Arena: Market Conditions Before Sonatype
Enterprise software development teams · 2008 · United States
Changing technical requirements
In 2008 an enterprise Java team built its software from open-source components fetched from public repositories, plus components its own developers made JFX-2 SO2. Companies either let developers pull freely from outside repositories and then loaded approved artifacts by hand into an internal repository for official builds, or blocked outside access entirely; in both cases the manual loading was tedious and error-prone SO2. As teams took up more languages and containers, their components arrived in many formats, npm, Python and Ruby packages, .NET libraries and Docker images among them JFX-6. No company worked in a single development environment, and each format came with its own dedicated tool, such as Docker's registry for containers JFX-3. A team needed one place to store, approve and release components across every language it used.
How each step happened
Step 1 of 5 · 2006–16
A repository built for Maven first
JFrog's founders built Artifactory to hold every kind of software package a company used. They open-sourced it in 2006 and founded JFrog around it in 2008 JFX-1, and were adding npm and Debian support in 2014 JFX-14. JFrog's 2020 annual report calls Artifactory the world's first universal package repository JF5. Chief executive Shlomi Ben Haim argued in 2016 that no company works in a single development environment, and named single-format tools, Maven for Java and Docker's registry, as the main competition JFX-3.
Sonatype started from one format. Founder Jason van Zyl had developed Apache Maven, and in 2008 the company's chief executive described Nexus as the product that manages the Maven repository JFX-2. Nexus 1.1 that November opened the architecture to plugins SO1, and the first paid plugins added staging and promotion of releases, a procurement repository serving only approved artifacts, and LDAP sign-in SO2. Nexus Repository 3, released in April 2016, put free support for npm, PyPI, NuGet, RubyGems, Bower and a private Docker registry beside Java in one product JFX-6.
Rivals JFrog open-sourced Artifactory in 2006 as a repository for every package type and was adding npm and Debian support in 2014 JFX-1 JFX-14.
CoverageDeveloper-First Strategy
Step 2 of 5 · 2008–18
Wide free use, a $3,000 paid edition
JFrog let developers start free and charged once use spread. Customers could begin with open-source Artifactory, usage-capped freemium products or a trial of the full platform, and upgraded as new teams or uses adopted it JF5. By 2020 JFrog still relied on self-service and inbound sales JF5. Paying customers rose from more than 2,500 in July 2016 to 4,500 in October 2018 and about 6,050 at the end of 2020 JFX-4 JFX-7 JF5.
Sonatype also had broad free use. In 2008 thousands of companies ran the open-source versions, and Nexus Professional cost $3,000 a year JFX-2. In 2016 Nexus counted more than 100,000 active installations, against 60,000 installations for Artifactory JFX-6 JFX-4. In September 2018 Sonatype said Nexus served 1,000 enterprises; a month later JFrog reported 4,500 customers SNTX-5 JFX-7. Maven Central, which Sonatype ran free, served over 1 trillion downloads in the year before June 2024, about 75% of it to hyperscale cloud customers; co-founder Brian Fox announced throttling of the heaviest users and in 2026 called for mandatory payment from high-volume users SNTX-7 SNTX-8. In late 2016 OpenMRS moved off Nexus to a free Artifactory Cloud instance JFrog offered SNTX-6.
Rivals JFrog sold through open source, freemium and trials with no significant outbound sales force, and had about 6,050 customers at the end of 2020 JF5.
Freemium ModelProduct-Led Sales
Step 3 of 5 · 2018–19
Majority stake sold to Vista
JFrog priced Artifactory so the bill grew with the customer's use. Its tiers, from Pro to Enterprise Plus, kept Artifactory at the core, added products at each level and were priced by servers or usage JF5. Enterprise Plus grew from about 10% of revenue in 2019 to about 20% in 2020, net dollar retention was 133% at the end of 2020, and revenue rose from $63.5 million in 2018 to $150.8 million in 2020 JF5. Its September 2020 IPO, priced at $44 a share, valued it at $3.9 billion JFX-8 JFX-9.
Sonatype raised growth capital too, then sold a majority stake. TPG invested $80 million in September 2018, when first-half sales were up 81% SNTX-5. In November 2019 Sonatype agreed to a majority investment from Vista Equity Partners on undisclosed terms, citing revenue growth close to 250% over three years and over 1,000 enterprise customers SO3 JFX-10. JFrog used the new owner as a sales argument: a December 2019 post questioned whether a firm that bought and resold companies would keep investing in Nexus, and promised to cover the remaining contract costs of customers moving from Nexus before year-end SNTX-1.
Rivals JFrog priced its tiers by servers or usage, reported 133% net dollar retention for 2020 and went public that September at a $3.9 billion valuation JF5 JFX-9.
Usage-Based PricingMulti-Product
Step 4 of 5 · 2013–22
Security sold as its own product line
Both companies sold security on top of a repository, and JFrog sold it to a larger base of paying accounts JF5 JFX-16. Its Xray, launched in July 2016, combined security databases with metadata from Artifactory to map a project's full dependency graph JFX-4. Advanced Security and Curation followed in 2023; at the end of 2025 they made up over 10% of ARR, sold as a bundle add-on to enterprise subscriptions, and JFrog said cohort data showed customers that added security expanding into broader product use JF4.
Sonatype moved first and built its paid products around component risk. Component Lifecycle Management, announced in April 2013, applied security, licensing and quality data to open-source components and integrated with the repository manager JFX-5. By 2019 Sonatype called itself a software supply chain automation company, selling Nexus Repository, Lifecycle and Firewall on its component data, Nexus Intelligence SO3 SO4. Its blog warned that open-source components "all age like milk, not like wine" SO4. In January 2022 it passed $100 million of ARR, with more than 2,000 organizations relying on it JFX-16, and first-half 2022 sales rose 50% SNTX-3.
Rivals JFrog launched Xray on Artifactory's metadata in July 2016 and by 2025 sold its newer security products as a bundle add-on to enterprise subscriptions JFX-4 JF4.
PlatformizationMulti-Product
Step 5 of 5 · 2022–25
About 2,000 organizations, 2022 to 2025
JFrog's customers kept building on Artifactory after the first purchase. Its 2020 annual report calls Artifactory the single source of truth for an organization's packages and says its integrations drive stickiness JF5; Howard Chen's analysis of its IPO filing adds the workflows and stored binaries built on it JF2. In 2025 net dollar retention was 119%, 1,168 customers paid more than $100,000 in ARR, and revenue reached $531.8 million JF3. The repository for every package type from step 1 now also carried JFrog's security products and AI models JF4.
Sonatype described roughly the same 2,000 customer organizations from 2022 to 2025. A May 2023 restructuring cut about 14% of staff and aimed the company at cloud, a higher renewal rate and strategic new logos SNTX-2. In February 2025 Sonatype put usage limits on its new free Community Edition, above 200,000 requests or 100,000 components, and asked the largest 5% of those instances to move to the paid Pro edition JFX-13. When Bhagwat Swaroop succeeded Wayne Jackson as chief executive in July 2025, Sonatype cited nearly 2,000 organizations, against more than 2,000 in January 2022 SNTX-4 JFX-16.
Rivals JFrog reported 119% net dollar retention and $531.8 million of revenue for 2025, with 1,168 customers above $100,000 in ARR JF3.