SECURITY ATLAS / EVALUATION BRIEF JFrog Xray, Advanced Security, and Curation Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/jfrog-security/ THE ATLAS TAKE JFrog Xray, Advanced Security, and Curation cover related but different jobs around software artifacts and dependencies. Xray findings and policy watches are not the same as advanced contextual analysis, and package admission through Curation is another control point. Atlas analysis: the strongest fit is an organization willing to make its artifact and dependency path authoritative. Evaluate the route software actually takes through repositories and builds. A policy can only govern traffic and artifacts that encounter it, while a contextual result needs supported evidence before a finding is suppressed. SCOPE What Artifactory and Xray already cover, Advanced Security add-on entitlements, repository policy latency, and metadata or source handling must be confirmed. Registry policy is not builder isolation, and a signature elsewhere does not replace Xray's artifact analysis. WORTH A LOOK WHEN Teams using artifact repositories as a control point for dependency risk, build policy, and software promotion. THINK TWICE WHEN Developers can bypass the controlled repository path or the team assumes Xray includes every Advanced Security and Curation feature. IMPLEMENTATION 1. Map the authoritative artifact route Identify remote repositories, mirrors, caches, direct internet access, and release promotion. 2. Select controls by stage Separate package admission, stored-artifact analysis, and developer source checks. 3. Define exceptions and rechecks Assign owners for blocked builds, contextual suppressions, and vulnerabilities appearing after release. OPERATING REALITY Repository routing, indexing coverage, watches, policy ownership, and build integration require maintenance. Atlas analysis: separate blocking a newly requested package from investigating a vulnerability in an existing deployed artifact. Both are useful, but they need different exception, retest, and developer communication workflows. COMMERCIAL CONSIDERATIONS Quote Xray, Advanced Security, and Curation explicitly against the deployment and expected artifact usage. - Required security products and license package - Artifact and repository deployment footprint - Build integration, storage, and policy operations EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Test dependency admission Acceptance evidence: Request an approved blocked test package through the controlled route and capture the developer outcome. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Trace a binary finding Acceptance evidence: Link a vulnerability to the stored artifact digest and the release that contains it. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Challenge contextual suppression Acceptance evidence: Change a supported lab usage condition and verify whether the applicability decision and policy result change. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - What does Xray already cover on this Artifactory instance without Advanced Security? - Is the Advanced Security add-on entitled under Enterprise X or Enterprise+, and which of SAST, secrets, and infrastructure as code are included? - How long after a package is ingested does Curation or Xray policy actually block or alert, and what source metadata is retained? EVIDENCE GAPS - No independent applicability or package-blocking accuracy measurement was performed. - Supported ecosystems and final add-on entitlement require deployment-specific confirmation. SOURCES JFrog security API lifecycle (Documentation) https://docs.jfrog.com/security/reference/about-security-apis Advanced Security scope and licensing (Documentation) https://docs.jfrog.com/security/docs/advanced-security Contextual analysis policies (Documentation) https://docs.jfrog.com/security/docs/contextual-analysis-policy Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.