Getting Started with JFrog Security
Learn how JFrog Security protects your software supply chain across the software development lifecycle.
Securing the End-to-End Software Supply Chain
JFrog Security is a comprehensive set of capabilities that secure your entire software supply chain from the moment code is written to when applications run in production. Built natively into the JFrog Platform, it enables teams to prevent risk early, detect issues continuously, enforce security policies consistently, and respond to threats in real time.
Rather than treating security as a collection of disconnected scans, JFrog Security provides a single, continuous security experience across development, CI/CD, artifact management, and runtime environments. For more information, see End-to-End Experience.
Why JFrog Security?
- End-to-End Protection: Security is embedded throughout the software development lifecycle (SDLC), from source code and open-source dependencies to binaries and runtime environments.
- Built into the JFrog Platform: Security operates on the same artifacts, metadata, and workflows you already use, without duplication or context switching.
- Policy-Driven and Automated: Centralized policies ensure consistent enforcement across builds, downloads, promotions, and production.
- Designed for Developers and Security Teams: Developers move fast with guardrails, while security teams retain visibility and control.
For product overviews and core concepts, see Products and Concepts.
How Does It Work
JFrog Security follows a continuous, lifecycle-based approach. Each stage builds on shared intelligence and feeds the next.
Detect
Gain visibility into source code, open-source usage, artifacts, and runtime behavior to understand what exists in your environment.
Centralize and Govern
Use Catalog, metadata, SBOMs, and policies as a shared source of truth for security decisions.
Build and Deploy
Evaluate risk during builds and promotions, ensuring only compliant components move forward.
Monitor and Respond
Continuously monitor artifacts and running applications as new risks emerge.
Improve Over Time
Insights from enforcement and runtime feed back into policies and development practices.
Where to Start?
You can choose a starting point based on your goals. Begin with any area that is most relevant to your role or use case. For hands-on onboarding, see JFrog Security Workshops.
End-to-End Experience
Understand how JFrog Security products work together across the entire SDLC, from source code to runtime.
Products and Concepts
Learn the core concepts and capabilities behind JFrog Security products such as Catalog, Curation, Xray, Advanced Security, and Runtime.
JFrog Security Workshops
Hands-on, guided onboarding for rolling out JFrog Security using proven, phased approaches.
Glossary
Get clear definitions for JFrog-specific security terms used throughout the platform and documentation.
Guides and How-Tos
Check out all the step-by-step procedures for configuring and using JFrog Security features across Source Code, Catalog, Curation, Xray, Advanced Security, and Runtime in the documentation menu.
Updated 25 days ago