JFrog listed on Canada SLSA to boost software security

JFrog Ltd has partnered with Data Centre Intelligence (DCI) to list the JFrog Software Supply Chain Platform on the Government of Canada’s Software Licensing Supply Arrangement (SLSA) Catalogue. This listing provides federal departments and Crown corporations a streamlined procurement path for software artifact management and AI governance capabilities. The availability comes as Canadian government organizations face increasing pressure to secure software supply chains and comply with new transparency standards.

The SLSA Catalogue listing allows buyers to acquire the JFrog Platform through pre-negotiated terms and pricing ceilings, streamlining the acquisition process. Rafael Santiago, SVP Global Sales at JFrog, stated that the partnership with DCI, which has over a decade of experience helping the Canadian government adopt technologies, places the platform on an approved path for teams navigating AI adoption and Software Bill of Materials (SBOM) requirements.

Rising Security Risks and Compliance Needs

JFrog’s 2026 Software Supply Chain Security State of the Union report indicates that over 48,000 new Common Vulnerabilities and Exposures (CVEs) were disclosed in 2025, representing a 20% year-over-year increase partially driven by AI-generated code. For government entities managing critical infrastructure, the ability to scan and verify software components is essential.

Canadian federal departments are currently addressing several new regulatory requirements:

AI Governance: The federal government’s AI Strategy for 2025–2027 sets expectations for responsible deployment and transparency across departments using AI tools.
SBOM Transparency: In September 2025, the Canadian Centre for Cyber Security joined international partners in publishing guidance encouraging the adoption of SBOMs to manage software risk.
Automated Decision-Making Compliance: The Treasury Board’s amended Directive on Automated Decision-Making requires federal institutions to demonstrate governance over automated systems by June 2026.

Platform Capabilities and Deployment

The JFrog Software Supply Chain Platform serves as a single source of truth for binaries, dependencies, and build artifacts. It can be deployed on-premises, in the cloud, or in hybrid environments to meet security requirements. Key components of the platform include:

Component	Function
JFrog Artifactory	Enterprise-grade binary artifact management with deployment flexibility for self-hosted environments.
JFrog Xray	Automated security scanning for open-source binary vulnerabilities and license compliance.
JFrog Curation	Proactive defense stopping risky open-source components at ingestion.
JFrog AI Catalog and MCP Registry	Governance for AI models and agent-based development assets.
JFrog AppTrust	Verifiable compliance and automated policy enforcement across the software supply chain.
SBOM Evidence	Detailed Software Bills of Materials aligned to CycloneDX and SPDX 3.0 standards.

Adam DaCosta, President of Data Centre Intelligence, emphasized that the listing gives departments a straightforward way to implement a trusted solution while working with a partner versed in public sector procurement. DCI, established in 2012 and located in Ottawa, specializes in public sector government solutions and procurement strategies.