JFrog Names Nine Winners in First Software Supply Chain Excellence Awards

Three categories, nine honorees

The awards fall into three categories: the Convergence Award, the Trusted Intelligence Award and the Guardian Award. Each has one winner from the Americas, EMEA and APAC. According to JFrog, the Convergence Award recognizes teams that unify a fragmented delivery workflow, bringing disconnected repositories, scanners and tools into a single governed system of record. The Trusted Intelligence Award covers enterprise-grade governance for AI and model lifecycles. The Guardian Award goes to software supply chain security at real enterprise scale.

A cross-functional panel of JFrog leaders and industry voices selected the winners. They scored each submission on the breadth of its story and the strength of its metrics.

The threat backdrop

JFrog framed the awards around growing pressure on software supply chains in the AI era. In its 2026 Software Supply Chain Security report, the company identified over 900 malicious AI agent skills carrying high-impact payloads, 495 malicious AI models on Hugging Face and 56 malicious extensions on OpenVSX. JFrog said attackers are no longer just targeting code but the autonomous tools that write, review and deploy it.

Roie Shorer, Chief Growth Officer at JFrog, said agents now write, review and deploy code faster than ever, while regulations require proof at every step. He said the winners "established a single source of truth where developers, security, and compliance teams can operate using the same data and the same rules."

Convergence Award winners

• Ford (Americas): With more than 15,000 developers across 80-plus global plants, Ford moved from separate repository tools and scanners to the JFrog Platform. The team now manages more than 43 million artifacts with 99.99% uptime and credits the consolidation with recapturing an estimated $8 million a year in developer productivity.
• SCHOTTEL Industries (EMEA): Over six months, Schottel delivered more than 32,000 artifacts, curated over 2,300 open-source packages and automatically blocked more than 900 risky ones. Automated governance replaced manual dependency approvals that had delayed developers by months.
• Rakuten Symphony (APAC): The company runs 28 self-hosted JFrog Enterprise+ instances across India, Japan and Singapore, connected by JFrog Federated Repositories. It cut manual triage effort by roughly 60% in a single month across more than 600 releases, reclaiming more than 500 engineer-hours.

Trusted Intelligence Award winners

• NVIDIA (Americas): NVIDIA applied curation, scanning and policy enforcement to its model mirrors, so a downloaded model faces the same checks as a package before reaching production. Thousands of AI model seats are now managed inside a controlled, auditable boundary.
• Husqvarna Group (EMEA): After consolidating overlapping scanners around the JFrog Platform, Husqvarna gained greater visibility into open-source dependencies. It says the centralized view supports traceability and reporting needs tied to regulations including the EU Cyber Resilience Act and NIS2.
• Singapore Airlines (APAC): The airline moved from "trust by verification" to "trust by default." More than 95% of AI and open-source dependencies are onboarded through curated channels, and late-stage release blocks from non-compliant dependencies are down 60-75%.

Guardian Award winners

• S&P Global (Americas): Critical vulnerabilities across 30 images fell by 90%, from 141 to 14. S&P reports that about 99% of malicious npm and PyPI packages are now blocked at the point of ingestion.
• TSB Bank (EMEA): TSB built a continuous governance platform using JFrog's APIs, GitHub Actions and Open Policy Agent. In its first seven months there were 75 governance issues, 74 of which were resolved.
• Iress (APAC): Across its 600 developer operations, the curation initiative mitigated six critical security incidents in eight months and eliminated 90% of reactive vulnerability triage, saving an estimated 13,705 engineering hours for the year.

What it means

The results come from the winners' own reporting and JFrog's presentation, but they show a common pattern: consolidating tools and checking dependencies, including AI models and agent skills, at the point of ingestion. JFrog says the full list of winners and category criteria is available at jfrog.com/software-supply-chain-awards.