JFrog Xray is an enterprise-grade Software Composition Analysis (SCA) tool designed to help organizations identify, prioritize, and remediate security vulnerabilities and license compliance issues in open source software (OSS) and third-party components. It supports continuous scanning of repositories, build packages, and container images throughout the software development lifecycle (SDLC), enabling developers to discover and fix security and compliance issues from the start.
Key capabilities:
- Open source risk detection and remediation: Continuously scan repositories, build packages, and container images to detect security threats early, reduce risk, accelerate remediation, and save costs.
- Developer experience: Seamlessly integrates with development tools with minimal impact on build times; view vulnerable dependencies along with remediation options and context directly in the IDE/CLI; automate pipelines for dependency, container, and on-demand scanning via JFrog CLI.
- License compliance: Gain a comprehensive view of direct and indirect dependencies through automatically generated Software Bill of Materials (SBOM), discover and resolve open source license issues before they are exposed in production, create policies to enforce regulatory requirements, and generate compliance reports for all OSS licenses.
- Operational risk management: Obtain additional data on OSS components to assess operational risk, and create custom policies to block packages based on risk factors such as version age, number of contributors, maintenance frequency, number of commits, and end of life.
- CVE research and enrichment: Rely on JFrog's dedicated security research team to provide in-depth CVE discovery and vulnerability data, helping to understand actual risk, prioritize high-severity CVEs, and accelerate remediation.
- Malicious package detection: Leverage JFrog's extended database of over 4 million OSS packages (sourced from public advisories and the JFrog security research team) to automatically discover and eliminate malicious packages and components, providing actionable immediate mitigation and remediation steps.
- JFrog Threat Hub: Provides a comprehensive and detailed view of vulnerabilities and their impact on software artifacts in the environment, reducing remediation time through clear visibility and control.
Usage and integration: Xray is a core component of the JFrog Platform (alongside Artifactory), seamlessly integrates with Artifactory, and shares extensive metadata. It can scan images and build artifacts uploaded to Artifactory and capture build process metadata (build info) for further analysis. Xray supports automatic detection of security vulnerabilities and compliance issues through steps in CI pipelines (such as GitHub, Jenkins, Azure). Plugin support includes VS Code,IntelliJ, Visual Studio, PyCharm, and other mainstream IDEs. Supports multiple policies and applies them to multiple repositories. Database updates typically occur automatically once per day, with accelerated updates during security incidents.
Use cases: Suitable for teams looking to implement security and compliance scanning in DevOps pipelines, especially organizations with needs in software supply chain security, open source dependency governance, container image scanning, license compliance management, and malicious package detection.
Limitations and notes: Xray supports more than 25 package types and technologies, including Docker, Maven, PyPI, npm, and NuGet. When offered as SaaS, it has a 99.99% uptime SLA; when self-managed, it can be deployed as a high-availability cluster. Xray is included in Pro X, Enterprise X, or Enterprise+ subscriptions. More details regarding specific pricing, deployment requirements, etc. are not currently provided in the materials.