I've just gone through the process of evaluating JFrog Xray for a potential migration from our current SCA/SBOM tooling, and the experience was... illuminating, in the way that staring directly into a floodlight is illuminating. I'm posting this because the journey from "interested" to "actually understanding what this will cost and entail" is far more convoluted than it should be for a product in this space.
The initial sign-up and "try now" flow is standard. You give them your details, they spin up a free trial instance in their cloud. The first reality check comes immediately: the trial is for the **entire JFrog Platform**, not just Xray. This is a double-edged sword. Good for integration testing, but overwhelming if you just want to scope out vulnerability scanning. The dashboard hits you with a dozen tiles for Artifactory, Pipelines, Distribution—it's easy to get lost. To even find Xray, you have to navigate to **Administration → Xray → Security & Compliance**. Not exactly intuitive.
Now, the pricing black box. You will not see a number anywhere. The "Pricing" page on the main site is just marketing speak about tiers. To get actual numbers, you must engage with sales. After several emails and a call, the model became clear, and it's the first major hurdle. Licensing is primarily based on **Artifactory storage** (the data you're scanning) and **number of developers**. This means your cost is tied to two metrics that may have nothing to do with your actual scanning workload. If you have terabytes of legacy binaries in Artifactory, you're paying for Xray to scan them, even if you only care about new container images in your CI pipeline. The "Enterprise" tier, which you'll need for any meaningful policy enforcement and CI/CD integration, starts at a significant five-figure annual commitment.
The setup to make it do something useful is non-trivial. Out of the box, it does nothing. You must first:
* Connect Xray to your Artifactory repositories (logical, but another config step).
* Configure **Watch** policies to define what repositories are scanned and how often.
* Set up **Policy** rules with a combination of security severity, license compliance, and operational risk criteria.
* Configure **Webhooks** or integration with your CI server (Jenkins, etc.) to break builds.
A minimal policy configuration for a Docker repository might look like this in the UI, but think of the maintenance overhead across hundreds of repos:
- **Watch:** `docker-prod-local`
- **Policy:** `Block High Severity CVEs`
- Rule: `Security` -> `Min Severity: High` -> `Fail on new violations`
- **Policy:** `Block Prohibited Licenses`
- Rule: `License` -> `Banned Licenses: GPL-3.0, AGPL-3.0` -> `Fail on new violations`
The scanning itself is fast and the database is comprehensive. However, the noise level is high. You'll get thousands of findings on your first full scan of existing artifacts, and triaging this is a project in itself. The real pain point becomes apparent when you try to automate responses. Fine-grained control requires diving into their REST API, as the UI can only take you so far.
My verdict on the sign-up and setup experience: It's a heavyweight enterprise process designed for organizations already bought into the JFrog ecosystem. If you're not using Artifactory as your primary binary repository, the friction and cost likely don't make sense. The tool is powerful, but the barrier to entry—both in cost and configuration complexity—is substantial. Be prepared for a long evaluation cycle and a significant implementation phase.
---
Been there, migrated that