JFrog study highlights gains in secure software delivery and ROI

JFrog has released the findings of a commissioned Total Economic Impact study conducted by Forrester Consulting, examining the business impact of its software supply chain platform on large enterprises. The study evaluates how organisations using the JFrog Platform manage software supply chain security across DevOps, DevSecOps, and AI or MLOps workflows, from code creation through to deployment and AI-driven development.

According to the study, a composite organisation modelled by Forrester achieved a 282% return on investment over three years by adopting the JFrog Platform. The analysis estimates total quantified benefits of US$5.4 million across that period, alongside a payback time of less than six months. These gains were attributed to improvements in security posture, higher developer productivity, better audit readiness, and reduced complexity across software delivery toolchains.

The findings position software supply chain security as a growing operational and financial priority for enterprises, particularly as organisations adopt AI-driven development practices. The study frames secure, governed software delivery as a foundational requirement rather than a downstream control, especially as automation and machine-driven processes become embedded in production environments.

Unified platform approach versus fragmented toolchains

The Forrester study contrasts a unified platform model with more fragmented approaches built around multiple point solutions. It concludes that enterprises relying on separate tools for artefact management, vulnerability scanning, compliance, and release workflows face higher operational overhead, greater integration complexity, and slower remediation cycles.

The JFrog Software Supply Chain Platform is presented as a single system of record for software artefacts, build metadata, and release processes. By consolidating these functions, the platform aims to standardise workflows across development, security, and operations teams while reducing the need for manual coordination between disparate tools. Forrester’s analysis suggests this consolidation improves visibility across the software development lifecycle and helps organisations enforce more consistent security and compliance practices.

A software supply chain manager from a telecommunications organisation interviewed as part of the study highlighted the operational impact of this approach, stating that “we no longer spend days chasing down vulnerabilities. JFrog gives us the visibility and automation to act within hours, not days.” The study indicates that this shift enables teams to focus on prioritising and resolving critical issues rather than managing tool sprawl or reconciling inconsistent data.

The report also notes that having a single source of truth for artefacts and dependencies simplifies collaboration between development and security teams. This shared context is described as particularly important in complex enterprise environments, where multiple teams and release pipelines operate in parallel and require consistent governance without slowing delivery.

Measured impact on security, productivity, and compliance

Beyond financial metrics, the study details several operational improvements attributed to the platform’s adoption. Forrester found that organisations reduced their overall software development tool spend by 71% through tool consolidation, driven by fewer licences and lower administrative overhead. These savings formed a significant component of the overall ROI calculation.

Security outcomes were also a central focus of the analysis. The study reports a 65% reduction in critical vulnerabilities, enabled by contextual analysis, curated repositories, and earlier security scanning within development workflows. Remediation times were reduced by 80%, reflecting faster identification, prioritisation, and resolution of issues before they reached production environments.

Developer efficiency emerged as another area of measurable impact. By streamlining environment setup, permissions, and configuration, organisations saved an estimated 38 hours per developer during onboarding. The study suggests this reduction in friction helps teams scale more quickly while maintaining consistent security controls, particularly in fast-growing engineering organisations.

While audit and compliance benefits were not fully quantified in financial terms, Forrester noted significant qualitative improvements. Automated software bill of materials generation, continuous scanning, and integrated policy enforcement were found to reduce manual effort and preparation time for audits. These capabilities were cited as increasingly important as regulatory scrutiny around software supply chains and AI systems continues to increase.

Commenting on the findings, JFrog co-founder and chief executive Shlomi Ben Haim said that “in the AI era, trusted, secure, and governed software delivery sits at the heart of every organization.” He added that relying on multiple point solutions can overwhelm developers and increase risk, while a unified platform approach allows teams to focus on critical vulnerabilities and deliver trusted releases with stronger economic returns.