JFrog (NASDAQ: FROG) has delivered an average annual return of 23.27% over the past five years, significantly outperforming the broader market by 12.0% on an annualized basis.

The software company currently holds a market capitalization of $10.93 billion. This valuation reflects the cumulative impact of its stock price appreciation since its initial public offering period.

Historical Investment Performance

An investor who purchased $100 worth of JFrog stock five years ago would see that position grow to $284.65 today. This calculation assumes a stock price of $88.65 at the time of writing.

The performance highlights the effect of compounded returns on capital growth over a multi-year horizon. The data underscores how consistent appreciation can multiply initial investment values substantially.

What the Numbers Show

The divergence between JFrog’s total return and the market benchmark illustrates the premium investors have paid for growth in the developer infrastructure sector. With an annualized return more than double the implied market average (derived from the 12.0% outperformance gap), the stock has generated significant alpha relative to broad indices over this specific five-year window.

JFrog Ltd (Nasdaq: FROG) has introduced the JFrog Traffic Controller, a network-layer enforcement solution integrated with Secure Access Service Edge providers Zscaler, Cloudflare, and Netskope. The tool reroutes software package downloads through JFrog Artifactory to prevent bypasses.

This launch addresses critical security gaps in software supply chains, particularly as AI coding agents autonomously pull dependencies. By enforcing policy at the network edge, JFrog aims to ensure every artifact flows through a trusted system of record without disrupting developer workflows.

Rising Threat Landscape

JFrog’s 2026 Software Supply Chain Security State of the Union report highlights a severe escalation in threats. Malicious packages surged 451% year over year, reaching over 171,000 unique instances. Despite this volume, only 40% of organizations have malicious package detection capabilities in place. Secrets detection is active in just 28% of enterprises.

The coverage gap is structural. AI coding agents like Claude Code, Cursor, Copilot, and Kiro run directly on developer machines, often bypassing proxy configurations and approved package lists. Each agent session represents a potential unmonitored entry point into the organization’s software supply chain.

How Traffic Controller Works

The JFrog Traffic Controller integrates with existing SASE infrastructure to stop malicious packages before they reach user machines. Rather than blocking requests, it transparently reroutes outbound package downloads through JFrog Artifactory. JFrog Curation then inspects each package against configured security, license, and quality policies.

Compliant packages are delivered without interruption. Malicious ones are stopped, and safe approved versions are served automatically when available. This creates a complete, auditable record of every package entering the organization.

Supported SASE Partners

The solution is available immediately through JFrog Curation, supporting three major providers:

• Zscaler Internet Access: Identifies and curates supply chain software package traffic through JFrog.
• Cloudflare Gateway: Configured to TLS-inspect public registry traffic and redirect package requests to JFrog Artifactory.
• Netskope One SSE: Applies real-time protection policies to redirect package manager traffic with browser passthrough.

Customer Validation

Adyen, a global financial technology platform, consolidated its software supply chain on the JFrog Platform to scale enterprise-wide DevSecOps practices. Adyen uses JFrog Curation as a real-time firewall to block malicious open-source packages from entering its pipelines.

Supun Vidana Pathiranage, DevSecOps Specialist at Adyen, noted that the goal is not to block development but to enable it safely. "JFrog Curation provides a firewall for open-source packages... We enable development; we don’t block it," he said.

What the Numbers Show

The disparity between threat volume and detection capability is stark. With malicious packages surging 451% to 171,000 instances, yet only 40% of organizations possessing detection capabilities, there is a significant exposure gap. This suggests that the majority of enterprises lack visibility into nearly half of all malicious package attempts, creating a high-risk environment for autonomous AI agents that operate outside traditional pipeline controls.