

JFrog Xray and CAST Highlight compete in the software analysis and security space. Users note that CAST Highlight has the advantage due to its advanced features and comprehensive solution offerings.
Features: JFrog Xray offers real-time binary analysis, deep dependency scanning, and integration with development environments. CAST Highlight provides portfolio analysis, open-source risk management, and technical debt estimation.
Room for Improvement: JFrog Xray could improve cloud-native features, expand its architectural analysis tools, and enhance user interface customization. CAST Highlight may benefit from improved integration with more development platforms, a more user-friendly setup process, and enhancing the scope of its vulnerability database.
Ease of Deployment and Customer Service: CAST Highlight's cloud-native deployment and flexible enterprise workflow integration are strong points. Their support is praised for being responsive and knowledgeable. JFrog Xray integrates seamlessly with various repositories, offering efficient problem resolution and trusted customer service.
Pricing and ROI: JFrog Xray is competitive in pricing, offering good ROI through effective vulnerability management. CAST Highlight has a higher setup cost but provides strong ROI by managing technical debt and reducing security risks, aligning closely with strategic IT goals.
In terms of time saved, it went from approximately 3.5 hours per insight report to around 40 minutes, which is 80% faster.
For one of the clients, they actually improved their security a lot based on the CAST Highlight results.
Some support team members are helpful, and others lack in-depth knowledge of the tool, which might cause challenges.
I interacted with customer support regarding one of my project results related to vulnerabilities and license risks, and they explained everything clearly, leaving me very satisfied.
When I get one of the supporters from India, they actually fix whatever is wrong.
When we need clarifications, we contact our account manager, and they arrange demos.
On a scale of 1 to 10, I would rate the technical support of JFrog Xray an eight because they are very knowledgeable.
The processing time per new report stays consistent, experiencing no slowdowns even when we had over 200 new reports dropped in a week.
The analysis is performed next to the source code, which means the performance, if you increase the number of applications, will not be affected that much.
According to my use case, it is highly scalable.
CAST Highlight proves reliable in nature.
CAST Highlight is not that stable because it has a lot of downtime.
I use JFrog Xray primarily for security purposes, and I find it reliable.
We did experience crashes, downtimes, and performance issues with JFrog Xray.
Understanding only the OS-specific blockers means I would avoid resolving irrelevant issues, thus saving time.
CAST Highlight's deduplication is great for avoiding spam, but sometimes we want two similar quotes if they are from very different company sizes, such as SMB versus enterprise perspectives on pricing.
It would be nice if it were easier to actually drill down and figure out how the score was calculated and what the exact thing was that violated a rule.
When we have given a very long tag, it doesn't work as expected and requires excessive scrolling.
somehow you need to adapt your GitLab pipeline and turn them into JFrog pipeline, and this is something they don't really advertise at first—you're obliged to use the JFrog CLI.
X-ray needs improvement in supporting more than one database, as it currently only supports PostgreSQL.
The price was relatively low, which means it was easy to convince the customers.
JFrog Xray provides a free trial of 14 days.
The basic scanning capabilities come with Artifactory, however, curation requires additional licenses.
Smart deduplication groups similar quotes and picks the strongest and most significant one. It stops insights from showing eight variations of great UI, giving diverse voices instead of repetition.
The user interface made the setup process smooth for me, but it was actually the CLI that stood out, as it was so easy to configure the scans that within an hour or two, I had the results to show.
In cloud migration, I use CAST highlight to identify blockers, which are the negative road patterns, and also the boosters, which are positive code patterns.
The most valuable features of JFrog Xray are its curation capabilities, its native integration with Artifactory, scanning for vulnerabilities, and license compliance features.
The policy-driven approach of JFrog Xray helped me maintain security standards by integrating it in the development pipeline.
With other registries such as ECR, we can use the images only in the AWS cloud. With JFrog, we can use this registry from any cloud or work locally as well.
| Product | Mindshare (%) |
|---|---|
| JFrog Xray | 5.1% |
| CAST Highlight | 1.4% |
| Other | 93.5% |


| Company Size | Count |
|---|---|
| Small Business | 3 |
| Midsize Enterprise | 1 |
| Large Enterprise | 6 |
| Company Size | Count |
|---|---|
| Small Business | 1 |
| Midsize Enterprise | 3 |
| Large Enterprise | 6 |
CAST Highlight is a SaaS software intelligence technology that delivers rapid, fact-based insights across your entire application portfolio. By automatically analyzing the source code of hundreds or thousands of applications, CAST Highlight helps organizations assess cloud maturity, AI & Agentic readiness, software health, open source risk, resiliency, technical debt, and sustainability from a single lightweight scan.
CAST Highlight is designed for CIOs, CTOs, enterprise architects, cloud leaders, application owners, security teams, and modernization teams that need a fact-based way to prioritize modernization, cloud, and AI adoption decisions at scale. It helps teams identify which applications are ready to move quickly, which require remediation, and where hidden software risks may affect transformation cost, timelines, security, resilience, or business outcomes.
Unlike traditional manual or survey-based assessments, CAST Highlight analyzes application source code directly to rapidly segment portfolios, prioritize modernization paths, and uncover risks before they impact transformation programs.
JFrog Xray is a robust solution for managing artifacts and vulnerabilities, integrating with tools like Artifactory to streamline dependency management and ensure security compliance. Recognized for its scalability and stability, it facilitates advanced reporting and license compliance.
JFrog Xray provides a comprehensive approach to artifact security and management, seamlessly integrating with CI/CD pipelines. Its deep scanning capabilities are particularly valuable for containerized applications, offering insights into vulnerabilities and compliance. The tool's policy-driven approach enhances security, while its efficiency in handling multiple package types ensures broad applicability. Despite room for improvement in speed and performance, it's a critical asset for organizations prioritizing secure software delivery.
What are JFrog Xray's key features?JFrog Xray finds application across industries where security and compliance are critical. In sectors reliant on container technology and open-source components, such as finance or technology, Xray aids in deploying secure applications. Through its deep scanning capabilities, companies can ensure that images and artifacts meet compliance standards, mitigating risks associated with dependencies and licenses.
We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.