JFrog Xray vs Legit Security comparison

Read 4 Legit Security reviews

827 Views
554 Comparison Views

100% willing to recommend

JFrog Xray

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jun 29, 2025

JFrog Xray and Legit Security compete in the security and vulnerability management category. JFrog Xray integrates robustly with DevOps tools, while Legit Security takes a more holistic approach with its infrastructure and code security. Each has strengths and addresses different aspects based on user needs.

Features: JFrog Xray provides comprehensive artifact scanning, deep CI/CD tool integration, and prioritization of vulnerabilities. Its integration with Artifactory allows seamless onboarding and management of dependencies. Legit Security offers continuous security policy monitoring, visibility across the development environment, and integration with multiple tools like GitHub and Jenkins, enhancing its infrastructure security.

Room for Improvement: JFrog Xray could benefit from enhancing its user interface and extending support for more external tools beyond Artifactory. Users have indicated room for improving its scanning speed and reducing false positives. Legit Security can improve its secret detection feature, experiencing a 10-20% false-positive rate. Streamlining the integration process further and enhancing the analysis of unmaintained repositories would help bolster its offering.

Ease of Deployment and Customer Service: JFrog Xray enables efficient deployment within DevOps pipelines with clear documentation and reliable support for troubleshooting. Legit Security provides adaptable deployment options catering to different environments, with a focus on proactive, personalized customer service for an enhanced customer experience.

Pricing and ROI: JFrog Xray offers a competitive structure with lower upfront costs, appealing for budget-conscious users, enhancing ROI by saving time in vulnerability management. Although Legit Security may involve higher initial costs, it provides considerable ROI through extensive security functionality and risk reduction.

To learn more, read our detailed JFrog Xray vs. Legit Security Report (Updated: September 2025).

JFrog Xray vs. Legit Security

Download the complete report

Helped 869,202 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

JFrog Xray

Ranking in Software Supply Chain Security

2nd

Average Rating

7.8

Reviews Sentiment

6.3

Number of Reviews

Ranking in other categories

Vulnerability Management (36th), Container Security (16th), Software Composition Analysis (SCA) (6th)

Legit Security

Ranking in Software Supply Chain Security

7th

Average Rating

10.0

Reviews Sentiment

7.8

Number of Reviews

Ranking in other categories

Application Security Posture Management (ASPM) (5th)

Mindshare comparison

As of October 2025, in the Software Supply Chain Security category, the mindshare of JFrog Xray is 16.3%, down from 18.2% compared to the previous year. The mindshare of Legit Security is 4.7%, up from 4.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Software Supply Chain Security Market Share Distribution
Product	Market Share (%)
JFrog Xray	16.3%
Legit Security	4.7%
Other	79.0%

Software Supply Chain Security

Featured Reviews

Anand Nanwana

DevOps Engineer at Syvora

Offers flexibility across clouds and easy credential management while interface improvements are needed

For JFrog Xray, the Artifactory and package repositories are valuable features. There are many benefits from JFrog Xray. For example, with other registries such as ECR, we can use the images only in the AWS cloud. With JFrog, we can use this registry from any cloud or work locally as well. JFrog can support multiple packages, such as NuGet package, pip, and other technologies. It can be used for Terraform as well. The credential management is very easy in JFrog. For instance, when using GitHub action as a CI/CD tool, I just need to create a token and set up JFrog CLI there and give access to the repository. With multiple repositories, I can generate a token for a specific repository, add that token in the GitHub secret, fetch from the CI/CD, run the command JFrog CLI, and authenticate through the token. Then we can push the images into JFrog.

Read full review

Tim Crothers

CISO at Mandiant / FireEye

Provides strong visibility, straightforward integration, and reduces the risk of attacks

Legit Security is a product that hyper-focuses on the various aspects of the software development pipeline. For example, if an engineer spins off a new project and stands up a new Git project, Legit automatically detects it, connects Snyk and other tools, and ensures the engineering team doesn't have to think about it. This way, we stay on top of security from the beginning. On the other hand, Legit provides a clear view of the controls around repositories. We have standards requiring code reviews and similar practices, and Legit shows us whether these are being followed. Additionally, Legit helps us identify unmaintained repositories, which often arise when engineering teams try something and leave it behind. This knowledge allows us to determine the appropriate action for these neglected projects. One area where Legit falls short is secret detection. While it functions well overall, the feature has a 10-20 percent false positive rate, requiring some manual intervention. Almost everything else works flawlessly. The true value proposition of Legit lies not in its features but in its ability to support our product security program's focus on creating guardrails instead of toll gates. Unlike traditional programs that require security reviews at specific stages, hindering development flow, we strive to partner with the product engineering team to ship secure code seamlessly within their existing workflows. Legit plays a crucial role in this by automatically notifying us of new projects, eliminating the need for manual communication. This partnership approach, enabled by Legit, allows us to work much closer with our engineering teams than ever before.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."

"I would say that this solution has helped our organization by allowing us to automate a lot of the processes."

"With JFrog, we can use this registry from any cloud or work locally as well, and it can support multiple packages such as NuGet, pip, and other technologies including Terraform, making credential management very easy."

"If multiple dependencies and vulnerabilities are found in a project, JFrog Xray is intelligent enough to tell you which vulnerability to target first."

"The solution is stable and reliable."

"JFrog Xray shows us a list of vulnerabilities that can impact our code."

"Good reporting functionalities."

"The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features."

More JFrog Xray pros

"The true value proposition of Legit lies not in its features but in its ability to support our product security program's focus on creating guardrails instead of toll gates."

"We implemented Legit Security to gain visibility into all development teams and ensure that consistent controls are in place and accounted for on every route."

"Legit has had a positive effect on our overall security posture."

"Legit has increased my security posture to a level I couldn't achieve before. I don't need to worry as much about what's happening within my developer environments. I can rest assured that my vulnerabilities are being detected."

Cons

"Lacks deeper reporting, the ability to compare things."

"The UI of JFrog Xray could be improved. There is a dialogue box in the Xray section that doesn't always work properly."

"JFrog Xray's documentation and error logging could be improved."

"I think that the user interface should be expanded to provide customers with a better dashboard for reviewing their feedback regarding their images and the vulnerabilities that are associated with the images."

"The out-of-the-box PostgreSQL provided is not stable, which is why we are considering enterprise support."

"X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL."

"Reporting is crucial, but it is lacking in the current tool. Every organization seeks specific data points rather than general information. Therefore, we require customized reports from the Xray tool."

"The speed of JFrog Xray should improve. Other solutions have better performance."

More JFrog Xray cons

"One issue is that engineering teams don't always embed secrets in the same way, making it difficult for the tool to consistently identify them."

"Legit Security could do a little better with detecting publicly exposed keys. It's not bad. The detections that they are running get to everything eventually, but it would be great if they could increase some of that awareness."

"I would like them to have their own static code scanner, and I'd like them to have their own open-source software scanners."

"The one we're working on right now is the ability to dynamically rerun development teams and groups."

Pricing and Cost Advice

Information not available

"The pricing is reasonable."

See which vendors are best for you

Use our free recommendation engine to learn which Software Supply Chain Security solutions are best for your needs.

See recommendations

869,202 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

25%

Manufacturing Company

12%

Computer Software Company

10%

Government

Computer Software Company

18%

University

12%

Financial Services Firm

12%

Educational Organization

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	1
Midsize Enterprise	3
Large Enterprise	6

No data available

Questions from the Community

What do you like most about JFrog Xray?

JFrog Xray shows us a list of vulnerabilities that can impact our code.

What needs improvement with JFrog Xray?

I would assess the integration of JFrog Xray with CI/CD tools as the weak point. You have two means to do that: one is using the API, or the other is using the command line from JFrog. That part is...

What is your primary use case for JFrog Xray?

For JFrog Xray product, you can use it for two main goals: compliance and security. You can use it to check if your licenses are compliant, and you can check if your dependencies you want to use ar...

What do you like most about Legit Security?

The true value proposition of Legit lies not in its features but in its ability to support our product security program's focus on creating guardrails instead of toll gates.

What is your experience regarding pricing and costs for Legit Security?

The pricing is reasonable.

What needs improvement with Legit Security?

Legit Security's secret detection works. However, there are some limitations to its effectiveness. One issue is that engineering teams don't always embed secrets in the same way, making it difficul...

Black Duck SCA vs JFrog Xray

Comparisons

Trivy vs JFrog Xray

Compared 14% of the time

Compared 12% of the time

Veracode vs JFrog Xray

Compared 6% of the time

Mend.io vs JFrog Xray

Compared 6% of the time

Prisma Cloud by Palo Alto Networks vs JFrog Xray

Compared 6% of the time

More JFrog Xray Competitors

Ox Security vs Legit Security

Compared 20% of the time

Cycode vs Legit Security

Compared 18% of the time

Apiiro vs Legit Security

Compared 17% of the time

Docker vs Legit Security

Compared 17% of the time

ArmorCode vs Legit Security

Compared 10% of the time

More Legit Security Competitors

Product Reports

JFrog Xray

Download JFrog Xray product report

Download Legit Security product report

Also Known As

JFrog Security Essentials

No data available

Overview

JFrog is on a mission to enable continuous updates through Liquid Software, empowering developers to code high-quality applications that securely flow to end-users with zero downtime. The world’s top brands such as Amazon, Facebook, Google, Netflix, Uber, VMware, and Spotify are among the 4500 companies that already depend on JFrog to manage binaries for their mission-critical applications. JFrog is a privately-held, global company, and is a proud sponsor of the Cloud Native Computing Foundation [CNCF].

If you are a team player and you care and you play to WIN, we have just the job you're looking for.

As we say at JFrog: "Once You Leap Forward You Won't Go Back!"

JFrog

Legit Security provides application security posture management platform that secures application delivery from code to cloud and protects an organization's software supply chain from attack. The platform’s unified application security control plane and automated SDLC discovery and analysis capabilities provide visibility and security control over rapidly changing environments and allow security issues to be prioritized based on context and business criticality to improve security team efficiency and effectiveness.

Sample Customers

google, amazon, cisco, netflix, oracle, vmware, facebook

Google, NYSE, Kraft-Hienz, Takeda Pharmaceuticals, and many other large enterprise and Fortune 500 customers. Learn more by going to: https://www.legitsecurity.com/...

JFrog Xray vs. Legit Security