Scaling compliance, security & efficiency – while seamlessly migrating to the cloud – with JFrog.

Iress has been at the forefront of financial software innovation for over three decades. The company provides critical solutions for financial market trading, wealth management, and superannuation.

Serving 90% of Australia’s top 30 brokers, Iress operates across Australia, the UK, Canada, Tunisia, Singapore, New Zealand, and South Africa, delivering robust technology platforms to a wide range of financial institutions.

With a presence in seven countries and a diverse technology stack, Iress faced challenges in managing multiple package managers, ensuring compliance with evolving regulations, and optimizing engineering resources.

Seeking to modernize its development infrastructure by migrating from a self-hosted package management system to a SaaS-based solution, Iress partnered with JFrog to successfully transition to a cloud-based artifact management and DevSecOps platform, enhancing operational efficiency, security, and visibility across its software supply chain.

In 2017, IRESS transitioned from a self-hosted environment to using the SAS platform exclusively, completing the migration within three months. This move improved scalability, security and cost efficiency by eliminating the need to manage hardware and software upgrades.

Iress had been using JFrog Artifactory for over seven years, initially deploying a self-hosted solution. However, as the company expanded and business needs grew, maintaining an on-premise deployment became increasingly challenging. Engineering teams faced constraints in managing upgrades, ensuring availability, and meeting stringent regulatory requirements like Australia’s CPS230 compliance standards.

The solution

To address these challenges, Iress made a strategic decision to transition to JFrog’s SaaS-based solution, hosted on AWS. The key drivers for this migration included:

• Resource optimization: Reducing the operational burden of maintaining Artifactory internally and reallocating engineering talent to high-value business initiatives.
• Regulatory compliance: Meeting stringent RTO and RPO metrics for data recovery and security mandates. With JFrog’s security and compliance capabilities, Iress could confidently demonstrate to regulators and financial institutions that its software processes are audit-ready.
• Enhanced visibility and control: Leveraging MyJFrog Portal to provide business units with granular cost insights and optimize artifact management.
• Improved security posture: Strengthening governance by ensuring full traceability of software artifacts from development to production.
• Federated Hybrid Deployment: Iress integrates its self-hosted Artifactory instances with JFrog’s SaaS through federation, ensuring synchronisation across deployments while allowing teams to transition workloads gradually.
• Cross-Region Replication: Leveraging AWS’s global infrastructure to support disaster recovery and enhance compliance in multiple regions.
• JFrog Xray for Security Scanning: Ensuring all artifacts stored within AWS are continuously scanned for vulnerabilities, enabling proactive risk mitigation before deployment.

By working closely with JFrog’s local team in Australia, Iress executed a seamless migration strategy, replicating its on-premise Artifactory setup in the cloud to minimize disruptions. The transition included integrating SaaS nodes with existing self-hosted instances through federation, enabling synchronization across deployments, carefully orchestrated to maintain service continuity and leverage AWS’s infrastructure for scalability and resilience.

Craig Wilson, Principal Cloud Platform Engineer, Iress, said: “Before the SaaS environment, the team faced a lot of pressure with hundreds of on-prem requests and requirements. We were a small team managing too many things!”

The SaaS platform automatically scales based on usage, alleviating these problems. IRESS also complies with CPS 230 and emphasizes robust data recovery practices. The company uses AWS for its SaaS offerings and maintains physical data centers for trading systems, focusing on a secure DevOps culture.

Migrating to JFrog’s SaaS platform allowed us to shift our focus from platform maintenance to value-generating initiatives, significantly improving our operational efficiency,” said Glenn McDonald, Head of Engineering Services, Iress.

Key benefits

By adopting JFrog’s SaaS platform, backed by AWS, Iress has achieved a future-ready DevOps infrastructure that enhances efficiency, security, and governance.

The strong collaboration between JFrog and Iress, along with AWS, has paved the way for continuous innovation, ensuring that Iress remains a leader in delivering secure, scalable, and compliant financial software solutions.

Key benefits include:

• Operational efficiency: Eliminated the overhead of self-hosted maintenance, freeing engineering teams to focus on innovation.
• Cost optimization: Improved visibility into software consumption patterns, reducing unnecessary artifact storage and operational costs. “With JFrog, we’ve gained critical cost visibility across our business units, empowering teams to manage their consumption more effectively,” said McDonald.
• Scalability and flexibility: Seamlessly scaled artifact management across global locations without infrastructure constraints.
• Robust security measures: Enabled software supply chain integrity by tracking artifacts throughout the development lifecycle. “Security is paramount at Iress, and JFrog’s platform plays a key role in ensuring our software supply chain meets the highest standards,” said McDonald.
• Regulatory readiness: Streamlined compliance with SOC2 standards, providing auditors with easy access to security documentation.
• Risk mitigation: Enhanced artifact traceability, reducing exposure to security vulnerabilities and compliance risks.

“JFrog’s platform is one of the few solutions capable of addressing the complexity of our global operations, and the partnership has been transformative. The level of support, expertise, and strategic alignment we’ve experienced has exceeded our expectations,” said McDonald.

The EveryOps future

Craig added: “We advanced from siloes to a single platform for DevOps. For instance, we now have visibility across and integration between front-end and back-end apps. EveryOps is about breaking down silos and creating a more holistic approach to technology development and management.”

“In the DevOps environment, you want everyone to be aware of security.” Craig sees EveryOps as an evolution of DevOps that emphasizes everyone’s responsibility across development, operations, security, and other technical domains.