This global technology company has tens of thousands of employees and millions of customers. It builds electronic and industrial products for consumer and enterprise markets. Its European regional headquarters ships a wide range of software, including business and creative applications, device management, image processing, and SDK and API tools.

The company used JFrog Xray to find and manage vulnerable packages, but cumbersome processes meant that it never got wide adoption. Xray had to be set up package by package, which took a lot of internal time and required support from JFrog. As a result, only 10-20% of projects were being scanned.

Where scanning was running, the results were hard to act on. Even with policies limited to high and critical vulnerabilities, Xray returned long lists of findings and engineers had to investigate each one to decide whether it applied to their project. The results didn’t always line up with other tools either. For npm packages, npm audit and Xray reported different statuses.

The security team wanted fuller vulnerability data and control over package licenses so that non-compliant packages stayed out of the supply chain. The EU Cyber Resilience Act (CRA) added a deadline. The company needs to produce and share SBOMs for its software by 2027.

The team wanted scanning that was easy to roll out everywhere, policy that was enforced automatically, and results developers could act on without leaving their workflow.

With high operational costs, limited adoption of Xray, inconsistent vulnerability scanning results, and slow onboarding, the existing on-premises JFrog setup was becoming a point of frustration. The company needed a cloud-native platform that delivered easy-to-implement scanning, enforced policy at scale, and provided actionable insights for developers, embedded in their workflows.

Running an on-premises platform with partial scanning left the company exposed, so they wanted to move fast. Working with the Cloudsmith team, they moved their artifacts out of JFrog and into Cloudsmith’s cloud-native repositories in about six weeks, without disrupting ongoing development. The migration eliminated infrastructure overhead and immediately provided developers with a fully managed, modern artifact platform, enabling them to continue building securely and efficiently.

Cloudsmith identifies risks in packages without requiring per-package configuration. Engineers open a repository and see which packages are vulnerable or malicious.

Security intelligence is continuously refreshed from the Open Source Vulnerabilities (OSV) database, so risk detection is current across repositories.

The company uses Cloudsmith’s policy management, built on Open Policy Agent (OPA), to write its security and license rules as code:

• High and critical vulnerabilities are quarantined automatically
• Lower-risk CVEs are tracked as new data comes in
• License policies block or flag packages with licenses the company doesn’t allow, such as copyleft

Teams are now moving their projects to connected repositories. A single shared repository pulls from public upstreams and holds one security policy, and project repositories draw from it. Vulnerable packages are blocked during development, long before release. One policy, managed in one place, covers every team on the shared repository.

Cloudsmith integrates with Bitbucket Pipelines, so policy checks run in the same builds developers already use. Developers get feedback where they work and don’t have to manage security configuration themselves.

The organization wanted to decommission their costly JFrog on-prem solution as soon as possible, because they felt exposed on the security front due to inadequate scanning. Switching to Cloudsmith provided stronger protection and immediate peace of mind. Leveraging Cloudsmith’s Migration Toolkit, they successfully moved to Cloudsmith’s cloud-based repositories without disruption to ongoing development. The migration eliminated infrastructure overhead and immediately provided developers with a fully managed, modern artifact platform, enabling them to continue building securely and efficiently.

The move from JFrog to Cloudsmith delivered measurable improvements for this organization across security, compliance, and developer productivity.

• Vulnerability scanning on 100% of projects, up from 10–20%
• Off JFrog in about six weeks, with no on-premises infrastructure left to run
• One set of security and license policies across Docker, Maven, npm, NuGet, and Raw
• Vulnerable packages caught during development, not after release
• Less time reconciling scan results, because every team works from the same continuously updated data
• With every project covered and policy enforced in one place, the company’s engineering and security teams ship software with confidence that it meets their standards