After three months of running JFrog Xray across our production pipelines, I’m left with a familiar feeling: underwhelmed. Not surprised, mind you. Another tool promising "deep recursive scanning" that mostly just repackages publicly available CVE data and bills you for the privilege.
We ran it on a mid-sized environment: about 300 active Docker images, a mix of Java, Go, and Node.js, all built via self-hosted runners (because obviously). Artifactory is already our registry, so the integration was trivial. Here's the raw, unglamorous breakdown of what Xray *actually* flagged during the trial period.
**Total Scanned Components:** ~42,000
**Total Vulnerabilities Flagged:** 1,847
**Breakdown by Severity:**
* Critical: 12
* High: 143
* Medium: 1,210
* Low: 482
The critical/high ones? All of them were from known CVEs in base images (like `alpine:3.16`) or widely reported library flaws (log4j, Spring Shell). Nothing our existing, simple pipeline script pulling from the OSV database didn't already tell us.
The real "insight" was supposed to be in the dependency graphs and impact analysis. In practice, this meant a flood of medium/low-severity issues for dev dependencies in `node_modules` or transitive jars that never see the light of runtime. It creates noise, not signal. The UI pushes you to set "Watch" policies and "fail builds," which is a great way to grind development to a halt over a low-severity issue in a package used only during linting.
Our config for a "production block" policy looked like this, and it was constantly firing on nonsense:
```yaml
policy_name: "block-critical-high"
watches:
- "prod-docker-repo"
filters:
- severity: "Critical"
- severity: "High"
actions:
- block_download: true
- fail_build: true
```
The cost/benefit feels off. You're adding complexity and another layer of failure points for what is essentially a curated, vendor-locked vulnerability feed. For teams already doing basic security scanning with free tools, the jump to Xray's pricing is hard to justify unless you're fully bought into the JFrog ecosystem and need the compliance checkboxes.
It didn't find anything *wrong*, per se. It just didn't find anything we didn't already know.
null