP Registry, your skill registry. And this is how our customers are looking at it. So what would be the impact of it on the long run? Will it be more than your Python or NPM or Docker? I don't know. But for sure, more and more artifacts, binaries and software packages are added to the solution we provide.

Operator

Your next question comes from the line of Shrenik Kothari with Baird.

Shrenik Kothari

Echoing my congrats on the great results. So just stepping back, your results and some of the customer examples do suggest you are becoming more deeply embedded in enterprise-wide infrastructure, especially with the Ford migration that you talked about with a petabyte of artifacts. It seems customers are increasingly consolidating security around you as a single system of record. So my question is like beyond the new AI-generated binaries and the tsunami of binaries you mentioned, Shlomi, as AI is seemingly accelerating modernization of these legacy applications and it looks like there are some examples. Just wanted to understand like broadly, are you seeing these legacy software assets already creating this another significant adoption cycle? And are there evidences building of more enterprise-wide standardization coming from that?

Shlomi Haim

Yes, Shrenik, thank you for the question. As I mentioned on the call, and we gave 3 examples of giant organizations that are scaling, a, with new artifacts, as I mentioned before; but b, with the fact that every developer is now powered by an agent, and have more to produce. The desired outcome of the world of AI results in a binary, a software package, whether it's a new artifact or something that belongs to the previous world of NPM, Python, Docker, Maven and 40 other technologies that are supported in JFrog. JFrog Artifactory is the Switzerland of system of record. We support all technologies as long as they are binaries. And the fact that you are now powered by agent provide us with one challenge is to scale to where you want us to go. And you mentioned Ford and others, we are scaling with them to infinity.

Operator

Your next question comes from the line of Howard Ma with Guggenheim Securities.

Howard Ma

Incredible quarter. I wanted to ask about the massive telco deal. And Shlomi, could you talk about the characteristics of this expansion that you believe are repeatable versus not repeatable with other similar type -- very large enterprises.

And for Ed, on a related note, you kind of gave us the numbers to do the math. We calculate it to like a $40 million expansion. And if you assume 5 years, and maybe it's like ratable $2 million a quarter. And if I back that out from Q3, I think you would have still accelerated cloud revenue in Q3 even without this massive deal. So any color to help investors do the math would be helpful.

Ed Grabscheid

Why don't I go ahead and start, and then Shlomi can talk about the construct of the large telco deal and why we won that deal. But first off, we're not going to go into the math of what we saw in that deal. It was a very strong deal. You saw it was a capture of a commitment, 167% in terms of data consumption and storage. So we're capturing overusage as a commitment. And it also showed the power of the platform. We were able to not only capture an expansion of security, but we also captured governance in that deal. And it turned out to be a very, very strong outcome, a $76 million deal, multiyear deal, and that will be reflected as a commitment going forward. And this is why you saw the confidence that we're showing in our guidance as we head into Q4.

Shlomi Haim

Yes. Well, first, I'll mention again that none of our customers represent more than 3% of our total revenue. That's a very diverse portfolio, and we are very disciplined with that. Second, we were honored to sign this contract and to scale with this customer, covering tens of thousands of developers that are powered by tens of thousands of agents. That generated more consumption, more data consumption on Azure Cloud. And it also introduced this organization to new needs of governance. The fact that you are faster and stronger powered by AI doesn't mean that you are scaling at the same pace with your governance system. So the adoption of AppTrust was very important leap forward with this customer.

And the second thing is obviously the security iron dome that we managed to put on top of the software supply chain and scale with them. So having this size of customers with this size of contract, it's not only the platform, it's not only the technology, it's not only the environment. It's the trust that our customer success, our sales team, our product team is building with these customers, and we are very, very honored to scale to these limits of contracts.

Operator

Your next question comes from the line of George McGreehan with Bank of America Securities.

George McGreehan

This is George McGreehan on for Koji Ikeda. I wanted to also ask a bit of a theoretical one. So obviously, we're seeing the tsunami binaries and kind of upstream of that. How much has production-ready code improved today in terms of code quality versus a year ago? And how much better do you think it can get over the next few years? And specifically, why?

Shlomi Haim

Yes, George, that's a great question. We are not necessarily breaking down the numbers now to how much of it was produced by this specifically. But what I can tell you is what I also said on the call is that developers are now running much faster. They become more product managers than developers. They are managing tens or hundreds of agents and produce more and more. The result of everything they build, if it's a quality result, will end as a binary. A binary that needs to be governed, that needs to be secured, that needs to be deployed, that needs to be managed from versioning perspective and so on. So we see more and more of it coming.

And on the other hand, what we see and you probably read the news in the last weeks that source code becoming commoditized. So on one hand, there is a lot of efforts to secure your primary asset, which is the binary. On the other hand, generating source code by agents or developers becoming commoditized. So that obviously raises the volume and the demand for the JFrog platform.

Operator

Your next question comes from the line of Brian Essex with JPMorgan.

Brian Essex

Great to see the acceleration with margin expansion, really nice results. Maybe Shlomi, for you, would love to understand how your budget environment has evolved throughout the year? Have you maintained the same stakeholders or with the elevated threat environment and some of the vulnerabilities that we've seen, some of the incidents that we've seen, has that scope of stakeholders within enterprises expanded?

And then as part B of that, are you -- is awareness of your platform moving up to CIO C-suites more frequently and garnering more stakeholder support within the enterprises? Just trying to get a sense of the momentum that you have. Are your budgets -- is your budget visibility expanding as you kind of head into the end of the year and think about the setup for next year?

Shlomi Haim

Yes, Brian, thank you for the question. I believe that we all understand that a $76 million deal is not being signed by a developer. So of course, the introduction to the C-suite of our customers is something that enable us to scale. And we report quarter after quarter the growth of our over $1 million in ARR customers that are betting more and more on JFrog. So that's obviously a great achievement of our strategic and sales team that managed to build this relationship with the C-suite of our customers, which, by the way, are the biggest organizations in the world.

The second thing, to your point, you are very much right. This is not just the CIO or CTO that used to pay for DevOps. A lot of our new customers are coming from the CISO office, the CISO itself, whether it's for governance and compliance or security demand. And the security momentum that we see and the adoption of the JFrog Security solution that contributed to the growth of the net dollar retention, as we mentioned, this comes with the larger checks that are being signed only by the C-suite. So the answer is yes on the C-suite and yes, on the expansion of the C-suite.

Operator

Your next question comes from the line of Matt Hedberg with RBC.

[Operator Instructions]

Matthew Hedberg

Congrats on the quarter from me as well. Maybe just to follow up on that last question on expansion. Obviously, it's great to see the tick up both year-on-year and sequentially here. I guess, Ed, you guys have a lot of drivers of that, and we talked about a lot of them on the call tonight. But I guess how should we think about the guardrails for like where NRR could go, especially as you kind of start to think about calibrating our models for next year as we think about 4Q and into next year?

Ed Grabscheid

Yes. Thanks for the question, Matt. Really, today, we're seeing a very, very healthy buying environment, and we're focused on that momentum just to continue to build with execution in 2026. We've seen strong usage over minimum commitment. We've been able to capture some of those customers into higher annual commitments. We're also seeing usage broadly across our platform above minimum commitments. It was sustained usage during Q3. So the focus today is really around the execution in 2026. We set the floor for 2026, and we'll provide some insights next quarter when we close out Q4 and the full year.

Operator

Your next question comes from the line of Jonathan Ruykhaver with Cantor.

Jonathan Ruykhaver

Once again, very impressive print. I'm just curious, when you look at the AI and ML model development trends, I mean, it does sound like, Shlomi, based on some of your comments that you're seeing incremental usage. Any way to quantify that use case and usage trends versus traditional software development? And our AI-related repositories growing faster than traditional software repositories. And then just finally, how does AI model development compare to software as it relates to data usage?

Shlomi Haim

Yes. Well, that's obviously something that we track closely. We are looking at the data, not only in our cloud, but also when we speak with our self-hosted customers to understand the level of adoption of AI. Obviously, the more progressed companies are adopting MCP skills, datasets, plug-ins and other new artifacts that were introduced during the era of AI. We are not yet ready to disclose the breakdown of the numbers. But for sure, this is increasing. This is the first thing.

The second thing, by using those tools, skills and MCP more specifically, it enables agents as first-level citizens on JFrog platform, using JFrog as a system of record, being protected by our security. So this generates not only those new packages, but also the usage of others such as the legacy binaries that we all know from the open source environment. So we are collecting the information. Once we would be ready and feel comfortable with it, we will share, of course, more information about it.

Operator

Your next question comes from the line of Yi Fu Lee with StoneX.

Yi Fu Lee

Congratulations, Shlomi and the JFrog team. Such a master quarter, obviously, 60% RPO growth, et cetera. Just want to get a sense on the AI native customers. I understand the biggest debate was like converting the overage to long-term commitments, which you guys have done. I was wondering what was it that this quarter drove the -- you could say like customer crossing the chasm, right, to sign longer term with you. Is there certain things that drove this behavior?

And then Ed, I know you're not going to give, but like I'm going to try anyway. On the longer term, right, in the back of the deck, obviously, we have our long-term model. After this monster beat, is there anything you could like comment on that? Any changes?

Ed Grabscheid

Thanks for the question, Yi Fu. I'll go ahead and start. First, let me remind you that the AI native customers are primarily self-hosted customers. We did talk about one that we closed in Q2, which is a hybrid customer. That just started. It's very early in the life cycle with JFrog. And so we're not going to necessarily comment on anything around conversion or capture for that particular customer. Again, reminding you that there's not one single customer that represents more than 3% of our revenues. But in terms of what we saw in a very, very strong quarter, as you mentioned, RPO was strong, capture of some customers to higher annual commitments.

When we look at the investor deck, I think you're referring probably to the long-term model. We're tracking very nicely against that. We will come back to you at the end of the year, and we can talk a little bit more about 2027. We're not ready to disclose anything at this point. But we're building momentum. We're building strength. As I mentioned, it's a healthy purchase environment, and we're capturing through the execution of our strategy, very strong outcome and results. And Shlomi can talk a little bit about what we saw in terms of those customers that we did capture bigger commitments.

Shlomi Haim

Yes. Well, Yi Fu, the commitment of these customers is obviously growing by the self-hosted demand, which is more projects, more departments, more regions. And we are very happy to see the collaboration with them. Some of them shared on stage at swampUP the partnership that they are building with JFrog. We are not commenting on one by one, but we are very honored to have those that are building AI with AI using JFrog as the system of record.

Operator

Your next question comes from the line of Jason Ader with William Blair.

Jason Ader

Can you talk, Shlomi, a little bit about the competitive landscape in supply chain security? Who do you see the most in bake-offs? And related to that, it seems like GitLab and GitHub are at least talking about security more, maybe investing more maybe because their repo business is under pressure. But maybe just talk about that picture for us.

Shlomi Haim

Yes. Well, Jason, the landscape -- the competitive landscape is very diverse. On the landscape of security, obviously, we see point solutions trying to provide a scalable solution for artifact firewall and for SBOM, AI BOM solutions, software composition analysis and things like that. I think that JFrog is well positioned as it differentiates itself by having those security solution very tightly integrated with Artifactory, the system of record. So what our customers keep telling us that there is no complete security solution and no complete governance solution without the very tight integration with Artifactory.

Now if you look at the point solution that I just mentioned, all of them need an access to Artifactory. And this is something that we look at and we consider every day. But it gives us a very strong reason to believe that our customers will prefer one platform over point solutions. Regarding the system of record landscape, the players there, most of them are providing solutions that are not hybrid, not universal and for sure, not scalable to the level of Artifactory. Therefore, the world of enterprise trust JFrog and scale with us.

Operator

Your next question comes from the line of Raimo Lenschow with Barclays.

Eamon Coughlin

This is Eamon Coughlin on for Raimo. I guess, Ed, on the commentary of converting some of those overusage into higher annual commitments, has that time line shortened over time as customers gain more confidence in AI workload durability? Or do procurement and forecasting uncertainty still make these conversions primarily on a case-by-case basis? And then is there any way to rank higher consumption, security adoption and self-managed migrations contribution to cloud growth this quarter? Congrats on the quarter.

Ed Grabscheid

Yes. Let me start, and then Shlomi can fill in if there's anything that I'm missing here. But what we saw in the first half of 2026 was a hesitation, and we saw customers almost like an insurance policy spending more than their minimum commitments. That trend is continuing even still today in Q3, but what we saw is some of our largest customers with clarity that AI workloads are continuing to grow and that they need to make commitments to JFrog, not only with their offerings to increase data consumption, but also with security and governance. It's not necessarily that those time lines have shortened, but the clarity around the decision-making became much clearer in Q3. So this is why we saw some of those customers converting and it was more of those large customers.

Operator

Your next question comes from the line of Nick Altmann with BTIG.

Nicholas Altmann

I wanted to circle back to the $76 million TCV contract. And the question is, could you just kind of give us a flavor of where that sort of compares to your other deals that have historically been very large on like an ACV basis? And I guess what I'm trying to get at is, it seems like you guys are kind of in a different atmosphere in terms of the deal sizes that you were really in even a year ago.

And so Ed, I know that you guys don't include these large transactions in the guidance, but maybe just talk us through how long that deal sort of took to close, whether there's other transactions of a similar size opportunity in the pipeline or whether this deal had maybe some anomalous -- anomalies that maybe leads it to an outsized opportunity versus what you guys see?

Shlomi Haim

Thank you, Nick. I'll start and Ed can chime in with more details about it. Signing an $80 million deal is not something that is based on a product or on a sales maneuver. It's an investment, a long-term investment, building trust with the customer for many years. It started with the migration from Sonatype Nexus to Artifactory, then the scalability, then the migration to the cloud, then the additional security solution, then more and more petabyte of usage and then AI came and changed everything in terms of the attack surface and the governance requirement.

So I think that this specific customer found a partner that could scale with it and provide the flexibility of a universal solution that will support several vendors, several agents, several solutions that they are adopting and using at the scale of AI. It's not necessarily different from other customers we see. Obviously, the magnitude is different. But we see more and more multimillion dollar deals, not only in 2026 results, but also in our pipeline. And therefore, we felt comfortable to raise the guidance for the year as we looked at the pipeline. This comes not only from one region, not only from one sector, not only from one side, it's across our portfolio, and we have a very strong confidence in our pipeline.

Ed Grabscheid

And just to close out, Shlomi's what he was saying here, in terms of the timing and the cadence, we see these very large deals typically come in the back half of the year. So if you recall, we had 3 of the largest deals a few years ago in Q3. This seems to be more of the theme where these type of deals close towards the back half of the calendar year.

Operator

There are no further questions at this time. I will now turn the call back to Shlomi for closing remarks.

Shlomi Haim

Thank you, everyone, for joining the call. We are very, very pleased with our Q3 results. We are looking forward to seeing you at the end of 2026 and make the frog be with you.

Operator

This concludes today's call. Thank you for attending. You may now disconnect.