JFrog Ltd (Nasdaq: FROG) has introduced the JFrog Traffic Controller, a network-layer enforcement solution integrated with Secure Access Service Edge providers Zscaler, Cloudflare, and Netskope. The tool reroutes software package downloads through JFrog Artifactory to prevent bypasses.

This launch addresses critical security gaps in software supply chains, particularly as AI coding agents autonomously pull dependencies. By enforcing policy at the network edge, JFrog aims to ensure every artifact flows through a trusted system of record without disrupting developer workflows.

Rising Threat Landscape

JFrog’s 2026 Software Supply Chain Security State of the Union report highlights a severe escalation in threats. Malicious packages surged 451% year over year, reaching over 171,000 unique instances. Despite this volume, only 40% of organizations have malicious package detection capabilities in place. Secrets detection is active in just 28% of enterprises.

The coverage gap is structural. AI coding agents like Claude Code, Cursor, Copilot, and Kiro run directly on developer machines, often bypassing proxy configurations and approved package lists. Each agent session represents a potential unmonitored entry point into the organization’s software supply chain.

How Traffic Controller Works

The JFrog Traffic Controller integrates with existing SASE infrastructure to stop malicious packages before they reach user machines. Rather than blocking requests, it transparently reroutes outbound package downloads through JFrog Artifactory. JFrog Curation then inspects each package against configured security, license, and quality policies.

Compliant packages are delivered without interruption. Malicious ones are stopped, and safe approved versions are served automatically when available. This creates a complete, auditable record of every package entering the organization.

Supported SASE Partners

The solution is available immediately through JFrog Curation, supporting three major providers:

• Zscaler Internet Access: Identifies and curates supply chain software package traffic through JFrog.
• Cloudflare Gateway: Configured to TLS-inspect public registry traffic and redirect package requests to JFrog Artifactory.
• Netskope One SSE: Applies real-time protection policies to redirect package manager traffic with browser passthrough.

Customer Validation

Adyen, a global financial technology platform, consolidated its software supply chain on the JFrog Platform to scale enterprise-wide DevSecOps practices. Adyen uses JFrog Curation as a real-time firewall to block malicious open-source packages from entering its pipelines.

Supun Vidana Pathiranage, DevSecOps Specialist at Adyen, noted that the goal is not to block development but to enable it safely. "JFrog Curation provides a firewall for open-source packages... We enable development; we don’t block it," he said.

What the Numbers Show

The disparity between threat volume and detection capability is stark. With malicious packages surging 451% to 171,000 instances, yet only 40% of organizations possessing detection capabilities, there is a significant exposure gap. This suggests that the majority of enterprises lack visibility into nearly half of all malicious package attempts, creating a high-risk environment for autonomous AI agents that operate outside traditional pipeline controls.

JFrog Ltd (NASDAQ: FROG) will host an investor and financial analyst event on September 2, 2026, as part of its annual swampUP user conference in New York City.

The one-hour session, scheduled from 1:30 pm to 2:30 pm ET, will be live-streamed from The Glasshouse venue. Management team members are set to present the company’s latest product innovations and provide a financial update.

Event Focus

The briefing will center on JFrog’s “Trusted Intelligence” framework. This approach aims to help enterprises secure, manage, and govern their software supply chains amid the transition to machine-generated software and AI scale.

Attendees will also hear live customer testimonials detailing real-world applications of the JFrog Software Supply Chain Platform.

Conference Context

swampUP 2026 runs from September 1 to September 3 in New York, with a subsequent stop in Barcelona from October 20 to October 22. The global tour targets software developers, security professionals, and DevOps leaders navigating the integration of AI models and autonomous agents into enterprise workflows.

Virtual registration for the investor hour is available via the company’s dedicated link.