By submitting this form, you agree to our 

The enterprise artifact management market - which has belonged for a while to JFrog and Sonatype - is now 

Cloudsmith was built on the core principle that 

. So does simplicity in design and workflow. Partnerships matter, too. We’ve built a comprehensive platform that controls and secures every artifact as it’s built, scanned, signed, stored, and shipped across the software supply chain. We’ve tailored our product to the specific needs of large organizations, which support hundreds of software development teams, rely on a huge range of languages and formats, operate at massive scale, and need to ensure the provenance and integrity of artifacts entering their supply chain.

Our work is paying off. Today our product helps Fortune 500 and Global 2000 corporations, as well as independent software companies, build and distribute their software more securely and efficiently. Many of these customers migrated to Cloudsmith from the two primary legacy solutions on the market - JFrog’s Artifactory, and Sonatype’s Nexus. These customers came to us because they ran into challenges scaling to ever-increasing DevSecOps demands. They asked for a fully managed platform that just works, so they can focus on building software, not infrastructure, CDNs, or clusters. And they recognized Cloudsmith as a fresh, modern, developer-friendly, API-first experience. Cloudsmith is infrastructure you don’t have to think about.

A successful startup transitions into scale-up mode when it solves customer problems in new and innovative ways, and starts to win real market share. Cloudsmith has arrived here. We 

closed our Series B with TCV and Insight Partners

 earlier this year to fund our growth. We’re seeing incumbents take notice. We’re seeing analyst firms like Gartner and Forrester recognizing Cloudsmith as a new and legitimate candidate for enterprises with complex needs. JFrog CFO Ed Grabscheid confirmed our growing market share when he 

told investors at a Bank of America conference

 on June 5 that they see two main competitors: Sonatype and a “

very, very small startup that is a cloud-native tool… not even worth mentioning the name,

” I’m pretty sure he was talking about Cloudsmith.

We agree that large organizations are looking at three main options - JFrog, Sonatype, and Cloudsmith - for comprehensive artifact management. The artifact offerings from hyperscalers like Azure, AWS, and Google, as well as SDLC leaders like GitHub and GitLab, are limited to a handful of formats and use cases. They’re okay for small teams, but they’re not intended to scale across broad engineering organizations. We hear every day from JFrog and Sonatype customers who are curious if Cloudsmith is a viable alternative to their legacy vendor, and from platform engineering teams who recognize the benefits of a common internal set of universal artifact repositories.

I suppose it’s in the spirit of this head-to-head competition that 

 of our advanced security offerings. They didn’t reach out to us in advance, and appear to have based their findings on their use of a Cloudsmith self-service trial account. We would have been happy to help them make a more well-informed comparison! We think their conclusions are misleading or highly confused, and they got a lot flat-out wrong. Our solutions engineers love working with prospective Cloudsmith customers to showcase the actual capabilities of Cloudsmith, in a way that’s relevant to their company’s processes, scale, and needs.

There is one point in JFrog’s analysis of Cloudsmith that I found telling. They seem to fault our approach to artifact security scanning for relying on third-party industry vulnerability data. This outlook seems to align with JFrog’s general position on partnerships (that they’re bad for business). At that same Bank of America conference, JFrog’s CFO said that when it comes to security scanning, “

” cannot operate without having a proxy to JFrog for access to the binary artifacts, which is true. 

you could cut the oxygen off to these point solutions. We choose not to do that, but most customers see advantage to two things: consolidation, and to secure the most critical asset, which is your binary.

We just have a different philosophy. We don’t think customers want their artifact management vendor to be their only source of vulnerability data and security scanning. In other words, not all JFrog Artifactory customers want to depend solely on JFrog Xray. We know that for sure, because they’ve told us. So we’re working hard to ensure Cloudsmith works well with commercial and open source security tools like ClamAV, Trivy, and Grype, as well as data sources like EPSS and CVSS, and we regularly incorporate their data into the metadata that’s available inside Cloudsmith repositories and exposed to our Enterprise Policy Manager (EPM). In this way, Cloudsmith is the control plane and the data plane for the entire software supply chain, but we don’t think we should be the sole provider of security data. We will not - to quote JFrog - “cut the oxygen off” from our partners in the ecosystem. We feel similarly about CI/CD, runtime scanning, observability, and hardened images; solving software supply chain security works best as a team sport.

If you want to see why so many companies are turning to Cloudsmith, 

 about what a modern, scalable, cloud-native artifact platform could look like for your organization.

Glenn Weinstein

The Artifact Management Market Is Up For Grabs

. In that time, I’ve learned a lot from our customers that I’d like to share.

The world needs a SaaS artifact management platform. 

Large software development teams want and need Cloudsmith. We’re the only enterprise-scale multi-tenant SaaS alternative to the two main products that have dominated market share over the past decade - JFrog Artifactory and Sonatype Nexus. Many of our customers and prospects tell us they’re anxious to switch to a cloud-native SaaS backbone that's inherently multi-tenant, where the vendor (that's us) manages one massive-scale instance that serves all customers.

There’s a real market for well-built, developer-friendly artifact management tooling.

 Our competitors are building horizontally. They’re adding native tools for things like CI/CD and security scanning. We fundamentally believe differently. We think developers want to use best-of-breed DevOps tools from vendors like Harness, CircleCI, Snyk, and Chainguard, rather than be pushed into accepting versions of these tools from their artifact management vendor. So we focus on integrating with, rather than competing against, the most innovative companies in the DevOps ecosystem. And we can do this better, because we’re SaaS.

Better artifact management is at the core of software supply chain security. So we’re laser-focused on building a truly great artifact management platform. One that developers and DevOps teams love. That’s built to work at web scale, without the infrastructure hassles. And we’re finding that developers agree!

The early appeal of Artifactory and Nexus was to provide a local copy of artifacts, just in case the original source was temporarily unavailable. That was a “nice to have,” but artifact management has morphed into a “must-have.” I’m seeing four key trends driving the elevation of this requirement -

The explosion in use of open-source software (OSS) as ingredients in the software supply chain. Where developers 10+ years ago might have used a few OSS packages here and there, today OSS makes up as much as 90% of all deployed code in production.

The rapidly growing threat environment in popular OSS registries like npm (Javascript), pypi (Python), Maven Central (Java), NuGet (.NET), and Docker Hub. Malware and other vulnerabilities are lurking all across these indexes, and the bad guys are getting smarter and more aggressive.

The rise of containerization, along with the ubiquitous use of publicly-sourced containers as building blocks.

The recognition of the need to methodically structure and control the software supply chain, leading to standards like Supply-chain Levels for Software Artifacts (

) and Secure Supply Chain Consumption Framework (

Developer-native software distribution is a game-changer.

 Many of our largest customers rely on Cloudsmith to deliver free and paid versions of their own SDKs and packages, relying on a combination of Cloudsmith repos, our global package delivery network, and our entitlement tokens to gate and monitor downloads. Our capabilities here go well beyond what’s available from traditional artifact management vendors, and it’s a natural extension of our platform since we’re already cloud-native SaaS.

“Me-too” artifact managers are nice, but you quickly outgrow them.

 We’ve seen the hyperscalers and source code platforms release their own artifact managers in recent years. But we’re finding their ambition and feature breadth to be more suited to small teams, rather than the enterprise-scale development teams Cloudsmith is built for. Using a hyperscaler-native tool like AWS CodeArtifact may be a good way to get started, but limited format support, analytics options, vulnerability scanning, and customizability seems to quickly push dev teams to look for more dedicated artifact management tools like Cloudsmith.

We’re committed to doing one thing - being the world’s software supply chain - and doing it incredibly well. 

A CEO’s Reflections: 6 Months In

 named me publicly as their new CEO. I’m joining 

, the co-founders of Cloudsmith, in building the world’s most powerful software supply chain platform.

The transition has actually been underway since I came to Cloudsmith’s HQ here in Belfast, Northern Ireland, on August 21. I’ve spent the past month meeting Cloudsmithers, our customers, and our investors. I’ve also 

, why he and Lee created the company, and what problems we’re solving for customers.

I’ve just spent the last four years as Chief Customer Officer at 

, where we served a network of millions of software developers with a broad set of communications APIs. Cloudsmith is also “by developers, for developers.” I first learned about version control systems and makefiles in the late 1990’s, but building and deploying software has become incredibly complex over the past few decades. Developers now need to master a deep stack of dependencies, and most of the bits we actually deploy are sourced from third-party libraries and other external artifacts.

Building and distributing software artifacts is core to the task of building software, and it warrants its own management control layer. Software organizations need a central approach for sourcing packages and containers from the likes of npm (JavaScript), pypi (Python), Maven Central (Java), and DockerHub (Docker), combining them with homegrown code, and distributing the resulting artifacts - which may themselves be packages or containers - to internal or external customers.

Using Cloudsmith as your software supply chain platform - controlling what comes in, and what goes out - gives you a place to plug in observability, security scanning, license checking, performance monitoring, and other value-added services to your CI/CD pipelines. And it allows you to distribute your software artifacts in a way that’s native to the developers that are consuming them - in their own CI/CD pipelines - and it lets you track and control that distribution.

This is actually not a new market. Competitors like JFrog’s Artifactory and Sonatype’s Nexus have provided artifact management for over a decade. But these legacy tools, which started out as on-premise and still today have a one-instance-per-customer model, were built for the pre-cloud generation. , Cloudsmith is the only player in the space that’s built from the ground up as a massive scale, multi-tenant Software as a Service (SaaS). This is a big reason I’ve chosen to join Cloudsmith. At 

, a startup I co-founded in 2006, we made a series of three bets that paid off in helping us build a great company - that Salesforce would displace Siebel in CRM, that Gmail would displace Exchange in corporate email, and that Workday would displace Peoplesoft in HRMS. In each case, despite serving customers increasingly poorly, the entrenched incumbent was the safe, de facto choice for most companies. But in each case, a new company built on the SaaS business model became the new standard - first slowly, then all at once, within a few years.

Cloudsmith is the next great SaaS platform that will displace seemingly comfortable incumbents that are built on yesterday’s outdated business model. We’re delivering global scale to our customers, and we’re innovating faster.

, along with a set of strong company values. I love that we are born and bred as a Northern Ireland company. I love that we are already serving an amazing set of software organizations like those at Shopify, VMware, StackOverflow, EnterpriseDB, Carta, and hundreds of others. I love that we are making the lives of software developers easier. I feel at home at Cloudsmith.

If your software organization is still running an on-premise (or “hosted”) legacy artifact management platform, or if you’re deploying production software that’s built by pulling directly from public software package indexes, or if you’re distributing your software in the form of packages to your customers’ software orgs, then 

. You’ll get a fully-featured trial edition to play with. If you REALLY want to talk to a salesperson, we have those too :) Or just contact me directly - I’d love to hear how it’s going.

A special thank you to two inspirational CEOs, 

 at Tercera, for showing me how to do the job right. I hope I can live up to their standards! And thank you to Alan, Lee, and all the Cloudsmithers for the warm welcome and the awesome onboarding thus far!

Cloudsmith Blog

The Artifact Management Market Is Up For Grabs

A CEO’s Reflections: 6 Months In

Hi. I'm the new CEO :)