. In that time, I’ve learned a lot from our customers that I’d like to share.

The world needs a SaaS artifact management platform. 

Large software development teams want and need Cloudsmith. We’re the only enterprise-scale multi-tenant SaaS alternative to the two main products that have dominated market share over the past decade - JFrog Artifactory and Sonatype Nexus. Many of our customers and prospects tell us they’re anxious to switch to a cloud-native SaaS backbone that's inherently multi-tenant, where the vendor (that's us) manages one massive-scale instance that serves all customers.

There’s a real market for well-built, developer-friendly artifact management tooling.

 Our competitors are building horizontally. They’re adding native tools for things like CI/CD and security scanning. We fundamentally believe differently. We think developers want to use best-of-breed DevOps tools from vendors like Harness, CircleCI, Snyk, and Chainguard, rather than be pushed into accepting versions of these tools from their artifact management vendor. So we focus on integrating with, rather than competing against, the most innovative companies in the DevOps ecosystem. And we can do this better, because we’re SaaS.

Better artifact management is at the core of software supply chain security. So we’re laser-focused on building a truly great artifact management platform. One that developers and DevOps teams love. That’s built to work at web scale, without the infrastructure hassles. And we’re finding that developers agree!

The early appeal of Artifactory and Nexus was to provide a local copy of artifacts, just in case the original source was temporarily unavailable. That was a “nice to have,” but artifact management has morphed into a “must-have.” I’m seeing four key trends driving the elevation of this requirement -

The explosion in use of open-source software (OSS) as ingredients in the software supply chain. Where developers 10+ years ago might have used a few OSS packages here and there, today OSS makes up as much as 90% of all deployed code in production.

The rapidly growing threat environment in popular OSS registries like npm (Javascript), pypi (Python), Maven Central (Java), NuGet (.NET), and Docker Hub. Malware and other vulnerabilities are lurking all across these indexes, and the bad guys are getting smarter and more aggressive.

The rise of containerization, along with the ubiquitous use of publicly-sourced containers as building blocks.

The recognition of the need to methodically structure and control the software supply chain, leading to standards like Supply-chain Levels for Software Artifacts (

) and Secure Supply Chain Consumption Framework (

Developer-native software distribution is a game-changer.

 Many of our largest customers rely on Cloudsmith to deliver free and paid versions of their own SDKs and packages, relying on a combination of Cloudsmith repos, our global package delivery network, and our entitlement tokens to gate and monitor downloads. Our capabilities here go well beyond what’s available from traditional artifact management vendors, and it’s a natural extension of our platform since we’re already cloud-native SaaS.

“Me-too” artifact managers are nice, but you quickly outgrow them.

 We’ve seen the hyperscalers and source code platforms release their own artifact managers in recent years. But we’re finding their ambition and feature breadth to be more suited to small teams, rather than the enterprise-scale development teams Cloudsmith is built for. Using a hyperscaler-native tool like AWS CodeArtifact may be a good way to get started, but limited format support, analytics options, vulnerability scanning, and customizability seems to quickly push dev teams to look for more dedicated artifact management tools like Cloudsmith.

We’re committed to doing one thing - being the world’s software supply chain - and doing it incredibly well. 

Glenn Weinstein

A CEO’s Reflections: 6 Months In

1 year ago today, I became a Cloudsmither. I joined this incredible company that 

 co-founded because we have an incredible product, built for a massive market, and we were really just getting started.

, the blog stands up as a solid argument for Cloudsmith. We’re displacing legacy artifact management vendors, winning some of their largest enterprise customers with full-scale replacements across hundreds of teams with thousands of developers.

As I approached my 1-year anniversary, I asked myself what 

 makes Cloudsmith special. I landed on three particular qualities of our personality that I think are ultimately the winning qualities that will make Cloudsmith a truly great and historic company.

. Cloudsmith has been multi-tenant software-as-a-service (SaaS) from the first lines of code Lee wrote back in 2016. When your native language is cloud SaaS, you solve a different class of problems. You’re constantly optimizing for throughput, performance, and uptime. Internally, our engineers refer to the company as “Cachesmith.” I love that.

Of course, that means that when we add new edge servers, or find a clever way to serve packages, or rebuild indexes, or redistribute worker queues, or improve EFS throughput, our entire customer base benefits. Our small and mid-size customers get the same performance boost as our largest enterprise customers. Without requiring an upgrade, or a maintenance window. SaaS has been the standard in many corners of the software world for the past decade or more, but it’s still relatively rare for artifact management, in part due to sheer scale - we’re moving around data volumes measured in petabytes, after all.

Cloudsmith is constantly thinking about how to make our global package delivery network faster and more reliable, so our customers don’t have to worry about it. Our massive cloud infrastructure is a big barrier to entry; it’d be hard for a startup to compete with us anytime soon. It’s also hard for any single team, at even the largest enterprise, to compete with our level of scale and global reach. By depending on Cloudsmith to power their artifact repositories, our customers get to focus on building their own great software.

. We really care about the internals of all the different package managers. We get excited about trends across the public open-source registries. We keep up on the latest advances in security scanning, provenance, and developer-native distribution. We obsess over how our customers can make their build pipeline more efficient and how we can make it easier to migrate tools to Cloudsmith. We’re giddy about ways to stream more real-time data to our customers’ reporting and analytics tools.

. That’s another way of saying we’re customer-focused, but at Cloudsmith that manifests itself as truly proactive support. We love finding and fixing problems before our customers are even aware of them. When you build a culture that rewards the kind of intellectual curiosity I’ve described here, you’re able to run faster. Sure, we have distinct roles for our customer support engineers and our product engineers. But when a customer issue pops up in our monitoring systems, we swarm the problem. This is true DevOps—our engineering team stays close to the runtime. It’s another aspect of SaaS that legacy on-premise single-instance software companies just can’t compete with.

Cloudsmith solves a boring problem. For our core customer persona—platform engineering teams—boring is good. Platform engineering is responsible to their developer teams for getting packages where they need to go. We do this for our customers, so we’ve solved a really specific pain. Business school 101—focus on what differentiates you; outsource the rest.

 every day. Thank you to Lee and Alan for embracing me, empowering me to lead Cloudsmith, and allowing us to act as a united leadership team. And thank you to all of our customers for your trust and loyalty. We’ll do everything we can to continue to earn them. I’m always open to your feedback: 

Cloudsmith Blog

A CEO’s Reflections: 6 Months In

What Makes Cloudsmith Special: Reflections on 1 Year as CEO