We've been running Xray on-prem for years. Recently evaluated the cloud SaaS version. The core scanning engine is identical. The "catch" is in the operational and compliance overhead.
On-prem:
* You manage the queue, storage for scan data, and scaling.
* Network egress for external DBs (NVD, etc.) is your problem.
* Full control over scan timing and resource isolation.
Cloud:
* Simpler deployment, but you're shipping all your artifact metadata and SBOMs externally.
* The API latency for large scans is noticeable if your registry isn't in the same cloud region.
* You lose fine-grained control. Can't pin the scanner version for a compliance freeze.
Main issue: If you're in a regulated industry, the cloud model might not pass internal audit. You're relying on JFrog's SOC2 report, not your own controls. The data residency clauses matter.
Example config difference for a high-volume pipeline:
On-prem worker config:
```yaml
xray:
persistence:
enabled: true
size: 500Gi
resources:
requests:
memory: "8Gi"
cpu: "2000m"
```
Cloud: You get whatever tier you pay for. Burst scanning during a CI rush hour will hit throttling.
Bottom line: Cloud is easier for greenfield. On-prem is mandatory if you have strict data sovereignty or need to scan air-gapped networks. The cost model shifts from CapEx to OpEx, but total cost isn't always lower.
-dk
Trust but verify, then don't trust.
I'm a DevOps engineer at a mid-sized fintech, managing about 200 services. We run a self-hosted Artifactory with Xray on-prem for scanning our container images and npm packages.
Based on our own evaluation last quarter:
1. **Total Cost:** On-prem was roughly 40% cheaper at our scale. Cloud list price started around $8k/month for our volume, not including the Azure egress costs for pulling artifacts to their scanner. Our on-prem hardware and storage amortizes to about $5k.
2. **Scan Latency:** Cloud scans added 2-3 seconds per image on average. For our large pipeline (300+ builds/day), that added up. On-prem, scanning is sub-second because it's on the same local network as the registry.
3. **Compliance Control:** This was the dealbreaker for us. On-prem lets us freeze versions for audit cycles. With cloud, you take their updates on their schedule. Our security team required a specific, immutable scanner version for PCI-DSS compliance.
4. **Operational Load:** Cloud wins easily. We spend maybe 5 hours a week managing the on-prem Xray VMs, queues, and database. The cloud version would be nearly zero. But, we can't tailor the resource limits for our big weekly scans.
I'd pick on-prem for any regulated industry or if you have over 50 developers. If you're a SaaS company in a non-regulated space and want to reduce ops work, cloud is fine. To decide, you need to tell us your compliance requirements and your average number of daily builds.
CloudNewbie
Your point about shipping artifact metadata externally is spot on. That's often the hidden hurdle for orgs with strict data governance. They see "scanning" as the main event, but the data residency requirements for SBOMs and dependencies can be a separate, bigger fight internally.
The compliance freeze aspect is another practical headache. Even outside heavily regulated industries, some engineering teams need to lock tool versions for a major release cycle. Losing that ability creates real friction.
I've seen teams try to hybrid it - keep the critical, audited pipelines on-prem and use cloud for experimental work. The operational split usually ends up costing more in management time, though.
Keep it constructive.
Spot on about the audit reliance shifting from your controls to their SOC2 report. That's the classic vendor sleight of hand, isn't it? They sell "simplicity" but what they're really selling is a transfer of accountability. Your security team now has to vet a third-party's paperwork instead of verifying your own infrastructure.
You mentioned the config difference, and that's where the real cost hides. The cloud tier you buy today gets you a certain throughput. Try running a massive remediation scan across your entire artifact history next quarter and watch the performance cliff. Suddenly you're on a call with their sales engineer discussing a "more suitable" enterprise plan.
And let's not pretend data residency is just a regulated industry problem. Any company with a decent GDPR playbook is going to have the same internal fight about shipping SBOMs externally. That operational overhead you avoid at deployment comes roaring back as legal and compliance review cycles.
Trust but verify.