Let's be clear: you're not just signing up for a service, you're initiating a bureaucratic courtship ritual with a vendor's sales and security teams. For a 50-person team, you're looking at the better part of a week, maybe two, before you have a functioning instance with meaningful scans. The actual click-through on their website is the fastest part.
The delay isn't in the software provisioning. It's in the process. Here's what you're really signing up for:
* **Initial Contact & Qualification:** You fill out the form. A Sales Development Rep (SDR) will contact you within a day, often same day. Their goal is to confirm you're a real 50-person team with a budget, not a student project. This call is brief.
* **The Sales Engineer (SE) Deep Dive:** This is where the clock starts ticking. The competent SEs, the ones who've actually run pipelines, will want to understand your stack. They're trying to scope your eventual license tier (Pro, Enterprise). Expect questions about:
* Your artifact types (Docker, Maven, npm, Go, etc.)
* Your approximate daily build volume and artifact storage count.
* Your existing JFrog Platform deployment (self-hosted Artifactory?) or if you're going cloud.
* Your compliance requirements (CVE, license violations, export control).
* **The Proof-of-Concept (PoC) Dance:** For a team of 50, they'll likely push a cloud trial. This is where you get your instance. But first, you'll receive a legal agreement (trial terms). This email thread alone can consume 2-3 days with legal on your side, if you have it.
* **Instance Provisioning & Configuration:** Once legal clears, you get credentials. The cloud instance is spun up in minutes. The real time sink is **configuring it to be useful**. You'll need to:
* Integrate with your source code manager (GitHub, GitLab, etc.) for build info.
* Connect to your CI system (Jenkins, GitLab CI, etc.) to enable automated scanning.
* Set up your first policies and watches. This is the core of Xray—defining rules for what constitutes a violation.
If you go self-hosted, add another week for infrastructure provisioning, navigating the system requirements, and the installation/configuration marathon. The `system.yaml` file is where dreams go to die if your storage paths are wrong.
```yaml
## Example snippet of where you'll likely spend an hour debugging
shared:
database:
type: postgresql
driver: org.postgresql.Driver
url: "postgres://:5432/xraydb?sslmode=disable"
filestore:
type: filesystem
path: "/var/opt/jfrog/xray/data" # This mount better have terabytes free.
```
Bottom line: From initial contact to having a policy that fails a build due to a critical CVE, budget **5-10 business days** for a cloud trial. It's not about the tool being slow; it's about the alignment, configuration, and security reviews inherent in adopting a platform that hooks into your entire SDLC. The sales cycle is the signup process.
-- old salt
You've nailed the process, but I'd argue the Sales Engineer call is also a scoping exercise for deployment architecture, which adds to the timeline. They need to decide if they're pushing you toward their SaaS offering (JFrog Cloud) or a self-hosted option, and that conversation hinges on your existing infra and compliance requirements. If you're already on Artifactory self-hosted, the SE will probe your Kubernetes or VM setup for the Xray node, which means you'll need internal platform team buy-in before you can even get a trial license key. That internal coordination often becomes the real bottleneck, not the vendor's process.
infrastructure is code