JFrog Xray

What is JFrog Xray?

JFrog Xray is JFrog Ltd's software supply chain security layer — listed in the current commercial catalog as JFrog Security Essentials — which analyzes source code and binaries inside JFrog Artifactory itself to surface known vulnerabilities (CVEs), malicious packages, license risk and component operational risk.

The architectural difference against an external scanner lies in where the analysis happens: because Xray runs inside the repository, binary scanning is enabled per repository with no need to export artifacts to another tool, and the same mechanism covers container images, Helm charts, builds and machine learning models. For source code, feedback arrives through FrogBot on the pull request and through IDE plugins, with fixes suggested inside the developer's own flow.

This page covers JFrog's security and governance set: Xray as the analysis base, plus the JFrog Advanced Security, JFrog Curation, JFrog Runtime, JFrog AppTrust and JFrog AI Catalog modules, which share the same licensing metric. All of them require JFrog Artifactory as a prerequisite — none is sold standalone.

Key features of JFrog Xray

The analysis base and the advanced modules deliver:

• Source and binary SCA — surfaces CVEs and license issues in open source dependencies, covering both the code and the compiled artifact.
• Premium vulnerability database — consolidates NVD, GitHub, Ubuntu, Debian, Red Hat and PHP with enrichment the JFrog Security Research Team.
• SBOM generation — exports in CycloneDX and SPDX; CycloneDX carries VEX exploitability data and, in recent versions, CBOM with certificate and secret findings.
• Policies and Watches — rules that flag or block components beyond a defined threshold, with Jira and webhook notifications.
• Promotion blocking — stops a Release Bundle moving to distribution when a linked Watch triggers a policy violation.
• Contextual Analysis — in Advanced Security, assesses whether a CVE is reachable given how the code uses the dependency, prioritizing what actually exposes the application.
• SAST, secrets, IaC and misconfigurations — additional Advanced Security scans across first-party code, leaked credentials, infrastructure as code and service configuration.
• Package Traffic Controller — in Curation, intercepts and redirects package traffic to ensure intake routes through JFrog, blocking whatever breaks policy.
• Continuous monitoring — re-evaluates already stored components when a new vulnerability emerges, with no new build required.

Benefits of JFrog Xray

Less noise in the remediation queue because Advanced Security's Contextual Analysis ranks CVEs by actual applicability instead of dumping everything by raw severity.

Risk stopped at intake because Curation acts at the front door: a rejected package never reaches the developer, and policy suggests a compliant alternative rather than simply denying.

Documented compliance because the SBOM is generated automatically per artifact, build or project in audit-accepted formats, rather than produced by hand when a customer demands it.

Releases under control because the Watch blocks promotion of a Release Bundle that breaks policy — the gate stops being a human process and becomes a rule enforced by the platform.

Fixes inside the developer's flow because FrogBot comments on the pull request and IDE plugins show the issue where the code is being written, cutting the cost of revisiting it weeks later.

Who JFrog Xray is for

Xray serves application security and AppSec teams, platform engineering and compliance areas answering for third-party audits, always in organizations already using Artifactory as their repository.

Recurring scenarios: the company now facing SBOM requirements in contracts that must produce the document per release; the organization hit by a malicious dependency incident that wants to block intake rather than detect later; and the AppSec team with a large CVE backlog that needs prioritization by real applicability.

What sets JFrog Xray apart

The structural differentiator is position: analysis happens inside the repository that already holds the artifact, so there is no step exporting binaries to an external tool and no risk of what was scanned diverging what was published. The same inventory serving the build serves the audit.

The second differentiator is end-to-end coverage under one policy: Curation at intake, Xray and Advanced Security at build, AppTrust at version governance and JFrog Runtime in the Kubernetes environment. The third is reach into AI assets — machine learning models and IDE extensions enter the same policy pipeline as traditional packages.

Requirements and prerequisites

JFrog Xray is not sold standalone: it requires JFrog Artifactory. In the self-managed model, Xray is available the Pro X edition and Xray in high availability exists only on Enterprise X and Enterprise +. The Advanced Security, Curation, AI Catalog and AppTrust modules require Enterprise X or Enterprise +.

On self-managed installations, Xray requires PostgreSQL — no other database is supported — in versions 13 to 17, and runs on a dedicated server, separate Artifactory. JFrog indicates roughly 6 vCPUs, 24 GB RAM and 500 GB SSD for up to 100,000 indexed artifacts. In the managed model, JFrog operates these components, including in the two São Paulo regions.

Security modules and bundles

Base SCA comes with the Artifactory edition. Advanced modules are contracted separately, standalone or bundled:

• JFrog Advanced Security — Contextual Analysis, leaked secrets detection, SAST, IaC scanning, misconfigurations and Runtime Integrity.
• JFrog Curation — blocking of out-of-policy open source packages, AI assets and IDE extensions, with Package Traffic Controller and a full audit trail.
• JFrog AppTrust — per-application risk governance, with defined ownership, lifecycle-stage policies and evidence collection partners such as NVIDIA, GitHub and ServiceNow.
• JFrog AI Catalog — model governance, MCP Registry, Agent Skills Registry and Shadow AI detection.
• Unified Security — a bundle with a 200-developer base gathering Curation, Advanced Security, Agentic Remediation, IDE Extensions Control and Snippet Detection.
• Ultimate Security — adds AI Catalog, AppTrust and Transitive Contextual Analysis; exclusive to Enterprise +.

Platform context sits on the JFrog Artifactory Cloud and JFrog Artifactory Self-Hosted pages.

How much does JFrog Xray cost?

The answer has two parts. Base SCA is already included in the contracted Artifactory edition, with no separate charge. The advanced modules — Advanced Security, Curation, AI Catalog, AppTrust and the bundles — are licensed per Contributing Developer, on an annual subscription.

JFrog's definition is specific and changes the math: a Contributing Developer is any developer who contributed to creating or updating a scanned artifact or project in the last 90 days — contributing includes submitting code, changing configuration or downloading a public package. A single developer working across several projects counts only once. So an IT area of 180 people where 120 touched scanned artifacts in the quarter licenses 120 contributing developers, not 180.

Each platform edition carries an included base — 50 contributing developers on Enterprise X and 200 on Enterprise + — and additional developers are purchased separately. The Unified Security and Ultimate Security bundles start at 200 developers.

There is no single list value because sizing changes the outcome: contributing developer count, chosen modules, the Artifactory edition in use, contract term and whether it is a new purchase or a renewal. To buy JFrog Xray in Brazil, OSB Software maps that scope with you, sends the commercial proposal, issues the Brazilian invoice and delivers the licenses — request a quote to get the exact figure for your scenario.

Frequently asked questions about JFrog Xray

Do I need Artifactory to use Xray? Yes. Xray analyzes artifacts stored in Artifactory and is not sold as a standalone product — the Artifactory edition determines which capabilities are available.

Who counts as a Contributing Developer? Anyone who contributed to a scanned artifact or project in the last 90 days. Whoever touched nothing scanned in the period is out of the count, and working across several projects does not multiply it.

Which SBOM formats does Xray generate? CycloneDX and SPDX. CycloneDX is the default for Release Bundles and carries VEX data; the format can be switched to SPDX in the system configuration.

Does Xray scan machine learning models? Yes. Scanning covers ML models and IDE extensions beyond traditional packages, applying the same license and security policies.

Does Xray need its own database? On self-managed installations, yes: it requires PostgreSQL and a dedicated server, separate Artifactory. In the managed model JFrog handles this.

Why buy JFrog Xray OSB Software?

OSB Software is an official JFrog Ltd partner in Brazil and supplies 100% genuine JFrog Xray licenses to companies, with Brazilian invoicing, local contracting in Portuguese and full legal compliance — the safe way to buy imported software under a Brazilian corporate entity, with no risk of irregular licensing.

When you buy JFrog Xray OSB Software, you get:

• Consultative, specialist support — specialists who size your contributing developer licensing to your actual operation, avoiding over- or under-buying.
• Fast, secure processes — purchase order to delivery of genuine licenses, traceable at every step.
• Dedicated commercial follow-up — quote to delivery and renewal, with advance notice before your license expires.
• Invoicing that fits your company — Brazilian invoicing and terms adapted to your corporate procurement process.
• Proven track record — thousands of customers served across Brazil.

If you are looking for where to buy JFrog Xray in Brazil with legal certainty and properly licensed imported software, request a quote: OSB Software delivers reliable technology, qualified support and a simple, transparent purchase.