JFrog Closes the Patching Gap with Universal Zero-Touch Remediation, Bringing Leading Patching Vendors into One Source of Truth

Nico Thirion, Field CISO, JFrog

“Having a single source of truth is essential for protection in today’s AI threat landscape, but visibility is only part of the problem. It’s also an issue of speed and a shift in the type of weakness itself.”

Nico Thirion, Field CISO, JFrog

“Attackers today chain together low-severity findings and run thousands of automated attempts until one unpatched system gives them an opening. This is a different kind of challenge needing a different approach. JFrog has adapted to this new requirement by focusing on early detection, accurate determination of exposure, and zero-touch remediation that enables customers to patch in hours vs. days.”

Gal Marder, Chief Strategy Officer, JFrog

“Frontier AI is introducing a new security risk for every enterprise – dramatically shrinking the time between vulnerability discovery and exploitation. Traditional patching processes simply cannot keep pace with AI-powered autonomous adversaries, leaving many enterprises exposed.”

Gal Marder, Chief Strategy Officer, JFrog

“Eliminating this risk requires two critical capabilities: high-quality patches across software ecosystems and a universal control plane that automates remediation at the binary level. Through our collaborations with Broadcom, Chainguard, Echo, Red Hat, and other leading patch providers, we enable organizations to eliminate the risks associated with slow, manual patching by moving toward fully automated, zero-touch remediation across their software supply chains.”

Alex Burrage, Director of Product Security, Chainguard

“There’s a real tension in how the industry patches open source today. Every cloud, vendor, and security team is quietly forking the same critical dependencies with its own patch set, held behind their own paywall.”

Alex Burrage, Director of Product Security, Chainguard

“Left alone, the default outcome is a two-tiered internet – one where enterprises get security fixes before the maintainers who wrote the code even see them. The only way out is a shared layer where every fix is visible, verifiable, and portable.”

David Szegedi, Chief Architect, Red Hat

“For over three decades, Red Hat has backported security patches across thousands of packages. Lightwell scales this exact model to meet the AI-era urgency.”

David Szegedi, Chief Architect, Red Hat

“We are applying the same discipline, upstream commitment, and engineering rigor across the application layer.”

Oren Penso, Member of Technical Staff, Tanzu Division, Broadcom

“TrueSource Spring Enterprise sits at the center of enterprise Java, which makes it a prime target the moment a new exploitation technique appears.”

Oren Penso, Member of Technical Staff, Tanzu Division, Broadcom

“Our job is to get a verified, backward-compatible fix into a developer’s hands before an automated attacker can weaponize the gap. Connecting that fix directly into JFrog’s artifact workflow means teams get Broadcom’s patch and JFrog’s evidence chain in the same motion, without slowing down a release to do it.”

Eylam Milner, Co-Founder and CTO, Echo.ai

“AI has changed both the scale of software development and the speed of threats. We can’t keep asking security teams to manually triage every vulnerability or developers to spend hours updating dependencies.”

Eylam Milner, Co-Founder and CTO, Echo.ai

“We need to start with secure-by-default components and automate the patching work, so people can focus on the judgment and engineering that need their attention.”