Migration case studies

Summary

A completed migration for an enterprise aerospace and transportation organization from JFrog Artifactory.

Before state

The customer had a 6-person team dedicated to maintaining JFrog Artifactory on-prem and wanted a managed solution.

Pain points and value drivers

• Quarterly updates and constant patches were absorbing significant team time.
• Numerous security incidents caused by vulnerable dependencies.
• Customer was experiencing frequent downtime and outages.
• Lack of standardization was creating cross-team inefficiencies.

Outcomes

• Cloudsmith offered a fully-managed solution and supported migration through a collaborative partnership.
• The customer adopted Cloudsmith's multi-format repositories as part of their migration.
• The customer adopted Cloudsmith's security features, closing security gaps.
• The customer completed its migration to Cloudsmith on time.
• The legacy artifact management system was fully retired.

Summary

A completed migration for an enterprise media, gaming and advertising organization from Sonatype Nexus.

Before state

The customer operated an aging, self-managed artifact infrastructure on Sonatype Nexus that was built many years ago. Over time, the environment struggled to keep up with scalability demands and reliability requirements. Maintaining and managing this complex setup required significant ongoing staff time and resources from a dedicated internal team.

Pain points and value drivers

• Scalability & Reliability Issues: The Nexus instance suffered from performance and stability bottlenecks, particularly across global operations.
• High Maintenance Overhead: Managing Nexus and its associated CDN consumed significant internal resources, requiring a dedicated team of 2–3 FTEs plus managerial oversight.
• Functional Limitations: Their existing setup lacked the extended features and functionality required from a modern artifact management platform.

Outcomes

• Reduced Operational Costs & Overhead: Shifted management and maintenance expenses into a predictable SaaS license, freeing up 2–3 FTEs and managerial bandwidth.
• Enterprise Reliability & Scale: Gained confidence through guaranteed Enterprise SLAs and a highly scalable, globally reliable infrastructure.
• Expanded Functionality: Unlocked a broader range of artifact management capabilities and features by migrating to Cloudsmith.
• Strong Partnership: Built a trusted working relationship and alignment between team decision-makers and Cloudsmith.

Summary

A completed migration for an enterprise retail and consumer organization from JFrog Artifactory.

Technology stack

• Bitbucket Pipelines
• Identity and access management

Before state

The customer relied on a self-hosted JFrog Artifactory instance to support their .NET application builds. Over time, the platform's overall complexity led to low adoption of its built-in security capabilities, particularly JFrog Xray. They needed a simpler, easier to set up artifact management platform that would maximise supply chain security feature adoption and performance, and had a tight timeline for migration.

Pain points and value drivers

• High System Complexity: The legacy self-hosted JFrog Artifactory setup was complex to manage and slow to configure.
• Low Security Feature Adoption: Complex tools and unsatisfactory performance from JFrog Xray resulted in low adoption across the organization.
• Migration Urgency: A strict deadline forced a swift transition away from their existing infrastructure without room for project delays.

Outcomes

• Streamlined Setup & Improved Adoption: Cloudsmith provided a straightforward, user-friendly solution that simplified repository setup and day-to-day management, leading to high adoption across teams.
• Enhanced Supply Chain Security: Cloudsmith unlocked powerful, customizable, and accessible vulnerability scanning and policy management, strengthening overall software supply chain security.
• Optimized Repository Structure: The customer leveraged Cloudsmith’s multi-format repository support to transition cleanly to a project-based repository structure.
• Better Governance Package Governance: The customer leveraged Cloudsmith's policies to enable finer control over third-party and upstream dependencies.

Customer quotes

• We've been really pleased with the whole onboarding process ... this is the smoothest and most pleasant experience that we've had

  Anonymous customer

  Migration feedback

Summary

A completed greenfield adoption for an enterprise technology and software organization without a standardized incumbent repository.

Before state

The customer lacked upfront controls over open-source software, with developers pulling dependencies directly from public registries while managing container images separately in AWS ECR. They had no central governance over security vulnerabilities or open-source license compliance, relying entirely on runtime detection tools like Wiz CNAPP after code was already deployed.

Pain points and value drivers

• Direct Ingestion of Unvetted OSS: Ingesting dependencies directly from public registries left the organization exposed to malicious and vulnerable packages.
• Lack of License and Vulnerability Controls: No automated guardrails to detect open-source licensing risks or security vulnerabilities prior to runtime.
• Late-Stage Security Detection: Security checking relied solely on runtime monitoring (Wiz CNAPP), catching threats only after packages reached production environments.
• Competitor Setup Complexity: Alternative platforms were ruled out on the basis of complexity.

Outcomes

• Cloud-Native Dependency Firewall: Implemented a cloud-native dependency firewall that proxies and caches Golang, Clojure (Maven), Python, and npm packages before they reach developer environments.
• Shift-Left Security & Compliance: Automated vulnerability scanning, license compliance checks, and SBOM generation.
• Low-Friction Management: Avoided operational burden by adopting a cloud-native SaaS platform.

Summary

A completed migration for an enterprise technology and software organization from mixed or self-managed tooling.

Technology stack

• GitHub Actions
• GitLab CI/CD
• GitLab
• Terraform
• Identity and access management

Before state

The customer was managing a highly fragmented and decentralized artifact management setup to deliver container images and packages across thousands of servers. Developers used range of platforms including GitLab Package Registry, GitHub Container Registry, and complex homegrown self-hosted tools that were time-consuming and difficult to maintain. To streamline operations, they decided to standardize on GitHub Enterprise and sought a cloud-native artifact platform to run alongside it.

Pain points and value drivers

• Tool Fragmentation & Decentralization: Package distribution was scattered across GitLab, GitHub, and custom homegrown systems, making unified management impossible.
• High Operational Burden: Managing and scaling self-hosted artifact tools was increasingly difficult, time-consuming, and resource-intensive.
• Security & Governance Risks: The fragmented ecosystem obscured vulnerability tracking, increased risk, and complicated disaster recovery planning.
• Strict Distribution & Scale Requirements: The customer needed to reliably deliver multiple package formats across hundreds of thousands of servers without performance bottlenecks.
• Lack of Vendor Partnership: Existing vendors failed to provide the high-level onboarding, dedicated support, and collaborative alignment the team required.

Outcomes

• Unified, Cloud-Native Platform: Cloudsmith standardized all artifact and container distribution (Python, Go, Rust, C++, OCI) into a single managed platform alongside GitHub Enterprise.
• Eliminated Management Overheads: Cloudsmith eliminated the overhead of self-hosted infrastructure by shifting to a fully managed, low-friction SaaS solution.
• High-Performance Global Distribution: The Customer achieved high reliability, performance, and optimized cache hit rates across their hundreds of thousands of Cloud servers.
• Strengthened Security & Compliance: Cloudsmith facilitated centralized artifact management to streamline vulnerability tracking, risk reduction, and disaster recovery planning.
• True Strategic Partnership: Cloudsmith worked closely with the organization through responsive onboarding, high SLA support, and ongoing collaboration after rollout.

Summary

A completed migration for an enterprise technology and software organization from JFrog Artifactory.

Before state

The organization relied on JFrog Artifactory and wanted a more consistent managed artifact workflow.

Pain points and value drivers

• Escalating costs with a previous vendor
• Poor support experience with a previous vendor
• Lack of effective vulnerability and malware policies
• Limited control over package lifecycles

Outcomes

• Rapid migration to Cloudsmith
• Production-wide malware and vulnerability policies in force
• A single source of all package flowing to production

Summary

A fast-tracked migration for a global logistics organization, moving to Cloudsmith from a legacy platform.

Technology stack

• GitHub Actions
• Jenkins
• Azure DevOps
• Backstage
• Terraform
• Identity and access management
• Security tooling

Before state

The customer was spending significant time and resources managing and patching a fragmented, on-premise artifact management infrastructure spread across Sonatype Nexus, JFrog Artifactory OSS, Azure Artifacts, and Satis. Developers were downloading packages directly from public repositories without policies, leaving a major gap in software supply chain security. Facing an expiring on-premise Nexus contract and a tight migration deadline, they urgently needed a consolidated, secure solution without risking operational downtime.

Pain points and value drivers

• Tool Fragmentation & Overhead: Artifacts were scattered across four different tools, requiring heavy time and resource investment to manage and patch on-premise infrastructure.
• Significant Security & Compliance Gaps: Lack of enforced policies and direct, unvetted downloads from public repositories exposed the organization to software supply chain risks.
• Imminent Migration Deadline: The impending expiration of their Nexus contract created a high-risk, tight timeline to migrate off their legacy setup.
• Developer Friction: Distributed tools and slow package transmission created friction and delays in development workflows.

Outcomes

• The organization completed its migration to Cloudsmith in a number of weeks.
• Infrastructure Consolidation: Cloudsmith allowed the customer to merge multiple fragmented tools into a single source of truth, providing centralized visibility across all development teams.
• Eliminated Management Overheads: Replaced on-premise patching and maintenance with a fully-managed, cloud-native platform, lowering total cost of ownership.
• Enterprise Software Supply Chain Security: Implemented real-time vulnerability scanning and automated policy enforcement to eliminate unvetted public repository downloads.
• Increased Developer Productivity: Boosted developer velocity by minimizing package transmission times through Cloudsmith's global package delivery network.
• On-Time Migration: Successfully met the tight contract expiration deadline through Cloudsmith's accelerated onboarding and migration support.