By submitting this form, you agree to our 

Answer twenty questions about your artifact and supply chain practices. Get a custom report card showing your maturity score against key regulatory and compliance frameworks.

Artifact Security Maturity Assessment

The enterprise artifact management market - which has belonged for a while to JFrog and Sonatype - is now 

Cloudsmith was built on the core principle that 

. So does simplicity in design and workflow. Partnerships matter, too. We’ve built a comprehensive platform that controls and secures every artifact as it’s built, scanned, signed, stored, and shipped across the software supply chain. We’ve tailored our product to the specific needs of large organizations, which support hundreds of software development teams, rely on a huge range of languages and formats, operate at massive scale, and need to ensure the provenance and integrity of artifacts entering their supply chain.

Our work is paying off. Today our product helps Fortune 500 and Global 2000 corporations, as well as independent software companies, build and distribute their software more securely and efficiently. Many of these customers migrated to Cloudsmith from the two primary legacy solutions on the market - JFrog’s Artifactory, and Sonatype’s Nexus. These customers came to us because they ran into challenges scaling to ever-increasing DevSecOps demands. They asked for a fully managed platform that just works, so they can focus on building software, not infrastructure, CDNs, or clusters. And they recognized Cloudsmith as a fresh, modern, developer-friendly, API-first experience. Cloudsmith is infrastructure you don’t have to think about.

A successful startup transitions into scale-up mode when it solves customer problems in new and innovative ways, and starts to win real market share. Cloudsmith has arrived here. We 

closed our Series B with TCV and Insight Partners

 earlier this year to fund our growth. We’re seeing incumbents take notice. We’re seeing analyst firms like Gartner and Forrester recognizing Cloudsmith as a new and legitimate candidate for enterprises with complex needs. JFrog CFO Ed Grabscheid confirmed our growing market share when he 

told investors at a Bank of America conference

 on June 5 that they see two main competitors: Sonatype and a “

very, very small startup that is a cloud-native tool… not even worth mentioning the name,

” I’m pretty sure he was talking about Cloudsmith.

We agree that large organizations are looking at three main options - JFrog, Sonatype, and Cloudsmith - for comprehensive artifact management. The artifact offerings from hyperscalers like Azure, AWS, and Google, as well as SDLC leaders like GitHub and GitLab, are limited to a handful of formats and use cases. They’re okay for small teams, but they’re not intended to scale across broad engineering organizations. We hear every day from JFrog and Sonatype customers who are curious if Cloudsmith is a viable alternative to their legacy vendor, and from platform engineering teams who recognize the benefits of a common internal set of universal artifact repositories.

I suppose it’s in the spirit of this head-to-head competition that 

 of our advanced security offerings. They didn’t reach out to us in advance, and appear to have based their findings on their use of a Cloudsmith self-service trial account. We would have been happy to help them make a more well-informed comparison! We think their conclusions are misleading or highly confused, and they got a lot flat-out wrong. Our solutions engineers love working with prospective Cloudsmith customers to showcase the actual capabilities of Cloudsmith, in a way that’s relevant to their company’s processes, scale, and needs.

There is one point in JFrog’s analysis of Cloudsmith that I found telling. They seem to fault our approach to artifact security scanning for relying on third-party industry vulnerability data. This outlook seems to align with JFrog’s general position on partnerships (that they’re bad for business). At that same Bank of America conference, JFrog’s CFO said that when it comes to security scanning, “

” cannot operate without having a proxy to JFrog for access to the binary artifacts, which is true. 

you could cut the oxygen off to these point solutions. We choose not to do that, but most customers see advantage to two things: consolidation, and to secure the most critical asset, which is your binary.

We just have a different philosophy. We don’t think customers want their artifact management vendor to be their only source of vulnerability data and security scanning. In other words, not all JFrog Artifactory customers want to depend solely on JFrog Xray. We know that for sure, because they’ve told us. So we’re working hard to ensure Cloudsmith works well with commercial and open source security tools like ClamAV, Trivy, and Grype, as well as data sources like EPSS and CVSS, and we regularly incorporate their data into the metadata that’s available inside Cloudsmith repositories and exposed to our Enterprise Policy Manager (EPM). In this way, Cloudsmith is the control plane and the data plane for the entire software supply chain, but we don’t think we should be the sole provider of security data. We will not - to quote JFrog - “cut the oxygen off” from our partners in the ecosystem. We feel similarly about CI/CD, runtime scanning, observability, and hardened images; solving software supply chain security works best as a team sport.

If you want to see why so many companies are turning to Cloudsmith, 

 about what a modern, scalable, cloud-native artifact platform could look like for your organization.

Glenn Weinstein

The Artifact Management Market Is Up For Grabs

1 year ago today, I became a Cloudsmither. I joined this incredible company that 

 co-founded because we have an incredible product, built for a massive market, and we were really just getting started.

, the blog stands up as a solid argument for Cloudsmith. We’re displacing legacy artifact management vendors, winning some of their largest enterprise customers with full-scale replacements across hundreds of teams with thousands of developers.

As I approached my 1-year anniversary, I asked myself what 

 makes Cloudsmith special. I landed on three particular qualities of our personality that I think are ultimately the winning qualities that will make Cloudsmith a truly great and historic company.

. Cloudsmith has been multi-tenant software-as-a-service (SaaS) from the first lines of code Lee wrote back in 2016. When your native language is cloud SaaS, you solve a different class of problems. You’re constantly optimizing for throughput, performance, and uptime. Internally, our engineers refer to the company as “Cachesmith.” I love that.

Of course, that means that when we add new edge servers, or find a clever way to serve packages, or rebuild indexes, or redistribute worker queues, or improve EFS throughput, our entire customer base benefits. Our small and mid-size customers get the same performance boost as our largest enterprise customers. Without requiring an upgrade, or a maintenance window. SaaS has been the standard in many corners of the software world for the past decade or more, but it’s still relatively rare for artifact management, in part due to sheer scale - we’re moving around data volumes measured in petabytes, after all.

Cloudsmith is constantly thinking about how to make our global package delivery network faster and more reliable, so our customers don’t have to worry about it. Our massive cloud infrastructure is a big barrier to entry; it’d be hard for a startup to compete with us anytime soon. It’s also hard for any single team, at even the largest enterprise, to compete with our level of scale and global reach. By depending on Cloudsmith to power their artifact repositories, our customers get to focus on building their own great software.

. We really care about the internals of all the different package managers. We get excited about trends across the public open-source registries. We keep up on the latest advances in security scanning, provenance, and developer-native distribution. We obsess over how our customers can make their build pipeline more efficient and how we can make it easier to migrate tools to Cloudsmith. We’re giddy about ways to stream more real-time data to our customers’ reporting and analytics tools.

. That’s another way of saying we’re customer-focused, but at Cloudsmith that manifests itself as truly proactive support. We love finding and fixing problems before our customers are even aware of them. When you build a culture that rewards the kind of intellectual curiosity I’ve described here, you’re able to run faster. Sure, we have distinct roles for our customer support engineers and our product engineers. But when a customer issue pops up in our monitoring systems, we swarm the problem. This is true DevOps—our engineering team stays close to the runtime. It’s another aspect of SaaS that legacy on-premise single-instance software companies just can’t compete with.

Cloudsmith solves a boring problem. For our core customer persona—platform engineering teams—boring is good. Platform engineering is responsible to their developer teams for getting packages where they need to go. We do this for our customers, so we’ve solved a really specific pain. Business school 101—focus on what differentiates you; outsource the rest.

 every day. Thank you to Lee and Alan for embracing me, empowering me to lead Cloudsmith, and allowing us to act as a united leadership team. And thank you to all of our customers for your trust and loyalty. We’ll do everything we can to continue to earn them. I’m always open to your feedback: 

What Makes Cloudsmith Special: Reflections on 1 Year as CEO

. In that time, I’ve learned a lot from our customers that I’d like to share.

The world needs a SaaS artifact management platform. 

Large software development teams want and need Cloudsmith. We’re the only enterprise-scale multi-tenant SaaS alternative to the two main products that have dominated market share over the past decade - JFrog Artifactory and Sonatype Nexus. Many of our customers and prospects tell us they’re anxious to switch to a cloud-native SaaS backbone that's inherently multi-tenant, where the vendor (that's us) manages one massive-scale instance that serves all customers.

There’s a real market for well-built, developer-friendly artifact management tooling.

 Our competitors are building horizontally. They’re adding native tools for things like CI/CD and security scanning. We fundamentally believe differently. We think developers want to use best-of-breed DevOps tools from vendors like Harness, CircleCI, Snyk, and Chainguard, rather than be pushed into accepting versions of these tools from their artifact management vendor. So we focus on integrating with, rather than competing against, the most innovative companies in the DevOps ecosystem. And we can do this better, because we’re SaaS.

Better artifact management is at the core of software supply chain security. So we’re laser-focused on building a truly great artifact management platform. One that developers and DevOps teams love. That’s built to work at web scale, without the infrastructure hassles. And we’re finding that developers agree!

The early appeal of Artifactory and Nexus was to provide a local copy of artifacts, just in case the original source was temporarily unavailable. That was a “nice to have,” but artifact management has morphed into a “must-have.” I’m seeing four key trends driving the elevation of this requirement -

The explosion in use of open-source software (OSS) as ingredients in the software supply chain. Where developers 10+ years ago might have used a few OSS packages here and there, today OSS makes up as much as 90% of all deployed code in production.

The rapidly growing threat environment in popular OSS registries like npm (Javascript), pypi (Python), Maven Central (Java), NuGet (.NET), and Docker Hub. Malware and other vulnerabilities are lurking all across these indexes, and the bad guys are getting smarter and more aggressive.

The rise of containerization, along with the ubiquitous use of publicly-sourced containers as building blocks.

The recognition of the need to methodically structure and control the software supply chain, leading to standards like Supply-chain Levels for Software Artifacts (

) and Secure Supply Chain Consumption Framework (

Developer-native software distribution is a game-changer.

 Many of our largest customers rely on Cloudsmith to deliver free and paid versions of their own SDKs and packages, relying on a combination of Cloudsmith repos, our global package delivery network, and our entitlement tokens to gate and monitor downloads. Our capabilities here go well beyond what’s available from traditional artifact management vendors, and it’s a natural extension of our platform since we’re already cloud-native SaaS.

“Me-too” artifact managers are nice, but you quickly outgrow them.

 We’ve seen the hyperscalers and source code platforms release their own artifact managers in recent years. But we’re finding their ambition and feature breadth to be more suited to small teams, rather than the enterprise-scale development teams Cloudsmith is built for. Using a hyperscaler-native tool like AWS CodeArtifact may be a good way to get started, but limited format support, analytics options, vulnerability scanning, and customizability seems to quickly push dev teams to look for more dedicated artifact management tools like Cloudsmith.

We’re committed to doing one thing - being the world’s software supply chain - and doing it incredibly well. 

A CEO’s Reflections: 6 Months In

 named me publicly as their new CEO. I’m joining 

, the co-founders of Cloudsmith, in building the world’s most powerful software supply chain platform.

The transition has actually been underway since I came to Cloudsmith’s HQ here in Belfast, Northern Ireland, on August 21. I’ve spent the past month meeting Cloudsmithers, our customers, and our investors. I’ve also 

, why he and Lee created the company, and what problems we’re solving for customers.

I’ve just spent the last four years as Chief Customer Officer at 

, where we served a network of millions of software developers with a broad set of communications APIs. Cloudsmith is also “by developers, for developers.” I first learned about version control systems and makefiles in the late 1990’s, but building and deploying software has become incredibly complex over the past few decades. Developers now need to master a deep stack of dependencies, and most of the bits we actually deploy are sourced from third-party libraries and other external artifacts.

Building and distributing software artifacts is core to the task of building software, and it warrants its own management control layer. Software organizations need a central approach for sourcing packages and containers from the likes of npm (JavaScript), pypi (Python), Maven Central (Java), and DockerHub (Docker), combining them with homegrown code, and distributing the resulting artifacts - which may themselves be packages or containers - to internal or external customers.

Using Cloudsmith as your software supply chain platform - controlling what comes in, and what goes out - gives you a place to plug in observability, security scanning, license checking, performance monitoring, and other value-added services to your CI/CD pipelines. And it allows you to distribute your software artifacts in a way that’s native to the developers that are consuming them - in their own CI/CD pipelines - and it lets you track and control that distribution.

This is actually not a new market. Competitors like JFrog’s Artifactory and Sonatype’s Nexus have provided artifact management for over a decade. But these legacy tools, which started out as on-premise and still today have a one-instance-per-customer model, were built for the pre-cloud generation. , Cloudsmith is the only player in the space that’s built from the ground up as a massive scale, multi-tenant Software as a Service (SaaS). This is a big reason I’ve chosen to join Cloudsmith. At 

, a startup I co-founded in 2006, we made a series of three bets that paid off in helping us build a great company - that Salesforce would displace Siebel in CRM, that Gmail would displace Exchange in corporate email, and that Workday would displace Peoplesoft in HRMS. In each case, despite serving customers increasingly poorly, the entrenched incumbent was the safe, de facto choice for most companies. But in each case, a new company built on the SaaS business model became the new standard - first slowly, then all at once, within a few years.

Cloudsmith is the next great SaaS platform that will displace seemingly comfortable incumbents that are built on yesterday’s outdated business model. We’re delivering global scale to our customers, and we’re innovating faster.

, along with a set of strong company values. I love that we are born and bred as a Northern Ireland company. I love that we are already serving an amazing set of software organizations like those at Shopify, VMware, StackOverflow, EnterpriseDB, Carta, and hundreds of others. I love that we are making the lives of software developers easier. I feel at home at Cloudsmith.

If your software organization is still running an on-premise (or “hosted”) legacy artifact management platform, or if you’re deploying production software that’s built by pulling directly from public software package indexes, or if you’re distributing your software in the form of packages to your customers’ software orgs, then 

. You’ll get a fully-featured trial edition to play with. If you REALLY want to talk to a salesperson, we have those too :) Or just contact me directly - I’d love to hear how it’s going.

A special thank you to two inspirational CEOs, 

 at Tercera, for showing me how to do the job right. I hope I can live up to their standards! And thank you to Alan, Lee, and all the Cloudsmithers for the warm welcome and the awesome onboarding thus far!

Cloudsmith Blog

The Artifact Management Market Is Up For Grabs

What Makes Cloudsmith Special: Reflections on 1 Year as CEO

A CEO’s Reflections: 6 Months In

Hi. I'm the new CEO :)