Optimizely PaaS DXP

Content is marked as being edited with an Edit Anyway override, comments and replies with @mentions on projects and project items, and email notifications through the Notification Dispatcher job. There is no real-time co-editing, presence or suggestion mode. Locking plus asynchronous comments places it at the low end of the adequate band.

Optimizely Content Recommendations (topic-interest based) and Product Recommendations (collaborative filtering for Commerce) are separate Optimizely products that write interests to ODP profiles. No recommendation engine ships in CMS 13 itself, and the Graph-based content sync for Content Recommendations was still described as forthcoming.

Correcting a prior error: Optimizely publishes DR objectives in its Service Continuity Policy rather than withholding them — for CMS the RPO is 10 minutes for web text content in normal operation and 1 hour in a declared DR situation (24 hours for other services), with content databases backed up every five minutes, full hourly backups, and up to 35 days of history for point-in-time restores, plus 24-hour full production backups with transaction-log PITR and multi-copy blob replication. Content and database export are available through the Deployment API as bacpac files and read-only BLOB SAS links. It falls short of the top band because the RTO is deferred to the Support Policy rather than stated as a figure, and automatic failover to a geo-redundant secondary region is a paid high-availability add-on rather than baseline.

Optimizely Web Experimentation and Feature Experimentation provide best-in-class A/B and multivariate testing with sequential stats, CUPED and feature flags, and CMS 13 content variations are the documented content side of experiments. These are sibling products licensed separately from CMS 13, so the add-on ceiling applies.

Optimizely DAM (part of Content Marketing Platform) embeds in CMS 13 through the DAM picker and Graph, with folders, tags, renditions, focal point, asset expiry, rights metadata and usage tracking back to CMP. It is a separately licensed product, so the add-on ceiling applies, and rendition selection inside the CMS picker is not supported.

Blueprints, developer-defined Styles and administrator control of which block types appear as elements or sections give brand guardrails, while Applications carry per-brand domains, languages and access rights and share blocks across brands. Not higher because there is no cross-brand approval workflow, policy enforcement engine or brand-level reporting.

Content approval sequences are defined per content type or tree path with multiple sequential steps, each with users or roles as reviewers, deadlines, required comments, four-eyes enforcement and a stored audit trail; content variations have their own approvals. Not higher because there are no custom workflow states, no parallel or conditional routing and no visual workflow designer.

Content performance analytics come from Optimizely Analytics (including the Agent Visibility dashboard) and the GA add-on rather than the CMS; inside CMS 13 there is search analytics in the Graph portal and audience statistics fed from GA4. Not higher because there is no native page performance, engagement or author productivity reporting in the CMS license.

The media library and Optimizely DAM store video files with metadata but provide no transcoding, adaptive streaming, captions or player; practical delivery is by embedding YouTube, Vimeo or Mux. No video pipeline appears in CMS 13 releases through 13.3.0.

Visual Builder is the default CMS 13 editing experience: drag-and-drop experiences built from sections, rows, columns and elements, copy and paste of layouts, Blueprints as reusable templates, developer-defined Styles as guardrails, and administrator control of allowed block types, for both coupled and headless (Next.js, Astro) frontends. Not higher because template locking is limited and new element types still need developer work.

First-party MA connectors 13.0.0 for HubSpot, Salesforce, Salesforce Marketing Cloud, Pardot, Eloqua, Delivra, Marketo and Microsoft Dynamics map form data to the external tool and expose MA profile criteria in audiences. Not higher because there is no native send, list sync, email authoring or email preview in the CMS; Optimizely Campaign is a separate product.

Nurture, drip and lead scoring live in the connected MA tool (Marketo, HubSpot, Eloqua, Salesforce), reached through the MA connectors and audience criteria built on MA profile data. Optimizely Campaign offers orchestration as a separate product. Not higher because CMS 13 itself has no automation.

Blueprints are the step change: editors create reusable layout templates directly in the UI — campaign landing pages, contest entry forms, mastheads, column and grid layouts — with automatic thumbnails, a browsable visual gallery, and export/import between environments, while Sections and Experiences decouple design from content models so content managers assemble page layouts from reusable sections without developer involvement. Around that sit Visual Builder as the default editor with autosave and drag-and-drop section reordering, Content Manager's search-first navigation, Content Variations managed from a toolbar dropdown, custom elements definable in the Admin UI, and Opal agents that run without configuration. Not higher because new content types and templates still require a .NET build and deploy, and legacy PageData pages remain in the form-based editor until they are remodeled as ExperienceData; not lower because launching a new campaign page from an existing blueprint is now genuinely a marketer-only task.

Auditing now covers all three dimensions the framework asks for: the Content Refresh Analysis agent audits sites for outdated content and reviews it against compliance guidelines; the Image Alt Text Generation agent scores alt text against WCAG 2.1 AA and Siteimprove's agent-to-agent integration auto-remediates accessibility issues directly inside the Optimizely CMS; and brand/quality compliance is enforced through Opal Instructions, input guardrails, and Output Evaluation scoring against a configurable 75–95% baseline with up to 10 criteria. The E-E-A-T Checker audits content against Google quality signals and paas_cms_geo_analysis audits LLM discoverability. Not higher because thin/duplicate content detection at scale is still undocumented and every auditing agent requires Opal licensing.

Governance now covers all three legs the framework requires. Audit trails: Version History records every agent-workflow change with who/when/what, Execution Log Exports pull run logs on demand for reporting and compliance, and Agent Credit Visibility logs per-run consumption. Brand enforcement: Opal Instructions with role-based edit permissions, input guardrails that train a classifier from plain-language rules, Output Evaluation scoring against a 75–95% baseline, and Execution Guardrails that learn normal behavior and auto-terminate rogue runs. Privacy and safety: EU App Hosting data residency, Safe URL Browsing (Google Web Risk plus optional Cloudflare Radar deep scan), a no-training-on-customer-data commitment, Opti ID org-wide GenAI disablement, human-in-the-loop approval gates, and ISO 27001/27017/27018, SOC 2 Type 2, and PCI DSS v4.0.1. Not higher because IP indemnification for AI output is still not publicly documented.

All four observability legs are now present: the refreshed Opal Agent Usage dashboard gives summary cards, an execution-type breakdown, agent and top-user tables, and weekly active-user trends; the Opal User Usage chart and credit dashboard track allocated and consumed credits per user, product, and agent with monthly billing and overage alerts; Agent Credit Visibility exposes credits used per run inside specialized and workflow agent logs while Execution Log Exports pull those logs on demand; and the Quality tab supplies agent performance visibility with configurable evaluation criteria and baseline scores, giving real quality-trend monitoring. CMS 13's Agent Visibility Analytics adds AI-crawler traffic. Not higher because there is no per-model performance comparison or prompt-effectiveness analytics, consistent with Opal's curated model routing.

Optimizely rebranded Opal as the Agent Platform and the Agent Directory passed 100 pre-built agents by July 2026 (51+ named agents shipped in 2026 alone), with CMS 13 PaaS-specific entries — Page Builder (PaaS), Content Analysis, Content Model Creation, GEO Schema Optimization, SEO Metadata Optimization — running on a drag-and-drop workflow canvas with triggers, loops, conditionals, and human-in-the-loop approval gates. Governance is now first-class: Agent Builder and Skill Builder let users author agents in Chat, Version History records every workflow change (what, when, by whom), and Execution Guardrails progress through Learning → Watching → Enforcing modes and auto-terminate rogue runs. Not higher because the deepest agent tooling is still SaaS-first and PaaS reaches it only through separate Opal licensing.

Built-in media library with folders, per-application asset folders, alt text and metadata via media content types, usage tracking through references, and URL-based resizing, cropping and WebP/AVIF conversion through Cloudflare on DXP hosting. Focal point and renditions come through the embedded Optimizely DAM picker. Not higher because transforms are a DXP hosting feature rather than part of the CMS itself and the native library has no editor-set focal point.

Editors personalize content areas and rich text per audience and preview the page as a chosen audience, and CMS 13 content variations add multiple published variants per item with their own approval and publishing lifecycle. Not higher because audience rendering is in-process only; headless personalization relies on variations driven by the separately licensed Experimentation products.

Optimizely Graph is included with CMS 13 and provides full-text search, facets, boosting, autocomplete, synonyms and pinned results, with the Search Management portal (search analytics, pinned results, synonyms) framed inside the CMS 13 navigation since 13.1.3. Not higher because there is no packaged search UI or merchandising rules engine for visitors, and Search & Navigation (Find) is gone in CMS 13.

CMS 13 Applications replace site definitions: one instance hosts many sites with their own hostnames, start pages, languages, access rights and preview routing, sharing the content tree and shared blocks, with per-application asset folders. Applications endpoints in the CMS REST API went GA in 13.1.0 and multiple default hostnames per locale returned in 13.2.0. Not higher because cross-site governance reporting is absent.

AI image generation is now invocable from the DAM Asset Picker inside Optimizely CMS (as well as from tasks and the library), and the dedicated Image Alt Text Generation agent audits up to 20 images on a page URL, scores existing alt text against WCAG 2.1 AA, and returns ready-to-use copy with a prioritized fix list — pairing generation with alt-text automation inside the asset workflow. Optimizely's embedded DAM adds AI smart tagging, metadata generation, and AI-assisted batch uploads, and paas_cms_upload_media handles asset ingestion. Not higher because smart cropping/focal-point selection is not AI-driven and both the generation and alt-text agents sit behind Opal licensing.

CMS 13 ships integrated auto-translation through the Optimizely Languages gadget backed by Google Cloud Translation across 135+ languages and 800+ locale variants, with machine translation that preserves page hierarchies, content areas, and blocks, draft-stage translation before publication, and JSON export for external providers; Cognitive Service Translator is selectable as an alternative provider under Settings → Languages, so engine choice is no longer fixed. Opal adds conversational translation that Optimizely markets as brand-voice preserving. Not higher because auto-translate requires the component to be configured on the site and translation quality scoring is not a documented built-in.

The June 2026 AEO platform launch put Conductor Intelligence inside Opal, giving PaaS customers log-based AI traffic analysis plus the Conductor AEO Gap Finder (high-priority content gaps against tracked competitors), the Conductor AI Brand Visibility Report across ChatGPT/Gemini/Perplexity, Profound Citation Gap Analysis, and a Page Performance Evaluation agent — layered on Optimizely Content Intelligence NLP gap/saturation analysis, ODP behavioral signals, Content Recommendations, the Content Analysis agent, and the Agent Visibility Analytics dashboard in Optimizely Analytics. Not higher because Conductor is a partner data layer rather than an owned capability, and both it and Content Intelligence are separately licensed on top of PaaS.

Optimizely Connect Platform apps sync commercetools and Shopify catalogs into Optimizely Graph in near real time so product data can be queried alongside CMS content, and External Content maps PIM or ERP data into content types. Not higher because these are connectors with no documented in-CMS product picker or bidirectional sync.

Optimizely's analyst standing is now among the strongest in this dataset: it took the top position in the 2026 Gartner Magic Quadrant for Digital Experience Platforms — leading on both Ability to Execute and Completeness of Vision and ending Adobe's five-year run at the top — with Gartner crediting platform breadth and modularity, pricing and packaging, and global momentum, and dropping the prior criticism that experimentation and content-marketing focus was diluting its DXP strategy. That stacks on Leader placements in the 2026 Gartner MQs for Content Marketing Platforms (9th consecutive year) and Personalization Engines (2nd year), the Forrester Wave for DXPs Q4 2025, and the 2026 Forrester Wave for Experience Optimization Solutions, where it scored the highest possible mark in 15 criteria. Not higher because this recognition attaches to Optimizely One as a suite rather than to PaaS CMS 13 specifically, Adobe remains close on both axes, and greenfield headless deals still route to Contentful, Sanity and Storyblok.

More of the performance loop is vendor-handled than prior scoring credited: DXP runs Azure App Service autoscale, Cloudflare CDN and HTTP/3, auto-configures Application Insights for APM, and issues a monthly performance report benchmarking page loads, response times and availability month-over-month — and CMS 13 has actually shipped performance fixes rather than only operational polish (a redundant synchronous content comparison in the Graph sync event handler that slowed the publish UI; project overview loading every project item now replaced by counts; CMS-52251 async visitor-data retrieval to avoid thread-pool exhaustion). Graph also supports cached/stored query templates so repeat requests reuse a parsed query shape. Raised because the prior read that CMS 13 brought 'little dedicated performance tooling' understated shipped fixes and the vendor-issued monthly report; not higher because application-layer tuning stays a recurring customer job — Graph query optimization replacing Find tuning, output caching, ContentArea nesting-depth limits, scheduling jobs off-peak, and Commerce catalog index/cache tuning.

Shared and inline blocks nest inside content areas and block properties, typed block lists are supported, and Visual Builder experiences compose sections, rows, columns and elements. Rich text is indexed to Graph with a structured JSON projection alongside HTML, which gives headless consumers more than an HTML blob. Not higher because the stored rich text remains XhtmlString HTML rather than a portable AST authored natively.

Full version history per language with a compare view that shows property differences between any two versions and counts changed properties per tab, one-click restore of earlier versions, trash with restore, and attribution of who saved each version. CMS 13 content variations add parallel published variants each with their own version history. Not higher because there is no content branching across environments and variations vary only localizable properties.

Graph webhooks cover document created, updated and deleted, bulk sync completion and expired content, with topic filtering and Basic or HMAC signing; in-process IContentEvents cover publish, move and delete for server code. Not higher because retries are limited, there are no delivery logs or admin UI for webhook management in CMS 13, and workflow transitions and schema changes are not emitted.

The in-platform translation UX is native: machine auto-translation through Azure Translator that preserves structure, translation of drafts, XLIFF and JSON export and import for external providers, and Language Manager 6.0 with configurable recursive depth. TMS connectors (GlobalLink, Lionbridge, Phrase, Smartling) are partner integrations. Not higher because translation memory lives in the external TMS and connector CMS 13 compatibility is not stated.

Scored against CMS 13 specifically, the add-on ecosystem is the platform's weakest technical surface right now: CMS 13 targets .NET 10 exclusively and its application-based architecture changed how add-ons hook in, so every package must be recompiled against 13.x assemblies before a site will even start, and as of late May 2026 only one or two third-party packages had shipped with upgrade issues unanswered elsewhere. Recompiles are landing steadily (Stott RobotsHandler 7.0.0, GoogleMapsEditor 5.0.0, Geta Sitemaps), and the App Marketplace, Optimizely-wide technology-partner network and CMS 13's embedded DAM remain real assets. But add-ons — not the CMS core — were the documented critical path for migration, and Commerce 15 is still in preview, so the effective CMS 13 catalog is well short of the 75+ band.

Optimizely Academy now publishes a dedicated PaaS learning path — 'PaaS CMS Development Fundamentals (CMS 13)' (April 2026), covering the architecture, the CMS 12 → 13 evolution, and the roles of Graph and Opti ID — alongside the 'CMS 13 – All you need to know!' collection (March 2026) that is still shipping new content weekly, a PaaS CMS Developer Certification exam, and live learning events in New York (Sept 2026), London and online (Oct 2026). Official docs cover install, upgrade, breaking changes, a third-party package compatibility page, and a webinar FAQ, backed by a published Q&A PDF and heavy partner/community coverage (Gosso, Svallin, Epinova, NoA Ignite, Velir, Pino Labs). Not higher because there is still no interactive in-console onboarding or guided in-product tutorial and the structured path is eLearning-and-docs rather than hands-on; not lower because a vendor-run, role-specific structured learning path plus certification and live training is exactly the 70+ band.

PaaS now has a first-party, self-hosted MCP server: the Optimizely.Cms.Opal.Tools NuGet package ships one that exposes the same schema-aware CMS tools as Opal Chat to any MCP-compatible client (Claude Code, Cursor, VS Code Copilot), registered with services.AddCmsMcpServer() and mapped via endpoints.MapMcp("/mcp"), covering content types, content items, display templates, and SEO/GEO operations against the real CMS structure. Community servers (first3things/optimizely-cms-mcp, JaxonDigital optimizely-dxp-mcp) supplement it. Not higher because this release supports only client secret authentication — Opti ID authentication, and with it per-user permission scoping, is deferred to a later release.

TinyMCE 8 with configurable toolbars and plugins, drag-in blocks and media within XhtmlString, and RICHTEXT_PRESET configuration in the JS SDK; Graph now emits a structured JSON projection of rich text for headless renderers. Not higher because the stored format is HTML with no custom marks or annotation model comparable to Portable Text, and Markdown for agents is still beta.

DXP-hosted sites sit behind a Cloudflare CDN with WAF and image resizing, Graph has its own CDN-backed delivery, and ISR for Next.js and Astro refreshes pages within seconds of publish through Graph webhooks. Not higher because cache purge in the portal is environment-wide (single-URL purge needs a ticket) and there is no edge personalization.

CMS 13 Audiences (visitor groups) ship in the base product with rule-based criteria for visits, geolocation, referrer, time, landing page, device and role, plus custom criteria via IVisitorGroupCriterion and Marketing Automation Profile criteria. Unified profiles come from Optimizely Data Platform, which is licensed separately and feeds real-time audiences into visitor groups. Not higher because native audiences work only on in-process (coupled) sites and first-party profiles require the ODP add-on.

Correcting a prior error: CMS 13 local development is now containerized out of the box — the Alloy template CLI accepts a Docker option that emits a ready-made docker-compose.yml bringing up a SQL Server container alongside the web app plus a .env file for SA_PASSWORD/DB_NAME/DB_DIRECTORY, and Optimizely publishes a first-party 'Create a Docker file for CMS 13' guide. Because CMS 13 runs on cross-platform .NET 10 rather than being coupled to Windows and IIS, it develops natively on macOS including Apple Silicon and on Linux containers, and no license file is required locally. It stops short of the top of the band because Opti ID and Optimizely Graph are mandatory cloud dependencies, so there is no fully offline inner loop.

Six months post-GA the CMS 13 upgrade has concrete published numbers rather than open-ended risk: a manual CMS 12→13 upgrade of a typical 40–60 content-type site runs 6–8 weeks of developer time, roughly 5 weeks end-to-end with partner automation, and Niteco sells a fixed-price 8-week guaranteed CMS 13 delivery; partner agentic-AI tooling reports 60–70% reductions in migration time and cost. The work is still substantial — .NET 10, Find-to-Graph, OPE-to-Visual Builder, SiteDefinitions-to-Applications, removal of dynamic properties/mirroring/legacy plugins, with third-party package incompatibility the single largest effort area — but CMS 12 remains patched in parallel so there is no forced cutover deadline.

Optimizely World is visibly active on CMS 13 nearly six months past GA, with Optimizely's own developers publishing there (Robert Svallin's CMS 12→13 Alloy upgrade and Preview 3 posts, Jake Minard's Graph SDK introduction) alongside a steady practitioner stream — developer-community updates dated Sept 16–17 2026 on Blazor Server UI in the CMS 13 Admin Shell and content-type icons, plus independent upgrade guides from gulla.net, wseweryn.dev, davidhome.net, nishtech.com and david-tec.com. Vendor-run Q&A supplements it: a March 26 2026 technical webinar produced both a published Q&A PDF and a permanent CMS 13 FAQ page in the official docs, and the Stack Overflow [episerver] tag carries 3,000+ historical questions with the broad .NET ecosystem as adjacent support. Raised because sustained employee participation and the formal Q&A program are stronger than a purely volunteer forum; not higher because the forum is self-described as community-driven with no staffing commitment and threads rely on users marking their own posts answered, so response times are unguaranteed; not lower because CMS 13 coverage is being actively produced rather than sparse.

Materially upgraded since the last review. Optimizely Graph (via Optimizely.Graph.Commerce, the primary search mechanism in Commerce Connect 15) provides GraphQL search with filtering and faceting, plus Pinned Results as the explicit successor to Best Bets. The prior scoring's main gap — that synonym and relevance tuning had no home after Search & Navigation was removed — is now closed: a Graph Portal item in the CMS 13 navigation bar frames the Search Management portal in the interface, with a Health & Monitoring area (search analytics Overview) and a Search Tools area covering Pinned Results and Synonyms, so merchandisers curate result ordering and term relationships without switching applications. Opal also exposes graph_pinned_result and graph_synonyms tools. Caveats keeping this out of the high 70s: the portal is beta, the nav item appears only for users with portal access, and a community add-on (OptiGraphExtensions) still fills gaps for some teams.

Upgraded since the last review. Search & Navigation (Find) is removed in CMS 13, making Optimizely Graph the search foundation — and the search-administration capability that was missing immediately after that removal has now returned inside the CMS. A Graph Portal item in the CMS 13 navigation bar frames the Search Management portal, giving administrators a Health & Monitoring Overview (search analytics dashboard) plus Search Tools for Pinned Results and Synonyms without switching applications. Combined with Graph's GraphQL filtering and faceting and Content Manager's search-first navigation, this is solid internal search with editorial control and relevance tuning. It stays below the 65+ band because the portal is beta and there is still no federated search across external systems (SharePoint, Confluence, Drive) and no AI-driven relevance ranking.

The SEO Metadata Optimization agent generates meta titles, descriptions, and OpenGraph tags and applies them as drafts directly in CMS 13 (PaaS), the GEO Schema Optimization agent recommends and generates JSON-LD schema markup, and the Image Alt Text Generation agent closes the alt-text leg — alongside paas_cms_seo_analysis/seo_edit and paas_cms_geo_analysis/geo_apply. The June 10 2026 AEO platform launch with Conductor adds the AEO Gap Finder, AI Brand Visibility Report, Profound Citation Gap Analysis, an E-E-A-T Checker, and a Page Performance Evaluation agent running Lighthouse audits, plus Agent Visibility Analytics over CDN log data. Not higher because taxonomy/tag generation is still undocumented and the Conductor intelligence layer is a partner add-on stacked on top of Opal licensing.

Optimizely ships first-class agent-developer tooling: Opal Tools SDKs in C#, JavaScript, and Python with @tool() decorators, an auto-generated /discovery endpoint, and built-in parameter validation, self-hostable on Azure/AWS/GCP or deployable to the Optimizely Connect Platform; plus the CMS 13 MCP server and paas_cms tool layer, a Graph C# SDK with a fluent API for strongly-typed content queries, a CMS REST API enabled by default via AddCms(), and Agent Builder/Skill Builder for in-Chat agent authoring. Optimizely also publishes docs.developers.optimizely.com/llms.txt — a Markdown index of every docs page plus OpenAPI endpoints, explicitly for AI agents. Not higher because there are still no official LangChain/LlamaIndex/CrewAI integration guides and the agent runtime requires Opal licensing.

CMS 13 supports code-first content types as .NET classes plus UI-created types, content contracts (interfaces) with allowed types and computed fields, typed block lists (IList<TBlock>), and ES-module custom property editors. The JavaScript SDK adds TypeScript content modelling with config:push, and code generation handles circular and self-referenced types. Not higher because UI-created block types still need a developer-authored view to render in a coupled PaaS site.

ContentReference<T>, ContentArea and LinkItem provide typed many-to-many references, and contracts give polymorphic references queryable through Optimizely Graph, which now returns DAM and CMS assets together through reference subfields. Reverse lookup exists through softlinks and Graph queries rather than declared bidirectional fields. Not higher because bidirectional relationships are not modelled natively and published variations do not generate softlinks.

DataAnnotations (Required, StringLength, RegularExpression, Range) on properties, IValidate<T> for cross-field and cross-content validation, and custom ValidationAttribute classes; the CMS REST API rejects invalid models with 400 InvalidModel, so validation also applies to API writes. Recent fixes keep validation errors visible in block dialogs and Visual Builder. Not higher because there is no built-in unique constraint or no-code validation rule builder.

Commerce Connect 15 (GA May 2026, requires CMS 13) adds catalogs, products, variants, bundles, pricing, inventory, promotions, cart and checkout with processor-based order APIs, and catalog entries use Visual Builder. It is licensed separately from CMS 13, so the add-on ceiling applies.

Momentum indicators strengthened materially in 2026: Optimizely reported 42% quarter-over-quarter ARR growth for its agent orchestration platform, with nearly 1,700 companies using Opal, 4,000+ unique agents built and 172,000+ agent runs across experimentation, campaign execution, content production and reporting — layered on a $400M ARR base and 300+ new logos in 2025 (Salesforce, Zoom, New Era, Mazda). G2 review volume grew from ~908 to 957 across products, Forrester named the platform a 'customer favorite' in Experience Optimization, and Opticon ran two 2026 editions (NYC, London). Not higher because the headline Opal figures are vendor-reported and company-wide rather than PaaS-CMS-specific, headcount edged down 1.3% within 2026, and the PaaS installed base is mid-migration to CMS 13 — absorbing budget that would otherwise fund net-new PaaS adoption.

CMS 13 runs on .NET 10 with standard ASP.NET Core MVC, ships the CMS REST API by default via AddCms(), renders Visual Builder through MVC tag helpers, and the headless story is now genuinely mainstream: the Stride starter is a Next.js app with full TypeScript typing and Tailwind CSS querying a standard GraphQL endpoint, with the Graph C# SDK and JavaScript SDK both GA. Working against that, Optimizely Search & Navigation (EPiServer.Find) is removed rather than deprecated in CMS 13 and its packages will not be upgraded, so Graph is the only supported search path and every implementation inherits its proprietary sync and schema semantics on top of the long-lived EPiServer API surface. Not higher because .NET plus EPiServer-era APIs (IContentRepository, initialization modules, virtual roles) still narrow the talent pool versus JS-native headless platforms; not lower because GraphQL, React/Next.js and ASP.NET Core MVC are all industry-standard and both SDKs are GA.

The transition-period starter gap the prior score flagged has closed: CMS 13 launched with a new first-party template, Stride, built around the Visual Builder content model — a single command scaffolds a working Next.js app with pre-built composition/experience components, Tailwind styling, full TypeScript typing, and config:push scripts that sync its content-type configuration into the CMS — while Alloy has been updated for CMS 13 and still installs via `dotnet new epi-alloy-mvc`, giving a working sample site and admin UI out of the box. An official 'Migrate an Alloy site from CMS 12 to CMS 13' guide covers the brownfield path, and custom elements are definable in the Admin UI without a code deployment. Not higher because deployment/CI-CD configuration is not part of the shipped templates and the Content Delivery API build for CMS 13 is still roadmap with no ETA, leaving some starter architectures unsupported; not lower because vendor-maintained templates with example content now exist on both the coupled and headless paths.

DXP PaaS ships more built-in operational visibility than most Traditional DXP peers: Application Insights is configured automatically for every DXP site by the EPiServer.CloudPlatform.Cms package, application logs stream live or download from the Management Portal with 90-day blob retention, a consumption-metrics view tracks usage, read access to the Azure portal is provided, and Optimizely issues a monthly performance report benchmarking average page loads, response times, views, events and availability against prior months. CMS 13 adds scheduled-job hang detection with log indicators, a Cloud License Management settings view showing active server names per URL, and third-party npm license visibility in edit mode, on top of 24/7 infrastructure monitoring. Not higher because Application Insights still needs further configuration to use fully depending on site architecture, application-layer alerting is customer-built, and a June 2026 DXP PaaS forum thread reporting a site going down twice a month shows diagnosis still lands on the customer; not lower because auto-configured APM plus a vendor-issued monthly performance report is a genuinely low setup burden.

The post-GA track record is now concrete rather than projected: a licensing bug found at launch was fixed in 13.0.1, the line reached EPiServer.Cms 13.1.2 / EPiServer.CMS.Core 13.1.1 within roughly five months, and the continuously-updated CMS 13 release notes document a steady fix stream — CMS-52251 (async visitor data / thread-pool exhaustion), CMS-50238 (security settings on import/export), the Graph sync publish slowdown, project overview load performance, CMS assets unqueryable through Graph via content reference fields, and localization fixes — while Forms 6.0.0 shipped with CMS 13 support and a moderate transitive CVE (ImageSharp) was patched quickly. Both CMS 13 and CMS 12 receive active bug and security triage. Raised because the fix stream has broadened well beyond the two documented items credited previously; not higher because the monthly NuGet cadence means non-critical bugs can wait weeks, every application-tier fix requires the customer to take the package and redeploy, and the third-party add-on breakage that dominates real upgrade pain is not Optimizely's to fix; not lower because critical issues get hotfix packages through support and the observed cadence is steady.

Improved since the last review on one specific axis the rubric calls out. The search-analytics capability lost when Search & Navigation was removed is partially restored: the Search Management portal's Health & Monitoring Overview is a search analytics dashboard reachable from the Graph Portal item in the CMS 13 nav bar, so intranet administrators can again monitor search performance and term behaviour and act on it via Synonyms and Pinned Results. ODP aggregates employee digital interaction data into custom segments and activity reports. Agent Visibility Analytics is oriented to external AI-crawler traffic, not internal employee engagement, so it does not count here. Department-level analytics dashboards, adoption rate tracking, and formal intranet ROI reporting still require custom ODP dashboard configuration or external BI.

Visual Builder is the default editing experience with synchronized live preview, interactive property highlighting and autosave, and it works for coupled MVC sites and headless frontends through preview routing per application and content type, preview tokens, and Graph draft sync. The JavaScript SDK renders experiences with live preview, and per-language and per-variation preview is supported. Not higher because there are no public unauthenticated share links and headless preview needs developer setup of preview routes.

Correcting a prior error: Optimizely does run a public bug bounty, migrated to Bugcrowd, paying up to USD $3,500 with partial safe harbor and disclosure permitted across 12 web and 3 API targets including episerver.net domains, backed by [email protected], a numbered Security Announcements Center (CMS-2025-01 high Stored XSS, CMS-2025-02 password complexity, CMS-2025-03 upload validation), annual third-party pentests and automated plus manual source analysis. Against that, the February 2026 ShinyHunters vishing breach is confirmed — attack Feb 11, disclosed Feb 23, attackers phished SSO credentials and MFA codes and took business contact information, CRM records and back-office documents, though they could not escalate privileges or reach customer databases and DXP production content was not implicated. A real breach plus a high-severity CMS XSS keeps this well below the 70+ clean-history band even with bounty and disclosure in place.

Post-GA velocity on CMS 13 is now demonstrably monthly rather than a one-time launch: the ongoing '2026 Optimizely CMS 13 release notes' page tracks a continuous stream through Q3 2026 — 13.0.2, Search Management portal surfaced inside the CMS navigation bar, Graph C# SDK facet configuration and boolean facet filtering, the Headless Forms REST API (Optimizely.Cms.Forms.Service) upgraded for OIDC, and Marketing Automation connectors (Delivra, Eloqua, HubSpot, Pardot, Salesforce, SFMC) all republished at 13.0.0. Optimizely has also publicly adopted a 'CMS Core' build-once philosophy so SaaS-first features (Visual Builder, GEO/.llms.txt, Opal Page Builder and content-model agents) now land on PaaS rather than staying SaaS-exclusive. Not higher because PaaS consumption is still customer-driven NuGet upgrades on the customer's own timetable, so shipped cadence and realized cadence diverge.

Optimizely maintains separate, structured, per-product release-note streams in the Support Help Center — an ongoing 2026 CMS 13 page (44937048830221), the one-time CMS 13 GA page (44734633809037), a still-live 2026 CMS 12 page (33309043090189), a CMS SaaS page, and a 2026 Opal page — so a PaaS buyer can follow their exact product line with version numbers and dated entries rather than a blog firehose. Breaking changes are documented separately with a dedicated 'Upgrade to Optimizely CMS 13 from CMS 12' guide in developer docs, and the version support policy is explicit (CMS 13 and 12 receive bug and security patching; CMS 11 and earlier only severe security). Not higher because breaking-change detail, Graph API migration reference tables, and upgrade walkthroughs remain split across developer docs and Optimizely World blogs instead of being inlined into the release-notes entries themselves.

Optimizely now publishes a standing public product-updates page per product line (optimizely.com/product-updates/content-management) stating the current quarter's investment areas — agentic content workflows, deeper platform connectivity, AI discoverability, virtual teammates for translation and optimization, expanded developer tooling — alongside the release notes' 'Coming next' section and Forum idea voting. Critically, the long-standing PaaS-vs-SaaS investment uncertainty has been answered publicly with the stated 'CMS Core' philosophy (features built once to serve both deployment models), and the roadmap was validated twice in 2026 by CMS 13 GA in March and the Agent Orchestration Platform launch at Opticon NYC. Not higher because there is still no public roadmap board with per-item status lifecycle and vote counts, and dated delivery commitments are absent — direction is disclosed, timing is not.

Engagement through the CMS 13 cycle has been unusually dense for a platform this size: independent practitioner posts ran continuously from pre-GA into Q3 2026 (Robert Svallin's Alloy upgrade walkthrough, Sanjay Katiyar's 12-to-13 migration, Aniket Gadre's 'what actually changed', Hung Le Hoang's two-part agentic upgrade series, Wojciech Seweryn's pre-upgrade checklist, Gosso's technical Q&A, Stuart Greig's upgrade comparison), the developer forum carries real troubleshooting threads with Optimizely staff answering, and the OMVP program announced a fresh H2 2026 cohort. Partner-side engagement is being actively driven through the Opal Innovation Challenge and Opal Certification World Tour. Not higher because activity is concentrated in a recognizable core of a few dozen OMVPs and partner bloggers rather than a broad contributor base, and GitHub issue throughput stays low relative to open-source-first ecosystems.

Beyond the ~592-partner directory (roughly 301 technology, 291 channel) with a tiered program, Optimizely materially deepened partner enablement in 2026: an Optimizely One Partner Accreditation Program, a relaunched certification catalog built with OMVPs and subject-matter experts including Core Competency tracks for new partners, and the partner-exclusive Opal Innovation Challenge and Opal Certification World Tour. Named enterprise SIs span Rightpoint (one of five Premier Platinum partners globally), Valtech, Perficient, Verndale, Netcel, Sagepath Reply and UNRVLD, and the 2026 calendar carried a dedicated UK Partner Day plus Opticon NY and London. Not higher because coverage remains concentrated in Northern and Western Europe and North America, with APAC and LATAM noticeably thinner.

CMS 13 drove a broad and sustained independent-content wave across 2026 spanning agency deep-dives and individual developer blogs — Royal Cyber's upgrade planning guide, Nishtech, NOA Ignite, Niteco, Mando Group, Nansen, Sagepath Reply, Technical Dogsbody's CMS roadmap analysis, potnoddle.github.io's agentic-CMS roadmap read, stuartgreig.dev, wseweryn.dev — plus trade coverage from ContentGrip, MarketScale and CMSWire and an Optimizely Academy catalog with ~11,000 students. Not higher because the independent long-form catalog is still thin where buyers look first: Udemy and Pluralsight coverage of Optimizely CMS is sparse, YouTube tutorial volume is low, and almost all the depth is authored by implementation partners with a commercial interest rather than neutral educators.

Stability signals are solid and improving: Optimizely remains Insight Partners-owned (Episerver acquisition 2020, rebrand 2021), disclosed a $400M ARR milestone, reported 42% QoQ ARR growth on its agent platform, grew headcount 19.9% from ~1,410 in 2023 to ~1,691 by March 2026 with no confirmed layoffs in 2025-2026, and is visibly funding product across CMS 13, Opal and SaaS CMS simultaneously. Not higher because there are no audited public financials, headcount slipped 1.3% within 2026 after years of growth, and the fundamental overhang is unresolved — a PE sponsor six years into a hold with no announced IPO or exit path, and no disclosed funding event since the 2019 Series D that preceded the acquisition.

Nothing improved in 2026 and new sourcing makes the terms look worse than previously scored: no monthly billing at any tier, no self-serve trial, 3–7% escalators standard (5–15% cited by some trackers, 5–10% at renewal if not negotiated), and auto-renewal windows reported at 60–90 days ahead of expiry with at least one tracker reporting a two-year minimum commitment. Optimizely publicly advertises no startup, nonprofit or education program — reduced pricing is entirely at sales discretion. Not lower because 2–3 year terms do buy real 20–30% discounts and the escalator is negotiable upfront.

CMS 13 deepens coupling — Search & Navigation is gone in favour of Graph, which cannot be self-hosted, and Opti ID is DXP-only, so a full exit means replacing search/delivery and identity as well as hosting. Worse, the primary export format is weaker than it looks: .episerverdata packages do not carry portable content-type definitions, only metadata referencing the original compiled .NET assemblies, so a package is realistically importable only into an equivalent Optimizely codebase — and even Optimizely's own PaaS→SaaS path drops entities such as personalized content and visitor groups. Not lower because the Content Delivery API (JSON), Content Management API and Service API provide documented programmatic bulk export.

Zero-to-working on CMS 13 is a heavy config surface: Optimizely Graph alone needs five appsettings values (GatewayAddress, AllowSendingLog, SingleKey, AppKey, Secret) plus the Graph service enabled on the instance before the project is wired, on top of an EPiServerDB connection string pointing at SQL Server 2022 or Azure SQL at compatibility level 140+, Opti ID via EPiServer.OptimizelyIdentity and services.AddOptimizelyIdentity(), and explicit service registration in Startup.cs for every referenced NuGet package. Several defaults are non-obvious traps — Opti ID auto-maps the CmsEditors and CmsAdmins virtual roles so pre-existing mappings must be deleted, Opti ID covers only shell/preview/edit unless you opt it in application-wide, and headless preview additionally needs AllowSyncDraftContent set on Graph. Not higher because both mandatory components carry their own credential and enablement steps before any content renders; not lower because the REST API is included by default via AddCms() and configuration lives in conventional appsettings.json and Startup.cs rather than a proprietary format.

Modeling is materially better supported than in CMS 12: content type contracts are plain .NET interfaces inheriting IContentData that can be used in AllowedTypesAttribute for cleaner composition, Content Variations store only explicitly modified properties as deltas, and the Opal Content Model Creation agent ships with CMS 13 with no configuration — it builds a content model from a URL or image, cross-references existing content types to avoid duplicates, returns each type marked New or Modified with full JSON, and asks before applying to the instance. The underlying risks are unchanged: the code-first model still auto-detects schema changes at startup, removing a property still orphans its data, and there is no migration or rollback tooling; the upgrade also surfaced a schema-name trap where content type names containing non-ASCII characters, hyphens or dots broke CMS 13 until a sanitizing migration step was added. Not higher because schema changes remain irreversible with no migration story and Visual Builder adoption forces remodeling PageData types as ExperienceData; not lower because the Opal agent plus strongly-typed Graph results remove a real class of hand-modeling and runtime-schema errors.

Core hygiene automation is strong: link integrity tracking parses properties on save and stores cross-references in a permanent-link table to prevent broken links, Graph auto-indexes on publish, version pruning runs from the admin UI, approval workflows are built in, and CMS 13's new Content Manager gives editors a search-first, Graph-powered interface that scales to large content libraries — while redesigned Application Management replaces SiteDefinition with validation, editable names/API IDs, default-application designation and identity-based (not display-name) multi-site resolution. The new risk is content variations: variation-only references are partly invisible to the reference data that governance, link-checking and 'where is this used' reporting depend on, nothing in the box prevents a page accumulating orphaned variations, and variation sprawl is hard to spot because it does not appear as nodes in the tree. Lowered from prior scoring because that blind spot is a genuine new hygiene gap; not lower still because link integrity, auto-indexing, pruning, workflow and Content Manager keep routine day-to-day burden light; not higher because Graph reindex after schema changes and version pruning on large trees remain manual attention.

Opal Chat is GA on CMS 13 PaaS via Optimizely.Cms.Opal.Tools (requires Opti ID), surfacing an in-editor chat widget for generation, rewriting, brainstorming, and research, and brand governance has materially deepened — Opal Instructions are now joined by input guardrails (admins define acceptance rules in plain language and Opal trains a classifier to enforce them) and Preferred output examples plus Output Evaluation criteria that score generated text against a 75–95% baseline. Not higher because the richest authoring surfaces remain SaaS-first and Opal is separately licensed on PaaS.

The paas_cms tool suite automates core content operations in natural language — list/get content types, create and update content types with full property definitions, update content items, publish immediately or on schedule, create content variations, and generate preview URLs — while the Page Builder (PaaS) agent turns a document, image, or URL into a publish-ready CMS 13 content item and the Content Model Creation agent cross-references existing models to prevent duplicate content types. DAM smart tagging and AI-assisted batch uploads cover bulk enrichment. Not higher because content routing and duplicate content-item detection remain undocumented, and every tool requires Opal licensing plus Opti ID.

Optimizely took a second consecutive Leader placement in the Gartner Magic Quadrant for Personalization Engines, and the ML engine reaches PaaS: contextual bandits are tightly integrated into CMS 13 and adjust which experience each visitor sees from real-time signals without ongoing manual configuration, ODP real-time segments resolve at sub-90-second latency, and Content Variations are testable inside Visual Builder with Stats Engine and multi-arm bandits plus promote-to-original. Content Recommendations and Limitless 1:1 Personalization round out the stack. Not higher because ODP and experimentation are separately licensed on PaaS and cold-start handling is not explicitly documented.

Optimizely Graph is the mandatory GraphQL delivery layer with filtering, facets, sorting, autocomplete, synonyms and locale fallback, backed by a typed C# SDK and JavaScript SDK; the CMS REST API covers management, and Content Delivery API 13.0 (Aug 19 2026) restores a REST delivery option. Not higher because the REST Content Delivery API is a compatibility release excluded from Visual Builder experiences.

Graph makes all content available to any channel through GraphQL with C# and JavaScript/TypeScript SDKs, the REST Content Delivery API, structured JSON rich text and an Astro or Next.js starter (Stride). Not higher because SDKs cover only .NET and JavaScript, rich text is HTML-based, and Markdown output for agents is beta.

The Google Analytics for Optimizely add-on (GA4, GTM script) shows statistics in the CMS dashboard, audiences can push statistics to GA4, the ODP JavaScript SDK streams behavioural events, and the Experimentation products connect to GA4, Adobe Analytics, Amplitude, Mixpanel and Segment. Not higher because these are vendor connectors and SDKs rather than built-in tag management.

Optimizely Forms 6 (CMS 13) offers drag-and-drop form building with conditional fields, multi-step forms with step routing, hidden and profiling fields, CAPTCHA, file upload, submission storage and export, custom actors and MA connector field mapping; the Headless Forms REST API 2.0 supports CMS 13. Not higher because there is no per-step drop-off analytics or lead routing.

Both deployment modes remain available — managed DXP hosting on Azure App Service across Integration, PreProduction and Production environments, or self-hosted ASP.NET Core on any compatible infrastructure, now genuinely cross-platform on .NET 10 with first-party Docker guidance. The caveat that pulls this down from the prior score is that CMS 13 makes Opti ID and Optimizely Graph mandatory components, so a self-hosted CMS 13 instance is no longer independent of Optimizely's cloud services the way CMS 12 could be. Both options exist, but the self-hosted option is materially less sovereign, placing it at the low end of the both-available band.

Optimizely DXP contracts an up-to-99.9% uptime SLA for production delivery on Azure with a public status page and a Severity 1 initial-response target of 30 minutes under Standard Support. September 2026 was a noisier month than the prior review captured: an SSL trust issue caused login failures across multiple DXP environments on Sept 2, Opti ID misrouted users to the wrong SSO login page on Sept 17, plus SMTP delivery delays and a CMP analytics outage. Because Opti ID is mandatory in CMS 13, identity-layer incidents now degrade editing for every CMS 13 tenant, so 99.9% with a visible cluster of auth incidents sits mid-band rather than at its top.

The DXP Deployment API is a full REST surface for pipeline automation — start, complete and reset deployments per environment, sync databases and BLOBs from Production downward, export databases as bacpac, and mint read-only SAS links for BLOB containers — wrapped by the EpiCloud PowerShell module and the dotnet-episerver CLI, with documented Azure DevOps multi-stage YAML, GitHub Actions and Octopus Deploy patterns over three-tier promotion with slot swapping and zero-downtime deploys. CMS 13 adds the ability to apply app settings and connection-string changes to a specific environment from the PaaS portal without running a full code deployment, which removes a common redeploy round-trip. Branch-per-PR content environments are still not natively supported, keeping it just above the mid-band.

The versioned v13.0.0-CMS documentation tree is unusually complete for a major release six months in: install, system requirements, configure, deploy, Dockerfile creation, content model/IContent, REST API reference, access rights documented separately for Opti-ID and non-Opti-ID setups, settings administration, a dedicated upgrade-from-CMS-12 guide, and — notably — separate framework/platform and third-party-package breaking-changes pages, supplemented by a published CMS 13 technical webinar Q&A and Q&A PDF, with Swagger UI and GraphiQL for interactive exploration. Frontend coverage has broadened to Next.js, React and Astro. It stays below 80 because backend framework guidance is .NET-only and the practical state of add-on and Content Delivery API availability is communicated more clearly in partner blogs than in official docs.

The official JavaScript/TypeScript SDK reached general availability in 2026 with full typing, autocomplete, structured error handling and first-class React/Next.js rendering, and pairs with @optimizely/cms-cli to enable genuine code-first content modeling — content types and property groups authored as TypeScript definitions and synced to the CMS, making code the source of truth for types under version control, with the contentType function's typing improved and build config now carrying language/locale settings. That is materially stronger than a merely typed client. It stays below the 80+ auto-generation band because for PaaS the canonical content model is still authored in C# as IContentData interfaces, and the TypeScript modeling flow is primarily the SaaS-oriented path feeding the frontend.

CMS 13's migration support is genuinely above average for a .NET major: CMS 12 remains under active maintenance in parallel with its own 2026 release-notes stream (a real deprecation window rather than a forced cutover), a first-party 'Upgrade to CMS 13 from CMS 12' doc exists, the Graph C# SDK ships an API migration reference mapping every Search & Navigation call plus .ToGraphQL() for debugging, and Optimizely published first-party guidance on using agentic AI to accelerate CMS and Commerce upgrades. Practitioners report the jump is materially easier than CMS 11 to 12. Not higher because the surface area broken is large — mandatory Graph and Opti ID, .NET 10, on-page editing removed, SiteDefinition replaced by the Application Model, ContentArea.FilteredItems obsoleted — and the third-party ecosystem lagged GA badly, with developers reporting solutions that restore and build cleanly on 13.0.2 but fail at runtime behind roughly ten partner packages plus a ShellModule DI breakage.

Community proxies grew modestly across 2026: the Optimizely Slack community now lists 5,700+ members (up from ~5,000), Optimizely Academy reports roughly 11,000 enrolled students, G2 carries 957 reviews across Optimizely products (up from ~908) with 204 on the CMS product specifically, and GitHub holds ~280 repositories across the optimizely and episerver organizations against ~3,000 Stack Overflow questions under the legacy tags. Not higher because this is an enterprise .NET community whose absolute scale sits an order of magnitude below WordPress or Drupal, and the Stack Overflow tag volume is largely historical EPiServer-era rather than current CMS 13 activity.

The hiring surface is real but shallow: aggregators list ~97 Optimizely job vacancies as of September 2026 with US averages around $155K/yr (typical band $135K-$174K) and Episerver-specific contract rates near $61/hr, and the relaunched certification catalog plus an ~11,000-student Academy give a formal credentialing path. CMS 13's .NET 10 base means general .NET developers can be retrained rather than hired cold, and the ~592-partner network supplies bench capacity. Not higher because platform-specific depth stays genuinely niche — Episerver/Optimizely developer listings number in the single digits on some national job boards, postings routinely demand 3-6 years of platform-specific experience on top of 6 years of .NET, and supply concentrates in the Nordics, UK and US such that buyers elsewhere still struggle to staff.

CMS 13 genuinely reduces licensing gates — Graph (search/content delivery) and Opti ID (identity/SSO) are bundled into the base CMS license and Search & Navigation is deprecated rather than upsold. The offset is that gating has shifted from price tier to hosting model: Opti ID is DXP-only, and Visual Builder — the flagship CMS 13 editing surface — plus the embedded DAM, External Content, CMP integration and Opal are all unavailable without it, so a self-hosted CMS 13 licensee is locked out of the headline features. Commerce Cloud, Campaign, Experimentation and ODP remain separate purchases.

CMS 13 runs locally on .NET 10 with project templates and the Stride demo site, license-free under IIS Express, and ships C#/JavaScript SDKs for Graph — so a developer inside a licensed org gets to a working site in under a day. But CMS 13 pushed two hard dependencies into the cloud: Graph requires a cloud-connected index even for local development (a Docker-based local Graph service is only 'being investigated' on the roadmap), and Opti ID login is DXP-only. Combined with no trial and multi-day DXP provisioning behind a sales cycle, a new evaluator cannot reach first value without procurement.

On DXP, hosting stays bundled and predictable — Azure compute, Cloudflare CDN, Azure SQL and Blob Storage across Integration, Preproduction and Production environments inside the subscription, with Graph infrastructure now folded into the CMS 13 license rather than billed separately. Correcting an earlier read: CMS 13 does not force DXP hosting — Graph is a cloud service but any CMS instance that can reach it can use it, so on-premises CMS 13 remains supported, though self-hosters pay their own Azure (third parties estimate $10K–$50K+/yr) and lose Opti ID and everything behind it. Not higher because the bundled cost is buried inside a large opaque license with metered traffic overages layered on top.

CMS 13 continues to chip away at operational load: scheduled-job hang detection, a cloud license-management dashboard, Applications replacing site definitions, and the September 2026 addition of a Graph Portal item in the CMS nav so search performance, pinned results and synonyms are managed without leaving the CMS. Optimizely manages the Azure infrastructure, SQL and Blob Storage on DXP while the customer still owns CI/CD, Application Insights, portal administration and — the real recurring burden on PaaS — application-level .NET and NuGet upgrades plus third-party package compatibility. Solidly mid-range: less than true self-hosting, materially more than managed SaaS.

The dominant CMS 13 conceptual change is PageData → ExperienceData, and the architecture explicitly expects coexistence — both are first-class citizens, legacy PageData content stays in the form-based editor until migrated, and Block Elements let blocks live inside Visual Builder Columns — so developers must hold two editing models at once rather than replacing one with another. On top of the ~9 legacy domains (ContentReference/ContentArea, publishing/versioning, initialization modules, Visitor Groups) CMS 13 adds Experiences/Sections/Elements/Columns, Blueprints, Content Variations, the Application Model replacing SiteDefinition, and mandatory Graph and Opti ID. Not higher because the dual-model coexistence is a lasting tax rather than a transition step; not lower because sections/columns/elements is a familiar page-builder mental model and IContentData content-type contracts clean up the model layer.

On the coupled MVC path preview is effectively free — Visual Builder is the default editing experience on PaaS CMS 13, renders server-side through tag helpers with no Graph dependency, and gives autosave plus synchronized preview in a single Outline + Live Preview workspace, closing the gap that previously separated PaaS from SaaS. The headless path is a different story and the docs are explicit that traditional on-page editing from MVC is not available by default: you set AllowSyncDraftContent on Graph, inject the CMS-served communicationinjector.js script into the draft layout, and wire signed preview tokens, draft-content authentication, URL routing and live-refresh hooks yourself. Not higher because the headless route is a documented multi-step integration rather than plug-and-play; not lower because official 'Live preview with Next.js (headless)' and 'Manually enable live preview' guides exist and the MVC route needs no preview code at all.

Optimizely Graph knowledge is now non-optional: Search & Navigation is removed from CMS 13 rather than deprecated and its packages will not be upgraded, so every implementation either learns Graph or builds a custom search provider, and teams migrating also need people who can read and patch community add-ons — Advanced Reviews, Geta NotFoundHandler, Geta Sitemaps and GoogleMapsEditor all required CMS 13 forks against moved or removed APIs. Offsetting that, .NET 10 and ASP.NET Core MVC are mainstream, certification is available but not mandatory, and Academy's PaaS CMS 13 fundamentals path plus GA C# and JS SDKs shorten the ramp for new hires. Not higher because mandatory Graph, the Visual Builder/ExperienceData paradigm shift and add-on patching all sit above the .NET baseline as proprietary knowledge; not lower because no certification is required and the underlying stack is a framework most .NET developers already know.

CMS 13 bundles several forced changes at once — Search & Navigation (Find) is removed outright rather than deprecated, so its packages will never be upgraded and Graph or a custom provider becomes mandatory; Opti ID is required; Plugin Manager, dynamic properties, mirroring and REST API extension points are gone; OPE is disabled for Visual Builder. The offsetting fact, often missed, is that this is not a forced cutover: Optimizely runs a live parallel '2026 CMS 12 release notes' stream and documents CMS 12 as still receiving bug monitoring, fixes and security patches as the prior major, and CMS 12 dates to 2021 — a multi-year deprecation window — while the Content Delivery API gap at launch has since been closed by Content REST API 13.0 for CMS 13 / .NET 10. Not higher because losing a separately-licensed product (Find) with no upgrade path and absorbing a mandatory SaaS dependency in one release is a real forced migration; not lower because the supported-fallback window is long and automatic SiteDefinition→Application migration plus documented Graph/Alloy migration paths shorten the runway.

CMP is a documented first-party integration rather than a loosely-coupled sibling product: the CMS + CMP publishing integration lets teams manage the production lifecycle of CMS pages using CMP tasks and workflows, and CMP DAM assets are selectable from inside CMS. CMP 2026 releases added custom date-range filtering in the Plan view (portfolio planning, localization calendars, event timelines) and the ability to link a single task to multiple campaigns, eliminating duplicate tasks across campaigns. Optimizely Campaign (separately licensed) covers email/web campaign execution, UTM tracking, and campaign analytics. CMS scheduled publishing handles web campaign timing and Audiences enable UTM-based campaign personalization. Still no native campaign calendar inside PaaS CMS itself, and both CMP and Campaign are separate licenses — CMS-only deployments remain basic.

Still the strongest experimentation story in this scorecard, but the previous scoring overstated CMS-native testing. CMS 13 Content Variations supply the authoring layer — multiple independently versioned published variants of the same content item in the same language, delta-based storage (only modified properties stored), independent version history and publishing lifecycle, audience tracking, divergence state, a needs-attention filter, and approval-workflow integration. The actual test engine — traffic splitting, visitor bucketing, conversion tracking, and statistical analysis — still requires the separately licensed Web Experimentation or Feature Experimentation product, and Optimizely's own CMS 13 FAQ lists deeper CMS/Experimentation integration as roadmap rather than shipped. With those products attached the capability is best-in-class: Stats Engine significance reporting, auto-winner selection, MVT, feature flags, in-visual-editor click-event metric creation, and Contextual Bandits for adaptive optimization beyond binary A/B.

Optimizely CMS still has no traditional native web-analytics dashboard inside the CMS; GA4/Adobe Analytics integration is via tag manager and ODP is the unified behavioral data hub across web, email, and commerce. The AEO/GEO analytics side has strengthened materially: the June 10 2026 Conductor partnership shipped a full AEO platform, and the Agent Visibility Analytics dashboard in Optimizely Analytics (explicitly supported for CMS 13, headless or coupled) surfaces AI-platform traffic trends and intent, which AI platforms visit most, and which pages they prefer — powered by CDN log data plus Opal insights, with an Agent Visibility Insights agent and a Conductor AI Brand Visibility Report agent on top. The new Graph Search Management portal adds a search-analytics Overview page reachable from the CMS nav. Core content-performance metrics (pageviews, engagement, decay) still live in external analytics tools rather than the CMS UI.

VB Blueprints are the primary brand guardrail in CMS 13: developers and central teams define the approved layouts, element palette and style system, and editors compose pages by selecting from those approved options, with a browsable gallery and export/import between environments. New since the last review: Opal's blueprint tools mean AI-generated pages are also constructed from approved Blueprints rather than freeform, and Optimizely documents Opal instructions plus prompt engineering as the mechanism for enforcing brand governance in agent workflows — closing the obvious loophole that AI page generation would otherwise open. Template descriptors allow brand-specific view rendering for shared block types, and content-area restrictions enforce component palette compliance. Still convention-based rather than a managed design token system with platform-level enforcement.

The scalable promotions engine supports complex discount rules (percentage, fixed, bundle, threshold, buy-X-get-Y), and the Opal Product Promotion agent lets merchandisers build and configure promotions via natural language. Optimizely Graph provides Pinned Results — the explicit successor to Best Bets — promoting selected products and content to the top of results for chosen queries with immediate effect, now curatable from the Graph Portal framed inside the CMS 13 nav. Visual Builder drag-and-drop catalog composition, faceting on ContentLink.Id, customizable saved views, and Dynamic Packages round out the toolset. Marked down from the previous review: the Commerce Connect 15 GA notes state the updated content selector is NOT integrated with the Marketing UI at GA — selecting associated content types when configuring promotions and campaigns is deferred to a future release, which is real friction in the merchandiser's core promotional workflow.

The core promotion engine supports time-based activation, channel-specific targeting, and complex discount rule combinations. The Opal Product Promotion agent lets merchandisers build and configure promotions via natural language. Dynamic Packages allow end-customer-configurable bundles, scheduled publishing controls time-based banner and landing page activation, and EU Omnibus lowest-price display (last 30 days) is native. Promotional content can be audience-targeted. Marked down: the Commerce Connect 15 GA release notes confirm the new content selector is not yet integrated with the Marketing UI, so associating content types with promotions and campaigns in the promotion configuration flow is still on a future release. Countdown timers remain custom element development.

CMS 13 consolidates what were separate Content Management and Content Definitions APIs in CMS 12 into a single REST API v1 rooted at /_cms/v1, auto-registered by AddCms() along with the OAuth token endpoint, and pairs it with Optimizely Graph as the GraphQL delivery layer (GraphiQL playground, cached query templates, a published known-limitations page). The docs are explicit that the CMS REST API is not for delivery — Graph is — which is a coherent split, but the Content Delivery API survives only as a compatibility bridge that will not cover Visual Builder experiences and will not be ported to CMS 14, and the EPiServer→Optimizely namespace migration is still incomplete. That forced-migration overhang keeps it out of the 85+ band.

Opti ID is now a mandatory component of CMS 13 and included in the license, giving every PaaS deployment centralized identity with SSO, SAML/OIDC federation, group and role management, and MFA rather than leaving auth to per-project ASP.NET Core Identity wiring. SSO is available across DXP tiers rather than Enterprise-gated, and the Graph SDK defaults to single-key auth with optional per-query Basic auth while the REST API uses OAuth 2.0 bearer tokens from the AddCms()-registered token endpoint. A September 2026 incident in which Opti ID redirected users to the wrong SSO login page is the main blemish on an otherwise strong, now-unified story.

CMS 13 cleanly separates identity from content authorization: Opti ID owns users, groups and custom roles, and when a user signs in the role syncs into CMS 13 as a user group against which six access types (read, create, change, delete, publish, administer) are set per content path, with Everyone and Administrators evaluated at runtime and a documented non-Opti-ID path for self-hosted deployments. CMS 13 also added permission enforcement during user-deletion and file-extension whitelisting on import. It still has no field-level permissions and no content-instance ownership scoping, which caps it in the custom-roles-with-scoping band rather than 80+.

Optimizely CMS 13 ships Visual Builder as the default editing experience with drag-and-drop authoring across pages, blocks, experiences, and media, composed as elements within sections, rows, and columns. Blueprints let editors save sections or whole experiences as reusable layout templates with auto thumbnails and a browsable gallery. CMS 13 adds custom elements definable directly in the Admin UI without code deployment. New since the last review: Opal gained blueprint tools for CMS 13 — agents can list and inspect Blueprints and create a content item from one, so AI-assisted page creation now starts from an approved layout rather than freeform composition. The Page Builder (PaaS) agent generates a full content item of a specified content type from a document, image, or URL, and agents installed from the Agent Directory now auto-update. Gap: no out-of-box 50+ component library; a custom element/block library is still required for full self-service.

Beyond base SEO page-type properties (MetaTitle, MetaDescription, CanonicalUrl), sitemap generation, and redirect management, CMS 13 ships the Opal SEO Metadata Optimization agent (analyzes webpages, generates optimized meta titles, descriptions and OpenGraph tags, applies them as drafts) and the GEO Schema Optimization agent (recommends and generates Schema.org types and JSON-LD markup written to the content's JsonLdTemplates property) — native structured-data generation plus AI meta optimization in the editor. New since the last review: Markdown for AI agents delivers a clean markdown rendition of pages to AI crawlers at the edge instead of full HTML, reducing ingestion cost and improving citation accuracy — but it is beta and gated behind a signup, so it earns partial credit only. Remaining gap: no single dedicated SEO validation dashboard with field-level validation; SEO is surfaced through Opal agents plus base properties.

Prior scoring understated this: DXP is not an EU/US binary — Optimizely documents fully available Azure regions spanning Europe, US (including South Central US), Canada Central, Canada East, Australia East, Australia Southeast and Southeast Asia, with geo-replication confined to the chosen delivery region and a documented procedure to migrate a live CMS 12 or 13 project between hosting regions without affecting the site. Contractual EU hosting, EU geofencing of support access with customer-controlled break-the-glass, and EU-US DPF back the guarantees. Held below the mid-80s because regions outside the published list are case-by-case subject to Azure capacity, edge/CDN caching can place copies outside the residency region, and adjacent products (ODP, Campaign) carry different residency profiles requiring separate procurement review.

This is a genuinely provisioned HIPAA offering, not a marketing claim: Optimizely documents a distinct HIPAA-enabled CMS variant covering PaaS explicitly, with additional auditing and security controls, an Optimizely-approved BAA required before any ePHI processing, Optimizely acting as Business Associate for Healthcare & Life Sciences customers, and documented feature exclusions that define the compliance boundary (SendGrid SMTP, production database exports, content sync-down, edge log exports, project migration all removed) plus a documented incompatibility with non-HIPAA-enabled Optimizely products. Score is held below the high 80s because those exclusions strip real PaaS capability and HIPAA-compliant application code remains the customer's responsibility.

Export is genuinely self-service and automatable: the DXP Management API and EpiCloud PowerShell module (Start-EpiDatabaseExport / Get-EpiDatabaseExport) produce a full .bacpac of the CMS or Commerce database to Azure Blob storage with a time-limited download link, blob containers export alongside it, and Forms submission data exports as JSON, XML or CSV. DPA v2026-01 documents retention and post-termination deletion, and Optimizely documents IP anonymization plus PII obfuscation when copying databases to non-production. Right-to-erasure inside the CMS still requires custom .NET implementation — the in-app Account Settings > Access or Deletion Requests portal and its REST API cover Experimentation and Personalization, not CMS PaaS — which keeps this out of the 80s.

No VPAT or ACR for the CMS 13 authoring interface is published or discoverable on the trust center or support site almost six months after GA, and there is no Section 508 formal conformance statement and no ATAG 2.0 documented assessment. What exists is a support section on accessibility basics and accessible formatting plus a Configured Commerce article still written to WCAG 2.0 AA — guidance about producing accessible output rather than procurement-grade documentation of the product itself, which is what regulated and public-sector buyers actually need. Marked down from the prior cycle because the post-GA window has now passed without an artifact appearing, leaving Optimizely well behind Adobe and Salesforce who publish current VPATs.

Governance now covers all three legs the framework requires. Audit trails: Version History records every agent-workflow change with who/when/what, Execution Log Exports pull run logs on demand for reporting and compliance, and Agent Credit Visibility logs per-run consumption. Brand enforcement: Opal Instructions with role-based edit permissions, input guardrails that train a classifier from plain-language rules, Output Evaluation scoring against a 75–95% baseline, and Execution Guardrails that learn normal behavior and auto-terminate rogue runs. Privacy and safety: EU App Hosting data residency, Safe URL Browsing (Google Web Risk plus optional Cloudflare Radar deep scan), a no-training-on-customer-data commitment, Opti ID org-wide GenAI disablement, human-in-the-loop approval gates, and ISO 27001/27017/27018, SOC 2 Type 2, and PCI DSS v4.0.1. Not higher because IP indemnification for AI output is still not publicly documented.

Optimizely rebranded Opal as the Agent Platform and the Agent Directory passed 100 pre-built agents by July 2026 (51+ named agents shipped in 2026 alone), with CMS 13 PaaS-specific entries — Page Builder (PaaS), Content Analysis, Content Model Creation, GEO Schema Optimization, SEO Metadata Optimization — running on a drag-and-drop workflow canvas with triggers, loops, conditionals, and human-in-the-loop approval gates. Governance is now first-class: Agent Builder and Skill Builder let users author agents in Chat, Version History records every workflow change (what, when, by whom), and Execution Guardrails progress through Learning → Watching → Enforcing modes and auto-terminate rogue runs. Not higher because the deepest agent tooling is still SaaS-first and PaaS reaches it only through separate Opal licensing.

Opal routes prompts across a curated model set — Google Gemini plus Anthropic Claude via Google Vertex AI since March 15 2026 — with selection available at instance and agent level, and the BYOAI capability plus the Epicweb BYOAI plugin extend CMS PaaS deployments to OpenAI, Azure OpenAI, Meta Llama, Writer, and Jasper. Not higher because this is vendor-curated model routing rather than customer BYOK: Optimizely explicitly reserves the right to add, remove, or substitute the underlying LLMs, and data-residency controls for arbitrary customer-supplied endpoints remain undocumented.

All four observability legs are now present: the refreshed Opal Agent Usage dashboard gives summary cards, an execution-type breakdown, agent and top-user tables, and weekly active-user trends; the Opal User Usage chart and credit dashboard track allocated and consumed credits per user, product, and agent with monthly billing and overage alerts; Agent Credit Visibility exposes credits used per run inside specialized and workflow agent logs while Execution Log Exports pull those logs on demand; and the Quality tab supplies agent performance visibility with configurable evaluation criteria and baseline scores, giving real quality-trend monitoring. CMS 13's Agent Visibility Analytics adds AI-crawler traffic. Not higher because there is no per-model performance comparison or prompt-effectiveness analytics, consistent with Opal's curated model routing.

The official JavaScript/TypeScript SDK reached general availability in 2026 with full typing, autocomplete, structured error handling and first-class React/Next.js rendering, and pairs with @optimizely/cms-cli to enable genuine code-first content modeling — content types and property groups authored as TypeScript definitions and synced to the CMS, making code the source of truth for types under version control, with the contentType function's typing improved and build config now carrying language/locale settings. That is materially stronger than a merely typed client. It stays below the 80+ auto-generation band because for PaaS the canonical content model is still authored in C# as IContentData interfaces, and the TypeScript modeling flow is primarily the SaaS-oriented path feeding the frontend.

Optimizely holds a triple-ISO stack at platform scope rather than inherited infrastructure scope: ISO 27001:2022 (current revision) covering CMS, Commerce Connect, Experimentation and Campaign, plus ISO 27017:2015 cloud security controls and ISO 27018:2019 cloud PII protection covering CMS, Commerce Connect and Experimentation. CMS is named explicitly in every one of the three scopes and the ISMS governing the DXP is certified, which clears the prompt's 80+ bar; maintenance to the 2022 standard shows sustained program investment.

Media are typed content items with code-defined metadata schemas; Content Manager adds Graph-powered search across CMS, DAM, and external sources with customizable grid columns, image/PDF grid browsing, and a details panel; and CMS 13 bundles a basic embedded Optimizely DAM tier (EPiServer.Cms.DamIntegration.UI) with AI tagging, smart renditions, folders/tags, and asset placement from inside Visual Builder. Cloudflare on DXP does URL-parameter resize, crop, rotate, quality, and WebP/AVIF conversion at the edge. Trimmed because embedded DAM requires a DXP environment — on-premises and HIPAA CMS 13 deployments are explicitly excluded — and there is no editor-set focal point in core (Cloudflare gravity=auto smart cropping is automatic detection, not an author-placed focal point).

Optimizely now publishes a standing public product-updates page per product line (optimizely.com/product-updates/content-management) stating the current quarter's investment areas — agentic content workflows, deeper platform connectivity, AI discoverability, virtual teammates for translation and optimization, expanded developer tooling — alongside the release notes' 'Coming next' section and Forum idea voting. Critically, the long-standing PaaS-vs-SaaS investment uncertainty has been answered publicly with the stated 'CMS Core' philosophy (features built once to serve both deployment models), and the roadmap was validated twice in 2026 by CMS 13 GA in March and the Agent Orchestration Platform launch at Opticon NYC. Not higher because there is still no public roadmap board with per-item status lifecycle and vote counts, and dated delivery commitments are absent — direction is disclosed, timing is not.

Stability signals are solid and improving: Optimizely remains Insight Partners-owned (Episerver acquisition 2020, rebrand 2021), disclosed a $400M ARR milestone, reported 42% QoQ ARR growth on its agent platform, grew headcount 19.9% from ~1,410 in 2023 to ~1,691 by March 2026 with no confirmed layoffs in 2025-2026, and is visibly funding product across CMS 13, Opal and SaaS CMS simultaneously. Not higher because there are no audited public financials, headcount slipped 1.3% within 2026 after years of growth, and the fundamental overhang is unresolved — a PE sponsor six years into a hold with no announced IPO or exit path, and no disclosed funding event since the 2019 Series D that preceded the acquisition.

The post-GA track record is now concrete rather than projected: a licensing bug found at launch was fixed in 13.0.1, the line reached EPiServer.Cms 13.1.2 / EPiServer.CMS.Core 13.1.1 within roughly five months, and the continuously-updated CMS 13 release notes document a steady fix stream — CMS-52251 (async visitor data / thread-pool exhaustion), CMS-50238 (security settings on import/export), the Graph sync publish slowdown, project overview load performance, CMS assets unqueryable through Graph via content reference fields, and localization fixes — while Forms 6.0.0 shipped with CMS 13 support and a moderate transitive CVE (ImageSharp) was patched quickly. Both CMS 13 and CMS 12 receive active bug and security triage. Raised because the fix stream has broadened well beyond the two documented items credited previously; not higher because the monthly NuGet cadence means non-critical bugs can wait weeks, every application-tier fix requires the customer to take the package and redeploy, and the third-party add-on breakage that dominates real upgrade pain is not Optimizely's to fix; not lower because critical issues get hotfix packages through support and the observed cadence is steady.

Optimizely CMS 13 ships Visual Builder as the default editing experience with drag-and-drop authoring across pages, blocks, experiences, and media, composed as elements within sections, rows, and columns. Blueprints let editors save sections or whole experiences as reusable layout templates with auto thumbnails and a browsable gallery. CMS 13 adds custom elements definable directly in the Admin UI without code deployment. New since the last review: Opal gained blueprint tools for CMS 13 — agents can list and inspect Blueprints and create a content item from one, so AI-assisted page creation now starts from an approved layout rather than freeform composition. The Page Builder (PaaS) agent generates a full content item of a specified content type from a document, image, or URL, and agents installed from the Agent Directory now auto-update. Gap: no out-of-box 50+ component library; a custom element/block library is still required for full self-service.

CMS 13 delivers real velocity gains. Visual Builder with Blueprints enables template cloning for fast page assembly, autosave reduces friction, custom elements can be defined in Admin UI without code deployment, and copy/paste of layout structures speeds composition. Auto-translation with structure preservation reduces localization cycle time. Content Manager provides search-first navigation across large libraries with filtering by type, status, and language. The Opal agent set is GA and embedded in the editorial workflow: content auditing, alt-text generation, SEO/GEO optimization, the Content Refresh agent for auditing and updating outdated content at scale, the Page Builder (PaaS) agent drafting a full content item from a document/image/URL, the Content Analysis agent producing reusable authoring instruction sets, and blueprint tools letting agents build from an approved template. Projects coordinate multi-page changes. Approval workflow steps still add latency, and PageData/ExperienceData coexistence means legacy pages stay in the older form-based editor until remodeled.

Optimizely states a WCAG 2.1 A and AA target driven partly by the European Accessibility Act, and the Opal AI-Assistant emits WCAG-compatible HTML in the RTE with automatic alt-text generation, but nearly six months after CMS 13 GA there is still no published conformance report for Visual Builder — now the default editing surface for pages, blocks, experiences and media. The Opal Web Accessibility Evaluation agent and the Design Editor accessibility test both audit delivered output rather than the authoring interface, so they cannot be credited here. A stated target without a formal conformance artifact places this squarely in the prompt's 45–65 band.

The SEO Metadata Optimization agent generates meta titles, descriptions, and OpenGraph tags and applies them as drafts directly in CMS 13 (PaaS), the GEO Schema Optimization agent recommends and generates JSON-LD schema markup, and the Image Alt Text Generation agent closes the alt-text leg — alongside paas_cms_seo_analysis/seo_edit and paas_cms_geo_analysis/geo_apply. The June 10 2026 AEO platform launch with Conductor adds the AEO Gap Finder, AI Brand Visibility Report, Profound Citation Gap Analysis, an E-E-A-T Checker, and a Page Performance Evaluation agent running Lighthouse audits, plus Agent Visibility Analytics over CDN log data. Not higher because taxonomy/tag generation is still undocumented and the Conductor intelligence layer is a partner add-on stacked on top of Opal licensing.

PaaS now has a first-party, self-hosted MCP server: the Optimizely.Cms.Opal.Tools NuGet package ships one that exposes the same schema-aware CMS tools as Opal Chat to any MCP-compatible client (Claude Code, Cursor, VS Code Copilot), registered with services.AddCmsMcpServer() and mapped via endpoints.MapMcp("/mcp"), covering content types, content items, display templates, and SEO/GEO operations against the real CMS structure. Community servers (first3things/optimizely-cms-mcp, JaxonDigital optimizely-dxp-mcp) supplement it. Not higher because this release supports only client secret authentication — Opti ID authentication, and with it per-user permission scoping, is deferred to a later release.

Optimizely ships first-class agent-developer tooling: Opal Tools SDKs in C#, JavaScript, and Python with @tool() decorators, an auto-generated /discovery endpoint, and built-in parameter validation, self-hostable on Azure/AWS/GCP or deployable to the Optimizely Connect Platform; plus the CMS 13 MCP server and paas_cms tool layer, a Graph C# SDK with a fluent API for strongly-typed content queries, a CMS REST API enabled by default via AddCms(), and Agent Builder/Skill Builder for in-Chat agent authoring. Optimizely also publishes docs.developers.optimizely.com/llms.txt — a Markdown index of every docs page plus OpenAPI endpoints, explicitly for AI agents. Not higher because there are still no official LangChain/LlamaIndex/CrewAI integration guides and the agent runtime requires Opal licensing.

The versioned v13.0.0-CMS documentation tree is unusually complete for a major release six months in: install, system requirements, configure, deploy, Dockerfile creation, content model/IContent, REST API reference, access rights documented separately for Opti-ID and non-Opti-ID setups, settings administration, a dedicated upgrade-from-CMS-12 guide, and — notably — separate framework/platform and third-party-package breaking-changes pages, supplemented by a published CMS 13 technical webinar Q&A and Q&A PDF, with Swagger UI and GraphiQL for interactive exploration. Frontend coverage has broadened to Next.js, React and Astro. It stays below 80 because backend framework guidance is .NET-only and the practical state of add-on and Content Delivery API availability is communicated more clearly in partner blogs than in official docs.

Momentum indicators strengthened materially in 2026: Optimizely reported 42% quarter-over-quarter ARR growth for its agent orchestration platform, with nearly 1,700 companies using Opal, 4,000+ unique agents built and 172,000+ agent runs across experimentation, campaign execution, content production and reporting — layered on a $400M ARR base and 300+ new logos in 2025 (Salesforce, Zoom, New Era, Mazda). G2 review volume grew from ~908 to 957 across products, Forrester named the platform a 'customer favorite' in Experience Optimization, and Opticon ran two 2026 editions (NYC, London). Not higher because the headline Opal figures are vendor-reported and company-wide rather than PaaS-CMS-specific, headcount edged down 1.3% within 2026, and the PaaS installed base is mid-migration to CMS 13 — absorbing budget that would otherwise fund net-new PaaS adoption.

CMS 13 includes embedded DAM as a standard feature (basic tier provided to all customers) directly integrated into the editing interface — editors browse, search, upload, tag, and reuse assets and generate renditions without leaving Visual Builder via EPiServer.Cms.DamIntegration.UI NuGet. Graph and Opti ID are included in the CMS 13 license, removing infrastructure barriers. However, the full CMP DAM with versioning, advanced rights management, and usage tracking still requires separate licensing — the embedded experience is closer to an enhanced asset library than a full enterprise DAM.

CMS 13 makes Graph mandatory (included in license), ensuring all CMS 13 deployments have access to Graph webhooks (doc.created/updated/deleted with wildcard filtering and content-status filtering). CMS 13 introduces a native webhook management UI in the admin interface with granular event subscriptions, filtering, and sync logs — closing the major historical gap. CMS PaaS retains the robust internal event system (IContentEvents, INotificationHandler<T>). The JavaScript SDK GA for CMS 13 includes built-in webhook support. Gaps remain: no signed payloads documented.

Media assets are typed content items with code-defined metadata schemas. URL-based image resizing via ImageSharp.Web or Cloudflare, plus focal point support. CMS 13 adds Content Manager with Graph-powered search across all content types, customizable grid views, and details panels for assets. The optional embedded Optimizely DAM integration brings AI-powered tagging, smart image renditions, and seamless asset placement directly via Visual Builder. Not higher because the AI tagging and rendition features live in the DAM add-on rather than the core CMS, and the built-in media library itself remains comparatively basic.

Optimizely Commerce Connect 15 (GA May 2026) is built on .NET 10 and CMS 13, providing a full-featured B2B/B2C commerce platform deeply integrated with CMS PaaS: product catalog with flexible data models, cart/checkout, order management, pricing engine, warehouse inventory, promotions, and on-demand language versioning. Product catalog editing now uses Visual Builder with drag-and-drop composition of entries, variants, bundles, and packages, real-time preview, and autosave. OptiGraph powers semantic search across storefronts.

CMS 13 (GA March 31, 2026) makes Visual Builder the default editorial interface for PaaS, completely replacing On-Page Editing. Visual Builder provides unified editing for pages, blocks, experiences, and media with autosave, interactive property highlighting, and synchronized live preview. Experiences use outline layout (flat ordered list of sections/components); sections use grid layout (hierarchical rows, columns, elements). Editors drag-and-drop shared blocks into experiences with automatic inline indexing to Graph. Custom elements definable in Admin UI. Server-side ASP.NET MVC rendering supported without requiring Graph.

CMS 13 adds autosave in Visual Builder across pages, blocks, and content variations but no real-time simultaneous editing, no presence indicators, and no inline comments on content. The Projects feature provides the closest analog: project-level @mentions, comments, and scheduling coordination. Last-save-wins conflict behavior persists. This remains a genuine and persistent gap for enterprise co-authoring workflows.

Optimizely Commerce Connect 15 provides purpose-built product content modeling: catalog structure with CatalogContentBase/ProductContent/VariationContent type hierarchy, product/variant/SKU hierarchies, rich product descriptions via CMS content blocks, product media management, and attribute-based product information. Visual Builder is now the default for product catalog editing with drag-and-drop, real-time preview, and autosave. On-demand language versioning supports global B2B/B2C scenarios.

Multilingual content management is a core strength inherited from Episerver's Scandinavian enterprise roots. Every content item supports multiple language branches with independent publish status and configurable fallback chains. CMS 13 adds integrated auto-translation via Google Cloud Translation supporting 135+ languages and 800+ locale variants, preserving design and structure including page hierarchies. Redesigned translation workflows, draft content translation, global language context switching, and a new Language Selector with branch/non-branch separation. Content Management API supports any valid language code without OS culture restriction.

Optimizely Forms 6.0 (released April 9, 2026) is built on .NET 10 and explicitly compatible with CMS 13, with modernized architecture using explicit DI registration, appsettings.json configuration (replacing Forms.config), and System.Text.Json serialization. Provides conditional field display logic (AND/OR, equals/not-equals/contains/regex), multi-step forms with conditional step routing, progressive profiling via field mapping to MA/CRM, hidden visitor profiling, file upload, CAPTCHA, custom actors for external API integration, and database submission storage. Native connectors route submissions to Marketo, HubSpot, Salesforce, Pardot, Eloqua, Dynamics CRM, Acoustic, and Delivra.

CMS 13 deprecates Optimizely Search & Navigation (Find), which was the primary commerce search integration via EPiServer.Find.Commerce. Best Bets (editorial product pinning), faceted content-product blending, and synonyms management are all lost with this deprecation. The migration path is Optimizely Graph, which provides GraphQL-based search with filtering and faceting capabilities, but does not yet have confirmed equivalent editorial merchandising controls (Best Bets, query rules). Commerce Search v3 (Vertex AI) applies to Configured Commerce, not Commerce Connect. Content search landing pages remain manageable from CMS. This is a significant regression in commerce search capabilities during the transition period.

Optimizely Commerce includes a scalable promotions engine with complex discount rules (percentage, fixed, bundle, threshold). Customizable catalog screen views allow merchandisers to save filtered product views. Dynamic Packages enable bundles where end customers choose variants. However, CMS 13 deprecates Search & Navigation, which means Best Bets (editorial product pinning in search results) is no longer available — a significant merchandising capability loss. Migration to Optimizely Graph for search does not yet have confirmed equivalent editorial merchandising controls. The Opal Product Promotion Agent is listed as 'Coming next' — not yet shipped. Score reflects editorial merchandising regression during the S&N-to-Graph transition.

Optimizely CMS provides solid SEO fundamentals via base page type properties (MetaTitle, MetaDescription, CanonicalUrl). Sitemap.xml via EPiServer.SEO.Sitemap NuGet package; redirects via EPiServer.SEO.Redirects. URL management flexible via IPartialRouter. CMS 13 release notes list Opal SEO Metadata Optimization Agent and GEO Schema Optimization Agent as 'Coming next' — not yet shipped in CMS 13 GA. Without Opal agents, SEO tooling relies on manual property management and community packages. Structured data (JSON-LD) requires custom Razor implementation; no unified SEO management UI.

CMS 13 PaaS supports native content variants per Visitor Group with in-editor preview per audience — editors assign different content blocks to different groups directly in Visual Builder, with synchronized preview switching by audience. CMS 13 Content Variations add multiple published versions of the same content with delta-based storage, independent version history, and variation-specific preview URLs. This meets the rubric's 'native variants + in-editor preview per audience' threshold for 70+, but ML-driven personalization still requires separately licensed ODP, and there is no native decisioning model — score reflects strong rule-based native capability without ML.

CMS 13 (GA March 31, 2026) makes Visual Builder the default editorial interface for PaaS, replacing On-Page Editing. Visual Builder provides unified editing for pages, blocks, experiences, and media with autosave, interactive property highlighting, and synchronized preview. Experiences use outline layout (flat ordered list of sections/components); sections use grid layout (hierarchical rows, columns, elements). Editors drag-and-drop shared blocks into experiences with automatic inline indexing to Graph. Custom elements definable in Admin UI. Server-side ASP.NET MVC rendering supported without requiring Graph.

The biggest CMS 13 improvement for PaaS: Visual Builder is now available on PaaS, replacing On-Page Edit as the default, with a unified interface for pages, blocks, experiences, and media with autosave and synchronized preview. It supports ASP.NET MVC rendering without requiring Graph dependency, making adoption straightforward for existing MVC implementations. Not higher because headless preview for Next.js still requires draft-mode wiring through Graph; not lower because this closes the major gap that previously held PaaS back versus SaaS for visual editing.

CMS 13 deprecates Optimizely Search & Navigation (Find), which was the primary commerce search integration via EPiServer.Find.Commerce. Best Bets (editorial product pinning), faceted content-product blending, and synonyms management are all lost with this deprecation. The migration path is Optimizely Graph, which provides GraphQL-based search with filtering and faceting capabilities, but does not yet have confirmed equivalent editorial merchandising controls (Best Bets, query rules). Commerce Search v3 (Vertex AI) applies to Configured Commerce, not Commerce Connect. Content search landing pages remain manageable from CMS. This is a significant regression in commerce search capabilities during the transition period.

CMS 13 brings Visual Builder to PaaS as the default editing interface, replacing On-Page Edit (now disabled by default). Visual Builder provides a unified interface for creating and editing pages, blocks, experiences, and media with drag-and-drop shared blocks, interactive property highlighting, real-time responsive preview, autosave, and grid-based layouts. Experiences and Sections enable editor-driven layout composition without developer involvement. Not higher because data-bound content loading and advanced personalization flows still require developer setup.

CMS 13 (GA March 31, 2026) introduces configurable preview routing with predefined tokens (Context, Host, Key, Locale, Path, Segment, Version), per-application and per-content-type routing in admin UI, and fallback route configuration. Content Variations provide variation-specific preview URLs with real-time synchronized preview ensuring accurate rendering of the variation being edited. Graph draft mode with AllowSyncDraftContent for headless draft preview. Gaps remain: no public shareable unauthenticated preview links, no branch/environment-per-PR preview.

CMS 13 deprecates Search & Navigation (Find), requiring migration to Optimizely Graph or third-party search providers. Find's full-text search with faceted filtering, relevance tuning admin, and synonyms management are all discontinued. Optimizely Graph provides GraphQL-based content search with filtering capabilities but lacks the editorial search admin (Best Bets, synonyms, relevance tuning) that Find provided. Federated search across external systems (SharePoint, Confluence) was already unavailable — now the primary internal search also transitions. Content Manager uses Graph for search-first navigation, which is functional but different from Find's enterprise search features.

CMS 13 meaningfully improves the editorial experience: Visual Builder provides a unified, modern interface for content creation across pages/blocks/experiences/media, Content Manager introduces search-first navigation powered by Graph, and Content Variations let editors manage multi-variant content without developer involvement. Custom elements definable in the Admin UI further reduce code-deployment dependency. Not higher because template creation and new content types still require .NET deploys; not lower because day-to-day content operations are now notably closer to SaaS-class self-service.

CMS 13 ships genuine velocity improvements: Visual Builder with Blueprints enables template cloning for fast page assembly, autosave reduces friction, custom elements can be defined in Admin UI without code deployment. Auto-translation with structure preservation (page hierarchies, content areas, blocks) is shipped and reduces localization cycle time. Content Manager provides search-first navigation for faster content discovery. However, Opal AI agents (28+ purpose-built agents for content tasks) are listed as 'Coming next for CMS 13' and are not yet GA — the previous score's claim of 50%+ campaign time reduction via Opal is not yet realizable. Gap: approval workflow steps still add latency.

Optimizely Commerce includes a scalable promotions engine with complex discount rules (percentage, fixed, bundle, threshold). Customizable catalog screen views allow merchandisers to save filtered product views. Dynamic Packages enable bundles where end customers choose variants. However, CMS 13 deprecates Search & Navigation, which means Best Bets (editorial product pinning in search results) is no longer available — a significant merchandising capability loss. Migration to Optimizely Graph for search does not yet have confirmed equivalent editorial merchandising controls. The Opal Product Promotion Agent is listed as 'Coming next' — not yet shipped.

CMS 13 PaaS release notes list 'Web MCP — access to Optimizely tools and instructions from anywhere' as a 'Coming next' feature, signaling official MCP investment. The first3things/optimizely-cms-mcp community server (v2.0.0-beta, 14 tools with discovery-first architecture) continues to mature. JaxonDigital's optimizely-dxp-mcp targets PaaS infrastructure. No official Optimizely-published MCP server is in GA — the official Experimentation MCP server was in closed beta as of August 2025. Not higher because Web MCP is announced but not shipped, and community servers remain pre-release.

Every content change creates a new version with full history, diff comparison, and rollback. CMS 13 introduces Content Variations — multiple published variations of the same content item in the same language with delta-based storage and independent publishing lifecycles, effectively providing content branching. Variations are indexed to Optimizely Graph with unique identifiers. This directly addresses the previous gap of no content branching and brings PaaS parity with best-in-class versioning.

CMS 13 (GA March 31, 2026) replaces Optimizely Find (Search & Navigation) with Optimizely Graph as the mandatory search engine. Graph SDK (Optimizely.Graph.Cms.Query) provides Boolean facets, decay/factor scoring, pinned results, IAsyncEnumerable streaming, cursor-based pagination, and field-level search with boosting. Content Manager in CMS 13 is a search-first interface powered by Graph with filtering across all content types. Graph is included in the CMS 13 license.

CMS 13 meaningfully reduces feature gating by bundling Optimizely Graph (search/content delivery) and Opti ID (identity management) into the base CMS license. Previously Graph was a separate add-on and Search & Navigation was the bundled option — now S&N is deprecated and Graph replaces it at no additional cost. However, Commerce Cloud, Campaign, Experimentation, ODP, and DAM remain separately licensed. The consolidation is a genuine improvement but the full DXP still requires multiple add-on purchases.

The core promotion engine supports time-based activation, channel-specific targeting, and complex discount rule combinations. Dynamic Packages allow end-customer-configurable bundles. Scheduled publishing controls time-based banner and landing page activation. EU Omnibus Directive lowest-price display (last 30 days) is native. Promotional content can be audience-targeted. However, the Opal Product Promotion Agent (natural language promotion configuration) is listed as 'Coming next for CMS 13' — not yet shipped. Countdown timers require custom block development.

CMS 13 significantly improves developer AI extensibility: full REST API included by default (via AddCms()), Graph C# SDK with fluent API for strongly-typed content queries, and OAuth client configuration via appsettings. These lower the barrier for AI agent integration. Opal Agent SDK enables custom agent development. Optimizely Graph (GraphQL) is RAG-ready. The open-source Optimizely Agent microservice (Go) wraps SDKs behind REST. Web MCP is announced as 'Coming next'. Not higher because no official LangChain/LlamaIndex guides exist and Opal tools haven't shipped on CMS 13 yet.

Media assets are typed content items with code-defined metadata schemas. URL-based image resizing via ImageSharp.Web or Cloudflare, plus focal point support. CMS 13 adds Content Manager with Graph-powered search across all content types, customizable grid views with orientation-aiding backgrounds for images and PDFs, and details panels for assets. Embedded Optimizely DAM integration NuGet package enables asset browsing, search, and selection from the DAM within the CMS. Still lacks AI-based smart cropping natively in CMS itself (that lives in CMP).

CMS 13 Graph SDK provides a strongly-typed fluent C# API compiling to GraphQL with .ToGraphQL() for debugging, custom cache eviction policies, single-key and Basic authentication modes, and support for IPrincipal-based access filtering. The SDK supports POCO deserialization and strongly-typed content models. Marketplace connectors for Algolia and Coveo remain available. Content Delivery API enables external search platform integration. The Graph SDK's extensibility surpasses Find's LINQ API with better debugging and caching controls.

CMS 13 introduces embedded DAM integration (EPiServer.Cms.DamIntegration.UI NuGet) built on External Sources via Optimizely Graph, with multiple access methods: embedded in editor, Content Manager picker, and dedicated picker. Graph and Opti ID are now included in the CMS 13 license, removing infrastructure barriers. However, CMP DAM itself still requires separate licensing and CMP API client credentials. The native CMS media library remains basic blob storage. The tighter integration and license-included Graph improve accessibility but the full DAM remains separately licensed.

CMS 13 makes Graph mandatory (included in license), ensuring all CMS 13 deployments have access to Graph webhooks (doc.created/updated/deleted with wildcard filtering and content-status filtering). CMS PaaS retains the robust internal event system (IContentEvents, INotificationHandler<T>). OptiGraphExtensions community package adds webhook management UI. Gaps remain: no native webhook management UI in core, no signed payloads, no delivery logs in admin panel.

CMS 13 is newly released and starters are in transition — Alloy and Foundation samples will need updates for .NET 10, Application-based architecture, and Visual Builder patterns, and dotnet new templates may lag the CMS 13 release. Optimizely's track record with starters is strong, but during the CMS 12→13 transition the starter ecosystem has a temporary quality dip. Not higher because of that transition gap; not lower because custom elements definable in the Admin UI without code deployment reduces boilerplate demand.

CMS 13 strengthens built-in operational visibility: scheduled-job hang detection flags stalled jobs via log indicators, Cloud License Management adds a Settings view showing active server names per URL with tooltips, and a third-party license page surfaces npm package licenses in edit mode. These sit on top of the existing DXP portal (environment health, deployment logs, Azure Log Analytics), Application Insights integration, Cloudflare analytics, and 24/7 infrastructure monitoring. Not higher because Application Insights configuration and application-layer telemetry still require customer setup; not lower because hang detection addresses a real operational pain point and the cumulative toolset now exceeds most Traditional DXP peers.

Optimizely CMS provides solid SEO fundamentals via base page type properties (MetaTitle, MetaDescription, CanonicalUrl). Sitemap.xml via EPiServer.SEO.Sitemap NuGet package; redirects via EPiServer.SEO.Redirects. URL management flexible via IPartialRouter. CMS 13 release notes list Opal SEO Metadata Optimization Agent and GEO Schema Optimization Agent as 'Coming next' — not yet shipped in CMS 13 GA. Without Opal agents, SEO tooling relies on manual property management and community packages. Structured data (JSON-LD) requires custom Razor implementation; no unified SEO management UI.

CMS 13 ships significant translation improvements: auto-translation via machine translation preserving original structure including page hierarchies, content areas, and blocks. Draft translation capability without prior publication enables faster localization workflows. Translatable content export in JSON format for external translation providers. Enhanced translation workflows with multiple initiation points. Global language context switching with dynamic UI adjustment. Multi-Language Management (MLM) provides translation workflow governance with per-locale approval chains. Market-level scheduling via Campaign product handles locale-specific campaigns. Transcreation (adapting beyond translation) still requires custom editorial process or external TMS.

CMS 13 PaaS ships enhanced auto-translation that preserves original structure including page hierarchies, content areas, and blocks — a meaningful improvement over CMS 12's Google Translate AI integration. Draft content can now be translated directly. The Languages add-on integrates Microsoft Translator (Azure Cognitive Services). Opal Chat (CMS 12) surfaces translation capabilities. Third-party TMS connectors (Phrase, Smartling) extend to 30+ MT engines. Not higher because brand voice preservation across locales is not documented as a built-in control.

Code-first content modeling via C# PageType/BlockType attributes with full .NET type system support. CMS 13 adds Custom Elements definable directly in Admin UI without code deployment, addressing the previous redeployment requirement for schema changes. Content Type Contracts (interfaces inheriting IContentData) enable flexible cross-type modeling and polymorphic references without package dependencies. Not higher because Custom Elements still rely on existing editor primitives rather than fully arbitrary schema design.

BlockType system provides genuine structured content with SharedBlocks and LocalBlocks. CMS 13 adds Experiences and Sections — layout structures separate from content that editors can build, copy, and paste between sections with grid-based layouts. Templates and Blueprints allow predefined content structures with central management and export/import. Optimizely Graph exposes all blocks as typed structured data. Still HTML-rendering-oriented for rich text rather than fully portable like Portable Text.

Built-in multi-step Content Approval Workflow with per-content-type/path configuration, role-based approver steps, email notifications, and reject-with-comments. CMS 13 adds Templates & Blueprints for creating, exporting, and importing content templates with predefined values and layouts, plus auto-translation preserving hierarchy and structure. Draft translation allows translating unpublished content without prior publication. Scheduled jobs are fully configurable for automated or manual execution.

Two first-class headless APIs: Content Delivery API (REST) and Optimizely Graph (GraphQL, now mandatory) with auto-generated schemas. CMS 13 adds a C# (.NET) SDK for Graph with fluent API, strongly-typed results, caching, and authentication support. REST API is now included by default with OAuth configuration via appsettings.json and consistency with SaaS. An experimental REST API for managing websites and headless applications was introduced. Content Type Contracts enable unified cross-type queries.

Multilingual content management is a core strength inherited from Episerver's Scandinavian enterprise roots. Every content item supports multiple language branches with independent publish status. Configurable language fallback chains. CMS 13 adds auto-translation that preserves original structure including page hierarchies, draft content translation support, global language context switching, and a redesigned Language Selector with branch/non-branch separation. Content Management API supports any valid language code without OS culture restriction.

CMS 13 strengthens an already strong extensibility model: Visual Builder custom elements can be defined in the Admin UI without code deployment, Application Management replaces SiteDefinition with auto-migration and expanded host types, and content-type contracts are defined via .NET interfaces inheriting from IContentData. These supplement full ASP.NET Core DI, middleware, IContentEvents hooks, IConfigurableModule/IInitializableModule startup extensibility, and MVC tag helpers for Visual Builder.

Optimizely DXP provides a documented 99.9% uptime SLA for production delivery environments on Azure, with status.optimizely.com currently showing All Systems Operational and only a small number of minor, promptly-resolved incidents in late March 2026. CMS 13's scheduled-job hang-detection logging improves operational visibility. 99.9% (not 99.95%+) keeps this in the 60-75 rubric band.

CMS 13 PaaS reached GA on March 31, 2026, delivering on the Q1 2026 target — a major version introducing .NET 10, Visual Builder, mandatory Optimizely Graph, and Content Variations. Post-GA velocity continues: Opal Chat and AI tools for CMS 13 shipped April 7, 2026 — one week after GA. CMS 12 PaaS continues monthly minor releases with dedicated 2026 release notes. Strong cadence for an enterprise PaaS platform.

CMS 13 GA release notes (updated April 2026) are structured and comprehensive — covering Visual Builder, Content Manager, Content Variations, Translation enhancements, C# SDK, DAM integration, and Applications Management with clear descriptions of each feature. Separate breaking changes documentation exists with migration guidance. The Graph SDK blog provides detailed API migration reference tables. Confidence is HIGH given the GA documentation quality.

CMS 13 GA ships with comprehensive migration tooling: the Graph C# SDK mirrors Search & Navigation patterns exactly, a complete API migration reference maps every S&N call to its Graph equivalent, and .ToGraphQL() enables debugging. Upgrade guide from CMS 12 to 13 is publicly available. However, the breaking changes remain significant — mandatory S&N removal, .NET 10 upgrade, namespace changes (EPiServer→Optimizely), PageReference→ContentReference, SiteDefinition replaced by Application Model, and on-page editing disabled. Proactive tooling for a known breaking change, but migration scope is substantial.

CMS 13 bundling Graph and Opti ID into the base license simplifies the modular cost structure slightly — two previously separate line items are now included. However, the fundamental model remains hybrid: annual platform fees plus usage-based components (MTUs for Intelligence Cloud, GMV for Commerce, page views/content items for Content Cloud) plus separate module licensing for Commerce, Campaign, and ODP. Impression-based components still create unpredictable scaling costs. Slightly better than pre-CMS-13 because Graph/Opti ID consolidation reduces the number of separate cost centers.

CMS 13 introduces several operational improvements: scheduled job hang detection for proactive monitoring, cloud license management dashboard for server visibility, and redesigned Application management replacing site definitions. These reduce manual administration overhead. Content Manager's search-first interface and auto-translation also reduce editor support burden. The improvement is incremental — Optimizely still manages Azure infrastructure while customers handle CI/CD, Application Insights, and portal admin — but the new tooling meaningfully reduces troubleshooting time.

CMS 13 increases lock-in slightly. Search & Navigation deprecation forces adoption of Optimizely Graph, a proprietary service with deeper platform integration than S&N. Mandatory Opti ID integration adds another proprietary dependency. While Graph provides Content Delivery API for JSON export and Content Management API provides full CRUD, the mandatory coupling to Graph/Opti ID means exit requires replacing both search/delivery and identity layers. Epinova Content Migration Engine remains available. DAM migration path is still 'upcoming, not yet available.'

Optimizely Academy continues the CMS Development Fundamentals and headless masterclass paths, but CMS 13 is newly GA (March 31 2026) and the documentation catalog is still catching up — migration guides, breaking-changes docs, and CMS 13-specific tutorials are being published progressively. The Alloy and Foundation starters still need CMS 13 updates, and PaaS CMS Developer Certification coverage for CMS 13 is pending. Not higher because of the transition-period gap; not lower because docs.developers.optimizely.com already hosts the v13 overview and upgrade guidance.

CMS 13 upgrades to .NET 10 — still mainstream ASP.NET Core with familiar MVC patterns. The Graph C# SDK provides a fluent, strongly-typed query API that feels natural to .NET developers, and the REST API is included by default via AddCms(), making headless consumption more accessible. Visual Builder supports ASP.NET MVC rendering without requiring Graph dependency, keeping the coupled MVC path familiar. Not higher because the .NET requirement still narrows the talent pool versus JS-native headless platforms; not lower because the headless story is incrementally more accessible.

CMS 13 includes Optimizely Graph and Opti ID as mandatory components in licensing, which adds service configuration (Graph endpoint, Opti ID authentication). REST API is included by default via AddCms(), reducing config for headless, and module URLs shifted from EPiServer to the Optimizely namespace, requiring config updates during migration. Not higher because mandatory Graph + Opti ID expand the base config surface; not lower because cleaner defaults and default REST inclusion offset part of the added setup.

CMS 13 improves data modeling with content type contracts via .NET interfaces inheriting IContentData, enabling cleaner composition patterns. Content Variations allow multiple published versions of the same content item in the same language using delta-based storage — a significant modeling advancement — and the code-first model still auto-detects schema changes at startup. Not higher because property removal still orphans data and there's no explicit migration/rollback tooling; not lower because Graph's strongly-typed query results reduce a class of runtime schema bugs.

CMS 13 is the scoring target; the upgrade FROM CMS 12 (the only path to CMS 13) carries substantial breaking changes now that GA shipped March 31, 2026. Search & Navigation removed (Graph SDK replacement), EPiServer→Optimizely namespace migration across module URLs and DAM packages, Plugin Manager removed, On-Page Edit disabled by default (Visual Builder is replacement), and .NET 8→10 framework target. Not higher because the aggregate breaking-change scope is large even with automatic SiteDefinition→Application migration easing one path; not lower because Graph SDK tooling and documented migration steps reduce friction versus fully manual rewrites.

Optimizely CMS does not have a native web analytics dashboard. ODP serves as the unified data hub aggregating behavioral data across web, email, and commerce channels. Standard GA4/Adobe Analytics integration via tag manager. GEO Analytics dashboard was referenced in previous scoring but Opal tools/agents (including GEO Analytics) are listed as 'Coming next for CMS 13' — not yet shipped. Search & Navigation admin analytics are also impacted by S&N deprecation. Primary metrics still live in external analytics tools rather than within the CMS UI.

CMS 13 ships auto-translation with structure preservation covering page hierarchies, content areas, and blocks — this applies to product content pages and category descriptions. Draft translation without prior publication speeds up product content localization. JSON export for external translation providers improves enterprise TMS integration. Multi-Language Management (MLM) governs translation workflows for product catalog content alongside CMS editorial content. Per-market product descriptions, currency-aware pricing display, and market-specific promotional calendars are all native in Commerce Connect. EU Omnibus lowest-price display for regulatory compliance.

Optimizely CMS supports knowledge management through flexible content types (Article, FAQ, HowTo PageTypes), hierarchical content organization via content tree, and content lifecycle management (draft, review, publish, archive, expire). Content Manager (CMS 13) provides search-first navigation via Optimizely Graph. However, Search & Navigation deprecation means the previous Find-based full-text search with faceting must be migrated to Graph or third-party — Graph provides search but the transition may impact intranet search quality during migration. Main gaps vs dedicated KM platforms: no native comment threading, no expert suggestion system, no knowledge graph.

ODP aggregates employee digital interaction data across the intranet, enabling custom audience segments and activity reports. Search & Navigation analytics (search term frequency, zero-result searches) are discontinued with the S&N deprecation in CMS 13. GEO Analytics and Opal-related analytics features are listed as 'Coming next' — not yet shipped. Department-level analytics dashboards, adoption rate tracking, and formal intranet ROI reporting require custom ODP dashboard configuration or external BI integration.

CMS 13 ships the Graph C# SDK with fluent API, strongly-typed POCO result deserialization, and query tracking for analytics, alongside the REST API for content modeling registered via AddCms(). The Content Delivery API (REST with Swagger/OpenAPI) and Optimizely Graph's GraphiQL playground round out a comprehensive API surface on .NET 10. Ongoing EPiServer to Optimizely namespace migration and remaining legacy inconsistencies cap the score.

CMS 13 introduces embedded DAM integration via the EPiServer.Cms.DamIntegration.UI package (requires Opti ID + active Graph), bringing native digital asset management into the CMS interface. The Optimizely Marketplace lists 100+ certified add-ons across CRM, DAM, translation, search, analytics, and commerce, with the commercetools partnership adding composable-commerce depth. The ecosystem is smaller than Adobe's or Sitecore's but benefits from certified partner vetting.

CMS 13 adds explicit hardening: file-extension filtering during import, restricted file uploads by extension, and permission enforcement during user deletion. The .NET 10 runtime brings current security patches on top of a clean track record with no major public CVEs, regular third-party penetration testing, and Cloudflare WAF protection. Lack of a public bug bounty program remains the primary gap.

CMS 13 retains the ~9 core conceptual domains (PageType/BlockType/MediaData, ContentArea/ContentReference, publishing/versioning, Visitor Groups) while adding Visual Builder concepts (Experiences, Content Variations) and replacing OPE as the default editing paradigm. Content type contracts via IContentData interfaces simplify the model layer, but the shift from Site-based to Application-based architecture adds a migration concept. Not higher because the domain count grew; not lower because abstractions are cleaner — a senior .NET developer still needs 4–6 weeks to ramp up.

CMS 13 replaces SiteDefinition with redesigned Application Management — create/edit/delete applications with validation, editable names and API IDs, default-application designation, and application-specific assets for editors. Expanded host types (Primary, Preview, Media for headless; Default/Primary/Media/Edit/RedirectPermanent/RedirectTemporary for in-process) simplify multi-site configuration. Legacy CMS strengths carry forward: Graph auto-indexing, content version pruning, ContentReference link database, and built-in approval workflow. Not higher because search reindex after schema changes and periodic version pruning on large trees still need attention; not lower because improved application management plus automation keeps day-to-day burden light.

Optimizely CMS 13 ships Visual Builder as the default editing experience with drag-and-drop authoring across pages, blocks, experiences, and media. Blueprints let editors save page compositions as reusable templates for brand consistency. CMS 13 adds custom elements definable directly in the Admin UI without code deployment, allowing administrators to create reusable element types through the interface rather than developer code — this expands self-service page building. Content Manager provides Graph-powered search-first content navigation. Gap: no out-of-box 50+ component library; custom block library still required for full self-service.

CMS content expiry (ExpiredDate) enables automatic archival of outdated content. Content approval workflows enforce review steps before publication. Content versioning records all changes with author, date, and version history. CMS 13 adds Content Variations with independent lifecycles — multiple published versions of the same content can have separate expiry and management independent of each other, improving lifecycle granularity. Scheduled publish dates now visible in Version gadget (CMS 13). However, automated review-date prompts, stale content flagging, and formal archival workflows with notifications are not native CMS features.

Optimizely CMS provides strong shared content for multi-brand implementations. SharedBlock items in the Global Assets folder are referenceable across any Application without duplication. VB Blueprints define the approved layout and component library centrally. CMS 13 adds custom elements definable directly in the Admin UI without code deployment — administrators can create reusable element types centrally and make them available across all brand Applications. Site-specific block rendering via multiple Razor view templates selected by ITemplateSelector. Global content shared via ContentReference to Global tree items.

CMS 13 ships enhanced translation capabilities that improve multi-brand localization governance: auto-translation preserving page structure, draft translation without prior publication, JSON export for external providers, global language context switching, and redesigned Language Selector. MLM enables per-brand translation workflows with per-locale approval chains — Brand A's French team is isolated from Brand B's French approval process. Role-based access scoped to Application + language branch combinations allows language-level editorial autonomy within brand boundaries. No fully automated per-brand-locale compliance guardrails.

VB Blueprints provide the closest native approximation of design system management — developers define the approved component library and style options centrally. CMS 13 adds custom elements definable in Admin UI without code deployment, which allows central teams to extend the element library without developer intervention — a small improvement in design system agility. Shared Razor component libraries maintained centrally and consumed per-brand via ITemplateSelector. CSS variables serve as brand-level design tokens. However, there is no centralized design token management UI, no versioning/changelog for the design system, and no update propagation mechanism.

Shared CMS content types (PageTypes, BlockTypes) are defined once in the .NET codebase and shared across all brand Applications. Brand-specific view rendering is applied via ITemplateSelector. CMS 13 adds custom elements definable in Admin UI without code deployment — administrators can extend the element type library without developer code changes, which slightly improves the ability to adapt content models per-brand use case. Brand-specific property extensions still require class inheritance. There is no visual model inheritance or per-brand content type extension via the CMS admin UI beyond custom elements.

Significantly richer certification portfolio than previously assessed. PCI DSS v4.0.1 with QSA-audited attestation for Experimentation and self-assessment for Commerce. TISAX for automotive. CSA STAR Level 1 with CAIQ 4.0 self-assessment. CyberGRX Tier 2 validated assessment. HECVAT for higher education. FSQS/Hellios Stage 3 for financial services. No FedRAMP or CSA STAR Level 2 third-party audit. Portfolio is above average for a commercial DXP but below top-tier platforms with FedRAMP.

Optimizely formally announced HIPAA-ready solutions in early 2025 with an explicit BAA available for CMS (PaaS & SaaS) and Web & Feature Experimentation. BAA includes security and privacy commitments for ePHI handling. Healthcare and life sciences is now a documented vertical with dedicated compliance documentation. PaaS customers still bear implementation responsibility for HIPAA-compliant application code, limiting the score versus fully managed platforms.

No public VPAT/ACR was found for the Optimizely CMS authoring interface. Support articles cover accessibility basics, accessible HTML, and formatting guidance but focus on delivered website accessibility rather than authoring UI conformance. No Section 508 formal conformance statement found publicly. No ATAG 2.0 documented assessment. Accessibility documentation may be available on request via sales, but public availability is the scoring standard. Below enterprise leaders like Adobe and Salesforce who publish current VPATs.

Optimizely holds ISO 27001:2022 (updated to latest standard), ISO 27017:2015 (cloud security controls), and ISO 27018:2019 (cloud PII protection) — all three covering CMS, Commerce Connect, and Web & Feature Experimentation. Previously ISO 27018 was unclear; it is now confirmed. The triple ISO certification for platform-scope operations (not just infrastructure) is strong. Transitioning to ISO 27001:2022 demonstrates active certification maintenance.

Optimizely covers GDPR, CCPA, UK GDPR (via DPA addendum), and EU-US DPF. TISAX certification for automotive industry. HECVAT/HECVAT-Lite for US higher education procurement. FSQS/Hellios Stage 3 for financial services supplier qualification. TTDSG/TKG compliance for German telecommunications. No FedRAMP authorization. No IRAP or C5. Broader industry coverage than previously assessed but still lacks US federal and APAC frameworks.

Optimizely targets WCAG 2.1 AA for the CMS authoring interface and has published blog content on accessibility as a basic feature in authoring tools. The new Web Accessibility Evaluation agent (Opal) helps assess delivered content but does not constitute formal conformance for the authoring UI itself. No formal WCAG conformance report for the CMS editing interface was found publicly. Keyboard navigation is supported; visual editor drag-and-drop has known screen reader gaps. Scandinavian accessibility culture drives investment but formal documentation is lacking.

Optimizely offers EU and US data hosting with contractual guarantees. EU geofencing restricts support access to EU-based staff with documented break-the-glass procedures. EU-US DPF certified. BCRs in development with Swedish DPA. Self-hosted PaaS customers have full Azure region control. However, residency is EU/US binary — no APAC region option. Some adjacent services (Data Platform, Campaign) may have different residency profiles requiring procurement review.