Optimizely PaaS DXP

Code-first modeling via C# PageType/BlockType attributes with the full .NET type system, plus admin-UI content type creation (Settings > Content Types) and Custom Elements definable in the Admin UI without a code deployment. Content Type Contracts (.NET interfaces inheriting IContentData) gained allowed/restricted types, fragment generation, a component fallback, and computed fields that every implementing type inherits and indexes. Trimmed slightly because the no-code path is incomplete in PaaS: a block created in the Admin UI still needs a developer-authored MVC view before it renders, and Optimizely's own docs recommend defining types in code for PaaS.

Strongly-typed ContentReference and ContentReference<T> give compile-time-validated references, ContentArea handles composition, and Content Type Contracts now let a single Graph query target every concrete type fulfilling a contract — genuine polymorphic traversal. Held flat rather than raised because references remain unidirectional (reverse lookup goes through softlinks or Graph, not native bidirectional fields), and CMS 13 added a new integrity gap: softlinks are not generated for published content variations, so a link, content-area item, or media usage that exists only inside a variation is invisible to the platform's reference tracking.

BlockType with SharedBlocks and LocalBlocks provides real structured composition, and CMS 13 layers on Experiences and Sections — grid-based rows/columns that decouple layout from the content model, can be copied and pasted between sections, and can be saved as Blueprints directly from the UI. Templates and Blueprints are centrally managed in Settings with search, filtering, pagination, and export/import; Graph exposes all of it as typed structured data. Not higher because rich text inside these structures is still an HTML blob rather than a portable AST like Portable Text, which caps true format-agnostic reuse.

Standard .NET DataAnnotations (Required, StringLength, RegularExpression, Range) enforce inline in the editor, IValidate<T> covers cross-field and business-rule validation, and custom ValidationAttribute types are fully supported — so the extensibility bar in the rubric is cleared comfortably. The whole .NET validation ecosystem applies and rules are unit-testable outside the CMS runtime. No CMS 13 paradigm change was found in the 2026 release notes, so this holds; not higher because there is no declarative uniqueness constraint or pre-save webhook validation hook.

Every change creates a version with full history, diff comparison, rollback, and scheduled publishing, and CMS 13 adds Content Variations — multiple published variations of the same item in the same language, with delta-based storage, an independent version history and publishing lifecycle per variation, approval-workflow integration, and a Variations toolbar dropdown with autosave. Reduced from the prior score because the branching analogy is narrower than it first appeared: variations can only diverge localizable properties (culture-invariant properties cannot vary) and published variations generate no softlinks, so reference tracking does not follow them.

Visual Builder is the default editing experience in CMS 13 PaaS and fully replaces on-page edit (OPE is disabled), giving a drag-and-drop canvas with grid rows/columns, real-time device preview, autosave, interactive property highlighting, and embedded DAM asset placement in one interface for pages, blocks, media, experiences, and sections. Editors compose layouts from reusable Sections and Blueprints without developer involvement, and server-side ASP.NET MVC rendering via tag helpers (epi-outline, epi-component, epi-grid, epi-row, epi-column) works without Graph. Not higher because introducing a genuinely new component still requires a developer-authored MVC view, and data-bound loading and personalization flows remain developer setup.

XhtmlString is backed by TinyMCE 8 in CMS 13 — a genuine engine upgrade — with per-content-type toolbar configuration (Minimal/Standard/Extended), custom plugins, an internal content-tree link picker, tables, and paste-from-Word, and 2026 shipped a run of stability fixes for editor width in IList, cursor position on table insert, PropertyList persistence, and Graph link indexing. Lowered from the prior score to respect the rubric's explicit gate: output is stored as an HTML blob, not a portable AST with custom renderers, so 75+ is not available. The 'Markdown for Agents' capability that would soften this is still a beta requiring signup, not GA.

Media are typed content items with code-defined metadata schemas; Content Manager adds Graph-powered search across CMS, DAM, and external sources with customizable grid columns, image/PDF grid browsing, and a details panel; and CMS 13 bundles a basic embedded Optimizely DAM tier (EPiServer.Cms.DamIntegration.UI) with AI tagging, smart renditions, folders/tags, and asset placement from inside Visual Builder. Cloudflare on DXP does URL-parameter resize, crop, rotate, quality, and WebP/AVIF conversion at the edge. Trimmed because embedded DAM requires a DXP environment — on-premises and HIPAA CMS 13 deployments are explicitly excluded — and there is no editor-set focal point in core (Cloudflare gravity=auto smart cropping is automatic detection, not an author-placed focal point).

Corrects a prior factual error: Optimizely does not hard-lock content items. The Concurrent Editing feature marks an item as being edited as soon as an editor starts, notifies other editors to avoid version conflicts, and lets a second editor proceed via 'Edit Anyway' or 'New Draft from Here' — optimistic locking with awareness, plus Tools > Permanently Mark as Being Edited for deliberate holds. Projects add coarse locking across active projects and async inline comments and replies on project items. Capped at the bottom of the adequate band because there is still no real-time co-editing, no presence cursors, and no CRDT merge; the being-edited flag auto-clears after a time and can be overridden, so conflict resolution is advisory rather than enforced.

Content Approval Workflows are configurable per content type and per content path with role-based approver steps, email notifications, and reject-with-comments, and Projects coordinate multi-item changes with grouping, comments, scheduled group publishing, and version tracking. CMS 13 adds redesigned translation workflows with machine translation and a Translate Content dialog that can copy structure, duplicate source content, or start empty, plus the Optimizely Languages gadget for XLIFF zip export/import and Blueprints/Templates managed centrally in Settings; content variations carry their own approval lifecycle. Not higher because there is no conditional routing between stages and XLIFF reimport still runs through a file upload plus scheduled job rather than a direct integration.

CMS 13 is GraphQL-native: Optimizely Graph is mandatory, auto-generates the schema from the content model, and supports full-text search, filtering, faceting, sorting, cursor and skip/limit pagination, autocomplete, and localization, with a new fluent C# SDK (Optimizely.Graph.Cms.Query) alongside the JavaScript SDK, and a separate CMS REST API enabled by default via AddCms() for management — clean delivery/management separation. Lowered because the REST delivery fallback is weak per the rubric: the Content Delivery API was not shipped at CMS 13 GA, arrives only as a compatibility version, will not be extended to Visual Builder experiences, and will not be ported to CMS 14.

Every DXP production tier fronts the site with Cloudflare including WAF, and Cloudflare edge image resizing transforms images on the fly from URL parameters; Optimizely Graph serves its GraphQL endpoint through its own CDN-accelerated layer. Reduced because cache invalidation is coarse: the PaaS portal's Troubleshoot tab purges an entire environment, single-URL purge is still an open feature request whose documented workarounds are purging everything or filing a support ticket, and the automatic per-page purge Optimizely documents is a Next.js ISR pattern driven by Graph webhooks in a front end you build yourself. No edge compute or edge-side personalization ships with CMS 13.

Materially weaker than previously scored. First-party webhooks in CMS 13 are Optimizely Graph webhooks, and the documentation scopes them to exactly two event types — bulk (a chunk of synced content finished processing) and expired (content reached its stop-publish date, delivered on a one-hour sliding window) — registered, listed, and deleted over REST with Basic or HMAC auth. There is no granular create/update/publish/delete or schema-change event, no filtering, no delivery log, no dead letter queue, and no replay; IContentEvents remains an in-process hook with no changes in CMS 13, and Optimizely states webhook-driven changes to it are a CMS 14 item. The publish/move/delete webhook UI with GitHub-spec HMAC signing is a community MIT add-on, not a shipped Optimizely feature.

Graph is the mandatory, channel-agnostic delivery layer with an auto-generated schema driven by the same code-first content model used for editing, variations are indexed with unique identifiers for variation-aware delivery, external DAM/PIM/CRM content can be federated in, and CMS 13 auto-generates llms.txt for AI consumers. Reduced because the rubric's 80+ band wants 5+ language SDKs and format-agnostic output and CMS 13 delivers neither: first-party SDKs are .NET and JavaScript only, rich text remains an HTML blob, the Markdown for Agents capability is still beta, and the REST fallback is a deprecated bridge excluded from Visual Builder experiences.

Audiences (Visitor Groups renamed in CMS 13) is a native rule-based segmentation engine with built-in criteria for visit count, geographic location, referrer, time of day, landing page, browser/device, role, and campaign, combinable with AND/OR and extensible via custom criteria; ODP real-time audiences sync into CMS Audiences and the 2026 Lytics Audience Sync App imports external audiences into ODP. Scored below 75 because the CMS 13 docs state Audiences work only on traditional in-process (MVC) sites and are not indexed to Graph — on headless/Graph-delivered sites the documented answer is Variations plus Experimentation, so the segmentation engine does not follow CMS 13's own preferred architecture.

CMS 13 ships two native mechanisms: Audience-driven content variants assigned in the editor with per-audience preview, and Content Variations — multiple published variations of the same content item in the same language, storing only explicitly modified properties, each with its own version history, publishing lifecycle, approval workflow, and preview URL. Not higher because audience-based rendering is confined to in-process MVC sites, and on the Graph/headless path the decisioning layer is separately licensed Experimentation rather than anything in the CMS license.

Optimizely Web and Feature Experimentation remain the reference implementation for experimentation — sequential testing, CUPED variance reduction, multiple-comparison correction, mutual exclusion groups, feature flags with gradual rollout and kill switch, and documented analytics integrations (GA4, Adobe, Amplitude, Mixpanel, Segment) — and CMS 13 Content Variations give the CMS a first-class object to test, with native integration to run A/B tests on CMS content. Held below 90 because Experimentation is a separate SKU from the CMS 13 PaaS license: the traffic-split engine, significance reporting, and results dashboards are not included, only the content-variation substrate is.

Two first-party algorithmic engines exist but neither is in the CMS 13 PaaS license: Product Recommendations (Commerce, collaborative filtering, still shipping in 2026 with Search report pagination) and Optimizely Content Recommendations, which auto-generates topic interests from site content plus browsing behaviour and pushes the top three interests into ODP profiles for segmentation and activation. Raised from the prior 38 because a genuine first-party content recommendation product does exist, but capped at 45 because automated content sync from CMS via a Graph connector is announced rather than shipped, and there is no recommendation component an editor can drop onto a CMS 13 page without licensing ODP or Commerce.

CMS 13 makes Optimizely Graph the mandatory, license-included search engine — Search & Navigation (Find) is removed and unsupported — and Graph covers faceting, boosting and relevance tuning, autocomplete and query suggestions, sorting, pinned results, and two-way/one-way synonyms. The Search Management portal is framed directly in the CMS 13 navigation bar with a Health & Monitoring search analytics dashboard plus no-code Pinned Results and Synonyms editors, and Content Manager is a Graph-powered search-first browsing interface. Not higher because relevance configuration is still split between the portal and code-level SDK boosting, and there is no in-CMS query-rule or business-rule builder beyond pinning and synonyms.

The CMS 13 Graph SDK (Optimizely.Graph.Cms.Query) is a strongly-typed fluent C# API compiling to GraphQL with .ToGraphQL() inspection, custom cache eviction, single-key and Basic auth, IPrincipal-based access filtering and POCO deserialization, and a GA JavaScript SDK with built-in webhook support; an official Algolia connector for Optimizely CMS and Commerce Connect is listed in the app directory, and Graph webhooks plus the delivery APIs support custom index sync to any external engine. Held at 68 rather than higher because the removal of Search & Navigation forced the whole third-party-search ecosystem to re-platform and CMS 13 compatibility for the Algolia and Coveo connectors is not documented on the connector listings.

Commerce Connect 15 (GA 18 May 2026) is built on .NET 10, requires CMS 13, and delivers a genuine B2B/B2C commerce platform: catalog with flexible data models, cart and checkout, processor-based order APIs with async order operations, pricing engine, warehouse inventory, promotions, and on-demand language versioning, with Graph powering full-text catalog search. Not higher because Commerce Connect is a separate licensed product rather than part of CMS 13, and marketplace/subscription commerce and OMS-grade fulfilment still sit outside it.

Optimizely now ships official no-code apps for both major external catalogs: the Commercetools app syncs the commercetools catalog into Optimizely Graph in real time so CMS editors can embed live product content in pages and campaigns, and the Shopify app imports the full Shopify catalog (titles, descriptions, prices, images) into OCP as custom objects with real-time updates, then fans out via Sync Manager. That is live product-data federation rather than a static picker, placing it in the 60–75 band; not higher because the sync is one-directional into Optimizely and there is no documented in-editor product picker browsing the external catalog directly.

Commerce Connect 15 provides purpose-built commerce content types — CatalogContentBase/ProductContent/VariationContent covering catalogs, products, variants, bundles and packages — and CMS 13 gives them the full editorial stack: catalog entries inherit Visual Builder as the default editing experience with drag-and-drop composition, real-time preview and autosave, and are discoverable in Content Manager alongside pages and blocks. On-demand language versioning covers global B2B/B2C copy. Not higher because merchandising-grade PIM functions (attribute governance, enrichment workflow, channel readiness scoring) still require an external PIM via External Content.

The genuinely native analytics in CMS 13 is the Search Management portal's Health & Monitoring overview — a search analytics dashboard included with the mandatory Graph license — plus audience statistics on Audiences when enabled. Page-level and site-level traffic figures on the CMS dashboard and in edit view come from the separately installed Google Analytics add-on, whose CMS 13 compatibility is not stated in the CMS 13 release notes. Lowered slightly because the prior score credited traffic analytics as if it were in-box; there is still no native path analysis, conversion funnel, content-lifecycle or author-productivity reporting.

Integration paths are documented across the suite: the Google Analytics add-on supports GA4 configuration and a custom-script slot for Google Tag Manager, audience statistics feed GA4 traffic data back against CMS Audiences, ODP provides cross-channel behavioural event streaming via its JavaScript SDK, and Experimentation publishes first-party analytics integrations for GA4, Adobe Analytics, Amplitude, Mixpanel, Segment and Heap. Above the 65 threshold for documented integration with major analytics platforms, but not higher because there is no bi-directional GA4 connector that returns content-performance data into the CMS editorial surface, and the richest integrations belong to Experimentation rather than the CMS.

CMS 13 replaces SiteDefinition with the Application model (IApplicationRepository, ApplicationEvent), with automatic migration of hostnames, wildcard host handling, site assets and start pages, and each application carries its own domain, language configuration, access controls and preview-routing rules. Content is genuinely shared rather than siloed — Shared Blocks, blueprints and content areas cross applications, and Graph supports filtering by application and ancestor. Not higher because Application.Name is immutable once created and there is no one-to-one mapping from legacy SiteDefinition.Id, so multi-site reorganisation carries real migration cost.

Localization remains the platform's deepest strength: per-language content branches with independent publishing state, culture-specific versus shared properties (effectively field-level localization), configurable fallback and replacement chains, per-language access rights, and a Content Management API that accepts any valid language code without OS culture restriction. CMS 13 adds translation of draft pages, blocks and experiences without prior publication, a redesigned Language Selector splitting languages with and without existing branches, and structure-preserving auto-translation across page hierarchies, content areas and blocks. Trimmed from the prior 92 because auto-translation is not in-box — it requires configuring an external translator component (Cognitive Service Translator) — so the machine-translation layer is a wiring exercise, not a shipped service.

The Translation Integration Framework abstracts TMS connectors behind XLIFF export/import with translation-status tracking and automatic import back to language branches, and certified connectors exist for Translations.com GlobalLink, Lionbridge, Phrase and Smartling; CMS 13 adds native export of translatable content as human-readable JSON that respects Visual Builder structures, giving a vendor-neutral handoff path. Confidence is MEDIUM and the score unchanged because CMS 13 compatibility is not published for the certified TMS connectors, which matters given how much of the add-on ecosystem is still re-platforming off CMS 12.

CMS 13 materially improved this: Styles are developer-defined, pre-approved visual options (colour schemes, spacing, alignment, background treatments) applicable at element, row, column, section or experience level, so brand guardrails are enforced in the composition layer rather than by convention; Blueprints save approved experience and section layouts as reusable templates with generated thumbnails, a browsable gallery, and export/import between environments; Applications give per-brand hosting, languages and RBAC over a shared content and block library. Held at 60 rather than 65+ because there is still no cross-brand approval routing, no brand-policy engine, and no dashboard reporting brand compliance across applications — governance is a set of good primitives, not a governance product.

CMS 13 ships embedded DAM (EPiServer.Cms.DamIntegration.UI) as a standard integration: editors browse, filter, search, tag and manage DAM assets including folders and renditions without leaving the editor, asset usage is tracked back to the CMP Asset usage view, and Description, FocalPoint and Renditions metadata is consistently exposed through both REST and Graph because assets are indexed into Graph via External Sources. Capped below 65 because the DAM itself is CMP — a separate licence — the CMS's own media library remains a folder-and-blob store without metadata schemas or rights management, and the CMS 13 asset picker explicitly refuses rendition selection.

This was previously under-scored: Optimizely DXP PaaS hosting includes a Cloudflare CDN with edge image resizing documented as a first-party platform feature — /cdn-cgi/image/<options>/<source> URL transforms covering width, height, quality, crop, rotate and filters, explicit f=webp output and automatic AVIF where the browser supports it — so on-the-fly transformation and modern-format delivery are native to the hosted product, not an external Cloudinary/Imgix bolt-on. CMP DAM adds pre-processed renditions and a FocalPoint object with X/Y coordinates plus AI Smart Focal Point for subject-aware cropping. Not higher because the transforms are a raw Cloudflare passthrough rather than a CMS-integrated pipeline — there is no responsive srcset generation in core (PictureRenderer is community), self-hosted PaaS deployments get none of it, and the CMS 13 asset picker cannot select a rendition.

The media library stores video files as blobs with basic HTML5 delivery and nothing else — no transcoding, no adaptive bitrate (HLS/DASH), no video CDN, no automatic thumbnail generation and no caption or subtitle management; CMP DAM holds video assets with metadata only and adds no encoding pipeline. CMS 13 and Commerce Connect 15 release notes add nothing here, and there are no official Mux, Vimeo or Brightcove connectors in the app directory. Raised from 15 only to the floor of the no-native-video band, since file storage and playback of uploaded video do work.

Visual Builder is the default editorial interface in CMS 13 and fully replaces On-Page Editing, with a coherent composition model — Experience → Section → Row → Column → Element — plus drag-and-drop reordering, copy/paste of layout structures between sections, administrator-defined elements, autosave, interactive property highlighting and synchronized live preview. Blueprints make any experience or section a reusable template with generated thumbnails, a browsable gallery and export/import across environments, and Styles let developers publish pre-approved visual options applicable at any level. Shared Blocks drag into experiences and auto-inline when indexed to Graph. Not higher because visual editing of a decoupled headless frontend still depends on preview-route wiring rather than a universal in-place editor.

Approval definitions configure an ordered sequence of review steps, each with one or more reviewers by user or role, with deadlines per item, four-eyes enforcement, email and in-UI notification, comments tied to the content version, and a stored audit trail; content in an approval flow loses the Publish action until every step clears, and CMS 13 Content Variations each carry their own approval workflow. Not higher because sequences are strictly sequential with no parallel branching or conditional routing, states beyond draft/ready-for-review/approved/published are not user-definable, there is no visual workflow designer, and there is no auto-escalation on a missed deadline.

Scheduling is solid: future-dated publish per item, stop-publish dates that mark content Expired automatically, scheduled rollback to a prior version after a limited-duration publish, and Projects as release bundles that group pages, shared blocks and Commerce Connect products for simultaneous manual or scheduled publication; CMS 13 adds the scheduled publish date to the version status display so editors can confirm timing at a glance, and Content Variations each have an independent publishing lifecycle. Held below 70 because there is still no calendar view — the Projects list is a task board, not a timeline — so bulk rescheduling and conflict-spotting across a publication plan remain manual.

Corrected upward: comments are a content-item feature, not project-only — editors add, edit and reply to comments on any content item, tag colleagues with @ autocomplete, and tagged users get both an in-UI notification and an email, with comments bound to a specific content version; combined with full version history and author attribution, Projects-level discussion, and the 'currently being edited' marker (auto-clearing, overridable via Edit Anyway, or pinned with Permanently Mark as Being Edited) this lands squarely in the commenting-and-mentions band. Not higher because there is no simultaneous multi-author editing, no presence indicators or shared cursors, no OT/CRDT merge, and no change-suggestion mode — CMS 13 adds autosave but the concurrency model is still advisory-warning plus last-save-wins.

Optimizely Forms 6.0.0 targets CMS 13 and .NET 10 with modernized DI registration, appsettings.json configuration and CMS 13 API alignment for scheduled jobs and property definition types, and the feature set is a genuine enterprise form builder: conditional field display (AND/OR with equals/not-equals/contains/regex), multi-step forms with conditional step routing, progressive profiling through field mapping to MA/CRM, hidden visitor-profile fields, file upload, CAPTCHA, custom actors for arbitrary external API calls, database submission storage with export, and a headless rendering mode. Not higher because form analytics are limited to submission counts with no funnel or per-step drop-off reporting.

There is no native email send in CMS PaaS, but the first-party connector breadth is above average and, importantly, current: EPiServer.ConnectForMarketingAutomation 13.0.0 plus CMS 13 builds of the Delivra, Eloqua, HubSpot, Pardot, Salesforce, Salesforce Marketing Cloud, Marketo and Microsoft Dynamics connectors shipped in 2026, so the integration layer survived the CMS 13 cut. Held at 65 because the depth is form-submission-to-ESP field mapping only — no CMS-event-triggered sends, no subscriber list management in the CMS, and no email template authoring or preview; Optimizely Campaign does all of that but is a separate product outside PaaS.

CMS PaaS is a capture-and-trigger source, not an orchestration engine: form submissions flow through MA connectors so nurture, drip and lead scoring all execute in the connected external platform, and ODP behavioural events support audience building rather than campaign flow. Nothing in CMS 13 or Commerce Connect 15 changes this — there is no drip builder, no lead scoring model, no lifecycle stage management and no multi-channel campaign canvas in the CMS. Above the 20–35 floor only because the connector plumbing and ODP event stream make the handoff genuinely turnkey.

ODP is a genuine first-party CDP with bidirectional CMS wiring — the JavaScript SDK streams page views, form submissions and custom events, identity resolution matches across multiple identifiers, and real-time audiences (sub-90-second freshness) resolve into CMS Audiences for personalization — extended in 2026 by the Lytics Audience Sync App importing external audiences and by Content Recommendations writing topic interests onto ODP profiles. Held to 62 because ODP is separately licensed and, on the CMS side, the audiences it feeds only render on in-process MVC sites, so the profile data does not reach a Graph-delivered headless frontend through any CMS mechanism.

The ecosystem is broad — the Optimizely App Directory (surfaced through Opti ID and OCP) offers filterable, no-code installable apps across products with a 700+ technology-partner network behind it, OCP lets developers build and publish their own connectors, and the first-party set is strong: Commercetools, Shopify, Algolia, CMP DAM, Graph, ODP, Experimentation and eight MA/CRM connectors. Held at 68 because the estate is fragmented across three registries (optimizely.com/apps, the Opti ID App Directory, and the legacy world.optimizely.com Episerver Add-ons NuGet catalogue) and the CMS 13 cut-over is actively straining it — Search & Navigation is gone, and CMS 13 compatibility is unstated for large parts of the add-on catalogue.

Corrected downward: the prior score credited a native webhook management UI in the CMS 13 admin interface, which does not exist — the CRUD interface with topic selection and wildcard patterns is OptiGraphExtensions, a community open-source add-on built for CMS 12, and native admin webhook management is discussed as a future CMS 14 direction. What CMS 13 actually ships is Graph webhooks, registered through the API with Basic/HMAC auth and a secret-derived payload signature, covering doc.created/updated/deleted with wildcard topics plus bulk-sync-completed and expired-content events, alongside the server-side IContentEvents model and a GA JavaScript SDK with webhook support. Not lower because Graph is license-included so every CMS 13 deployment has these events; not higher because there is no admin UI, no delivery log, and retries for undeliverable notifications are explicitly limited.

CMS 13 turned preview into a configurable routing system: Settings > Preview routing exposes a per-application toggle, an editable fallback route, and additional routes added per base type or content type, all composed from predefined tokens (Context, Host, Key, Locale, Path, Segment, Version); preview-token validation checks the principal's permissions on the routed content rather than binding to a single content reference, so tokens are reusable across a headless setup. Visual Builder gives synchronized live preview by default, Content Variations get variation-specific preview URLs, and Graph draft mode indexes drafts for headless consumption. Not higher because there are still no public unauthenticated shareable preview links and no per-branch or per-PR preview environments.

Opti ID is mandatory in CMS 13 and consolidates identity across the whole suite: SSO against any SAML or OIDC IdP, SCIM provisioning officially supported with Entra ID, Okta and PingOne (group push creates internal Opti ID groups), and instances, system roles and custom roles managed in the Opti ID Admin Center. Inside the CMS this resolves to content-tree ACLs (Read/Create/Change/Delete/Publish/Administer per node with inheritance), per-language-branch permissions and per-application access. Not higher because there is still no field- or property-level permission within a content type, and SCIM syncs only users and groups — role assignment remains a manual Opti ID task.

CMS 13 consolidates what were separate Content Management and Content Definitions APIs in CMS 12 into a single REST API v1 rooted at /_cms/v1, auto-registered by AddCms() along with the OAuth token endpoint, and pairs it with Optimizely Graph as the GraphQL delivery layer (GraphiQL playground, cached query templates, a published known-limitations page). The docs are explicit that the CMS REST API is not for delivery — Graph is — which is a coherent split, but the Content Delivery API survives only as a compatibility bridge that will not cover Visual Builder experiences and will not be ported to CMS 14, and the EPiServer→Optimizely namespace migration is still incomplete. That forced-migration overhang keeps it out of the 85+ band.

Optimizely Graph supports cached query templates (stored=true plus the cg-stored-query: template header) that pre-translate repeated query structures, and the Graph C# SDK adds client-side result caching with custom eviction policies on top of Cloudflare CDN edge caching, cursor-based pagination and IAsyncEnumerable streaming. Against that, Graph returns at most 10,000 hits so skip+limit paging has a hard ceiling, and per-tier throughput/rate-limit numbers are acknowledged to exist but are not published. Documented ceilings plus undocumented throughput keep this just below the 75+ band.

Two mature first-party SDKs anchor the ecosystem: the Graph C# SDK (fluent API, caching, strongly-typed results) and the official JavaScript/TypeScript SDK (@optimizely/cms-sdk, episerver/content-js-sdk), which reached general availability in 2026 with first-class React/Next.js support covering both SaaS and PaaS, alongside @optimizely/cms-cli. There are still no official Python, Go, Ruby, PHP, Swift, or Android SDKs, holding this in the 2–3-official-SDK band despite the quality and active release cadence of what exists.

Scored against CMS 13 specifically, the add-on ecosystem is the platform's weakest technical surface right now: CMS 13 targets .NET 10 exclusively and its application-based architecture changed how add-ons hook in, so every package must be recompiled against 13.x assemblies before a site will even start, and as of late May 2026 only one or two third-party packages had shipped with upgrade issues unanswered elsewhere. Recompiles are landing steadily (Stott RobotsHandler 7.0.0, GoogleMapsEditor 5.0.0, Geta Sitemaps), and the App Marketplace, Optimizely-wide technology-partner network and CMS 13's embedded DAM remain real assets. But add-ons — not the CMS core — were the documented critical path for migration, and Commerce 15 is still in preview, so the effective CMS 13 catalog is well short of the 75+ band.

CMS 13 pairs full ASP.NET Core extensibility — IServiceCollection DI, middleware pipeline, IContentEvents hooks, IConfigurableModule/IInitializableModule startup extension — with Visual Builder custom elements definable in the Admin UI without a code deployment, and Application Management replacing SiteDefinition with auto-migration and expanded host types. Content-type contracts are plain .NET interfaces inheriting IContentData, so the model is code-first and fully version-controllable. This is genuine server-side-hook-plus-custom-UI extensibility, comfortably in the 75+ band.

Opti ID is now a mandatory component of CMS 13 and included in the license, giving every PaaS deployment centralized identity with SSO, SAML/OIDC federation, group and role management, and MFA rather than leaving auth to per-project ASP.NET Core Identity wiring. SSO is available across DXP tiers rather than Enterprise-gated, and the Graph SDK defaults to single-key auth with optional per-query Basic auth while the REST API uses OAuth 2.0 bearer tokens from the AddCms()-registered token endpoint. A September 2026 incident in which Opti ID redirected users to the wrong SSO login page is the main blemish on an otherwise strong, now-unified story.

CMS 13 cleanly separates identity from content authorization: Opti ID owns users, groups and custom roles, and when a user signs in the role syncs into CMS 13 as a user group against which six access types (read, create, change, delete, publish, administer) are set per content path, with Everyone and Administrators evaluated at runtime and a documented non-Opti-ID path for self-hosted deployments. CMS 13 also added permission enforcement during user-deletion and file-extension whitelisting on import. It still has no field-level permissions and no content-instance ownership scoping, which caps it in the custom-roles-with-scoping band rather than 80+.

Optimizely DXP holds SOC 2 Type II, ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, PCI DSS v4.0.1 and TISAX, all independently audited and surfaced through trust.optimizely.com, with a GDPR DPA available to all DXP customers and EU data residency on Azure. PCI DSS v4.0.1 is a genuine differentiator for commerce workloads. The absence of a HIPAA BAA and of FedRAMP authorization keeps it from going higher.

Correcting a prior error: Optimizely does run a public bug bounty, migrated to Bugcrowd, paying up to USD $3,500 with partial safe harbor and disclosure permitted across 12 web and 3 API targets including episerver.net domains, backed by [email protected], a numbered Security Announcements Center (CMS-2025-01 high Stored XSS, CMS-2025-02 password complexity, CMS-2025-03 upload validation), annual third-party pentests and automated plus manual source analysis. Against that, the February 2026 ShinyHunters vishing breach is confirmed — attack Feb 11, disclosed Feb 23, attackers phished SSO credentials and MFA codes and took business contact information, CRM records and back-office documents, though they could not escalate privileges or reach customer databases and DXP production content was not implicated. A real breach plus a high-severity CMS XSS keeps this well below the 70+ clean-history band even with bounty and disclosure in place.

Both deployment modes remain available — managed DXP hosting on Azure App Service across Integration, PreProduction and Production environments, or self-hosted ASP.NET Core on any compatible infrastructure, now genuinely cross-platform on .NET 10 with first-party Docker guidance. The caveat that pulls this down from the prior score is that CMS 13 makes Opti ID and Optimizely Graph mandatory components, so a self-hosted CMS 13 instance is no longer independent of Optimizely's cloud services the way CMS 12 could be. Both options exist, but the self-hosted option is materially less sovereign, placing it at the low end of the both-available band.

Optimizely DXP contracts an up-to-99.9% uptime SLA for production delivery on Azure with a public status page and a Severity 1 initial-response target of 30 minutes under Standard Support. September 2026 was a noisier month than the prior review captured: an SSL trust issue caused login failures across multiple DXP environments on Sept 2, Opti ID misrouted users to the wrong SSO login page on Sept 17, plus SMTP delivery delays and a CMP analytics outage. Because Opti ID is mandatory in CMS 13, identity-layer incidents now degrade editing for every CMS 13 tenant, so 99.9% with a visible cluster of auth incidents sits mid-band rather than at its top.

DXP handles horizontal scaling on Azure App Service with CPU/memory autoscale, CM/CD separation, Cloudflare CDN edge caching, and a minimum of two availability zones per enabled region (provisionable across three), while Graph's cached query templates and the SDK's client-side caching with eviction policies reduce delivery load at scale. Tiering (Performance, Optimized, Premium) gives different scale envelopes and the platform is enterprise-proven with references like H&M, PayPal, Toyota and Vodafone. Published hard numbers remain thin and Graph's 10,000-hit result ceiling is a real constraint on very large result sets, holding it below 75.

Correcting a prior error: Optimizely publishes DR objectives in its Service Continuity Policy rather than withholding them — for CMS the RPO is 10 minutes for web text content in normal operation and 1 hour in a declared DR situation (24 hours for other services), with content databases backed up every five minutes, full hourly backups, and up to 35 days of history for point-in-time restores, plus 24-hour full production backups with transaction-log PITR and multi-copy blob replication. Content and database export are available through the Deployment API as bacpac files and read-only BLOB SAS links. It falls short of the top band because the RTO is deferred to the Support Policy rather than stated as a figure, and automatic failover to a geo-redundant secondary region is a paid high-availability add-on rather than baseline.

Correcting a prior error: CMS 13 local development is now containerized out of the box — the Alloy template CLI accepts a Docker option that emits a ready-made docker-compose.yml bringing up a SQL Server container alongside the web app plus a .env file for SA_PASSWORD/DB_NAME/DB_DIRECTORY, and Optimizely publishes a first-party 'Create a Docker file for CMS 13' guide. Because CMS 13 runs on cross-platform .NET 10 rather than being coupled to Windows and IIS, it develops natively on macOS including Apple Silicon and on Linux containers, and no license file is required locally. It stops short of the top of the band because Opti ID and Optimizely Graph are mandatory cloud dependencies, so there is no fully offline inner loop.

The DXP Deployment API is a full REST surface for pipeline automation — start, complete and reset deployments per environment, sync databases and BLOBs from Production downward, export databases as bacpac, and mint read-only SAS links for BLOB containers — wrapped by the EpiCloud PowerShell module and the dotnet-episerver CLI, with documented Azure DevOps multi-stage YAML, GitHub Actions and Octopus Deploy patterns over three-tier promotion with slot swapping and zero-downtime deploys. CMS 13 adds the ability to apply app settings and connection-string changes to a specific environment from the PaaS portal without running a full code deployment, which removes a common redeploy round-trip. Branch-per-PR content environments are still not natively supported, keeping it just above the mid-band.

The versioned v13.0.0-CMS documentation tree is unusually complete for a major release six months in: install, system requirements, configure, deploy, Dockerfile creation, content model/IContent, REST API reference, access rights documented separately for Opti-ID and non-Opti-ID setups, settings administration, a dedicated upgrade-from-CMS-12 guide, and — notably — separate framework/platform and third-party-package breaking-changes pages, supplemented by a published CMS 13 technical webinar Q&A and Q&A PDF, with Swagger UI and GraphiQL for interactive exploration. Frontend coverage has broadened to Next.js, React and Astro. It stays below 80 because backend framework guidance is .NET-only and the practical state of add-on and Content Delivery API availability is communicated more clearly in partner blogs than in official docs.

The official JavaScript/TypeScript SDK reached general availability in 2026 with full typing, autocomplete, structured error handling and first-class React/Next.js rendering, and pairs with @optimizely/cms-cli to enable genuine code-first content modeling — content types and property groups authored as TypeScript definitions and synced to the CMS, making code the source of truth for types under version control, with the contentType function's typing improved and build config now carrying language/locale settings. That is materially stronger than a merely typed client. It stays below the 80+ auto-generation band because for PaaS the canonical content model is still authored in C# as IContentData interfaces, and the TypeScript modeling flow is primarily the SaaS-oriented path feeding the frontend.

Post-GA velocity on CMS 13 is now demonstrably monthly rather than a one-time launch: the ongoing '2026 Optimizely CMS 13 release notes' page tracks a continuous stream through Q3 2026 — 13.0.2, Search Management portal surfaced inside the CMS navigation bar, Graph C# SDK facet configuration and boolean facet filtering, the Headless Forms REST API (Optimizely.Cms.Forms.Service) upgraded for OIDC, and Marketing Automation connectors (Delivra, Eloqua, HubSpot, Pardot, Salesforce, SFMC) all republished at 13.0.0. Optimizely has also publicly adopted a 'CMS Core' build-once philosophy so SaaS-first features (Visual Builder, GEO/.llms.txt, Opal Page Builder and content-model agents) now land on PaaS rather than staying SaaS-exclusive. Not higher because PaaS consumption is still customer-driven NuGet upgrades on the customer's own timetable, so shipped cadence and realized cadence diverge.

Optimizely maintains separate, structured, per-product release-note streams in the Support Help Center — an ongoing 2026 CMS 13 page (44937048830221), the one-time CMS 13 GA page (44734633809037), a still-live 2026 CMS 12 page (33309043090189), a CMS SaaS page, and a 2026 Opal page — so a PaaS buyer can follow their exact product line with version numbers and dated entries rather than a blog firehose. Breaking changes are documented separately with a dedicated 'Upgrade to Optimizely CMS 13 from CMS 12' guide in developer docs, and the version support policy is explicit (CMS 13 and 12 receive bug and security patching; CMS 11 and earlier only severe security). Not higher because breaking-change detail, Graph API migration reference tables, and upgrade walkthroughs remain split across developer docs and Optimizely World blogs instead of being inlined into the release-notes entries themselves.

Optimizely now publishes a standing public product-updates page per product line (optimizely.com/product-updates/content-management) stating the current quarter's investment areas — agentic content workflows, deeper platform connectivity, AI discoverability, virtual teammates for translation and optimization, expanded developer tooling — alongside the release notes' 'Coming next' section and Forum idea voting. Critically, the long-standing PaaS-vs-SaaS investment uncertainty has been answered publicly with the stated 'CMS Core' philosophy (features built once to serve both deployment models), and the roadmap was validated twice in 2026 by CMS 13 GA in March and the Agent Orchestration Platform launch at Opticon NYC. Not higher because there is still no public roadmap board with per-item status lifecycle and vote counts, and dated delivery commitments are absent — direction is disclosed, timing is not.

CMS 13's migration support is genuinely above average for a .NET major: CMS 12 remains under active maintenance in parallel with its own 2026 release-notes stream (a real deprecation window rather than a forced cutover), a first-party 'Upgrade to CMS 13 from CMS 12' doc exists, the Graph C# SDK ships an API migration reference mapping every Search & Navigation call plus .ToGraphQL() for debugging, and Optimizely published first-party guidance on using agentic AI to accelerate CMS and Commerce upgrades. Practitioners report the jump is materially easier than CMS 11 to 12. Not higher because the surface area broken is large — mandatory Graph and Opti ID, .NET 10, on-page editing removed, SiteDefinition replaced by the Application Model, ContentArea.FilteredItems obsoleted — and the third-party ecosystem lagged GA badly, with developers reporting solutions that restore and build cleanly on 13.0.2 but fail at runtime behind roughly ten partner packages plus a ShellModule DI breakage.

Community proxies grew modestly across 2026: the Optimizely Slack community now lists 5,700+ members (up from ~5,000), Optimizely Academy reports roughly 11,000 enrolled students, G2 carries 957 reviews across Optimizely products (up from ~908) with 204 on the CMS product specifically, and GitHub holds ~280 repositories across the optimizely and episerver organizations against ~3,000 Stack Overflow questions under the legacy tags. Not higher because this is an enterprise .NET community whose absolute scale sits an order of magnitude below WordPress or Drupal, and the Stack Overflow tag volume is largely historical EPiServer-era rather than current CMS 13 activity.

Engagement through the CMS 13 cycle has been unusually dense for a platform this size: independent practitioner posts ran continuously from pre-GA into Q3 2026 (Robert Svallin's Alloy upgrade walkthrough, Sanjay Katiyar's 12-to-13 migration, Aniket Gadre's 'what actually changed', Hung Le Hoang's two-part agentic upgrade series, Wojciech Seweryn's pre-upgrade checklist, Gosso's technical Q&A, Stuart Greig's upgrade comparison), the developer forum carries real troubleshooting threads with Optimizely staff answering, and the OMVP program announced a fresh H2 2026 cohort. Partner-side engagement is being actively driven through the Opal Innovation Challenge and Opal Certification World Tour. Not higher because activity is concentrated in a recognizable core of a few dozen OMVPs and partner bloggers rather than a broad contributor base, and GitHub issue throughput stays low relative to open-source-first ecosystems.

Beyond the ~592-partner directory (roughly 301 technology, 291 channel) with a tiered program, Optimizely materially deepened partner enablement in 2026: an Optimizely One Partner Accreditation Program, a relaunched certification catalog built with OMVPs and subject-matter experts including Core Competency tracks for new partners, and the partner-exclusive Opal Innovation Challenge and Opal Certification World Tour. Named enterprise SIs span Rightpoint (one of five Premier Platinum partners globally), Valtech, Perficient, Verndale, Netcel, Sagepath Reply and UNRVLD, and the 2026 calendar carried a dedicated UK Partner Day plus Opticon NY and London. Not higher because coverage remains concentrated in Northern and Western Europe and North America, with APAC and LATAM noticeably thinner.

CMS 13 drove a broad and sustained independent-content wave across 2026 spanning agency deep-dives and individual developer blogs — Royal Cyber's upgrade planning guide, Nishtech, NOA Ignite, Niteco, Mando Group, Nansen, Sagepath Reply, Technical Dogsbody's CMS roadmap analysis, potnoddle.github.io's agentic-CMS roadmap read, stuartgreig.dev, wseweryn.dev — plus trade coverage from ContentGrip, MarketScale and CMSWire and an Optimizely Academy catalog with ~11,000 students. Not higher because the independent long-form catalog is still thin where buyers look first: Udemy and Pluralsight coverage of Optimizely CMS is sparse, YouTube tutorial volume is low, and almost all the depth is authored by implementation partners with a commercial interest rather than neutral educators.

The hiring surface is real but shallow: aggregators list ~97 Optimizely job vacancies as of September 2026 with US averages around $155K/yr (typical band $135K-$174K) and Episerver-specific contract rates near $61/hr, and the relaunched certification catalog plus an ~11,000-student Academy give a formal credentialing path. CMS 13's .NET 10 base means general .NET developers can be retrained rather than hired cold, and the ~592-partner network supplies bench capacity. Not higher because platform-specific depth stays genuinely niche — Episerver/Optimizely developer listings number in the single digits on some national job boards, postings routinely demand 3-6 years of platform-specific experience on top of 6 years of .NET, and supply concentrates in the Nordics, UK and US such that buyers elsewhere still struggle to staff.

Momentum indicators strengthened materially in 2026: Optimizely reported 42% quarter-over-quarter ARR growth for its agent orchestration platform, with nearly 1,700 companies using Opal, 4,000+ unique agents built and 172,000+ agent runs across experimentation, campaign execution, content production and reporting — layered on a $400M ARR base and 300+ new logos in 2025 (Salesforce, Zoom, New Era, Mazda). G2 review volume grew from ~908 to 957 across products, Forrester named the platform a 'customer favorite' in Experience Optimization, and Opticon ran two 2026 editions (NYC, London). Not higher because the headline Opal figures are vendor-reported and company-wide rather than PaaS-CMS-specific, headcount edged down 1.3% within 2026, and the PaaS installed base is mid-migration to CMS 13 — absorbing budget that would otherwise fund net-new PaaS adoption.

Stability signals are solid and improving: Optimizely remains Insight Partners-owned (Episerver acquisition 2020, rebrand 2021), disclosed a $400M ARR milestone, reported 42% QoQ ARR growth on its agent platform, grew headcount 19.9% from ~1,410 in 2023 to ~1,691 by March 2026 with no confirmed layoffs in 2025-2026, and is visibly funding product across CMS 13, Opal and SaaS CMS simultaneously. Not higher because there are no audited public financials, headcount slipped 1.3% within 2026 after years of growth, and the fundamental overhang is unresolved — a PE sponsor six years into a hold with no announced IPO or exit path, and no disclosed funding event since the 2019 Series D that preceded the acquisition.

Optimizely's analyst standing is now among the strongest in this dataset: it took the top position in the 2026 Gartner Magic Quadrant for Digital Experience Platforms — leading on both Ability to Execute and Completeness of Vision and ending Adobe's five-year run at the top — with Gartner crediting platform breadth and modularity, pricing and packaging, and global momentum, and dropping the prior criticism that experimentation and content-marketing focus was diluting its DXP strategy. That stacks on Leader placements in the 2026 Gartner MQs for Content Marketing Platforms (9th consecutive year) and Personalization Engines (2nd year), the Forrester Wave for DXPs Q4 2025, and the 2026 Forrester Wave for Experience Optimization Solutions, where it scored the highest possible mark in 15 criteria. Not higher because this recognition attaches to Optimizely One as a suite rather than to PaaS CMS 13 specifically, Adobe remains close on both axes, and greenfield headless deals still route to Contentful, Sanity and Storyblok.

G2 now shows a precise figure for the CMS product itself: 4.0/5 across 204 reviews, against a blended 4.2/5 over 957 reviews spanning all Optimizely products — and the scoring guide places 4.0 with a review count in this range at 45-60. Reviewers praise the editing interface, ease of use for non-technical staff, customization depth, multi-language handling and responsive support, but complaint themes are persistent and operationally serious: a steep learning curve requiring developer involvement for routine work, the Projects feature reported as crashing sites, difficulty integrating unsupported third-party software, and upgrades described as hard and tied to framework version jumps. Not higher because those upgrade complaints land directly on the CMS 13 story this score is measuring, and the reviewer criticism that Optimizely Graph has underdelivered on expected AI functionality now bites harder given CMS 13 makes Graph mandatory.

Optimizely pricing for CMS 13 PaaS remains entirely sales-gated in September 2026 — every product on optimizely.com/plans routes to 'Talk to Sales' with no published tier matrix, no dollar amounts and no self-serve checkout. Third-party procurement data now puts the median annual contract at ~$82,894 across 125+ logged transactions (entry ~$36K, enterprise $250K–$500K+), and PaaS buyers additionally carry hosting cost that is never quoted publicly. Not higher because complete opacity persists across all products; not lower because the DXP consumption-metrics documentation at least names what is metered.

CMS 13 bundling Optimizely Graph and Opti ID into the base license removes two previously separate line items, and DXP publishes a consumption-metrics reference so customers can at least see what is counted. But the model stays hybrid and usage-exposed: annual platform fee plus metered page views, sessions, API calls, MTUs and GMV with overage fees when contracted allocations are exceeded, plus separately licensed Commerce, Campaign, Experimentation and ODP, plus credit-based Opal AI consumption. Third-party analysis that the license is only 30–50% of first-year spend confirms the sticker is a poor predictor of total cost.

CMS 13 genuinely reduces licensing gates — Graph (search/content delivery) and Opti ID (identity/SSO) are bundled into the base CMS license and Search & Navigation is deprecated rather than upsold. The offset is that gating has shifted from price tier to hosting model: Opti ID is DXP-only, and Visual Builder — the flagship CMS 13 editing surface — plus the embedded DAM, External Content, CMP integration and Opal are all unavailable without it, so a self-hosted CMS 13 licensee is locked out of the headline features. Commerce Cloud, Campaign, Experimentation and ODP remain separate purchases.

Nothing improved in 2026 and new sourcing makes the terms look worse than previously scored: no monthly billing at any tier, no self-serve trial, 3–7% escalators standard (5–15% cited by some trackers, 5–10% at renewal if not negotiated), and auto-renewal windows reported at 60–90 days ahead of expiry with at least one tracker reporting a two-year minimum commitment. Optimizely publicly advertises no startup, nonprofit or education program — reduced pricing is entirely at sales discretion. Not lower because 2–3 year terms do buy real 20–30% discounts and the escalator is negotiable upfront.

Optimizely PaaS CMS 13 has no free tier, no community edition and no open-source path. A license is waived only for local IIS Express development; any testing or production instance requires a commercial license, and there is no self-serve trial or sandbox for the CMS at all. The Stride starter template (replacing Alloy) and open-source Foundation are developer scaffolds, not free product tiers, and the mandatory Opti ID is DXP-only so even an evaluation install is procurement-gated.

CMS 13 runs locally on .NET 10 with project templates and the Stride demo site, license-free under IIS Express, and ships C#/JavaScript SDKs for Graph — so a developer inside a licensed org gets to a working site in under a day. But CMS 13 pushed two hard dependencies into the cloud: Graph requires a cloud-connected index even for local development (a Docker-based local Graph service is only 'being investigated' on the roadmap), and Opti ID login is DXP-only. Combined with no trial and multi-day DXP provisioning behind a sales cycle, a new evaluator cannot reach first value without procurement.

Six months post-GA the CMS 13 upgrade has concrete published numbers rather than open-ended risk: a manual CMS 12→13 upgrade of a typical 40–60 content-type site runs 6–8 weeks of developer time, roughly 5 weeks end-to-end with partner automation, and Niteco sells a fixed-price 8-week guaranteed CMS 13 delivery; partner agentic-AI tooling reports 60–70% reductions in migration time and cost. The work is still substantial — .NET 10, Find-to-Graph, OPE-to-Visual Builder, SiteDefinitions-to-Applications, removal of dynamic properties/mirroring/legacy plugins, with third-party package incompatibility the single largest effort area — but CMS 12 remains patched in parallel so there is no forced cutover deadline.

CMS 13 sits on current mainstream .NET 10 and the new fluent C# SDK for Graph keeps Graph work in familiar idioms, which helps talent availability. But Optimizely-specific roles still command a premium — ZipRecruiter puts US 'Optimizely' postings at ~$155K average ($135K–$174K typical) and mid-senior Optimizely CMS .NET roles at $150–160K against a senior generalist .NET baseline nearer $130–145K — and CMS 13 forces re-skilling of the existing pool onto Graph, Visual Builder and Applications. Certification is $300 per exam and lapses after 24 months, making it a recurring rather than one-off cost.

On DXP, hosting stays bundled and predictable — Azure compute, Cloudflare CDN, Azure SQL and Blob Storage across Integration, Preproduction and Production environments inside the subscription, with Graph infrastructure now folded into the CMS 13 license rather than billed separately. Correcting an earlier read: CMS 13 does not force DXP hosting — Graph is a cloud service but any CMS instance that can reach it can use it, so on-premises CMS 13 remains supported, though self-hosters pay their own Azure (third parties estimate $10K–$50K+/yr) and lose Opti ID and everything behind it. Not higher because the bundled cost is buried inside a large opaque license with metered traffic overages layered on top.

CMS 13 continues to chip away at operational load: scheduled-job hang detection, a cloud license-management dashboard, Applications replacing site definitions, and the September 2026 addition of a Graph Portal item in the CMS nav so search performance, pinned results and synonyms are managed without leaving the CMS. Optimizely manages the Azure infrastructure, SQL and Blob Storage on DXP while the customer still owns CI/CD, Application Insights, portal administration and — the real recurring burden on PaaS — application-level .NET and NuGet upgrades plus third-party package compatibility. Solidly mid-range: less than true self-hosting, materially more than managed SaaS.

CMS 13 deepens coupling — Search & Navigation is gone in favour of Graph, which cannot be self-hosted, and Opti ID is DXP-only, so a full exit means replacing search/delivery and identity as well as hosting. Worse, the primary export format is weaker than it looks: .episerverdata packages do not carry portable content-type definitions, only metadata referencing the original compiled .NET assemblies, so a package is realistically importable only into an equivalent Optimizely codebase — and even Optimizely's own PaaS→SaaS path drops entities such as personalized content and visitor groups. Not lower because the Content Delivery API (JSON), Content Management API and Service API provide documented programmatic bulk export.

The dominant CMS 13 conceptual change is PageData → ExperienceData, and the architecture explicitly expects coexistence — both are first-class citizens, legacy PageData content stays in the form-based editor until migrated, and Block Elements let blocks live inside Visual Builder Columns — so developers must hold two editing models at once rather than replacing one with another. On top of the ~9 legacy domains (ContentReference/ContentArea, publishing/versioning, initialization modules, Visitor Groups) CMS 13 adds Experiences/Sections/Elements/Columns, Blueprints, Content Variations, the Application Model replacing SiteDefinition, and mandatory Graph and Opti ID. Not higher because the dual-model coexistence is a lasting tax rather than a transition step; not lower because sections/columns/elements is a familiar page-builder mental model and IContentData content-type contracts clean up the model layer.

Optimizely Academy now publishes a dedicated PaaS learning path — 'PaaS CMS Development Fundamentals (CMS 13)' (April 2026), covering the architecture, the CMS 12 → 13 evolution, and the roles of Graph and Opti ID — alongside the 'CMS 13 – All you need to know!' collection (March 2026) that is still shipping new content weekly, a PaaS CMS Developer Certification exam, and live learning events in New York (Sept 2026), London and online (Oct 2026). Official docs cover install, upgrade, breaking changes, a third-party package compatibility page, and a webinar FAQ, backed by a published Q&A PDF and heavy partner/community coverage (Gosso, Svallin, Epinova, NoA Ignite, Velir, Pino Labs). Not higher because there is still no interactive in-console onboarding or guided in-product tutorial and the structured path is eLearning-and-docs rather than hands-on; not lower because a vendor-run, role-specific structured learning path plus certification and live training is exactly the 70+ band.

CMS 13 runs on .NET 10 with standard ASP.NET Core MVC, ships the CMS REST API by default via AddCms(), renders Visual Builder through MVC tag helpers, and the headless story is now genuinely mainstream: the Stride starter is a Next.js app with full TypeScript typing and Tailwind CSS querying a standard GraphQL endpoint, with the Graph C# SDK and JavaScript SDK both GA. Working against that, Optimizely Search & Navigation (EPiServer.Find) is removed rather than deprecated in CMS 13 and its packages will not be upgraded, so Graph is the only supported search path and every implementation inherits its proprietary sync and schema semantics on top of the long-lived EPiServer API surface. Not higher because .NET plus EPiServer-era APIs (IContentRepository, initialization modules, virtual roles) still narrow the talent pool versus JS-native headless platforms; not lower because GraphQL, React/Next.js and ASP.NET Core MVC are all industry-standard and both SDKs are GA.

The transition-period starter gap the prior score flagged has closed: CMS 13 launched with a new first-party template, Stride, built around the Visual Builder content model — a single command scaffolds a working Next.js app with pre-built composition/experience components, Tailwind styling, full TypeScript typing, and config:push scripts that sync its content-type configuration into the CMS — while Alloy has been updated for CMS 13 and still installs via `dotnet new epi-alloy-mvc`, giving a working sample site and admin UI out of the box. An official 'Migrate an Alloy site from CMS 12 to CMS 13' guide covers the brownfield path, and custom elements are definable in the Admin UI without a code deployment. Not higher because deployment/CI-CD configuration is not part of the shipped templates and the Content Delivery API build for CMS 13 is still roadmap with no ETA, leaving some starter architectures unsupported; not lower because vendor-maintained templates with example content now exist on both the coupled and headless paths.

Zero-to-working on CMS 13 is a heavy config surface: Optimizely Graph alone needs five appsettings values (GatewayAddress, AllowSendingLog, SingleKey, AppKey, Secret) plus the Graph service enabled on the instance before the project is wired, on top of an EPiServerDB connection string pointing at SQL Server 2022 or Azure SQL at compatibility level 140+, Opti ID via EPiServer.OptimizelyIdentity and services.AddOptimizelyIdentity(), and explicit service registration in Startup.cs for every referenced NuGet package. Several defaults are non-obvious traps — Opti ID auto-maps the CmsEditors and CmsAdmins virtual roles so pre-existing mappings must be deleted, Opti ID covers only shell/preview/edit unless you opt it in application-wide, and headless preview additionally needs AllowSyncDraftContent set on Graph. Not higher because both mandatory components carry their own credential and enablement steps before any content renders; not lower because the REST API is included by default via AddCms() and configuration lives in conventional appsettings.json and Startup.cs rather than a proprietary format.

Modeling is materially better supported than in CMS 12: content type contracts are plain .NET interfaces inheriting IContentData that can be used in AllowedTypesAttribute for cleaner composition, Content Variations store only explicitly modified properties as deltas, and the Opal Content Model Creation agent ships with CMS 13 with no configuration — it builds a content model from a URL or image, cross-references existing content types to avoid duplicates, returns each type marked New or Modified with full JSON, and asks before applying to the instance. The underlying risks are unchanged: the code-first model still auto-detects schema changes at startup, removing a property still orphans its data, and there is no migration or rollback tooling; the upgrade also surfaced a schema-name trap where content type names containing non-ASCII characters, hyphens or dots broke CMS 13 until a sanitizing migration step was added. Not higher because schema changes remain irreversible with no migration story and Visual Builder adoption forces remodeling PageData types as ExperienceData; not lower because the Opal agent plus strongly-typed Graph results remove a real class of hand-modeling and runtime-schema errors.

On the coupled MVC path preview is effectively free — Visual Builder is the default editing experience on PaaS CMS 13, renders server-side through tag helpers with no Graph dependency, and gives autosave plus synchronized preview in a single Outline + Live Preview workspace, closing the gap that previously separated PaaS from SaaS. The headless path is a different story and the docs are explicit that traditional on-page editing from MVC is not available by default: you set AllowSyncDraftContent on Graph, inject the CMS-served communicationinjector.js script into the draft layout, and wire signed preview tokens, draft-content authentication, URL routing and live-refresh hooks yourself. Not higher because the headless route is a documented multi-step integration rather than plug-and-play; not lower because official 'Live preview with Next.js (headless)' and 'Manually enable live preview' guides exist and the MVC route needs no preview code at all.

Optimizely Graph knowledge is now non-optional: Search & Navigation is removed from CMS 13 rather than deprecated and its packages will not be upgraded, so every implementation either learns Graph or builds a custom search provider, and teams migrating also need people who can read and patch community add-ons — Advanced Reviews, Geta NotFoundHandler, Geta Sitemaps and GoogleMapsEditor all required CMS 13 forks against moved or removed APIs. Offsetting that, .NET 10 and ASP.NET Core MVC are mainstream, certification is available but not mandatory, and Academy's PaaS CMS 13 fundamentals path plus GA C# and JS SDKs shorten the ramp for new hires. Not higher because mandatory Graph, the Visual Builder/ExperienceData paradigm shift and add-on patching all sit above the .NET baseline as proprietary knowledge; not lower because no certification is required and the underlying stack is a framework most .NET developers already know.

A production CMS-only implementation still needs roughly 5–7 people — technical lead, 2–3 .NET developers, frontend developer, DevOps, PM — because PaaS puts hosting, environment and deployment ownership on the customer regardless of how much the authoring tooling improves. Stride and the out-of-the-box Opal agents shave marginal effort off scaffolding and content modeling, and mandatory Graph removes the separate search-infrastructure specialist that Find implementations needed, but neither collapses a role. Not higher because DevOps plus a multi-developer .NET team remains the floor and Commerce pushes it to 7–9; not lower because the tooling gains are real and the search specialist genuinely disappears.

Blueprints are the step change: editors create reusable layout templates directly in the UI — campaign landing pages, contest entry forms, mastheads, column and grid layouts — with automatic thumbnails, a browsable visual gallery, and export/import between environments, while Sections and Experiences decouple design from content models so content managers assemble page layouts from reusable sections without developer involvement. Around that sit Visual Builder as the default editor with autosave and drag-and-drop section reordering, Content Manager's search-first navigation, Content Variations managed from a toolbar dropdown, custom elements definable in the Admin UI, and Opal agents that run without configuration. Not higher because new content types and templates still require a .NET build and deploy, and legacy PageData pages remain in the form-based editor until they are remodeled as ExperienceData; not lower because launching a new campaign page from an existing blueprint is now genuinely a marketer-only task.

The CMS 12→13 path remains a re-platform rather than an in-place upgrade: a breaking Optimizely Graph schema change prevents CMS 12 and CMS 13 sharing one Graph instance, so the documented migration stands up a NEW CMS 13 project alongside CMS 12, and Optimizely now publishes a dedicated third-party incompatibility catalog naming commonly-used packages that simply break (Geta.NotFoundHandler, Geta.Optimizely.Sitemaps, Geta.Optimizely.GenericLinks, Geta.Optimizely.ContentTypeIcons, Advanced.CMS.AdvancedReviews, RobotsHandler) with removal leaving orphaned content-type definitions that throw 'could not create instance' at runtime. Add .NET 10 + Visual Studio 2026, EPiServer→Optimizely namespaces, removal of Search & Navigation, Plugin Manager, dynamic properties, mirroring and REST API extension points, OPE disabled for Visual Builder, and the silent break where IValidate<T> validators are no longer auto-discovered and stop running unless explicitly DI-registered. Not higher because the parallel-rebuild reality and catalogued third-party breakage exceed a routine major upgrade; not lower because automatic SiteDefinition→Application migration, documented ordered upgrade steps, Alloy/Graph SDK migration guides and partner AI accelerators (Royal Cyber OptiUpgrade Assistant: ~31 automated steps, 220+ build-error categories, ~5 weeks end-to-end vs 6–8 weeks manual; Niteco AI Migration Accelerator) materially reduce manual rewrite effort.

Optimizely publishes numbered CMS security advisories (CMS-2025-01/02/03) with explicit fixed-version guidance and maintains the current major plus one prior — CMS 13 and CMS 12 — for security and severe bugs, while CMS 13 adds proactive hardening (file-extension whitelist filtering on all blob upload paths, permission enforcement on user deletion) and post-GA fixes like CMS-50238 (security settings not initialized during import/export). The 2025 SEC Consult disclosure (CVE-2025-27800/27801/27802: stored XSS via the Notes gadget, SVG upload on ContentReference properties, and RTE fields) was patched with per-branch fixed versions for 11.x and 12.x, and no CMS 13 CVE has been published as of Sept 2026. Not higher because application-tier patches ship as NuGet updates the customer must take and redeploy — only the Azure/infrastructure layer is Optimizely-managed; not lower because advisory clarity, two-major maintenance, vendor-managed infra and fast transitive patching are solid.

CMS 13 bundles several forced changes at once — Search & Navigation (Find) is removed outright rather than deprecated, so its packages will never be upgraded and Graph or a custom provider becomes mandatory; Opti ID is required; Plugin Manager, dynamic properties, mirroring and REST API extension points are gone; OPE is disabled for Visual Builder. The offsetting fact, often missed, is that this is not a forced cutover: Optimizely runs a live parallel '2026 CMS 12 release notes' stream and documents CMS 12 as still receiving bug monitoring, fixes and security patches as the prior major, and CMS 12 dates to 2021 — a multi-year deprecation window — while the Content Delivery API gap at launch has since been closed by Content REST API 13.0 for CMS 13 / .NET 10. Not higher because losing a separately-licensed product (Find) with no upgrade path and absorbing a mandatory SaaS dependency in one release is a real forced migration; not lower because the supported-fallback window is long and automatic SiteDefinition→Application migration plus documented Graph/Alloy migration paths shorten the runway.

CMS 13 makes Optimizely Graph and Opti ID non-optional cloud dependencies (both license-bundled), trading a self-contained NuGet stack for mandatory SaaS coupling — Graph alone needs five appsettings values (GatewayAddress, AllowSendingLog, SingleKey, AppKey, Secret) plus per-package service registration in a specific order, and the database floor rises to SQL Server 2022 / Azure SQL at compatibility level 140+. Against that, dropping Find removes the Elasticsearch-backed search subsystem entirely, .NET 10 is a well-supported runtime, and a full solution stays at roughly 10–15 Optimizely packages; transitive churn is real but modest (ImageSharp 2.1.10→2.1.11), and the DAM renamespace EPiServer→Optimizely is a one-time codebase-wide edit. Not higher because mandatory cloud services, a DB compatibility floor and a still-recovering third-party package ecosystem add coupling a pure self-hosted stack avoids; not lower because the package surface is manageable and .NET 10 ecosystem compatibility is strong.

DXP PaaS ships more built-in operational visibility than most Traditional DXP peers: Application Insights is configured automatically for every DXP site by the EPiServer.CloudPlatform.Cms package, application logs stream live or download from the Management Portal with 90-day blob retention, a consumption-metrics view tracks usage, read access to the Azure portal is provided, and Optimizely issues a monthly performance report benchmarking average page loads, response times, views, events and availability against prior months. CMS 13 adds scheduled-job hang detection with log indicators, a Cloud License Management settings view showing active server names per URL, and third-party npm license visibility in edit mode, on top of 24/7 infrastructure monitoring. Not higher because Application Insights still needs further configuration to use fully depending on site architecture, application-layer alerting is customer-built, and a June 2026 DXP PaaS forum thread reporting a site going down twice a month shows diagnosis still lands on the customer; not lower because auto-configured APM plus a vendor-issued monthly performance report is a genuinely low setup burden.

Core hygiene automation is strong: link integrity tracking parses properties on save and stores cross-references in a permanent-link table to prevent broken links, Graph auto-indexes on publish, version pruning runs from the admin UI, approval workflows are built in, and CMS 13's new Content Manager gives editors a search-first, Graph-powered interface that scales to large content libraries — while redesigned Application Management replaces SiteDefinition with validation, editable names/API IDs, default-application designation and identity-based (not display-name) multi-site resolution. The new risk is content variations: variation-only references are partly invisible to the reference data that governance, link-checking and 'where is this used' reporting depend on, nothing in the box prevents a page accumulating orphaned variations, and variation sprawl is hard to spot because it does not appear as nodes in the tree. Lowered from prior scoring because that blind spot is a genuine new hygiene gap; not lower still because link integrity, auto-indexing, pruning, workflow and Content Manager keep routine day-to-day burden light; not higher because Graph reindex after schema changes and version pruning on large trees remain manual attention.

More of the performance loop is vendor-handled than prior scoring credited: DXP runs Azure App Service autoscale, Cloudflare CDN and HTTP/3, auto-configures Application Insights for APM, and issues a monthly performance report benchmarking page loads, response times and availability month-over-month — and CMS 13 has actually shipped performance fixes rather than only operational polish (a redundant synchronous content comparison in the Graph sync event handler that slowed the publish UI; project overview loading every project item now replaced by counts; CMS-52251 async visitor-data retrieval to avoid thread-pool exhaustion). Graph also supports cached/stored query templates so repeat requests reuse a parsed query shape. Raised because the prior read that CMS 13 brought 'little dedicated performance tooling' understated shipped fixes and the vendor-issued monthly report; not higher because application-layer tuning stays a recurring customer job — Graph query optimization replacing Find tuning, output caching, ContentArea nesting-depth limits, scheduling jobs off-peak, and Commerce catalog index/cache tuning.

Optimizely publishes a formal Support Policy (v2025-07A) and SLA: Standard support is included, Premium is a paid add-on, and the Advanced Service Level Objectives — the faster response targets — apply only to named Technical Contacts and authorized portal submitters, so the better experience is explicitly purchased rather than default. Premium adds a designated Technical Support Engineer aligned to the customer's business hours who maintains a documented profile of critical workflows and integrations, plus a monthly Health Check Review of environment, access and prior-month tickets; DXP carries an up-to-99.9% application-level SLA with infrastructure support bundled into the subscription. G2 shows 4.2/5 across ~918 reviews with a split picture — 'top notch,' fast, weekend-available support on deployment and staging issues and ~24hr typical response, against recurring complaints about response time and depth of assistance on non-critical tickets. Not higher because the rubric caps Enterprise-gated support in the 40–60 band and the depth complaints persist; not lower because Standard SLOs are reasonable, the policy is published rather than opaque, and infra support is bundled.

Optimizely World is visibly active on CMS 13 nearly six months past GA, with Optimizely's own developers publishing there (Robert Svallin's CMS 12→13 Alloy upgrade and Preview 3 posts, Jake Minard's Graph SDK introduction) alongside a steady practitioner stream — developer-community updates dated Sept 16–17 2026 on Blazor Server UI in the CMS 13 Admin Shell and content-type icons, plus independent upgrade guides from gulla.net, wseweryn.dev, davidhome.net, nishtech.com and david-tec.com. Vendor-run Q&A supplements it: a March 26 2026 technical webinar produced both a published Q&A PDF and a permanent CMS 13 FAQ page in the official docs, and the Stack Overflow [episerver] tag carries 3,000+ historical questions with the broad .NET ecosystem as adjacent support. Raised because sustained employee participation and the formal Q&A program are stronger than a purely volunteer forum; not higher because the forum is self-described as community-driven with no staffing commitment and threads rely on users marking their own posts answered, so response times are unguaranteed; not lower because CMS 13 coverage is being actively produced rather than sparse.

The post-GA track record is now concrete rather than projected: a licensing bug found at launch was fixed in 13.0.1, the line reached EPiServer.Cms 13.1.2 / EPiServer.CMS.Core 13.1.1 within roughly five months, and the continuously-updated CMS 13 release notes document a steady fix stream — CMS-52251 (async visitor data / thread-pool exhaustion), CMS-50238 (security settings on import/export), the Graph sync publish slowdown, project overview load performance, CMS assets unqueryable through Graph via content reference fields, and localization fixes — while Forms 6.0.0 shipped with CMS 13 support and a moderate transitive CVE (ImageSharp) was patched quickly. Both CMS 13 and CMS 12 receive active bug and security triage. Raised because the fix stream has broadened well beyond the two documented items credited previously; not higher because the monthly NuGet cadence means non-critical bugs can wait weeks, every application-tier fix requires the customer to take the package and redeploy, and the third-party add-on breakage that dominates real upgrade pain is not Optimizely's to fix; not lower because critical issues get hotfix packages through support and the observed cadence is steady.

Optimizely CMS 13 ships Visual Builder as the default editing experience with drag-and-drop authoring across pages, blocks, experiences, and media, composed as elements within sections, rows, and columns. Blueprints let editors save sections or whole experiences as reusable layout templates with auto thumbnails and a browsable gallery. CMS 13 adds custom elements definable directly in the Admin UI without code deployment. New since the last review: Opal gained blueprint tools for CMS 13 — agents can list and inspect Blueprints and create a content item from one, so AI-assisted page creation now starts from an approved layout rather than freeform composition. The Page Builder (PaaS) agent generates a full content item of a specified content type from a document, image, or URL, and agents installed from the Agent Directory now auto-update. Gap: no out-of-box 50+ component library; a custom element/block library is still required for full self-service.

CMP is a documented first-party integration rather than a loosely-coupled sibling product: the CMS + CMP publishing integration lets teams manage the production lifecycle of CMS pages using CMP tasks and workflows, and CMP DAM assets are selectable from inside CMS. CMP 2026 releases added custom date-range filtering in the Plan view (portfolio planning, localization calendars, event timelines) and the ability to link a single task to multiple campaigns, eliminating duplicate tasks across campaigns. Optimizely Campaign (separately licensed) covers email/web campaign execution, UTM tracking, and campaign analytics. CMS scheduled publishing handles web campaign timing and Audiences enable UTM-based campaign personalization. Still no native campaign calendar inside PaaS CMS itself, and both CMP and Campaign are separate licenses — CMS-only deployments remain basic.

Beyond base SEO page-type properties (MetaTitle, MetaDescription, CanonicalUrl), sitemap generation, and redirect management, CMS 13 ships the Opal SEO Metadata Optimization agent (analyzes webpages, generates optimized meta titles, descriptions and OpenGraph tags, applies them as drafts) and the GEO Schema Optimization agent (recommends and generates Schema.org types and JSON-LD markup written to the content's JsonLdTemplates property) — native structured-data generation plus AI meta optimization in the editor. New since the last review: Markdown for AI agents delivers a clean markdown rendition of pages to AI crawlers at the edge instead of full HTML, reducing ingestion cost and improving citation accuracy — but it is beta and gated behind a signup, so it earns partial credit only. Remaining gap: no single dedicated SEO validation dashboard with field-level validation; SEO is surfaced through Opal agents plus base properties.

Optimizely Forms (EPiServer.Forms 6.0.0, made CMS 13-compatible) provides a drag-and-drop form builder with multi-step forms, conditional/dependent field logic, file upload, and submission storage. Headless Optimizely Forms works with Optimizely Graph or the Content Delivery API, and smooth-deployment support now preserves form data through Graph index rebuilds. CTA management runs through CMS blocks/elements — no dedicated CTA interface. Conversion tracking integrates with Experimentation goals. Lead capture connects to CRM via custom SubmitActors or webhooks; LinkedIn Lead Gen Ads routes form data into ODP for nurturing. Strong when the full stack is deployed; CMS-only deployments are more limited.

CMS 13 renames Visitor Groups to Audiences and integrates them into the Visual Builder UI — editors show or hide content based on audience membership with an in-editor 'View as Audience' preview per segment, no developer work. In CMS 13 the personalization unit moves from blocks to Elements and Sections, which are finer-grained and visible in the Visual Builder Outline; personalization remains component-level rather than field-level (individual text properties cannot be personalized directly — audience-specific elements are layered above a default fallback and evaluated top to bottom). Built-in criteria include visit count, geographic location, role, referrer, and visited pages. Contextual Bandits use ML to select the best experience per visitor from real-time signals. ODP Real-Time Segments extend audience definitions to CDP-level behavioral and transactional data. This is genuine native behavioral targeting, not rule-based-only.

Still the strongest experimentation story in this scorecard, but the previous scoring overstated CMS-native testing. CMS 13 Content Variations supply the authoring layer — multiple independently versioned published variants of the same content item in the same language, delta-based storage (only modified properties stored), independent version history and publishing lifecycle, audience tracking, divergence state, a needs-attention filter, and approval-workflow integration. The actual test engine — traffic splitting, visitor bucketing, conversion tracking, and statistical analysis — still requires the separately licensed Web Experimentation or Feature Experimentation product, and Optimizely's own CMS 13 FAQ lists deeper CMS/Experimentation integration as roadmap rather than shipped. With those products attached the capability is best-in-class: Stats Engine significance reporting, auto-winner selection, MVT, feature flags, in-visual-editor click-event metric creation, and Contextual Bandits for adaptive optimization beyond binary A/B.

CMS 13 delivers real velocity gains. Visual Builder with Blueprints enables template cloning for fast page assembly, autosave reduces friction, custom elements can be defined in Admin UI without code deployment, and copy/paste of layout structures speeds composition. Auto-translation with structure preservation reduces localization cycle time. Content Manager provides search-first navigation across large libraries with filtering by type, status, and language. The Opal agent set is GA and embedded in the editorial workflow: content auditing, alt-text generation, SEO/GEO optimization, the Content Refresh agent for auditing and updating outdated content at scale, the Page Builder (PaaS) agent drafting a full content item from a document/image/URL, the Content Analysis agent producing reusable authoring instruction sets, and blueprint tools letting agents build from an approved template. Projects coordinate multi-page changes. Approval workflow steps still add latency, and PageData/ExperienceData coexistence means legacy pages stay in the older form-based editor until remodeled.

CMS 13 serves both traditional rendered web pages and headless delivery via Optimizely Graph, supporting native mobile app channels and third-party frontends; Optimizely documents write-once content delivered by API to mobile apps, IoT devices, and web storefronts. Content REST API 13.0 restored Content Delivery API support for CMS 13/.NET 10 (pages and blocks only — no experience/sections support), with Graph the recommended long-term delivery path. Email is covered by Optimizely Campaign and social by CMP, both separate products. Four-plus channels are reachable (web, headless/app, email, social), but every channel beyond web requires a separate licensed product or custom integration — this is not a unified single-product multi-channel CMS.

Optimizely CMS still has no traditional native web-analytics dashboard inside the CMS; GA4/Adobe Analytics integration is via tag manager and ODP is the unified behavioral data hub across web, email, and commerce. The AEO/GEO analytics side has strengthened materially: the June 10 2026 Conductor partnership shipped a full AEO platform, and the Agent Visibility Analytics dashboard in Optimizely Analytics (explicitly supported for CMS 13, headless or coupled) surfaces AI-platform traffic trends and intent, which AI platforms visit most, and which pages they prefer — powered by CDN log data plus Opal insights, with an Agent Visibility Insights agent and a Conductor AI Brand Visibility Report agent on top. The new Graph Search Management portal adds a search-analytics Overview page reachable from the CMS nav. Core content-performance metrics (pageviews, engagement, decay) still live in external analytics tools rather than the CMS UI.

VB Blueprints are the primary brand guardrail in CMS 13: developers and central teams define the approved layouts, element palette and style system, and editors compose pages by selecting from those approved options, with a browsable gallery and export/import between environments. New since the last review: Opal's blueprint tools mean AI-generated pages are also constructed from approved Blueprints rather than freeform, and Optimizely documents Opal instructions plus prompt engineering as the mechanism for enforcing brand governance in agent workflows — closing the obvious loophole that AI page generation would otherwise open. Template descriptors allow brand-specific view rendering for shared block types, and content-area restrictions enforce component palette compliance. Still convention-based rather than a managed design token system with platform-level enforcement.

Open Graph and Twitter Card meta tags are manageable via CMS page type properties, and the Opal SEO Metadata Optimization agent now generates OpenGraph tags alongside meta titles and descriptions, giving AI-assisted social preview card control. CMP provides push-to-social workflows and scheduling for Facebook, Twitter/X and LinkedIn from the editorial calendar — but CMP is a separate licensed product, not built into CMS. No native social scheduling or UGC embed management within CMS itself. Social proof widgets (follower counts, social feeds) require custom element/block development or third-party embed. Adequate for OG meta management; needs CMP for actual social publishing.

CMS 13 ships native embedded DAM integration via the EPiServer.Cms.DamIntegration.UI package — editors browse, search, and select Optimizely DAM assets directly within the authoring interface without context switching. It is opt-in (install if you have DAM) and requires Opti ID, an active Optimizely Graph service, and CMP API client credentials; a standalone migration package converts CMS 12-style DAM integrations. Graph queries now return DAM assets and CMS assets together in content reference fields. The separately documented CMS + CMP integration also exposes CMP DAM resources for selection and linking in CMS. The Opal alt-text agent auto-produces accessibility/SEO alt text for images. The standard CMS media library handles basic image/file management, with file-upload extension whitelisting added in CMS 13. Rights management for marketing volumes still requires the dedicated DAM product connected through the integration.

CMS 13 ships significant translation improvements: auto-translation via machine translation preserving original structure including page hierarchies, content areas, and blocks; draft translation of pages, blocks and experiences without prior publication; translatable content export in human-readable JSON for external translation providers, respecting Visual Builder structures; and translation initiation from multiple entry points (context menu, toolbar ribbon, language selector). 790 languages can be made available in CMS Settings. A configurable RecursiveDepth setting caps how many hierarchy levels Language Manager includes when translating or copying, which is a real guardrail against runaway bulk translation. The redesigned Language Selector splits languages into existing-branch and untranslated sections. MLM provides per-locale approval chains; market-level campaign scheduling runs through Campaign. Transcreation (adapting beyond translation) still requires custom editorial process or an external TMS.

Optimizely ODP serves as the central MarTech hub with 100+ native integrations. Pre-built connectors include Salesforce CRM (bi-directional), Salesforce Marketing Cloud, Microsoft Dynamics CRM (bi-directional form field mapping), Marketo (bi-directional ODP sync), HubSpot (bi-directional ODP sync), LinkedIn Lead Gen Ads, and Tealium. ODP's unified audience builder routes segments into CMS personalization, Experimentation, Campaign, and external activation channels. The 2026 Conductor partnership adds an AEO/SEO intelligence integration on top. Form submit actors enable custom webhook/API delivery to CRM on submission. Covers CRM, MAP, CDP, and ad-platform categories with event-based triggers.

Commerce Connect 15 (GA mid-May 2026, on .NET 10 + CMS 13) provides full product information management natively integrated with CMS. CatalogContentType is a strongly-typed .NET class defining product/variant/catalog node schemas, and catalog entries are CMS 13 content types that inherit platform capabilities automatically — Visual Builder is the default editor for catalog entries with drag-and-drop content elements for products, variants, bundles, and packages plus real-time storefront preview. External Content support connects product data from multiple external systems into the CMS editing experience without duplication. Customizable catalog views save merchandiser-specific filters. B2B features include customer-org-specific pricing, negotiated price lists, and per-market availability. EU Omnibus lowest-price display (last 30 days) is native.

The scalable promotions engine supports complex discount rules (percentage, fixed, bundle, threshold, buy-X-get-Y), and the Opal Product Promotion agent lets merchandisers build and configure promotions via natural language. Optimizely Graph provides Pinned Results — the explicit successor to Best Bets — promoting selected products and content to the top of results for chosen queries with immediate effect, now curatable from the Graph Portal framed inside the CMS 13 nav. Visual Builder drag-and-drop catalog composition, faceting on ContentLink.Id, customizable saved views, and Dynamic Packages round out the toolset. Marked down from the previous review: the Commerce Connect 15 GA notes state the updated content selector is NOT integrated with the Marketing UI at GA — selecting associated content types when configuring promotions and campaigns is deferred to a future release, which is real friction in the merchandiser's core promotional workflow.

Optimizely Commerce Connect's integration with CMS PaaS remains the deepest content-commerce integration in this scorecard — a native extension of the same CMS framework, fully GA in Commerce Connect 15 (mid-May 2026). CMS PageType and CatalogContentType both derive from IContentData, sharing the content repository, versioning, workflow, media management, and delivery. Commerce 15 makes Visual Builder the unified editor across CMS pages and catalog entries with real-time preview, and products and variants are discoverable in Content Manager alongside CMS content via Graph. Commerce catalog pages embed CMS content blocks via ContentArea. Additionally, the Optimizely-commercetools partnership provides a composable alternative for MACH-aligned deployments.

The shared CMS+Commerce architecture enables content-driven commerce natively — editorial teams embed product references, promotions, and commerce CTAs inside editorial content (buying guides, lookbooks, campaign pages) without external API integration. Commerce Connect 15 makes Visual Builder the default editor for both editorial and catalog content, so editors drag and drop product elements alongside editorial content on the same page with real-time preview. Commerce data (pricing, availability, promotions) is accessible within CMS elements and blocks. ContentArea on Commerce pages allows CMS editorial blocks directly on product detail pages. This is a first-class authoring pattern for shoppable editorial rather than a bolt-on.

CMS blocks can be placed on checkout and cart pages in Commerce Connect implementations, allowing CMS-managed trust badges, shipping callouts, and promotional banners within transactional flows without separate commerce template changes. Commerce Connect 15 replaced the legacy workflow engine with processor-based order APIs and async order operations, which gives implementers cleaner extension points around the transactional flow. CMS-managed checkout content is achievable but requires a deliberate implementation pattern; it is not a zero-configuration capability, and One Page Checkout remains a roadmap item.

Order confirmation pages in Commerce Connect can embed CMS content blocks (cross-sell recommendations, loyalty program CTAs, review solicitation). Post-purchase email automation — order confirmation, shipping updates, review requests — runs through Optimizely Campaign triggered on order events. Commerce data (order status, purchased products) can trigger ODP audiences that feed CMS personalization on return visits. This is not a native order-event-triggered CMS content delivery system; it requires deliberate integration configuration plus a separately licensed email product.

Optimizely Commerce Connect has strong B2B pricing capabilities (customer-org-specific pricing, negotiated price lists, quantity breaks, market-specific catalogs). ODP's B2B schema enables account-level segmentation, activation, and reporting. Audiences can gate catalog sections and landing pages by authenticated user role or organization membership, and content-path ACLs handle gated product documentation and spec sheets. Quote-request and punchout workflows are NOT in Commerce Connect — they belong to Optimizely Configured Commerce, a separate product line built for manufacturers and distributors, so a Commerce Connect deployment needing RFQ or cXML punchout must build it or buy the other product.

Materially upgraded since the last review. Optimizely Graph (via Optimizely.Graph.Commerce, the primary search mechanism in Commerce Connect 15) provides GraphQL search with filtering and faceting, plus Pinned Results as the explicit successor to Best Bets. The prior scoring's main gap — that synonym and relevance tuning had no home after Search & Navigation was removed — is now closed: a Graph Portal item in the CMS 13 navigation bar frames the Search Management portal in the interface, with a Health & Monitoring area (search analytics Overview) and a Search Tools area covering Pinned Results and Synonyms, so merchandisers curate result ordering and term relationships without switching applications. Opal also exposes graph_pinned_result and graph_synonyms tools. Caveats keeping this out of the high 70s: the portal is beta, the nav item appears only for users with portal access, and a community add-on (OptiGraphExtensions) still fills gaps for some teams.

The core promotion engine supports time-based activation, channel-specific targeting, and complex discount rule combinations. The Opal Product Promotion agent lets merchandisers build and configure promotions via natural language. Dynamic Packages allow end-customer-configurable bundles, scheduled publishing controls time-based banner and landing page activation, and EU Omnibus lowest-price display (last 30 days) is native. Promotional content can be audience-targeted. Marked down: the Commerce Connect 15 GA release notes confirm the new content selector is not yet integrated with the Marketing UI, so associating content types with promotions and campaigns in the promotion configuration flow is still on a future release. Countdown timers remain custom element development.

Commerce Connect supports unlimited storefronts on a shared codebase — sites share the product catalog, promotions engine, and order management while having storefront-specific editorial content, templates, and access control. CMS 13 Applications replace Site Definitions with a streamlined interface for managing in-process and headless websites: each Application has a unique URL, start page, internal identity, and application-specific asset folders, and applications in a multi-application setup share media and blocks. Per-market pricing, availability, and language-specific product descriptions are native. ODP supports multi-site, multi-region customer data management.

The CMS 13 embedded DAM provides rich product media management: asset tagging, version control, renditions, and usage tracking, with Graph now returning DAM and CMS assets together in content reference fields. Commerce Connect 15 Visual Builder for catalog entries adds drag-and-drop media composition on product pages with real-time preview, and the Opal alt-text agent improves accessibility and SEO for product imagery. Image transforms via EPiServer.ImageLibrary handle standard product photography, and video embeds on PDPs are achievable via CMS media or third-party video blocks. However, 360-degree product views, AR/3D model references, image hotspots, and zoom remain third-party integrations — none are native Commerce Connect capabilities.

Optimizely Commerce Connect has no native marketplace or multi-vendor content capabilities, and the Commerce Connect 15 GA release notes add nothing in this area. Multi-author content is achievable via CMS roles — multiple editors can manage different product categories — but there is no seller profile, seller-specific product description workflow, review aggregation, or content quality moderation tooling. Custom development could build seller portals on the CMS content model and Forms, but these would be bespoke implementations with no platform support.

CMS 13 auto-translation with structure preservation covers product content pages and category descriptions, and draft translation without prior publication speeds product content localization. Translatable-content JSON export improves enterprise TMS integration, and the RecursiveDepth setting caps how deep Language Manager goes when translating or copying catalog hierarchies — a practical guardrail on large catalogs. MLM governs translation workflows for product catalog content alongside CMS editorial content. Per-market product descriptions, currency-aware pricing display, and market-specific promotional calendars are all native in Commerce Connect, and EU Omnibus lowest-price display handles that regulatory requirement.

ODP aggregates content engagement and commerce transaction data, enabling content-to-revenue attribution through custom ODP dashboard configuration. Experimentation links content variants to commerce conversion goals (add-to-cart, purchase) with statistical significance reporting, and Web Experimentation's new in-editor click-event creation lowers the effort of instrumenting those goals. Standard e-commerce analytics integration (GA4 Enhanced Ecommerce, Adobe Analytics) captures conversion funnel data. Achievable, but it requires deliberate ODP configuration and custom reporting — there is no out-of-box CMS attribution dashboard.

Opti ID (mandatory in CMS 13) provides centralized identity management with SAML and OIDC for SSO and SCIM provisioning with Entra ID, Okta, and PingOne for automated user lifecycle management (up to 5 SSO connections per organization). Custom roles created in Opti ID sync to CMS as user groups. CMS provides content-path-level access control with Read/Create/Change/Delete/Publish/Administer permissions assigned to roles, with inheritance and language-branch permissions. Audiences target content by authenticated user properties (role, department claims from OIDC). CMS 13 adds permission checking on user deletion. Permission granularity is at the subtree level rather than per-item, and Opti ID SSO is available only for CMS 13 instances hosted on DXP.

Optimizely CMS supports knowledge management through flexible content types (Article, FAQ, HowTo PageTypes), hierarchical organization via the content tree, and content lifecycle management (draft, review, publish, archive, expire). Content Manager provides Graph-powered search-first navigation with filtering by content type, status, and language, and the Opal FAQ Creation agent extracts Q&A pairs from existing content. Full-text search runs on Optimizely Graph, which now offers synonym management and pinned results through the Search Management portal framed in the CMS nav — meaningfully better for knowledge retrieval than the immediate post-Find state. Main gaps versus dedicated KM platforms remain: no comment threading beyond editorial inline comments, no expert suggestion system, no knowledge graph.

Optimizely PaaS can host employee portal content using the standard CMS rendering model — intranet pages, news feeds, and policy documents are all buildable with audience-targeted delivery, and Audiences driven by OIDC claims enable department/role-targeted intranet content. Visual Builder improves authoring ergonomics for HR and communications teams. The weaknesses are unchanged and structural: no native social or collaboration features (comments, reactions, @mentions) for employees, no org chart, no employee directory schema, no notification/alert system, no native employee mobile app. Optimizely does not market or document an intranet product, and no first-party employee-experience tooling appeared in the 2026 releases. These gaps require custom development or a companion platform such as SharePoint/Viva Connections.

Audience targeting via OIDC claims enables department/role/location-specific announcement delivery — editors can target news and announcements to specific employee segments — and scheduled publishing manages communications calendars. The CMP-Teams integration sends real-time alerts for CMP content activity into Microsoft Teams channels. Read receipts, acknowledgment tracking, mandatory-read workflows, and formal internal comms reporting are still not native CMS capabilities; they require custom development or a dedicated intranet product.

Optimizely CMS has no native people directory, employee profile schema, org chart visualization, or HR system integration. Employee profile pages can be built as custom content types and OIDC user properties can be surfaced from Entra ID, but this is a full custom development effort with no platform support. The SharePoint Connect that enabled SharePoint People directory integration was available for CMS 11 and is not available for CMS 12 or CMS 13. Organizations requiring a people directory must build custom or run SharePoint/Microsoft Viva alongside.

CMS content versioning applies to policy documents — each published version is preserved with author and timestamp metadata — and content approval workflows can enforce review steps before policy publication. ExpiredDate enables automatic archival of outdated policies, and CMS 13 adds file upload restrictions by extension whitelist, improving document governance. Mandatory acknowledgment tracking is not native and requires custom implementation. CMS can serve as a document repository, but dedicated policy management is beyond its scope without significant custom work.

Audience-based content targeting can deliver role-specific onboarding content (a new hire sees department-specific content based on an OIDC role claim), and custom content types can structure 30/60/90-day content paths hierarchically. Structured onboarding journeys with progressive disclosure, completion tracking, task checklists, and HR-triggered new-hire portals are not native CMS capabilities. Campaign can send time-based onboarding email sequences triggered by hire date. These features require considerable custom development.

Upgraded since the last review. Search & Navigation (Find) is removed in CMS 13, making Optimizely Graph the search foundation — and the search-administration capability that was missing immediately after that removal has now returned inside the CMS. A Graph Portal item in the CMS 13 navigation bar frames the Search Management portal, giving administrators a Health & Monitoring Overview (search analytics dashboard) plus Search Tools for Pinned Results and Synonyms without switching applications. Combined with Graph's GraphQL filtering and faceting and Content Manager's search-first navigation, this is solid internal search with editorial control and relevance tuning. It stays below the 65+ band because the portal is beta and there is still no federated search across external systems (SharePoint, Confluence, Drive) and no AI-driven relevance ranking.

Optimizely CMS delivers responsive web content via ASP.NET Core MVC rendering, so mobile browsers receive responsive intranet pages without a dedicated native app. Content Delivery API and Graph enable custom native mobile apps consuming CMS content. There is no Optimizely-provided native mobile app for intranet employees, no offline content sync, no push notification system, and no kiosk or shared-device mode. Deskless and frontline workers are not a design consideration for this platform.

Optimizely CMS has no native LMS integration, course management, completion tracking, or certification features. Training materials (videos, PDFs, documents) can be hosted as CMS content and OIDC-based access control can gate training content by role, but completion tracking requires an external LMS reached through a custom API connector. There are no pre-built connectors to common LMS platforms.

Optimizely CMS has no native social layer for employee engagement — no employee-facing comments, reactions, discussion forums, peer recognition, polls or surveys, idea submission, or community spaces. CMS 13's inline comments and Projects are authoring-team collaboration tools, not an employee social layer. The platform is document-first; organizations requiring social intranet features must integrate a dedicated employee experience platform (Staffbase, Simpplr, Workvivo) or build custom modules.

The CMP + Microsoft Teams integration delivers real-time alerts for CMP content activity (mentions, asset shares, task assignments) into Teams channels with click-through links to CMP tasks, and the CMS + CMP publishing integration ties CMS page production into CMP tasks and workflows. Opti ID provides SAML/OIDC SSO with Entra ID and the platform runs on Azure, simplifying Microsoft 365 identity alignment. Deeper Microsoft 365 integration is limited: the SharePoint connector was discontinued after CMS 11, there are no embedded CMS content cards in Teams, and there is no native Google Workspace or Slack integration.

ExpiredDate enables automatic archival of outdated content, approval workflows enforce review steps, and versioning records all changes with author, date, and history. CMS 13 Content Variations have independent lifecycles, so variants can carry separate expiry and management, and scheduled publish dates are now visible in the Version gadget. The Opal Content Refresh agent identifies and sorts outdated content by last edit date and helps resolve duplicate or stale content across a site, adding AI-assisted stale-content detection. Automated review-date prompts, ownership assignment, and formal archival workflows with notifications are still not native.

Improved since the last review on one specific axis the rubric calls out. The search-analytics capability lost when Search & Navigation was removed is partially restored: the Search Management portal's Health & Monitoring Overview is a search analytics dashboard reachable from the Graph Portal item in the CMS 13 nav bar, so intranet administrators can again monitor search performance and term behaviour and act on it via Synonyms and Pinned Results. ODP aggregates employee digital interaction data into custom segments and activity reports. Agent Visibility Analytics is oriented to external AI-crawler traffic, not internal employee engagement, so it does not count here. Department-level analytics dashboards, adoption rate tracking, and formal intranet ROI reporting still require custom ODP dashboard configuration or external BI.

CMS 13 replaces Site Definitions with Applications — each Application has a unique URL, start page, internal/normalized identity, and application-specific asset folders with expanded host types (Primary, Preview, Media, Edit, redirect), and the model covers both in-process and headless sites. Multiple Applications share the same file structure and SQL database (logical separation) with independent content trees, site-specific templates, and separate access control. Automatic migration from SiteDefinition to Application settings eases the transition. For strict regulatory data isolation, separate DXP environments per client are required: isolation is logical, not physical — adequate for multi-brand, not true multi-tenant with hard data boundaries.

Strong shared content for multi-brand implementations. Shared blocks are unique instances with their own publishing lifecycle, live in the CMS Assets panel, and can be reused by multiple content instances and multiple Applications; they drag and drop into experiences, are edited in context, and are automatically inlined when indexed to Optimizely Graph so headless delivery stays complete. Brand folders can be created under For All Sites to share assets across sites while each site keeps site-specific folders. VB Blueprints define the approved layout and component library centrally with export/import between environments. CMS 13 custom elements are definable in the Admin UI without code deployment, letting central teams extend the element library across all brand Applications.

Multi-level governance for multi-brand deployments: central administrators access all Applications and global settings, brand editors are restricted to their Application's content tree via ACLs, and approval workflows are configurable per Application with site-specific reviewer pools. Content approval requirements are enforced per content type and path. CMP Workflow Actions provide step-level permission control for fixed workflows including external agency contributor access. Optimizely documents Opal instructions plus prompt engineering as the mechanism for enforcing brand governance in agent workflows — worth noting as AI authoring spreads, though it is a configuration convention rather than an enforced policy engine. Handles central oversight with brand autonomy, but relies on custom role configuration rather than a purpose-built brand-management UI, and is less granular than Sitecore XP's per-item permissions.

Adding Applications to an Optimizely PaaS DXP has moderate marginal cost — a new Application requires configuration, content tree, access control, and templates, primarily developer time with no incremental subscription cost (unlimited sites per DXP subscription). Traffic scaling is handled by DXP Azure autoscaling within the capacity tier; growth may require a tier upgrade. Implementation cost per additional brand decreases as shared blocks, VB Blueprints, and governance patterns mature. The shared-codebase and shared-database model provides genuine economies of scale versus N separate installations.

Per-brand visual identity is achieved through site-specific CSS, Razor view templates, and VB Blueprint style configurations — each brand Application can have its own stylesheet, typography, color tokens (as CSS variables), and logo rendering. ITemplateSelector enables brand-specific component rendering from shared block types, and VB Blueprints lock layout and style selection to brand-approved options. This is convention-based CSS theming rather than a managed design token system with enforcement, versioning, or propagation — but it is effective for multi-brand deployments on a shared codebase.

CMS 13's translation improvements strengthen multi-brand localization governance: auto-translation preserving page structure, draft translation without prior publication, JSON export for external providers, translation initiation from multiple entry points, and a redesigned Language Selector splitting translated from untranslated languages. The configurable RecursiveDepth setting caps how many hierarchy levels Language Manager includes when translating or copying, which prevents a brand-locale team from cascading changes further than intended. MLM enables per-brand translation workflows with per-locale approval chains, so Brand A's French team is isolated from Brand B's French approval process, and role-based access scoped to Application plus language branch allows language-level editorial autonomy within brand boundaries. No fully automated per-brand-locale compliance guardrails.

No native cross-brand analytics dashboard in Optimizely CMS. Analytics are per-Application by default. ODP can aggregate data across Applications into unified segments and reports, but this requires deliberate custom configuration. Agent Visibility Analytics reports AI-platform traffic per instance and is not a portfolio comparison tool. Executives requiring portfolio-level comparison across brands must build custom ODP dashboards or integrate external BI tools.

CMS approval definitions can be configured independently per content type and content tree path, so each brand Application can have its own approval chain, review stages, and reviewer pools. Different brands can run separate approval chains, editorial teams, and publishing permissions within the same CMS instance, and Content Variations carry approval workflow integration so variant-level publishing is governed too. CMP supports brand-specific workflow configurations with step-level access control. Central administrators can audit publishing history and approval logs across all brands.

Content can be shared across brand Applications by referencing shared blocks and media from the global/For All Sites folders — a legal disclaimer or global nav element is authored once and referenced across all brands without duplication, and shared blocks keep a single publishing lifecycle so an update propagates everywhere they are used. Export/import moves pages, blocks, and folders between environments to seed a target site with curated content, and RecursiveDepth controls how deep a copy cascades. But there is still no native 'push content from Brand A to Brand B' syndication workflow with controlled override points — when corporate publishes a press release there is no mechanism to distribute it to child brand sites with local adaptation. That requires custom development (scheduled job or content event handler); Graph could power a custom solution.

Per-brand and per-region compliance settings are achievable through role-based publishing permissions (only approved publishers can publish to a locale), content approval workflows (a compliance reviewer step per region), and locale-specific content variants (per-region legal content, cookie consent, GDPR disclaimers). EU Omnibus lowest-price display is native on the commerce side. But there are no automated publishing guardrails that prevent non-compliant content from reaching a specific region — compliance enforcement relies on workflow configuration and human review, and accessibility validation requires third-party tools.

VB Blueprints are the closest native approximation of design system management — central teams define the approved component library and style options, with a browsable gallery and export/import between environments that gives a crude distribution mechanism. CMS 13 custom elements are definable in the Admin UI without code deployment, letting central teams extend the element library without developer intervention. Shared Razor component libraries are maintained centrally and consumed per-brand via ITemplateSelector, and CSS variables serve as brand-level design tokens. Still no centralized design token management UI, no versioning or changelog for the design system, and no update propagation mechanism beyond redeploying shared code.

Opti ID (mandatory in CMS 13) provides centralized identity management across all brands and Applications — a central admin manages users, roles, and SSO configuration for the entire portfolio from a single interface, and custom Opti ID roles sync into CMS as user groups. SCIM provisioning with Entra ID, Okta, and PingOne automates user lifecycle management including brand team onboarding and offboarding. Brand-scoped editor roles via ACLs give brand teams autonomous self-management, and cross-brand contributor roles are configurable by adding a user to multiple Application role groups. SAML/OIDC SSO provides unified authentication across brands, capped at 5 SSO connections per organization.

Shared CMS content types (PageTypes, BlockTypes, element types) are defined once in the .NET codebase and shared across all brand Applications, with brand-specific view rendering applied via ITemplateSelector. CMS 13 custom elements definable in the Admin UI without code deployment let administrators extend the element library per brand use case without a developer cycle, and the Opal Content Model Creation agent can build best-practice models from a URL or image while cross-referencing existing types to avoid duplicates. Brand-specific property extensions still require class inheritance in code, and there is no visual model inheritance or per-brand content type extension through the CMS admin UI beyond custom elements.

Optimizely has no native executive portfolio reporting across brand Applications — reporting is per-Application, not cross-Application. ODP can aggregate data across all brand sites into custom dashboards, but that requires deliberate data pipeline configuration and dashboard development. Content freshness by brand, publishing SLA adherence, cost allocation per Application, and capacity planning reports all require custom implementation. Executives managing a brand portfolio have no native single-pane view, and nothing in the 2026 CMS 13 release stream addresses this.

Optimizely publishes DPA v2026-01 (effective Jan 1 2026) available to all customers with EU SCCs plus UK and Swiss addendums, EU data hosting with free geofencing that restricts support access to EU-based staff under customer-controlled break-the-glass, EU-US Data Privacy Framework certification, and a public sub-processor list with change notification via the status page. BCRs remain in progress with the Swedish DPA, and CMS 13 introduces new sub-processors (Optimizely Graph, Opti ID) that force customers to re-run DPO sign-off — plus PaaS customers still implement DSR workflows in application code, which caps this below the top anchor.

This is a genuinely provisioned HIPAA offering, not a marketing claim: Optimizely documents a distinct HIPAA-enabled CMS variant covering PaaS explicitly, with additional auditing and security controls, an Optimizely-approved BAA required before any ePHI processing, Optimizely acting as Business Associate for Healthcare & Life Sciences customers, and documented feature exclusions that define the compliance boundary (SendGrid SMTP, production database exports, content sync-down, edge log exports, project migration all removed) plus a documented incompatibility with non-HIPAA-enabled Optimizely products. Score is held below the high 80s because those exclusions strip real PaaS capability and HIPAA-compliant application code remains the customer's responsibility.

Coverage spans GDPR, CCPA, UK GDPR (DPA addendum), EU-US DPF, TISAX (automotive — Campaign scope), HECVAT/HECVAT-Lite (US higher education), FSQS/Hellios Stage 3 (financial services), TTDSG/TKG (German telecom), and PCI DSS v4.0.1 — broader industry-vertical coverage than most DXPs. The absence of FedRAMP, StateRAMP, IRAP, C5, ENS and Cyber Essentials authorizations held by Optimizely itself (Azure holding them does not transfer) keeps this well below federal-grade platforms.

SOC 2 Type 2 attestation from an independent third-party auditor covers an unusually broad product scope — CMS (PaaS & SaaS), Commerce Connect, Web & Feature Experimentation, Configured Commerce, ODP, CMP and Analytics — on an annual cadence, with reports released to customers via CSM (prospects via sales) under NDA. Wide product coverage beats most competitors; the exact Trust Service Criteria in scope are not publicly enumerated on the trust center and self-hosted deployments are out of scope, so this stops short of the 85+ anchor.

Optimizely holds a triple-ISO stack at platform scope rather than inherited infrastructure scope: ISO 27001:2022 (current revision) covering CMS, Commerce Connect, Experimentation and Campaign, plus ISO 27017:2015 cloud security controls and ISO 27018:2019 cloud PII protection covering CMS, Commerce Connect and Experimentation. CMS is named explicitly in every one of the three scopes and the ISMS governing the DXP is certified, which clears the prompt's 80+ bar; maintenance to the 2022 standard shows sustained program investment.

Portfolio is above average for a commercial DXP: PCI DSS v4.0.1 (QSA-audited for Experimentation; SAQ for Commerce Connect and Configured Commerce), TISAX, CSA STAR Level 1 with CAIQ 4.0, CyberGRX Tier 2 validated assessment, HECVAT, and FSQS/Hellios Stage 3. CSA STAR remains Level 1 self-assessment with no third-party-audited Level 2, and there is no FedRAMP, IRAP, C5, ENS or Cyber Essentials Plus, which caps this below federal-authorized platforms.

Prior scoring understated this: DXP is not an EU/US binary — Optimizely documents fully available Azure regions spanning Europe, US (including South Central US), Canada Central, Canada East, Australia East, Australia Southeast and Southeast Asia, with geo-replication confined to the chosen delivery region and a documented procedure to migrate a live CMS 12 or 13 project between hosting regions without affecting the site. Contractual EU hosting, EU geofencing of support access with customer-controlled break-the-glass, and EU-US DPF back the guarantees. Held below the mid-80s because regions outside the published list are case-by-case subject to Azure capacity, edge/CDN caching can place copies outside the residency region, and adjacent products (ODP, Campaign) carry different residency profiles requiring separate procurement review.

Export is genuinely self-service and automatable: the DXP Management API and EpiCloud PowerShell module (Start-EpiDatabaseExport / Get-EpiDatabaseExport) produce a full .bacpac of the CMS or Commerce database to Azure Blob storage with a time-limited download link, blob containers export alongside it, and Forms submission data exports as JSON, XML or CSV. DPA v2026-01 documents retention and post-termination deletion, and Optimizely documents IP anonymization plus PII obfuscation when copying databases to non-production. Right-to-erasure inside the CMS still requires custom .NET implementation — the in-app Account Settings > Access or Deletion Requests portal and its REST API cover Experimentation and Personalization, not CMS PaaS — which keeps this out of the 80s.

The Activity API (which supersedes the older ChangeLog API) logs content edits, publish events and admin actions with genuinely configurable retention — ArchiveRetentionPeriod on ActivityOptions defaults to 12 months, 0 deletes immediately and -1 retains indefinitely, with TruncateMaximum and TruncateDatabaseTimeout controlling the truncation job — and Opti ID, mandatory in CMS 13, adds a User Activity Log with error-code and success columns for SSO/MFA/SCIM events. CMS 13 also added scheduled-job hang detection logging. Two things hold this at the top of the API-polling band rather than 75+: SIEM consumption is customer-plumbed through Azure Monitor / Application Insights and DXP Management Portal log downloads rather than a native push connector, and the Change Log Auto Truncate scheduled job is enabled by default and weekly deletes change log items older than one month unless deliberately reconfigured.

Optimizely states a WCAG 2.1 A and AA target driven partly by the European Accessibility Act, and the Opal AI-Assistant emits WCAG-compatible HTML in the RTE with automatic alt-text generation, but nearly six months after CMS 13 GA there is still no published conformance report for Visual Builder — now the default editing surface for pages, blocks, experiences and media. The Opal Web Accessibility Evaluation agent and the Design Editor accessibility test both audit delivered output rather than the authoring interface, so they cannot be credited here. A stated target without a formal conformance artifact places this squarely in the prompt's 45–65 band.

No VPAT or ACR for the CMS 13 authoring interface is published or discoverable on the trust center or support site almost six months after GA, and there is no Section 508 formal conformance statement and no ATAG 2.0 documented assessment. What exists is a support section on accessibility basics and accessible formatting plus a Configured Commerce article still written to WCAG 2.0 AA — guidance about producing accessible output rather than procurement-grade documentation of the product itself, which is what regulated and public-sector buyers actually need. Marked down from the prior cycle because the post-GA window has now passed without an artifact appearing, leaving Optimizely well behind Adobe and Salesforce who publish current VPATs.

Opal Chat is GA on CMS 13 PaaS via Optimizely.Cms.Opal.Tools (requires Opti ID), surfacing an in-editor chat widget for generation, rewriting, brainstorming, and research, and brand governance has materially deepened — Opal Instructions are now joined by input guardrails (admins define acceptance rules in plain language and Opal trains a classifier to enforce them) and Preferred output examples plus Output Evaluation criteria that score generated text against a 75–95% baseline. Not higher because the richest authoring surfaces remain SaaS-first and Opal is separately licensed on PaaS.

AI image generation is now invocable from the DAM Asset Picker inside Optimizely CMS (as well as from tasks and the library), and the dedicated Image Alt Text Generation agent audits up to 20 images on a page URL, scores existing alt text against WCAG 2.1 AA, and returns ready-to-use copy with a prioritized fix list — pairing generation with alt-text automation inside the asset workflow. Optimizely's embedded DAM adds AI smart tagging, metadata generation, and AI-assisted batch uploads, and paas_cms_upload_media handles asset ingestion. Not higher because smart cropping/focal-point selection is not AI-driven and both the generation and alt-text agents sit behind Opal licensing.

CMS 13 ships integrated auto-translation through the Optimizely Languages gadget backed by Google Cloud Translation across 135+ languages and 800+ locale variants, with machine translation that preserves page hierarchies, content areas, and blocks, draft-stage translation before publication, and JSON export for external providers; Cognitive Service Translator is selectable as an alternative provider under Settings → Languages, so engine choice is no longer fixed. Opal adds conversational translation that Optimizely markets as brand-voice preserving. Not higher because auto-translate requires the component to be configured on the site and translation quality scoring is not a documented built-in.

The SEO Metadata Optimization agent generates meta titles, descriptions, and OpenGraph tags and applies them as drafts directly in CMS 13 (PaaS), the GEO Schema Optimization agent recommends and generates JSON-LD schema markup, and the Image Alt Text Generation agent closes the alt-text leg — alongside paas_cms_seo_analysis/seo_edit and paas_cms_geo_analysis/geo_apply. The June 10 2026 AEO platform launch with Conductor adds the AEO Gap Finder, AI Brand Visibility Report, Profound Citation Gap Analysis, an E-E-A-T Checker, and a Page Performance Evaluation agent running Lighthouse audits, plus Agent Visibility Analytics over CDN log data. Not higher because taxonomy/tag generation is still undocumented and the Conductor intelligence layer is a partner add-on stacked on top of Opal licensing.

The paas_cms tool suite automates core content operations in natural language — list/get content types, create and update content types with full property definitions, update content items, publish immediately or on schedule, create content variations, and generate preview URLs — while the Page Builder (PaaS) agent turns a document, image, or URL into a publish-ready CMS 13 content item and the Content Model Creation agent cross-references existing models to prevent duplicate content types. DAM smart tagging and AI-assisted batch uploads cover bulk enrichment. Not higher because content routing and duplicate content-item detection remain undocumented, and every tool requires Opal licensing plus Opti ID.

Optimizely rebranded Opal as the Agent Platform and the Agent Directory passed 100 pre-built agents by July 2026 (51+ named agents shipped in 2026 alone), with CMS 13 PaaS-specific entries — Page Builder (PaaS), Content Analysis, Content Model Creation, GEO Schema Optimization, SEO Metadata Optimization — running on a drag-and-drop workflow canvas with triggers, loops, conditionals, and human-in-the-loop approval gates. Governance is now first-class: Agent Builder and Skill Builder let users author agents in Chat, Version History records every workflow change (what, when, by whom), and Execution Guardrails progress through Learning → Watching → Enforcing modes and auto-terminate rogue runs. Not higher because the deepest agent tooling is still SaaS-first and PaaS reaches it only through separate Opal licensing.

The June 2026 AEO platform launch put Conductor Intelligence inside Opal, giving PaaS customers log-based AI traffic analysis plus the Conductor AEO Gap Finder (high-priority content gaps against tracked competitors), the Conductor AI Brand Visibility Report across ChatGPT/Gemini/Perplexity, Profound Citation Gap Analysis, and a Page Performance Evaluation agent — layered on Optimizely Content Intelligence NLP gap/saturation analysis, ODP behavioral signals, Content Recommendations, the Content Analysis agent, and the Agent Visibility Analytics dashboard in Optimizely Analytics. Not higher because Conductor is a partner data layer rather than an owned capability, and both it and Content Intelligence are separately licensed on top of PaaS.

Auditing now covers all three dimensions the framework asks for: the Content Refresh Analysis agent audits sites for outdated content and reviews it against compliance guidelines; the Image Alt Text Generation agent scores alt text against WCAG 2.1 AA and Siteimprove's agent-to-agent integration auto-remediates accessibility issues directly inside the Optimizely CMS; and brand/quality compliance is enforced through Opal Instructions, input guardrails, and Output Evaluation scoring against a configurable 75–95% baseline with up to 10 criteria. The E-E-A-T Checker audits content against Google quality signals and paas_cms_geo_analysis audits LLM discoverability. Not higher because thin/duplicate content detection at scale is still undocumented and every auditing agent requires Opal licensing.

Optimizely Graph is the default search engine in CMS 13 (Search & Navigation deprecated), with a Graph C# SDK offering a fluent API, field-level boosting, and facets, and Content Manager provides Graph-powered search-first content discovery natively. Hybrid semantic search via `_ranking: SEMANTIC` — a mixed keyword/vector mode that understands synonyms, intent, and related concepts — remains explicitly flagged 'an experimental feature and may be subject to change' in the 2026 Graph docs. Not higher because that experimental status is unchanged and Graph is a separately licensed prerequisite for CMS 13.

Optimizely took a second consecutive Leader placement in the Gartner Magic Quadrant for Personalization Engines, and the ML engine reaches PaaS: contextual bandits are tightly integrated into CMS 13 and adjust which experience each visitor sees from real-time signals without ongoing manual configuration, ODP real-time segments resolve at sub-90-second latency, and Content Variations are testable inside Visual Builder with Stats Engine and multi-arm bandits plus promote-to-original. Content Recommendations and Limitless 1:1 Personalization round out the stack. Not higher because ODP and experimentation are separately licensed on PaaS and cold-start handling is not explicitly documented.

PaaS now has a first-party, self-hosted MCP server: the Optimizely.Cms.Opal.Tools NuGet package ships one that exposes the same schema-aware CMS tools as Opal Chat to any MCP-compatible client (Claude Code, Cursor, VS Code Copilot), registered with services.AddCmsMcpServer() and mapped via endpoints.MapMcp("/mcp"), covering content types, content items, display templates, and SEO/GEO operations against the real CMS structure. Community servers (first3things/optimizely-cms-mcp, JaxonDigital optimizely-dxp-mcp) supplement it. Not higher because this release supports only client secret authentication — Opti ID authentication, and with it per-user permission scoping, is deferred to a later release.

Opal routes prompts across a curated model set — Google Gemini plus Anthropic Claude via Google Vertex AI since March 15 2026 — with selection available at instance and agent level, and the BYOAI capability plus the Epicweb BYOAI plugin extend CMS PaaS deployments to OpenAI, Azure OpenAI, Meta Llama, Writer, and Jasper. Not higher because this is vendor-curated model routing rather than customer BYOK: Optimizely explicitly reserves the right to add, remove, or substitute the underlying LLMs, and data-residency controls for arbitrary customer-supplied endpoints remain undocumented.

Optimizely ships first-class agent-developer tooling: Opal Tools SDKs in C#, JavaScript, and Python with @tool() decorators, an auto-generated /discovery endpoint, and built-in parameter validation, self-hostable on Azure/AWS/GCP or deployable to the Optimizely Connect Platform; plus the CMS 13 MCP server and paas_cms tool layer, a Graph C# SDK with a fluent API for strongly-typed content queries, a CMS REST API enabled by default via AddCms(), and Agent Builder/Skill Builder for in-Chat agent authoring. Optimizely also publishes docs.developers.optimizely.com/llms.txt — a Markdown index of every docs page plus OpenAPI endpoints, explicitly for AI agents. Not higher because there are still no official LangChain/LlamaIndex/CrewAI integration guides and the agent runtime requires Opal licensing.

Governance now covers all three legs the framework requires. Audit trails: Version History records every agent-workflow change with who/when/what, Execution Log Exports pull run logs on demand for reporting and compliance, and Agent Credit Visibility logs per-run consumption. Brand enforcement: Opal Instructions with role-based edit permissions, input guardrails that train a classifier from plain-language rules, Output Evaluation scoring against a 75–95% baseline, and Execution Guardrails that learn normal behavior and auto-terminate rogue runs. Privacy and safety: EU App Hosting data residency, Safe URL Browsing (Google Web Risk plus optional Cloudflare Radar deep scan), a no-training-on-customer-data commitment, Opti ID org-wide GenAI disablement, human-in-the-loop approval gates, and ISO 27001/27017/27018, SOC 2 Type 2, and PCI DSS v4.0.1. Not higher because IP indemnification for AI output is still not publicly documented.

All four observability legs are now present: the refreshed Opal Agent Usage dashboard gives summary cards, an execution-type breakdown, agent and top-user tables, and weekly active-user trends; the Opal User Usage chart and credit dashboard track allocated and consumed credits per user, product, and agent with monthly billing and overage alerts; Agent Credit Visibility exposes credits used per run inside specialized and workflow agent logs while Execution Log Exports pull those logs on demand; and the Quality tab supplies agent performance visibility with configurable evaluation criteria and baseline scores, giving real quality-trend monitoring. CMS 13's Agent Visibility Analytics adds AI-crawler traffic. Not higher because there is no per-model performance comparison or prompt-effectiveness analytics, consistent with Opal's curated model routing.