Every New Compliance Framework Restarts the Same Fire Drill. It Doesn’t Have To.

JFrog announced Out-of-the-Box Compliance Frameworks for its AppTrust platform at swampUP 2026, aiming to replace audit-driven, point-in-time compliance efforts with continuous governance embedded in software delivery. Initially supporting NIST SSDF and the EU Cyber Resilience Act, the feature pre-maps regulatory controls to enforceable Policy-as-Code rules, allowing AppSec teams to activate frameworks without writing Rego policies or manually translating requirements. AppTrust identifies covered and uncovered controls, uses artifact-based production data to maintain current compliance coverage, and provides traceability across AI-agent activity, commits, pull requests, Jira tickets, and shipped artifacts. The platform separates responsibility between AppSec teams, which manage applicable controls and rules, and development managers, which control application rollout and enforcement timing. JFrog positions the offering as a response to growing regulatory demands, faster AI-assisted software development, audit-evidence challenges, and potential EU CRA penalties and personal liability for security leaders; it is available through the Ultimate Security Bundle, with further frameworks under development.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.