End-to-End Experience

Who Is This Experience For?

This end-to-end journey is for multiple roles working together:

• Platform and security admins: Define policies, configure enforcement, and keep the organization compliant.
• Developers: Consume secure packages, fix issues early, and move fast without friction.
• DevSecOps and platform engineers: Integrate security into CI/CD pipelines and runtime environments.

Each of the following stages highlights what happens, why it matters, and who is involved.

---

The JFrog Security Foundation: One Source of Truth

At the core of JFrog Security is a unified security data model built on the JFrog Platform:

• Artifacts and packages: stored and managed in JFrog Artifactory.
• JFrog Catalog: Identifies, enriches, and classifies open-source packages used across the organization.
• Metadata: Includes vulnerabilities, licenses, and package attributes.
• Software bills of materials (SBOMs): Generated automatically or imported.
• Policies: Define what is allowed, blocked, or monitored.

This foundation makes sure that every security decision, in development, CI/CD, or production, is based on the same trusted data.

---

The End-to-End Security Journey

1. Prevent Risk in First-Party Code

Capability: Source Code

• What happens: Developers scan source code to detect security issues early in the development lifecycle.
• Why it matters: Fixing vulnerabilities in code before it is built or deployed significantly reduces cost and risk.
• Who is involved: Developers, with guardrails defined by security teams.

JFrog Security integrates into developer workflows and CI pipelines, helping teams address issues before they become part of an artifact.

---

2. Identify and Understand Open-Source Usage

Capability: Catalog

• What happens: JFrog Catalog identifies, enriches, and tracks open-source packages used across builds and repositories.
• Why it matters: Organizations can't secure what they don't know they're using.
• Who is involved: Platform and security teams.

JFrog Catalog provides visibility into package usage and enriches packages with security and license context. This shared intelligence is used by downstream security controls to make consistent policy decisions.

---

3. Control Open-Source Dependencies Before They Enter

Capability: Curation

• What happens: JFrog Curation approves or blocks open-source packages before they are downloaded, based on security and license policies.
• Why it matters: Most applications rely heavily on third-party dependencies, which are a major source of supply chain risk.
• Who is involved: Security admins define policies. Developers automatically consume approved components.

Curation ensures that only trusted, policy-compliant packages are introduced into your builds.

---

4. Detect Risk in Built Artifacts

Capability: Xray

• What happens: JFrog Xray continuously scans artifacts and builds for vulnerabilities, license violations, and malicious content.
• Why it matters: Risk can be introduced at build time through dependency updates or configuration changes.
• Who is involved: DevSecOps teams and security admins.

Xray analyzes binaries in context and ties actionable findings directly to artifacts and builds.

---

5. Enforce Security Policies Across the Pipeline

Capability: Policy Enforcement

• What happens: JFrog Security enforces security policies across multiple control points, including:

  • Dependency resolution
  • Build promotion
  • Artifact download

• Why it matters: A single policy definition ensures consistent enforcement without duplicating rules.

• Who is involved: Security admins define policies. Enforcement happens automatically.

At this stage, teams can choose how to respond when issues are found:

• Block the action. For more information, see Create Policies, Xray, and Create Advanced Security Policies.
• Allow with conditions, for example by using Curation waivers.
• Automatically select a compliant version with Curation.

---

6. Understand What You Are Shipping

Capability: SBOM

• What happens: JFrog generates software bills of materials (SBOMs), enriches them, and associates them with artifacts.
• Why it matters: SBOMs provide transparency for compliance, audits, and downstream consumers.
• Who is involved: Security, compliance, and legal teams.

JFrog SBOMs are continuously enriched with vulnerability and license data, ensuring they remain accurate over time.

---

7. Deep Security Analysis Before Deployment

Capability: Advanced Security

• What happens: Additional scans detect exposed secrets and insecure infrastructure-as-code (IaC), and they prioritize vulnerabilities using contextual analysis.
• Why it matters: Not all vulnerabilities pose the same risk. Context helps teams focus on what truly matters.
• Who is involved: Security and DevSecOps teams.

JFrog Advanced Security provides deeper insight beyond a traditional common vulnerabilities and exposures (CVE) scan.

---

8. Monitor and Protect Applications at Runtime

Capability: Runtime

• What happens: JFrog Runtime monitors running applications for suspicious behavior and exploitation attempts.
• Why it matters: Some risks only emerge in production environments.
• Who is involved: Security and operations teams.

JFrog Runtime extends protection beyond build and deployment into live environments.

---

9. Close the Loop: Learn and Improve

Capability: Continuous Feedback

• What happens: Insights from scans and runtime monitoring feed back into policies and development practices.
• Why it matters: Security improves continuously as teams learn from real-world usage.
• Who is involved: All roles.

This feedback loop ensures JFrog Security is not a one-time setup, but an evolving system that adapts to new risks.

---

Map Your Security Goals to JFrog Capabilities

The following table maps common software supply chain security goals to the JFrog Security capabilities and products that address them. Use it to identify the area most relevant to you, and then continue with the recommended next step.

Recommended Next Steps

Choose the path that best matches your immediate security goal:

Prevent Risky Dependencies from Entering Your Environment

Start with the JFrog Curation onboarding guide to define policies that control which open-source packages developers can use and prevent risky dependencies from being introduced.

For more information, see Curation Workshop.

Detect Vulnerabilities and License Issues in Builds and Artifacts

Continue with the JFrog Xray onboarding guide to scan artifacts and builds, generate and enrich SBOMs, and manage security findings across your CI/CD pipeline.

For more information, see Xray Workshop.

Learn the Core Security Concepts Before Configuring

Read about policies, enforcement points, and SBOMs before getting hands-on.

For more information, see Products/Concepts.

Get Familiar with JFrog Security Terminology

If you're new to JFrog Security or want quick clarification on terms used throughout the documentation, you can review the Glossary for concise definitions of key concepts and capabilities.

For more information, see Glossary.

Related Topics

• Getting Started with JFrog Security
• JFrog Security Implementation Guides
• Watches in JFrog Xray