More packages. More malicious models. More attack surfaces that didn’t exist a year ago. And in the middle of all of it, organizations cut their application security tool count nearly in half. Companies truly believe they’re becoming leaner, faster, more deliberate, more in control, and doing more with less. But are they?
The 2026 report combines original threat intelligence from the JFrog Security Research team, full-year data from the JFrog Platform, and responses from over 1,500 Security and DevOps professionals across eight countries to understand where software supply chain security actually stands today, and where the governance gaps are growing faster than anyone wants to admit.
