Artifact management is one of those disciplines that engineering teams do badly for years without realising it. Builds produce binaries, containers, packages and now model weights, and those outputs get scattered across object storage buckets, registry instances, CI caches and somebody's laptop, with no consistent versioning, no provenance record and no idea which build produced the thing currently running in production. JFrog built a large business on solving that, and JFrog Academy is a better piece of education than the subject sounds. The free tier is substantial.
Self-paced courses cover Artifactory itself, Xray for vulnerability and licence scanning, the security and governance layers, and increasingly the machine learning tooling. Practice labs are included, which matters more than it sounds, because artifact management is one of those things that makes no sense as theory and clicks immediately the first time you watch a build promote a binary through repository stages. Access is free with an account and is not gated on being a customer. The paid tier is instructor-led training, roughly four hours per session, charged either by card or against training credits.
That is a defensible split. Live instruction costs the vendor real money, self-paced content does not, and pricing accordingly is more honest than the alternative of gating everything behind a customer relationship. The part I rate most highly is the software supply chain security content. This has become one of the most important and least understood areas in engineering, driven partly by regulation and partly by a run of incidents that made everyone realise they had no idea what was in their dependency tree.
The material covers software bills of materials, provenance and attestation, vulnerability triage and the gap between a scanner reporting a CVE and that CVE being exploitable in your particular usage. That last distinction is the one most teams get wrong, drowning in critical-severity findings for code paths they never call, and JFrog teaches it properly. That content transfers regardless of which artifact platform you run. The machine learning material is the reason this academy belongs in an AI course catalogue at all.
JFrog acquired Qwak in June 2024 for around two hundred and thirty million dollars and folded it in as JFrog ML, and the resulting curriculum teaches model management from a DevOps rather than a data science direction. That framing is correct and underserved. A trained model is an artifact. It has a version, a lineage, a set of dependencies, a provenance record and a security surface, and it belongs in the same governance machinery as a container image rather than in a notebook on somebody's machine.
Most MLOps education approaches this from the data science side and reaches the same conclusion eventually. JFrog starts there, which is faster, and it means the material covers things other MLOps courses miss, particularly scanning model files for malicious payloads, which is a real attack vector that most teams have never considered. Pickle deserialisation in a downloaded model file is arbitrary code execution and a lot of practitioners do not know that. The bolted-on feeling is real, though.
The ML content sits somewhat apart from the core Artifactory curriculum rather than being woven through it, which is what you would expect eighteen months after an acquisition, and the integration story in the training is smoother than the integration story in the product. The gap is the usual one, sharpened by price. Artifactory is expensive, the training assumes you have it, and nothing in the curriculum addresses when a full artifact management platform is more machinery than a given team needs. A team of eight with one language and one deployment target can get a long way with the package registry built into their source control provider.
The threshold where a dedicated platform earns its cost is somewhere well above that, and locating it is not JFrog's job. Certification exists at Associate level and gives the programme somewhere to finish. It is not a heavyweight credential but it is a reasonable signal that somebody understands repository structure, promotion pipelines and scanning workflow. Three point nine.
Free self-paced training with labs on a genuinely important and badly understood problem, the best supply chain security material in any vendor academy I have looked at, and an unusual and correct framing of model management as an artifact governance problem rather than a data science one.