Xperience by Kentico is a .NET digital experience platform that puts content, email, marketing automation, personalization and basic commerce in one product, hosted as managed SaaS or in your own cloud.
Xperience by Kentico is the successor to Kentico Xperience 13, rebuilt on ASP.NET Core with SaaS hosting, a shared content hub and the AIRA AI service. Version 13 still has some features the new platform lacks, such as native A/B testing and social publishing, but its support ends on December 31, 2026, so the choice is about migration timing rather than which to keep.
Full Comparison →Both are .NET platforms with integrated marketing, but Xperience by Kentico is simpler to run, ships monthly and comes as managed SaaS. Sitecore XP offers deeper personalization and testing and a larger global partner network, at a much higher cost and operating burden.
Full Comparison →Both target .NET teams. Xperience by Kentico includes marketing automation, email, personalization and commerce in the licensed product, while Umbraco offers a free open-source core, a larger community and lower entry cost, with marketing features added through partners and add-ons.
Full Comparison →Both are .NET digital experience platforms aimed at the mid-market. Xperience by Kentico has the faster release cadence, native email and commerce, and a more active AI developer toolkit, while buyers should compare each vendor's security history and the depth of personalization they actually need.
Full Comparison →Our analysts rate 9 platforms as replacements, with a recommendation for who should move and who should stay. Ratings updated Oct 17, 2026.
Contacts, dynamic segments, widget personalization, a visual form builder, native email channels and a visual automation builder all ship in the core product and share one profile. Unified profiles (March 2026) merge contacts, members and customers, and automation gained custom triggers, actions and conditions in mid 2026. A marketing team can run segmentation, nurture and email without buying a separate automation platform.
Kentico hosts the whole site on Azure behind a managed Cloudflare CDN, with QA, staging and production environments, a deployment pipeline and a public status page. Page Builder gives marketers drag-and-drop sections, widgets and templates on the real rendered page. Buyers who want one vendor to run the site and the editing experience get both, with private cloud and self-hosting as alternatives.
A named feature release has shipped every month of 2026, with weekly hotfixes in between and a detailed changelog that flags known issues, obsolete APIs and security fixes. A public roadmap shows released, preview and planned work. A published policy guarantees at least 12 months of backward compatibility after a deprecation, so buyers can plan upgrades rather than react to them.
Developers can add custom modules, data types, builder widgets, automation steps and React admin pages. KentiCopilot is a suite of AI development tools for coding agents, with plugins for web development, marketing features, Kentico Xperience 13 migration and project upgrades with deployment configuration. A Management MCP server (Model Context Protocol, the standard AI agents use to call tools) left preview in September 2026, so agents can model and edit content during local development.
The SaaS service is ISO 27001 certified and SOC 2 Type II audited, with reports in a trust center. Customers pick one of 20 Azure regions across North America, Europe, Asia Pacific and the Middle East, and data stays in a single-tenant account in that region. That clears most security questionnaires for regulated mid-market buyers, though no HIPAA business associate agreement is offered.
Kentico held G2 Leader status in the digital experience platform grid in Winter, Spring and Summer 2026, with 391 reviews averaging 4.4 out of 5. Reviewers single out ease of use and responsive support from in-house engineers. Kentico reported 2025 revenue of $56.7M, up 35 percent, which lowers vendor risk for a long contract.
Kentico published advisories almost every month of 2026, including several SQL injection flaws, an account-recovery takeover and a multi-factor authentication bypass, most affecting every version back to 22.0. Fixes ship quickly, but each one means updating packages and redeploying. Self-hosted and private cloud customers carry the most exposure and need a disciplined patch process.
Xperience by Kentico has no built-in A/B or multivariate testing for web pages or for emails. Kentico recommends VWO through its Tag Manager instead, and page testing is a roadmap item only. There is also no recommendation engine, so optimization teams must license and run a separate testing tool and build related-content logic themselves.
The only official SDK is .NET, and there is no first-party JavaScript client, TypeScript type generation or Next.js starter. Headless delivery is a read-only GraphQL API, and visual editing does not reach headless frontends. Teams built around JavaScript frameworks will rely on community guides and their own glue code.
Kentico's How to Buy page explains the price structure (channels, tier, AI credits, cloud level) but shows no dollar figures, so starting prices come only from third-party listings. Contracts are annual, and reviewers report subscription increases of up to 25 percent. Evaluation is limited to a 7-day hosted trial or a 30-day local license.
AIRA, Kentico's built-in AI service, runs only on Kentico-managed Azure OpenAI with no option to bring your own model or key. All four marketing agents are still preview features subject to breaking changes. There is no native semantic search over your own content, which requires a separately licensed Azure AI Search or Algolia service.
The rebuilt platform dropped the intranet, social and community features of older Kentico versions. There is no employee directory, internal announcement tooling, comments or workplace integration with Microsoft 365 or Slack. An employee portal would be a custom build from scratch.
Content types cover four targets (reusable content, web pages, emails, headless items) with a broad data type set, reusable field schemas for shared field groups, and since the August 2026 refresh (31.8.0) custom data types inside reusable field schemas with their own editing components. Content types can be created through the Management API and MCP server, but there is no first-class schema-as-code authoring model and no native union field type, so it stays below the 80+ band.
Combined content and page reference fields allow many-to-many links to items of multiple types (polymorphic by allowed type list or reusable field schema), queryable through the ContentItemQueryBuilder with linked-item depth and through GraphQL for headless items. The May 2026 content reuse locator shows where an item is referenced, giving reverse visibility in the UI, but reverse traversal is not a first-class query concept like graph-native headless CMSs.
Structured composition comes through linked content items (inline creation of nested items within content forms), reusable field schemas, and Page and Email Builder sections and widgets that embed structured content. Rich text is HTML rather than a portable AST and nested composition relies on references, so it sits in the upper adequate band rather than 75+.
Fields support built-in validation rules (required, length, regex, ranges, allowed file types) and developers can register custom validation rules as code, which apply in the content form and the Management API. No declarative cross-field rule engine is documented, and validation on headless API writes depends on the management layer, so it lands in the high 60s.
Content items and pages keep version history with draft and published states, revert to a previous version, and author attribution, and content can be synced between environments with detailed selection. There is no branching or release-bundle model and no field-level visual diff for marketers, so it stays in the adequate band.
A standalone Taxonomies application holds hierarchical tag collections that any content type can use through a Taxonomy data type, with Content hub filtering, smart folders based on taxonomy, and WhereContainsTags queries in the content API. Term governance is permission based and terms are reusable across types and channels, but there are no synonyms or bulk reclassification tooling, which keeps it just under 75.
Website channel pages are edited and previewed in context through Page Builder on the real rendered site, with per-language preview and shareable preview URLs. For headless channels preview depends on the frontend team wiring draft GraphQL retrieval, and there is no click-to-edit overlay SDK for external frameworks, which keeps it in the upper adequate band.
The rich text editor (Froala v5) supports configurable toolbars, custom plugins, links to content items and assets, and AIRA text refinement in place. Output is an HTML blob rather than a portable AST, so it stays in the standard WYSIWYG band.
Assets are stored as content item assets in the Content hub with smart drag and drop upload, focal point, WEBP/AVIF format conversion, quality settings and image variants for responsive delivery, plus usage tracking through the content reuse locator. Legacy media libraries are being retired and assets do not keep file version history, so it sits in the mid 60s.
Content overwrite protection (May 2026), opt-in content locking for pages, reusable and headless items (June 2026) and emails (July 2026) with lock-owner notifications and an override permission, plus workflow step comments and notification emails. There is no real-time co-editing, presence or inline commenting with mentions, so it sits in the locking-plus-async band.
Custom workflows with any number of steps between Draft and Published, role-based step permissions, per-content-type assignment across pages, reusable items, emails and headless items, step comments and notification emails, and workflow history. Each content type can be in only one workflow and there is no parallel approval or conditional routing, so it stays in the low 70s.
Scheduled publishing, scheduled unpublishing and cascade scheduled publishing of linked items are available for reusable items and pages, and content sync with detailed selection moves sets of changes between environments. There is no release bundle, no publishing calendar view, and a 2025 community answer reported headless items lacked scheduled unpublish, so it sits in the 60–74 band.
Language variants per content item with per-language fallback chains, per-language workflow and publishing, language-prefix URLs and since September 2026 language-specific domains per website channel (private cloud only so far). Localization is document-level (variant per item) rather than field-level with per-field fallback, so it lands above the document-level band but below 75.
Custom roles with application permissions, workspaces for scoping Content hub access, page-level permissions in website channels, workflow step role assignments and an override-lock permission, plus administration SSO via OIDC (Entra ID and others). Field-level permissions need a community package and SCIM provisioning is not documented, so it stays in the 45–65 band.
Headless channels expose a GraphQL delivery API per channel secured by API keys, a headless REST API arrived in preview in April 2026, and a separate Management API covers content, pages and Page Builder. Coupled website channels use the in-process .NET content query API, and the REST delivery API is still maturing, so it sits at the low end of the REST + GraphQL band.
Every SaaS project runs behind a managed Cloudflare CDN with TLS, DDoS protection and security event monitoring in Xperience Portal, and cache dependencies drive output cache invalidation. Customers cannot bring their own CDN and there is no edge-side personalization or documented sub-second purge API, so it stays in the low 70s.
Server-side global events cover content, workflow, form and object lifecycle in code, the official Zapier module sends outbound events and accepts inbound actions, and automation custom triggers can be fired from webhooks. There is no native configurable outbound webhook service with signing, retries and delivery logs, so it sits in the mid band.
One Content hub feeds website, email and headless channels, with GraphQL and preview REST APIs for external frontends and official Next.js guidance from the community. Official SDKs are .NET-centric, rich text is HTML, and headless delivery needs the Advanced tier, so it sits as a traditional DXP with a capable API layer.
Native contact management with activity tracking, dynamic contact groups built in a rule builder, unified Profiles merging contacts, members and customers (March 2026) and identity resolution with extensible APIs (April 2026), all usable directly in personalization and automation rules. Segments are evaluated in-platform rather than streamed from a named enterprise CDP, which keeps it in the mid 70s.
Page Builder widgets and Email Builder widgets support personalization variants per contact group, previewed in the builder, and developers can personalize headless and coded content using the same contact data. Personalization is widget-scoped with rule-based groups rather than full page or field variants, so it sits at the native threshold.
Xperience by Kentico has no native A/B or multivariate testing for web pages or for emails; Kentico's migration guidance recommends VWO through the built-in Tag Manager, which offers a VWO A/B testing template. Page A/B testing and AI experiments for emails are roadmap items only, so experimentation depends on an external tool and sits in the 20–40 band, credited slightly for the ready-made Tag Manager template.
No built-in algorithmic recommendation engine is documented, and no first-party recommendation integration is listed among Kentico's integrations. Related content relies on editorial curation or taxonomy-driven queries built by developers.
Kentico maintains official open-source integrations for Lucene.NET (local code-defined indexes with auto-indexing), Algolia and Azure AI Search, each with index sync on content changes. There is no native search service with relevance tuning or analytics in the product, so it sits at the integration ceiling.
Native digital commerce provides products as content items, a persistent cart entity, a price calculation pipeline (taxes, shipping, promotions), order management with statuses, catalog, order and free-shipping promotions with coupons (September 2026), and cart item promotions planned for October. It is a developer framework: cart and checkout UI, payment and delivery providers must be built, and it needs the Advanced tier, so it stays below 70.
Kentico maintains an official Shopify connector that syncs products through the Storefront and Admin APIs on a schedule and supports cart and checkout via Shopify. There are no first-party connectors for commercetools, BigCommerce, SAP or Salesforce Commerce, so breadth limits it below the integration ceiling.
Native customer journey analytics (with prebuilt journeys in the September 2026 Dancing Goat), campaign reporting, email statistics and contact activity logs give marketing-level performance insight. There is no built-in web analytics or content performance dashboard; Kentico points to Google Analytics or Clarity for page analytics, so it stays below 60.
The built-in Xperience Tag Manager lets marketers add GTM, GA4, Microsoft Clarity, VWO, Intercom and custom tags with consent awareness, and official CRM integrations sync contacts with Dynamics 365 and Salesforce. There is no first-party Adobe Analytics, Segment or Amplitude connector, so it sits in the high 60s.
One instance runs multiple website, email and headless channels, all drawing on a shared Content hub of reusable items, with per-channel languages, domains and content type scopes. Governance across channels is role and workspace based, which supports native shared-content multi-site at the low 70s.
In-platform translation UX includes a translations queue with bulk and linked-content translation, while TMS connectivity comes from vendor-built connectors (XTM, GPI's free XbyK connector) rather than Kentico-maintained Phrase or Smartling integrations. Packaging is integration because professional TMS workflows rely on partner connectors.
Channels, workspaces and roles let one organization separate brand teams while sharing a central Content hub and component library, with per-channel content type scopes. There is no cross-brand policy enforcement, brand override layer on shared components, or brand-level analytics, so it stays in the 40–60 band.
Native content item assets offer taxonomy, smart folders and usage tracking but no asset versioning, rights or approval tooling beyond content workflow, so enterprise DAM comes through the official Bynder integration. Integration packaging caps it, and the native library alone would land in the basic band.
Video files can be uploaded and stored as content item assets and served through the CDN, but there is no transcoding, adaptive streaming, captions management or player. Most implementations embed YouTube, Vimeo or a DAM, so it sits just under the basic-upload band.
Page Builder offers drag-and-drop sections and widgets with live in-context composition, page templates (including preset templates), restricted widget zones and section properties, plus Email Builder for emails and Management API support for Page Builder. It applies to website channels only, not headless frontends, which keeps it just below 75.
Xperience renders website channels natively (ASP.NET Core) and Xperience by Kentico SaaS hosts the full site with managed Cloudflare CDN, TLS, QA/STG/PROD environments, deployment pipeline with logs in Xperience Portal and an SLA. Limits are the .NET rendering stack, no bring-your-own CDN, no hosting for separate headless frontends, and SaaS domain management lagging private cloud, so it sits in the 75–89 band.
Visual Form Builder with field visibility conditions, smart fields for progressive profiling, consent fields, submission storage, CSV export with an Export permission (August 2026), automation triggers on submission and CRM lead sync. No multi-step form wizard is documented out of the box, so it sits in the low 70s.
Native email channels with Email Builder, recipient lists and newsletters, regular and automation-triggered emails, widget personalization, statistics, preview and content locking, sent through SMTP or the official SendGrid integration. There is no native email A/B testing (Kentico points to its roadmap) and no HubSpot, Marketo or SFMC connector, but native send still covers subscriber management, triggered sends and preview, so it stays above 70.
A visual automation builder with triggers, rule-based conditions and actions, extended in June and July 2026 with custom actions, custom triggers (including webhook and scheduled triggers) and custom conditions surfaced to marketers. Lead scoring is not a built-in feature and must be implemented as custom conditions, so it sits at the native threshold.
Native URL management with slugs, vanity URLs, automatic redirects from former URLs, language prefixes and domains, and SEO metadata through content model fields; sitemap.xml and robots.txt come from developer code or the community XperienceCommunity.SEO package. No structured data authoring or on-page SEO recommendations, so it sits at the bottom of the 60–74 band.
llms.txt generation and Markdown content negotiation for AI agents are available only through the community XperienceCommunity.SEO package, and per-bot crawler controls depend on Cloudflare settings Kentico manages for SaaS rather than an exposed product feature. There is no native AI citation reporting, so it is custom.
Kentico maintains a set of official integrations (Algolia, Azure AI Search, Lucene, CRM for Dynamics 365 and Salesforce, Shopify, Bynder, SendGrid, Zapier, Tag Manager) with a bug-fix policy, plus a Community Integrations Hub. The catalog is a directory of a few dozen items installed via NuGet rather than a 50+ marketplace with one-click install, so it sits in the high 40s.
Native members with registration and sign-in on ASP.NET Core Identity, external providers (any Microsoft-supported OAuth/OIDC provider, so Entra, Auth0, Okta), secured pages requiring authentication, member roles for access control, and members merged into unified Profiles for personalization. Self-service portal pages and preference centers are built by developers, so it stays just below 75.
Content delivery for headless channels is a GraphQL API per channel with an auto-generated schema, API-key security and a built-in query browser; .NET consumers get the Content Item Query API and IContentRetriever (which gained IncludeContentTypeFields projection in v31.7.0). The previously credited 'preview Headless REST API' could not be found anywhere in the changelog or docs and has been removed; the only REST surfaces are headless tracking and the OpenAPI-described Management API, which is scoped to local development. Not higher because GraphQL is retrieval-only with no mutations or subscriptions and there is no REST content delivery API.
GraphQL responses are dynamically cached, EnableUnionQueryOptimization prevents timeouts on fields linking many content types, and SaaS plans include a CDN with dynamic routing (100 GB on standard plans). 2026 Refreshes fixed several retrieval performance problems, including language-fallback queries where fetching one item by GUID cost as much as fetching every item of the type. Not higher because there are no published delivery rate limits, response-time targets or large-dataset sync patterns.
The only official content SDK is .NET (Kentico.Xperience.* NuGet packages), which is well maintained with typed generated classes and LINQ-style queries. The npm package @kentico/management-api-mcp is an MCP server for AI agents, not a content delivery client. JavaScript, Python and mobile consumers have to call the GraphQL endpoint directly with no official client library.
The Community Integrations Hub lists NuGet-distributed integrations from Kentico, partners and the community. Official packages cover Algolia, Azure AI Search, Zapier, Tag Manager (GA4/VWO/Intercom/Clarity) and Application Insights, and the SaaS plans include CDN, SendGrid email and WAF. The KentiCopilot repository adds AI coding plugins but not customer-facing integrations. Not higher because the catalog is small, with thin DAM and translation-service coverage compared with larger ecosystems.
Extensibility is deep and .NET-based: custom modules and object types, global event handlers, Page/Form/Email Builder components, custom data types and React admin UI pages. The Refreshes since July added custom Marketing Automation triggers and conditions (v31.7.0), custom data types in reusable field schemas (v31.8.0), and an opt-in CSV Export action for any admin listing page (v31.9.0). The main constraint is that every extension requires C#/.NET and React skills; there is no low-code path.
Admin SSO works with any OAuth/OIDC provider, with documented setups for Entra ID, Auth0 and Okta, but only one external provider can be active at a time and SAML is not supported natively. Admin MFA and token-bucket rate limiting protect the user-management endpoints, and the headless API uses API keys. Scored down because a second authentication-flow advisory followed the May MFA bypass: an account-recovery flaw (CVSS 8.6, v22.0.0–31.8.4, self-hosted only) that could grant unauthorized admin access.
RBAC supports custom roles with application-level permissions, per-page permission management in the content tree, and workspaces that scope Content hub access. There are no field-level permissions, and a September 2026 IDOR advisory (CVSS 7.1) showed workspace boundaries could be crossed for limited metadata and folder moves. Stays at 65: custom roles with content scoping, but without field-level control.
Xperience by Kentico SaaS is ISO 27001 certified and SOC 2 Type II audited, with evidence, pentest reports and policies in a SafeBase Trust Center. SaaS plans include WAF, DDoS and bot mitigation, database encryption, and region choice across NA, EU and APAC Azure regions. Not higher because no HIPAA BAA is documented.
The 2026 advisory wave has continued past the May SQL injection (CVSS 9.4) and MFA bypass (8.6). Since July there have been three more SQL injections (segments builder 8.6, content sync 7.5, a macro 8.6), arbitrary file read through Email Builder MJML includes (7.1), shared-cache exposure of authenticated assets (8.2), an account-recovery admin takeover (8.6) and a workspace IDOR (7.1). Most issues span v22.0.0 to the current release. Communication is good: dedicated advisories with researcher credit and fast hotfixes. It is penalized for sustained frequency and severity in the active product line, on top of the older KX13 CVEs in CISA KEV and a disclosure program with no paid bounty.
Three deployment options: Kentico-managed single-tenant SaaS on Azure (NA/EU/APAC), documented private cloud deployments on Azure or AWS (S3 file providers), and standard self-hosted ASP.NET Core, including containers. The feature set is the same across models; v31.9.0 added language-specific domains specifically for private cloud channels. This option set suits regulated buyers, but SaaS is Azure-only.
The SaaS service plan table lists 'Uptime Service Level Availability: Designed for 99.9%'. SaaS also includes 24/7/365 availability management, root cause analysis, a public status page with opt-in notifications (status.xperience-portal.com), and per-channel uptime checkers. Down 2 because the uptime figure is a design target, not a contractual SLA with credits, and 99.9% trails the 99.95%+ tier.
Multi-instance ASP.NET Core deployments are supported with shared storage and server synchronization tasks, and SaaS includes a CDN with dynamic routing. Standard SaaS plans describe auto-scaling as 'temporary... in case of a rare peak in workload', not elastic scaling. Several 2026 fixes addressed multi-instance sync tasks piling up and timing out deployments and updates. No scale limits or enterprise benchmarks are published.
Kentico publishes SaaS targets of RTO ≈ 1 hour and RPO 1–24 hours with annual DR testing. Production and staging database and blob storage are backed up daily and geo-redundantly, with self-service restore points, exports and on-demand backups in Xperience Portal. Not higher because standard plans keep daily backups for only 3 days (7 on Custom) and weekly backups for 30, and the RPO can be as long as 24 hours.
The full platform runs locally from dotnet new templates with production parity, hot reload and .NET CLI code generation. Since July: the Management MCP server went GA for local agentic development and can start before the host app; the Dancing Goat template ships with preconfigured MCP servers and instruction files; and a --kxp-db-status command reports database readiness. Not 70+ because a local SQL Server is required and there is no lightweight emulator.
Continuous Integration serializes database objects to XML for source control, and Continuous Deployment restores them to target environments. SaaS offers QA, optional STG and (on Custom plans) UAT environments, a deployment API with personal access tokens, zero-downtime slot-swap deployments and content sync between instances. The new --kxp-db-status command lets pipelines branch on database state, and the KentiCopilot project-lifecycle plugin generates CI/CD repository configuration. Not higher because there are no branch-per-PR content environments or standalone schema migration CLI, and content sync broke in 31.8.0 until hotfix 31.8.1.
docs.kentico.com is comprehensive and current: detailed changelogs per Refresh and hotfix, dedicated security advisories, API reference, guides, and the Learn portal. Every page is also available as Markdown, with llms.txt indexes and whole-area llms-full.txt dumps for AI tooling. Not higher because code samples are C# only and there is no interactive playground beyond the per-channel GraphQL browser.
There is no first-party TypeScript SDK or type generation from content schemas; type safety comes from C# classes generated by the .NET CLI. TypeScript/React is used only for admin UI extensions, whose shared React Router dependency moved to v7 in v31.8.0. Frontend teams using the GraphQL API have to rely on third-party GraphQL codegen.
The official changelog shows a named Refresh every month of 2026 so far (Jan 22, Feb 23, Mar 23, Apr 16, May 14, Jun 29, Jul 28 31.7.0, Aug 20 31.8.0, Sep 24 31.9.0). Weekly hotfixes, SaaS updates and AIRA model updates land in between (31.8.1 to 31.8.4 in Aug and Sep, 31.9.1 and 31.9.2 on Oct 1 and Oct 8). Each Refresh ships real features: the Sept one added Management MCP tool groups, free-shipping promotions, CSV export on every listing page and a DB status CLI. Not higher because individual Refreshes are incremental rather than platform-shifting.
The docs changelog is a single versioned feed with fixed sections per release: New features, Updates and changes, Known issues, Manual update steps, Newly obsolete API, Fixed issues, and Fixed issues – security, which links to a dated security advisory. Upcoming removals are announced ahead of time with migration guides (media libraries → Content hub assets, .NET 8/9 end of support, KX13 end of support). The whole feed is also published as Markdown. Not higher because there is no per-change machine-readable feed or codemod linkage.
Kentico maintains a public product roadmap at roadmap.kentico.com with 'Released', 'In Preview', and 'Planned' tabs visible to all. Regular community blog posts provide roadmap Q&A and expert chat series. The CEO published a public 2026 outlook. Not scoring 85+ because community voting/Canny-style prioritization is not strongly evidenced.
The published support policy guarantees at least 12 months of backward compatibility after a feature is deprecated or an API is marked obsolete, with the replacement running alongside it. Each release lists its obsolete APIs. Removals are staged: media library support ended Jul 24, 2026 and the removal was then postponed past the Sept Refresh. Migration tooling covers the KX13 exit (Migration Tool plus the KentiCopilot kx13-migration plugin). Not higher because AI tooling (Management MCP/API) is explicitly exempt and was renamed without notice in 31.9.0, and 31.8.0 shipped a content sync regression that needed a hotfix four days later.
Kentico runs a community portal (community.kentico.com) with MVP and Community Leader programs, and active GitHub repositories (e.g., Kentico/community-portal). The G2 listing has grown to 391 reviews (from roughly 365 earlier in 2026), substantial for a DXP, but GitHub star counts are modest given the .NET/commercial nature of the product. Not a large open-source community.
The community portal publishes content on a sustained near-monthly cadence (through the June 29, 2026 Refresh), runs an MVP/Community Leaders recognition program that grew its cohort into 2026, and held Community Program Summits in 2026. Kentico team members actively contribute to the community blog and run UX feedback and early-access sessions with program members. Engagement appears genuine for a mid-market B2B product; forum response times not independently verified.
Kentico has a formal partner program with certified agencies and a partner integrations directory. In 2026 it runs Kentico Connection as three regional events for customers and partners: North America in Hilton Head (Oct 6 to 8), APAC in Sydney (Oct 15) and EMEA in London (Nov 18), with agencies such as BizStream sponsoring and presenting. No evidence of major global SIs (Accenture, Deloitte) at the level of tier-1 DXPs, but a solid mid-market agency network is evident.
There is a reasonable volume of community tutorials, blog posts, and YouTube content (especially from partners), but Xperience by Kentico is not widely covered on Udemy or Pluralsight. The platform is .NET-specific and mid-market, limiting the breadth of third-party educational content compared to larger open-source or headless platforms.
Kentico targets the .NET/C# developer ecosystem, which is large in absolute terms but niche for DXP specialization. A certification program exists, and LinkedIn shows active job postings for Kentico developers particularly in mid-market agencies. Not widely recognized in Stack Overflow developer surveys, limiting talent pool compared to platforms like Drupal or WordPress.
Kentico reported 2025 revenue of $56.7M, up 35% from $42M in 2024, plus record ARR growth driven by Xperience by Kentico SaaS uptake. CMS Critic and eCommerceNews both carried it, though the figures are self-reported. G2 Leader status continued into the Summer 2026 DXP grid. Part of the growth is a captive migration of KX13 customers ahead of its Dec 31, 2026 end of support, and enterprise logo announcements remain sparse.
Kentico is privately held and backed by Expedition Growth Capital (2022). It reports $56.7M revenue in 2025 (+35%), a stated focus on profitability, and roughly 226 employees, with no layoff reports found. The CEO's year-end 2025 letter describes steady execution through a soft US market. Not higher because there is no recent growth round and all financials are self-reported.
Xperience by Kentico holds G2 Leader status in DXP (through the Winter 2026 report), Gartner Peer Insights 4.5/5, and Info-Tech Research Group Champion (Composite 8.3/10, NPS +77, 85% likely to recommend). The platform differentiates on ease of use, .NET developer experience, and mid-market fit with integrated digital commerce and agentic AI (AIRA). Not in the 80+ tier because Gartner Magic Quadrant inclusion is not confirmed.
The G2 listing shows 391 reviews at 4.4/5, with a high share of 4–5 star reviews and strong ease-of-use and support scores, and Kentico held G2 Leader status in the DXP grid in Winter, Spring and Summer 2026. Gartner Peer Insights averages about 4.5/5 and the Info-Tech NPS is +77. Scored at the low end of the 75–85 band because the G2 average sits just under 4.5 and the listing mixes KX13 and Xperience by Kentico reviews; no systemic pricing or reliability complaints were found.
Kentico's official How to Buy page (now kentico.com/platform/how-to-buy; /pricing redirects there) lays out the four-step structure — channels, Standard vs Advanced tier, AIRA credit package, SaaS cloud level — but a fetch on 2026-09-28 found no dollar figures and no pricing PDF link, and every path ends in 'Speak to an expert'. The widely quoted 'from $990/mo self-managed, $1,990/mo SaaS' figures now come only from third-party listings, so buyers can see the price structure but not verifiable vendor prices. Not lower because the structure is public and third-party starting prices are consistent across sources.
Fixed-cost SaaS subscription based on pre-defined cloud levels avoids consumption spikes — a strong predictability signal — and channel-based licensing (one main channel included, add-ons for more) is predictable for most buyers. Newer AIRA/Agentic Marketing Suite runs on a credit consumption model with a monthly allocation plus opt-in expansion, introducing a metered element that a new Usage tab helps track. Penalized for multi-channel and AI credit add-ons that may not surface until scoping.
Standard tier covers single-channel web projects; Advanced tier unlocks multi-channel and enhanced digital marketing features, and AIRA (agentic AI marketing) is a separate paid credit add-on that launched Feb 1, 2026 with pricing not public. Splitting multi-channel and AI marketing behind higher tiers/add-ons is a meaningful gate for real DXP use cases, though core CMS functionality is accessible at the base tier.
Pricing is annual-only (third-party minimums ~$23,880/yr SaaS, ~$11,880/yr self-managed) with no monthly billing option, and no startup, nonprofit or education program is documented publicly. G2 reviews cited by 2026 pricing analyses flag recurring subscription increases, with some reporting annual hikes of up to 25%, and no exit provisions are published beyond the trial. Enterprise DXP norm, but rigid next to SaaS competitors with monthly terms.
Only a 7-day hosted trial and a 30-day local evaluation license are available; there is no permanent free tier and the core platform is not open source (though Kentico publishes MIT-licensed companion repos). Compared to open-source DXPs like Drupal or headless CMS with free-forever tiers, this is a significant gap for solo developers or small teams evaluating the platform.
SaaS cloud infrastructure is described as ready in 30 minutes, and the Kickstart .NET CLI workflow gives developers a running local instance quickly. However, content type modeling, channel setup, and Kentico-specific conventions add a half-day to full day before a working site is live for an experienced .NET developer. The ongoing monthly refresh cadence (Mar/Apr 2026 releases) keeps shipping DX improvements but doesn't fundamentally accelerate first-value.
Partner reports place typical KX13→XbK migrations and agency implementations at 3–6 months and 6–12 months for highly customized/enterprise scopes, with KX13 end-of-life on Dec 31, 2026 driving a wave of time-sensitive replatforming. Migration is a controlled replatform (not an upgrade) requiring custom code to be rewritten for .NET Core, adding months to brownfield projects; greenfield .NET shops trend faster. Scores near the DXP average — adequate but not strong.
.NET/C# is mainstream, which limits the talent premium versus proprietary-language DXPs like Sitecore or AEM. However, Kentico-specific certification, proprietary content modeling conventions, and the relatively niche XbK platform mean a moderate premium over generic .NET developers. Dedicated certification programs and specialist consultancies confirm a non-trivial expertise gap.
The SaaS tier bundles hosting (pre-defined Cloud Levels) into the subscription with no additional infrastructure spend, while the self-managed tier requires customer-provisioned Azure/AWS hosting estimated at $10K–$30K/yr additional. For buyers choosing SaaS — the primary positioning and starting point in Kentico's published pricing — hosting is included and fixed-cost.
SaaS deployment is fully managed — no server patching, scaling, or monitoring burden — with the monthly refresh cadence auto-applied to SaaS tenants. Content ops still require trained editors and periodic upgrade attention, and self-managed adds DevOps overhead. Scoring reflects the SaaS majority path; ops burden is modest compared to on-premise DXPs like AEM or HCL DX.
Kentico provides an open-source Migration Toolkit on GitHub and supports content/data export, reducing content migration costs materially. However, code migration is explicitly not handled — all bespoke development must be manually rewritten on exit or version upgrade — and proprietary content modeling plus API conventions create moderate data-layer lock-in.
XbyK uses ASP.NET Core MVC patterns that map well for .NET developers, but developers must learn platform-specific abstractions: Page Builder (widgets, sections, templates), content types vs. page types vs. reusable content, channels, and a proprietary content repository API (not Entity Framework). The certification exam covers content modeling, custom modules, Page Builder, and CI/CD — a non-trivial concept surface, and KentiCopilot AI scaffolding helps navigate but does not reduce it. Cleaner than KX13's Portal Engine hybrid but still meaningfully proprietary.
Kentico maintains a structured Developer Learning Map, Developer Kickstart guide, training-guides repo and a Certified Developer path, and has layered AI-assisted onboarding on top: the KentiCopilot marketplace was reorganized in July 2026 into workflow plugins (kentico-web-development walks agents from wireframe through bootstrapping, content modeling and implementation), and the Management MCP server came out of preview on Sept 3, 2026 (31.8.3) with a recommendation to use it on all projects. Not higher because there is still no in-app interactive developer tour and no framework-specific (Next.js) guided learning path.
The primary development model is ASP.NET Core MVC (new projects target .NET 10 since 31.0.0), which is mainstream in enterprise .NET circles but a non-starter for JS-only developers. Headless delivery is a GraphQL channel (Hot Chocolate) that supports decoupled Next.js builds, but Kentico maintains no Next.js/React starter or SDK, so that path is community-documented and secondary. The platform uses its own content retriever API rather than a standard ORM, and Page Builder widget registration is proprietary.
The .NET CLI project templates were substantially modernized in 2026: the August 20 refresh (31.8.0) rebuilt Dancing Goat with Tailwind CSS, an esbuild pipeline, reworked Page Builder content, better SEO, and pre-configured MCP servers plus AI instruction files, and moved all templates to Central Package Management. The September 24 refresh (31.9.0) updated its visual design again. Alongside xperience-component-starter and the Admin Design Components reference project, this is a real example-content starter. Not higher because there is still no vendor-maintained Next.js/Nuxt/Astro starter for the headless channel.
Setup requires the .NET SDK, .NET CLI template registration, SQL Server provisioning, and admin/presentation wiring, which is moderate for experienced .NET developers. 2026 tooling trims friction: templates use Central Package Management, the KentiCopilot project-lifecycle plugin generates CD repository.config, and 31.9.0 added a --kxp-db-status command so scripts and agents can check database readiness without starting the app. That same release made SystemEmailOptions.ServiceDomain or AllowedHosts mandatory on self-hosted projects for user-invite and password-reset emails, adding one more non-obvious config value, so the score holds.
XbyK uses a structured content type system with code-generated C# models, making schema changes type-safe and refactorable, with CI/CD serialization for schema-as-code. The Management MCP server (GA Sept 2026) manages content types, reusable field schemas, and as of 31.9.0 custom module classes and UI forms. 31.8.0 also let custom data types be used in reusable field schemas. There are no documented severe field-count limits, but the reusable-content vs. page vs. headless-item split needs upfront planning, and media library removal forces an asset-model migration on older projects.
Page Builder has built-in preview and edit modes plus a read-only inspection mode, so editors preview unpublished changes at high fidelity with no extra developer work on the standard ASP.NET Core presentation model. Headless channels only provide a configurable Preview URL button: the Next.js side still needs custom middleware to fetch draft content over GraphQL, and there is no visual editing for headless. Not higher because the plug-and-play path covers only the .NET MVC model.
A Certified Developer exam still exists and is strongly expected for agency partners, covering Page Builder internals, custom modules, content modeling, GDPR, and CI/CD — not just general .NET skills, and the platform remains inaccessible to JS/Python-only developers. Kentico's 2026 AI-dev push (KentiCopilot skills, MCP servers, Claude Code/Cursor/Copilot support) explicitly aims to 'lower the seniority bar,' modestly reducing the platform-specific expertise needed before first delivery. Not higher because the proprietary Page Builder/module model and certification expectation persist.
XbyK is designed for professional development teams, not solo developers. Migration guides reference 3–6 month timelines (6–12 for large/customized solutions) and costs from $10K to $150K+, implying dedicated dev + ops + solution architect roles. The architecture (Page Builder, custom modules, SQL Server, CI/CD, two-application topology) typically needs a 2–3 person team minimum; solo deployments are possible for simple sites but not typical.
Page Builder lets marketers self-serve page layout, widget placement, and content edits post go-live, with read-only inspection reducing editor friction, and AIRA now assists marketers directly: the April 2026 refresh added SEO & GEO Specialist and Campaign Manager agents plus segment-condition building, and the May 14, 2026 refresh (31.5.0) extended AIRA text-field assistance across all content type targets including headless items. Not higher because new widget types, page templates, and new content types still require developers.
Monthly Refreshes shipped every month of 2026 (31.7.0 Jul 28, 31.8.0 Aug 20, 31.9.0 Sep 24) as NuGet package updates plus a database update, and 31.9.0 added a `--kxp-db-status` command so pipelines can detect a required database update without starting the app. But updates are not frictionless: 31.5.0 bumped Microsoft.Data.SqlClient across majors 6 and 7 with possible breaking changes, and upgrading to 31.7.0–31.7.3 could fail with a command timeout on databases with many orphaned sync tasks (the fix is to skip to 31.7.4). Not higher because every update, even on SaaS, needs a developer to update NuGet, update the database and redeploy.
Kentico has published at least one security advisory almost every month of 2026 for its own codebase, most rated high: SQL injection in Form Builder (CVSS 8.7, Jun 4), Segments condition builder SQLi (8.6) and content-sync SQLi (7.5) (Jul 9), macro input validation (8.6, Aug 13), shared-cache leakage of media resources (8.2, Sep 10), and an account-recovery flaw (8.6, Sep 24). That follows May's critical 9.4 admin-UI SQLi. Most affect every version back to 22.0.0, and the only fix is updating to the latest version, so each one means a NuGet update and a redeploy. Not lower because advisories are clear and scoped, fixes ship within a week through hotfixes, Kentico runs the SaaS infrastructure, and some flaws (e.g. the Sep 24 account-recovery issue) did not affect SaaS.
Kentico publishes a support policy guaranteeing at least 12 months of backward compatibility after a deprecation. Media Libraries followed it: marked obsolete in 30.8.0 (Jul 2025), support ended Jul 24, 2026, hidden in 31.8.0 for projects that don't use them, and full removal, first planned for the September Refresh, has been postponed. There is a migration guide to Content hub assets. Separately, projects must move to .NET 10 before .NET 8/9 lose Microsoft support on Nov 10, 2026. The Management MCP/API, which left preview in 31.8.3, is explicitly exempt from the policy and can break without notice. Not higher because a forced media-asset migration and a framework retarget both land in 2026.
On SaaS, Kentico runs the infrastructure dependencies (Azure SQL, Blob Storage, Cloudflare CDN). The application layer is still an ASP.NET Core/NuGet tree whose version must match the database, and 2026 forced several dependency moves: Microsoft.Data.SqlClient 6→7, a HotChocolate GraphQL security update, repeated transitive-dependency vulnerability hotfixes, and a required .NET 10 retarget by Nov 2026. Not lower because SaaS removes the infrastructure burden and Kentico documents how it handles transitive vulnerabilities; not higher because version-locked NuGet and database updates add friction every month.
Xperience Portal gives SaaS customers custom uptime checkers with alerting (added April 2026, with an admin/logon checker created automatically for existing projects), metrics for server errors, response time, CPU and memory, and a Security events view of Cloudflare events. Application Insights is bundled, AIRA credit use appears on a Usage tab, and 31.9.0 made the event log exportable to CSV by default. Not higher because self-hosted and private-cloud deployments have no built-in monitoring, and SaaS customers still need their own application-layer APM and alert tuning.
Built-in workflows, content locking (June 2026), form usage tracking ('Used in' tab) and the AIRA agents (Content Strategist, SEO & GEO Specialist) reduce day-to-day editorial overhead, and 31.9.0 adds CSV export on listing pages, which helps with manual audits. There is still no native broken-reference detection, orphaned-content alerting, stale-content identification or content health dashboard, so hygiene remains manual or depends on paid third-party tools such as Siteimprove. Not lower because locking and the AIRA agents lighten the load; not higher because content hygiene is not automated.
SaaS deployments get Cloudflare CDN edge caching, DDoS protection and Kentico-managed scaling, and Portal response-time metrics show degradation without extra setup. Output caching and cache dependencies are still the developer's job, and 31.9.0 fixed a memory leak in the cache-dependency Tag Helper, a reminder that app-layer caching needs attention. Not higher because output caching and SQL tuning remain the customer's responsibility, and self-hosted deployments need full tuning.
G2 reviewers keep Xperience by Kentico in Leader status (Winter 2026), with about 98% rating it 4–5 stars and 92% recommending it, and 'ease of support' is one of its best-scoring areas. Reviews repeatedly mention fast responses from in-house engineers, and both Standard and Premium tiers include 24/7 support. Not higher because a dedicated CSM and the best SLA terms require Premium, and some reviewers want faster turnaround on development-service requests and more detailed technical documentation.
The Kentico Community Portal has a Q&A forum where Kentico staff answer questions, a monthly Refresh blog (most recently September 24, 2026) and an MVP/Community Leaders program, and the open-source KentiCopilot plugins and Migration Tool on GitHub add another place to get help. The community is still small compared with WordPress, Drupal or the large headless CMS platforms, so niche integration questions often go without an answer. Not lower because staff take part actively and the monthly releases keep developers informed.
Weekly hotfixes (four per Refresh cycle through 31.8.4) deliver bug and security fixes quickly with a detailed list of fixed issues each time, and every 2026 security advisory shipped with a patched version the same day. Reviewers praise how fast fixes arrive. Not higher because the volume of recurring high-severity flaws suggests QA debt, and some hotfixes caused new problems (e.g. the 31.7.0–31.7.3 update timeout) that needed further fixes.
Xperience by Kentico includes a Page Builder with drag-and-drop widget placement and pre-defined page templates, enabling marketers to create landing pages from existing templates without developer involvement. Version history for pages (March 2025) allows marketers to restore prior widget configurations. Content sync enables staging-to-production promotion with one click (May 2025). Developers must define new layouts and widgets first, so net-new page structures still require developer work. Scores at the lower end of the 65+ tier.
A dedicated Campaigns feature (March 2026) combines campaign briefs, associated digital assets, and linked customer journeys with AIRA Campaign Insights for AI-driven KPI evaluation. The May 2026 refresh added a guided campaign-brief authoring flow: the Campaign Manager Agent asks marketers a structured series of questions (brand, goals, audiences, KPIs, channels, messaging) and restructures the answers into a formatted brief. The production-ready Campaign Manager Agent (April 2026) evaluates campaign performance against KPIs, audience groups, and journey metrics and generates final reports comparing success across multiple campaigns — a significant step toward portfolio-level campaign orchestration. Email Builder (production March 2025) provides visual drag-and-drop email authoring. Marketing automation with conditional branching is native. Multi-channel coordination and a dedicated content calendar UI are still absent.
The SEO & GEO Specialist Agent (April 2026, production-ready) reviews pages for both classic SEO attributes and AI readability/comprehension, provides keyword-based scoring and prioritized recommendations — closing the previously noted gap of no in-box SEO audit/scoring tool. Multiple vanity URLs per page with canonical URL selection (June 2025), URL management application for centralized redirect management (May 2025), and forward-slash support in custom URLs (July 2025) give solid SEO URL hygiene. Standard meta title/description fields are on all content types. The community XperienceCommunity.SEO package adds automatic sitemap generation, dynamic robots.txt, and llms.txt. GEO scoring for AI crawler readability is a forward-looking differentiator.
Native Form Builder supports lead capture with validation rules, conditional logic, and field visibility conditions (January 2026). Lead scoring, email marketing, and marketing automation with value-based activity signals (January 2026) are all native. 'Used in' tracking shows which pages each form appears on across channels. Form Builder improvements shipped October 2025. Form submissions can be exported to CSV (August 2026), and the official CRM package pushes form submissions to Salesforce or Dynamics as leads. Not a marketing automation powerhouse, but well above headless CMS baseline with genuine out-of-the-box lead capture, scoring, and nurture.
Identity Resolution (April 2026, production-ready) unifies customer, contact, and member profiles under single identities and automatically merges profiles when visitors log in with existing accounts — a meaningful upgrade from the earlier preview-only CDP unified profiles. AIRA Segment Condition Builder (April 2026, production-ready) uses AI to assist marketers in defining complex multi-rule segment conditions. Widget-level personalization in Page Builder delivers separate content variants per contact group based on behavioral, demographic, and activity-based segments. Email widget personalization (June 2025) allows per-segment email variants. Membership Roles (March 2026) enable tiered channel-specific content access. No full page-level rules engine or real-time behavioral personalization yet.
Xperience by Kentico has no native content-level or server-side A/B testing — all first-party A/B testing documentation still references legacy KX12/KX13 only, and the XbK changelog contains no native experimentation feature. However, Kentico now maintains an official Tag Manager package (github.com/Kentico/xperience-by-kentico-tag-manager) that lets marketers enable a VWO integration directly from the administration UI, injecting VWO SmartCode into a website channel for front-end A/B testing and experimentation (added December 2025). This is client-side experimentation via a tight third-party integration: experiment design, targeting, and statistical significance/winner selection all live in VWO's own platform, and the integration can manipulate only front-end data (no backend experimentation). Email Builder subject/content variants remain per-segment personalization, not statistically validated experiments. This fits the 'experimentation via tight integration' tier at the lower end — a real optimization path exists, but nothing native or content-model-aware.
Page Builder with template-based page creation, version history for pages, content sync from staging to production (May 2025), and shareable preview URLs (December 2025) support a reasonable content velocity workflow. AIRA inline text generation and transformation was expanded to text fields across all content type targets including headless items (May 2026), extending assisted authoring beyond the rich text editor. Content overwrite protection (May 2026) and globally configurable content locking (June 2026) prevent lost edits and rework from concurrent editing, and a content reuse locator surfaces cross-channel usage during editorial decisions. Drag-and-drop asset uploading during content creation (November 2025) reduces friction. 'Save and create another' (August 2026) creates the next page or content item with the previous page's content type, template and tree position already filled in, which speeds up batch authoring. Content locking was extended to emails (July 2026). True bulk editing is still not featured, and new page types still require developer setup of widgets.
XbK natively supports website channels, email channels (Email Builder), and headless delivery via GraphQL for mobile apps and SPAs — covering web, email, and headless channels from a single content hub. Order status notifications extend commerce content to transactional email channels. Structured content in the Content Hub enables reuse across any API-connected surface. Social media publishing from KX13 was not ported to XbK. Native 4+ channel support without social.
The official Tag Manager package (github.com/Kentico/xperience-by-kentico-tag-manager) lets marketers enable Google Analytics 4, Google Tag Manager, and Microsoft Clarity (session recording, heatmaps, scrollmaps) directly from the administration UI per website channel — first-class configuration of standard analytics tags without developer template edits, though the metrics themselves still live in the external tools. In-platform, customer journey analytics (March 2025) visualizes contact progression and drop-off through journey stages with date-range filtering, AIRA Campaign Insights evaluates KPI performance across campaigns (March 2026), and the Campaign Manager Agent (April 2026) generates final reports comparing success across multiple campaigns. Form submission tracking with channel and language metadata (October 2025) surfaces form performance. Still no native web analytics module comparable to KX13's visitor tracking — page views, sessions, and source attribution remain in GA4/GTM.
Widget-based Page Builder naturally constrains authors to developer-defined components — marketers can only place pre-built widgets, preventing arbitrary HTML or off-brand layout choices. This enforces structural consistency indirectly. However, there is no platform-level design token management, approved color palette enforcement, or style locking system. Brand consistency relies on developers building a constrained widget palette and CSS, not on platform-enforced guardrails. Moderate consistency through architectural constraint, not explicit brand governance tooling.
The social media publishing module from KX13 (Facebook/Twitter/LinkedIn posting, analytics) was not ported to Xperience by Kentico. Standard meta fields on content types support Open Graph and social card metadata through developer-configured fields. No dedicated social scheduling workflow, push-to-social workflow, or social preview management UI exists in XbK. Authors can configure OG meta fields but there is no native social channel integration beyond standard meta tags.
Content Hub replaced KX13's media library as the centralized asset repository with taxonomy-driven organization, AIRA auto-tagging of images (March 2025), AI focal point detection for smart cropping (February 2025), dimension-specific image variants, auto-scaling on upload (April 2025), CDN link generation, and 'Used in' tracking to see where assets are referenced. Media library support ended July 2026 and the libraries are hidden in the admin UI (August 2026); their removal was postponed. Bynder DAM official connector covers enterprise DAM needs. No built-in rights management or video transcoding, but meaningfully above basic media library tier.
Language variants are available on all content types — pages, reusable content items, headless items, and products. Language fallback prevents blank content. Translation workflow with multi-step review and approval is built in. Phrase Localization Platform and XTM Cloud official connectors support professional TMS-driven translation workflows. Admin UI fully localized (July 2025). AIRA provides translation assistance. Per-channel language strategies allow separate locale approaches per brand/region. Limited locale-specific campaign calendar or transcreation workflow tooling — localization applies to content generally, not with marketing-specific campaign variant management.
Kentico maintains an official, fully supported CRM integration (github.com/Kentico/xperience-by-kentico-crm, 7-day bug-fix policy, active September 2026) with plug-and-play packages for Salesforce Sales Cloud and Microsoft Dynamics Sales. It sends form submissions to the CRM as leads and shows sync status in the admin UI. Earlier scoring runs missed this connector, so the old claim that XbK had no Salesforce connector was wrong. The official Tag Manager package covers analytics and engagement tags (GA4, GTM, Clarity, VWO, Intercom). Bynder (DAM), Phrase/XTM (localization), Campaign Monitor (email sending) and Zapier round out the pre-built connectors. Marketing automation became much more extensible in 2026: custom actions (June 2026), then custom triggers and custom conditions (July 2026). All three show up in the marketer's Automation Builder, and triggers can start processes from external-system inputs or purchases. There is still no MAP connector (Marketo, HubSpot, Pardot), no CDP or ad-platform connector, and no native outbound webhooks. The CRM connector syncs leads one way and does not sync contacts both ways. Pre-built connectors now cover CRM, analytics/tags, DAM and email, with code-level event triggers, which puts this item in the middle of the 35–55 band.
Products are managed as content types in the Content Hub, allowing reuse of descriptions and assets across websites, emails, mobile apps, and headless channels — production-ready as of July 2025. Content-type architecture is flexible: physical goods, digital goods, memberships, and gated content are all supported. However, the framework is architecturally modern but less feature-complete than KX13's mature e-commerce module — dedicated attribute modeling depth, product bundle configuration, and product taxonomy richness require custom implementation. Not a purpose-built PIM.
Kentico's native digital commerce includes catalog discounts, order discounts (December 2025), and generic coupon codes (January 2026), plus order and customer management applications — more than most CMS platforms. However, dedicated merchandising tooling — category page ranking, search result merchandising, cross-sell/upsell content surfaces, product spotlight modules — is not evident. The commerce framework remains extensible but thin on native merchandising UI for non-developers. No 'Buy X Get Y' or product bundle discounts yet (these existed in KX13).
XbK's digital commerce is a native framework, not an integration layer for leading external commerce platforms. No native connectors to Shopify, commercetools, Salesforce Commerce Cloud, or BigCommerce are confirmed. The extensible architecture supports custom ERP/PIM/CRM connections via API but these are custom integration work. Commerce Migration Tool added support for migrating KX13 customers and orders (January 2026) — this is a legacy migration path, not live federation with third-party commerce platforms.
Because products are modeled as content types in the Content Hub, Page Builder pages can blend editorial content and product references in the same authoring surface — buying guides, feature spotlights, and product-adjacent editorial are structurally natural. However, there are no first-class shoppable content patterns: no 'shop the look' widget, no inline add-to-cart embedded in editorial content, no lookbook authoring mode. Editorial-commerce blending is architecturally possible but not an out-of-the-box authoring pattern for non-developers.
XbK's checkout is a developer-configured flow with configurable extension points — the IOrderCreationService orchestrates order creation (October 2025). Trust badges, shipping callouts, or upsell banners within cart/checkout are not managed from the CMS as a first-class feature. Content from the Content Hub could theoretically be injected into checkout templates via developer code, but there is no marketer-facing UI for cart content management. Commerce content lives in the Content Hub but transactional flow customization is developer territory.
Order status email notifications are managed from the CMS via the Email Builder with commerce-specific merge tags/placeholders (June 2025). Order confirmation, processing, and delivery status emails can be designed and managed by marketers using the visual email builder. Beyond email notifications, post-purchase content (product onboarding sequences, review solicitation, loyalty content) is not featured as a native capability — it would require custom marketing automation sequences.
Membership Roles (March 2026) enable gated content access by role, which can be applied to restrict product catalogs or pricing content to authenticated B2B buyers. The content-type product model supports custom pricing tiers via the extensible pricing pipeline. However, there are no purpose-built B2B commerce features: no account-based pricing portal UI, no RFQ/quote workflow, no buyer/seller account hierarchy, no gated spec sheet management system. B2B patterns are achievable with significant custom development.
Core XbK has no built-in site search. Kentico does ship three official, fully supported search integrations (7-day bug-fix policy, all updated September 2026): Algolia, Azure AI Search and Lucene.NET. Each one indexes content tree pages and reusable items using a code-first approach. Developers can build faceted and relevance-tuned search, including blended content-product results, on Algolia or Azure AI Search, and those engines provide synonym management. That configuration happens in the search service and in code, though. There is no marketer-facing search merchandising, no CMS-managed search landing pages and no commerce-specific product discovery layer. Basic search with enrichment through official connectors puts this item in the lower-middle of the 35–55 band.
Catalog discounts and order discounts are production-ready (December 2025), and generic coupon codes are native (January 2026) — covering core promotional mechanics. The February 2026 refresh added promotion targeting flexibility, letting marketers scope a promotion to all customers or only those authenticated through member accounts — a step toward audience-specific promotional targeting. Free shipping promotions (September 2026) join catalog and order discounts: they remove shipping cost above a cart threshold, can be limited to specific shipping methods, and store managers configure them like any other promotion. Content scheduling via workflow and scheduled publishing allows time-activated promotional banners, and Page Builder widgets can display promotional content. However, dedicated countdown timer widgets, tiered pricing tables with display logic, and channel-specific promotional content targeting are still not documented as native features.
XbK's multi-channel architecture supports multiple website channels from a single instance, each with its own domain, page tree, and configuration. The Content Hub provides shared product content (descriptions, images, attributes) accessible across all storefront channels, while per-channel page trees control storefront-specific editorial and legal content. Language variants per channel allow region-specific pricing and content. This is architecturally sound for multi-storefront but requires developer configuration and there is no storefront-specific governance UI for non-technical teams.
Content Hub with AI focal point detection (February 2025) and dimension-specific image variants provides solid image management for product photography. Video can be embedded via content items. Maximum dimension auto-scaling on upload prevents oversized images. CDN delivery for all assets. However, 360-degree product views, AR/3D model hosting, image hotspots, and zoom functionality are not native — these require custom frontend development or third-party plugins. Basic image galleries and video embeds are possible.
XbK has no marketplace or multi-vendor commerce features. There are no seller profile management tools, seller-contributed product description workflows, or content moderation at marketplace scale. Multi-author content is technically possible via RBAC permissions, but this is generic collaborative editing rather than marketplace-specific tooling. The native commerce framework is single-vendor by design.
All product content types support language variants, enabling locale-specific product descriptions. The extensible pricing pipeline supports multi-currency display (via custom implementation). Per-region tax configuration is supported. Phrase and XTM connectors enable professional translation of product content. However, currency-aware content blocks, regulatory content templates (EU labeling, CA Prop 65), and market-specific promotional calendar management are not native — they require custom development.
Customer journey analytics visualizes progression and drop-off through marketing journeys including commerce touchpoints (March 2025). AIRA Campaign Insights evaluates KPIs including conversion metrics (March 2026). However, there is no dedicated content-to-revenue attribution within the CMS — connecting which content pages assisted or drove purchases requires external analytics tools (GA4 with enhanced ecommerce integration). Commerce analytics data is not surfaced as content performance metrics within the editorial interface.
Workspaces segregate Content Hub content into distinct role-scoped areas, with granular per-workspace permissions (View, Create/Update, Delete) assigned per role and per application — e.g., full Content hub permissions in Workspace A but View-only in Workspace B — so editors only see and act on the content in their workspace. Page permission management adds hierarchical page-level access control. This moves beyond simple content-type RBAC toward content-instance/area-based visibility control. SSO with OAuth/OIDC providers (Microsoft Entra ID, Auth0, Okta) is native, and Membership Roles (March 2026) add tiered visitor-facing content access with channel-tree inheritance. Fine-grained department/team partitioning for classic intranet use is still primarily an editorial-governance construct rather than audience-org-unit content targeting, so it lands solidly above content-type RBAC but short of full audience-based visibility.
Content lifecycle features including workflows, content versioning with full history, and multi-step approval processes are available. The Content Hub provides taxonomy-driven content organization. However, dedicated knowledge management features are absent: no content expiry/review scheduling, no stale content flagging, no structured knowledge article lifecycle distinct from standard content, no internal search quality tuned for knowledge retrieval at scale. Xperience is marketed as a marketing/commerce DXP — knowledge management is not a strategic use case.
Xperience by Kentico is purpose-built for marketing and commerce use cases, not employee intranets. Legacy Kentico versions (K8/K9) had explicit intranet feature sets, but the Xperience rebuild focuses entirely on digital marketing, commerce, and headless delivery. Membership Roles (March 2026) provide tiered content access which marginally supports restricted internal portals, but there are no native employee directory integrations, news feed widgets, social/community features, push notifications, or org chart tools. Building a full employee portal requires substantial custom frontend work.
XbK has no native internal communications features. A website channel could be configured as an employee news site with access-controlled content, but there are no targeted announcement tools, read receipts, acknowledgment tracking, or mandatory-read workflows. Audience segmentation exists for marketing (contact groups) but these are visitor-facing, not employee-department-targeted. Internal comms beyond basic intranet pages require custom frontend development.
No native employee directory, skills/expertise database, org chart, or team page management exists in Xperience by Kentico. Content Hub could theoretically model employee profiles as content items, but there is no out-of-the-box directory UI, org chart visualization, or HR system integration (Workday, BambooHR). This requires complete custom development from scratch.
Content versioning and workflow-based approval are available for all content — policies could be modeled as content types and managed through standard editorial workflows with version history. However, there are no purpose-built policy management features: no document acknowledgment tracking, no mandatory-read enforcement, no automated review/expiry reminders, no audit trail specific to policy acceptance. Standard CMS versioning is present but policy lifecycle management is absent.
No native onboarding journey or structured role-based content path features exist in XbK. Marketing automation with customer journeys could theoretically be adapted for employee onboarding sequences, but the automation is designed for marketing contacts/customers, not employee data integration. Progressive disclosure over 30/60/90 days, HR-triggered new-hire portals, and task checklists would all require substantial custom development without native platform support.
XbK has no built-in search engine. The official Lucene.NET, Algolia and Azure AI Search integrations (fully supported, active September 2026) index channel content, so internal search with facets and AI-assisted relevance is possible on Azure AI Search or Algolia. All of it is code-first and aimed at public website search. There is no federated search across SharePoint, Confluence or Drive, and nothing tunes search for internal knowledge volumes. Intranet search quality depends entirely on custom implementation.
All XbK website themes/templates are responsive and mobile-accessible via browser. However, there is no native mobile app for employee portal access, no offline content synchronization, and no push notification capability for intranet content. Headless delivery via API could enable custom mobile apps but this is custom development. The platform is designed for responsive web delivery to public visitors, not native mobile experience for frontline workers.
No LMS integration or native micro-learning features exist in Xperience by Kentico. The platform's integration catalog does not include Cornerstone, Workday Learning, or any LMS. Course assignment, completion tracking, and certification management would require full custom development with a separate LMS platform.
No community or social features exist in Xperience by Kentico. The social and community modules from legacy Kentico versions were removed in the XbK rebuild and have not been reintroduced. There are no comments, reactions, discussion forums, peer recognition, polls/surveys, or idea submission features. The platform is positioned exclusively for marketing and commerce, not community or collaboration.
No native Microsoft 365/Teams, Google Workspace, or Slack integration exists in XbK. The integration catalog does not list any workplace tool connectors. KentiCopilot provides MCP integration with developer tools (Claude Code, Cursor, GitHub Copilot) but this is a developer experience feature, not an employee communication integration. Webhook-based connections to workplace tools would require custom development.
Content versioning with full history is available for pages and content items. Workflow-based approval processes provide review stages before publishing. Content sync (staging to production) adds a promotion mechanism, and content overwrite protection (May 2026) plus globally configurable content locking (June 2026) reduce collaboration conflicts. However, automated review date scheduling, stale content flagging, ownership assignment for content freshness accountability, and archival workflows are still not documented as native features. Content lifecycle management remains manual — editors must proactively archive or review content without automated nudges.
XbK's analytics capabilities (customer journey analytics, campaign insights) are designed for external visitor and customer measurement, not internal employee content consumption. There are no department-level content view dashboards, failed intranet search term reports, employee engagement heatmaps, or adoption dashboards for intranet ROI. Internal analytics is not a supported use case.
XbK supports multiple website channels within a single instance, each with separate content models (namespaced content types), separate domains, and separate page trees. The Xperience Portal is multi-tenant by architecture, with SaaS support for multiple website channels from one instance. This is silo-based channel isolation within a shared application instance — not true per-tenant environment isolation. Organizations requiring completely separate environments (separate databases, separate deployments) must provision separate XbK instances.
The Content Hub enables shared reusable content items and assets across all website and headless channels — a genuine cross-brand content sharing mechanism as a first-class architectural feature. Developers can create Razor Class Libraries (RCLs) to organize components shared between channels. The multichannel sample repository demonstrates this pattern officially. This is a workable content-sharing model, but shared component libraries require developer setup of RCLs and are not self-service for brand managers.
Centralized user management, advanced permissions with page-tree-level ACLs, and workflow approvals are available across all channels within a single XbK instance. Workspaces add content-area governance: content can be segregated into workspaces with per-workspace role permission scoping (View/Create/Update/Delete per application), giving central teams a first-class way to enforce who can act on which content across brands while preserving per-channel autonomy. Content publishing workflows with notifications and a content reuse locator further strengthen editorial governance. Cross-brand content-standard enforcement (schema policies per brand) and cross-brand approval routing remain limited; governance is primarily at the user/permission/workspace level rather than enforced per-brand content schemas.
XbK uses channel-based licensing: one main channel included in the platform license, with additional channels purchased separately. This creates approximately linear per-brand cost scaling — each new brand channel adds incremental cost. No evidence of volume tiers or economies of scale for large many-brand portfolios. Not super-linear (no separate high-cost per-brand licenses), but not economically advantaged for large multi-brand deployments either.
Each XbK website channel has its own dedicated frontend (separate Razor Class Library, separate CSS/static assets, separate logo and visual identity). Per-channel theming is architecturally clean with genuine visual isolation between brands. However, this is all developer-managed CSS and component configuration — there is no platform-level design token management, no visual theme editor for brand managers, and no version-controlled brand style propagation system. Per-brand visual identity is achievable but requires developer implementation.
Per-channel language configurations allow each brand to have its own language strategy. Language variants per content item enable brand-specific translated content. The Phrase and XTM connectors support professional translation workflows. However, brand-specific translation approval chains are not documented — translation governance appears to be a single shared workflow rather than per-brand translation routing. No brand-locale governance matrix with per-brand translation approval chains and regional legal content governance is confirmed.
XbK's analytics (customer journey analytics, campaign insights) are scoped per channel/campaign, not aggregated at portfolio level. There is no cross-brand dashboard showing content velocity, publishing cadence, or engagement comparison across the brand portfolio. Each brand/channel team sees their own metrics. Portfolio-level aggregation requires manual external analytics work.
Workflow configurations are available per channel in XbK — approval chains and review stages can be configured independently for each brand channel. Central admin retains audit visibility across all channels. This provides meaningful per-brand workflow autonomy within a centrally auditable system. However, the configurability of per-brand workflows is not extensively documented as a self-service feature — it appears to require admin-level configuration rather than brand-team-managed workflow design.
The Content Hub enables sharing of reusable content items across all channels — press releases, product descriptions, and legal copy can be authored once and referenced (not duplicated) by multiple brand channels. This is structural content reuse, not a formal syndication system with override points and push-update workflows. Corporate-to-brand content syndication with controlled local adaptation (e.g., the brand can override a product blurb but can't override a legal disclaimer) is not a documented native capability.
Basic compliance configuration is available per channel — cookie consent and GDPR handling are supported via standard web mechanisms (consent banners configurable per channel). Cloudflare security event monitoring is surfaced in the Portal (January 2026). However, there are no platform-enforced publishing guardrails that prevent non-compliant content from going live per brand, no per-brand accessibility standard enforcement, and no data residency controls per channel. Compliance is primarily developer/admin configured, not platform-enforced guardrails.
The RCL (Razor Class Library) pattern in XbK supports a shared component library maintained centrally with per-channel brand extensions — a documented and officially sample-supported pattern. However, this design system lives entirely in code: there is no platform-level design system management UI, no component versioning system, no update propagation mechanism, and no brand-extension workflow for non-developers. Central component libraries require developer discipline and code-level versioning (Git), not platform tooling.
A single XbK instance provides a central admin who can manage users across all brand channels. Workspaces let central teams give brand/project groups autonomous content areas with role permissions scoped per workspace (View/Create/Update/Delete per application), so brand teams operate independently while central admin retains oversight. Per-channel role scoping allows brand teams autonomous editorial permissions within their channel. SSO via OAuth/OIDC (Microsoft Entra ID, Auth0, Okta) works across all channels from a single identity provider, and users can hold roles across multiple channels. Comfortably meets the central-admin-with-autonomous-brand-teams-and-SSO bar.
Content types in the Content Hub are shared across channels by default, providing a common baseline model accessible to all brands. Per-channel namespacing allows channels to have unique content types extending the shared model. However, a formal model extension pattern — where Brand A adds video fields to a global product page type and Brand B adds comparison tables without forking the base type — is not a documented platform-native capability. It requires developer-managed code-level inheritance, not a platform-managed model extension workflow.
No portfolio-level reporting dashboard exists in XbK. Metrics (customer journey analytics, campaign insights) are scoped per campaign or per channel. There is no executive view of content freshness across the brand portfolio, publishing SLA adherence tracking, cost allocation per tenant, or capacity planning data. Multi-brand deployments would require custom reporting built externally (BI tools, external analytics aggregation) to achieve portfolio-level visibility.
EU residency is real (West/North Europe, Germany West Central, Switzerland North, UK regions) and Kentico's privacy policy relies on the EU-U.S. Data Privacy Framework and SCCs for transfers. Consent management is built in. However, the Data protection application is only a framework: the docs say that by default Xperience provides no personal data collection or erasure functionality, so developers must implement collectors and erasers. No public DPA or sub-processor list could be fetched; the trust center sits behind a Cloudflare challenge. That keeps the score in the 60–78 band.
No HIPAA BAA is offered and there is no HIPAA-eligible SaaS documentation. The only HIPAA mentions on kentico.com are general explainers in marketing blogs and a healthcare ebook. The docs corpus mentions healthcare only once, as a generic example of why 2FA may be required. Without a vendor-executed BAA, covered entities cannot use the SaaS for PHI.
The security page claims GDPR, CCPA and Australia Privacy Act alignment. It also claims DORA alignment and Digital Services Act readiness, and a dedicated Australian Privacy Act page maps Kentico's practices to the Australian Privacy Principles. These are self-attested alignments, not audited frameworks. There is no FedRAMP, IRAP, C5, PCI-DSS or HITRUST, and no LGPD or PIPEDA commitment specific to Kentico. That puts it modestly above the GDPR + CCPA baseline.
Kentico holds a SOC 2 Type II attestation, with controls verified annually and continuous monitoring, and the report is distributed through the Kentico Trust Center. Which Trust Service Criteria are covered, and the report period, could not be verified because the trust center blocks non-browser access. That holds the score below the 85+ tier.
Kentico is ISO 27001 certified at the company and ISMS level, and the SaaS docs state it applies to the SaaS offering. That is more than inheriting Azure's certificate. There is no ISO 27018 or ISO 27701 certification, which blocks the 80+ tier.
SOC 2 Type II and ISO 27001 are the only formal attestations. DORA alignment and DSA readiness are self-declared postures, not certifications. There is a public Vulnerability Disclosure Program, but no CSA STAR, PCI-DSS, Cyber Essentials Plus, FedRAMP, IRAP, ENS or C5 was found.
The SaaS offering supports 20 Azure regions across the US, Canada, the EU, UK, Switzerland, East Asia, Japan, Australia and the UAE. Kentico states that all customer data is stored in a single-tenant account in the region the customer picks at provisioning. Two things leave the chosen region: Xperience Portal account data (usernames, project names, Auth0, logs) always sits in Kentico's European data center, and Cloudflare CDN caching is global. No contractual residency guarantee could be verified.
Xperience Portal offers self-service manual and automatic exports: the database as a bacpac file plus blob storage, in separate Restore points and Exports apps since 30.1.0. That gives customers complete data portability. However, personal-data erasure is not built in, because developers must write custom erasers. No post-termination retention or deletion period is published.
With 'Log object actions' enabled, the Event log records create, edit and delete actions on objects, and an AfterExportListingEvent hook supports auditing of data exports. Retention is set by entry count through the Event log size setting and CMSLogKeepPercent, not by time. Logging goes through Microsoft.Extensions.Logging providers, and SaaS adds an Application Insights integration viewable in Xperience Portal, so logs can reach Azure Monitor and SIEM tools. There is no dedicated audit-log product, native SIEM connector or compliance reporting.
There is still no WCAG 2.1 AA conformance statement or stated conformance target for the administration UI. The changelog does show ongoing accessibility work. The September 24, 2026 Refresh made AIRA guidance fully keyboard accessible and added focus rings to dashboard tiles and the image focal-point control. An earlier refresh gave date/time inputs keyboard navigation and ARIA. That is concrete progress, but it is incremental and not measured against a standard.
No VPAT, ACR, Section 508 statement or ATAG assessment exists for Xperience by Kentico. kentico.com/accessibility returns 404. Kentico's accessibility messaging covers only helping customers make their delivered websites WCAG-compliant (alt text, content validation), not the authoring tool. That is a procurement gap for public-sector buyers.
AIRA's GA 'Generate content' feature generates and refines text in page, email, content item, and headless item fields, using per-field AIRA instructions and item context. It also offers in-place rich text refinements with predefined or custom prompts and a global 'Tone of voice guidelines' setting, and generated output lands as a reviewable draft. Scores below 70 because there is no bulk or mass generation, and brand controls amount to one global tone field plus per-field instructions rather than governed prompt templates.
AIRA image processing (GA) auto-selects focal points for image variants on upload, and during mass upload it generates SEO-friendly image descriptions and assigns taxonomy tags based on image content. Neither the docs nor the product pages mention any native image generation. That puts it in the 40–60 band for auto alt text and tagging without generation.
AIRA translations are a native MT feature, not a TMS hookup. They translate pages (including Page Builder content) and content items into new language variants as reviewable drafts, and bulk jobs run through mass translation and a Translation queue application. Admins can configure brand terminology, words to leave untranslated, formatting rules, custom instructions, and the global tone of voice. Held just below 70 because there is no translation quality scoring and links are not re-targeted automatically.
Mass-upload image description (alt text) and auto-tagging to taxonomy fields are GA. The SEO & GEO Specialist agent analyzes pages for keyword targeting, SEO best practice, and AI readability, but the docs mark it as a Preview feature, and it returns recommendations in chat rather than auto-writing metadata. Nothing in the docs covers dedicated meta-description, OG, or schema-markup generation (editors can only enable generic 'Generate content' on such fields), so this is partial automation at 40–60, not the 67 previously credited on the assumption the agent was GA.
Several AI assists sit inside editorial and marketing work: auto-tagging and description of images on mass upload, bulk AIRA translation through the Translation queue, the AIRA Segment Condition Builder (off by default and requiring the CDP), and the Campaign Manager's asset-readiness checks. These count as multiple lightweight assists, but there is no AI-driven duplicate detection, content routing, smart scheduling, or stale-content lifecycle automation. The June 2026 extensible automation actions are developer extensions, not AI.
The AIRA Agentic Marketing Suite now names four agents: SEO & GEO Specialist, Content Strategist, Customer Journey Optimization Specialist, and Campaign Manager. Kentico's docs flag every one of them as a 'Preview feature' subject to breaking changes, even though the previous score treated them as GA. They have real governance: an admin-managed Agents tab with enable/disable and custom instructions, 'Allow' approval prompts that since August 2026 persist until answered, and permission-aware tool use. Because the agents are chat-invoked, single-scenario, and all in preview, this sits in the early/beta band rather than the GA 55–75 band.
AIRA Customer Journey Insights shows contact-group progression and the best and worst performing segments per journey stage. The Customer Journey Optimization Specialist (Preview) diagnoses drop-offs on page and email stages, and the Campaign Manager (Preview) produces campaign reports and cross-campaign comparisons. There is no content intelligence dashboard with topic clustering, content health scoring, stale-content detection, or editorial priority queues.
The Content Strategist agent audits a page against a stored Content Strategy artifact for style compliance, tone, and voice alignment, returning findings graded Critical/Major/Minor/Suggestion with quoted text and suggested fixes. The SEO & GEO Specialist adds SEO and AI-readability audits. Both agents are Preview, work one page at a time, and have no accessibility scanning or site-scale duplicate or thin-content detection. That is one dimension done well, at the low end of 45–60.
There is no native vector search, embedding generation, or semantic search in the XbyK core. Semantic ranking comes from the official, fully supported Kentico/xperience-by-kentico-azure-ai-search integration, which requires the customer's own Azure AI Search resource, alongside the Algolia and Lucene integrations. The only hybrid vector search Kentico ships is inside the Documentation MCP server, which searches product docs, not customer content. That makes semantic search a paid external add-on, in the 35–55 band.
The AIRA Segment Condition Builder turns natural-language descriptions into CDP segment condition rules, and the Customer Journey Optimization Specialist recommends page or email fixes for drop-off stages. Execution stays rule-based, so this is AI-assisted personalization in the 40–60 band. There is no ML scoring, predictive segment assignment, or next-best-content engine comparable to Bloomreach Loomi or Sitecore CDP.
The official Management MCP server (@kentico/management-api-mcp) left preview on 2026-09-03. It exposes schema-aware CRUD over content types, content items, pages, Page Builder components, channels, languages, and, since September, custom modules and classes, with tool groups (--enabled-groups). Kentico's docs, however, restrict it to local development instances with only basic authentication and no per-operation authorization, and say not to enable it in production. That means it lacks the permissions and production publish path the 75+ tier requires. A Documentation MCP server and a Content Modeling MCP server complete the roster, which keeps it at the top of the official-GA-with-limits band.
AIRA is a Kentico-managed, credit-metered service running on Microsoft Azure OpenAI and Azure Image Analysis. Neither the AIRA configuration docs nor the pricing and policies page offers any setting to supply your own API key, provider, or model. The Kentico/xperience-module-openai-azure repo cited previously has been archived since February 2025, and the plugin that swaps the LLM provider is community-built. KentiCopilot does let developers bring their own coding assistant (Claude Code, Copilot, Cursor), but the platform's AI features stay locked to the vendor model.
KentiCopilot has become a real agent-oriented developer toolkit: a GA Management MCP with an OpenAPI spec that agents are expected to discover, Documentation and Content Modeling MCP servers, a docs corpus published as llms-full.txt, and plugins and skills for automation actions, triggers, and conditions. Recent additions (July–September 2026) include a KX13 migration plugin, a --kxp-db-status CLI command built for agents and pipelines, and a Dancing Goat template with MCP servers and instruction files pre-configured. Held below 70 because this tooling targets development-time coding agents, and there are no agent-optimized content delivery or RAG endpoints and no LangChain or LlamaIndex guides.
Governance covers brand guardrails (global tone of voice, per-agent custom instructions, and the Content Strategy artifact behind View/Manage artifacts permissions), human-in-the-loop 'Allow' prompts before agents save, AI output created as drafts, permission-aware tool use, and per-feature or per-agent disable switches. Privacy terms state that prompts and responses are neither stored nor used for training. The docs say nothing about an AIRA audit trail of who invoked AI and what it generated (the earlier 'logs all agent activity' claim is unsupported), and there is no hallucination scoring or IP indemnification, which puts it at the bottom of the 50–70 band.
The AIRA application's Overview tab shows the credit balance and the next renewal. The Usage tab breaks down consumed credits and request counts by source for the last 30 days or since renewal, and admins can export 90 days of usage as CSV. That is basic usage and cost visibility. It scores below 65 because there are no per-user metrics, prompt-effectiveness analytics, or quality trend monitoring.
How composite scores (0–100) have changed over time. Click legend items to show/hide metrics.
Framework v2.0·Oct 10, 2026·Categories 1 and 2 restructured: Core Content Management now holds everything a CMS must do regardless of architecture, and Category 2 scores only the DXP feature layer with a packaging rule. Pure headless platforms score lower in Category 2 by design. Scores before and after this line are not directly comparable.
Xperience by Kentico's momentum is mixed and leans slightly negative: Platform Velocity rose to 71.9 on a steady release cadence, while Suite Capability, Operational Ease and Cost Efficiency each slipped by under a point. The Suite Capability decline comes from a closer look at AI and optimization, since AIRA runs only on Kentico's managed, credit-metered Azure OpenAI service with no option to bring your own model or key, there is still no native A/B or multivariate testing for pages or emails, and the agentic and built-in analytics features proved narrower than their positioning suggests. The clearest gain is site search, where officially maintained Lucene.NET, Algolia and Azure AI Search integrations now give teams a supported path, but buyers who put experimentation or AI governance first should budget for third-party tools.
Score Changes
AIRA is a Kentico-managed, credit-metered service running on Microsoft Azure OpenAI and Azure Image Analysis. Neither the AIRA configuration docs nor the pricing and policies page offers any setting to supply your own API key, provider, or model. The Kentico/xperience-module-openai-azure repo cited previously has been archived since February 2025, and the plugin that swaps the LLM provider is community-built. KentiCopilot does let developers bring their own coding assistant (Claude Code, Copilot, Cursor), but the platform's AI features stay locked to the vendor model.
Xperience by Kentico has no native A/B or multivariate testing for web pages or for emails; Kentico's migration guidance recommends VWO through the built-in Tag Manager, which offers a VWO A/B testing template. Page A/B testing and AI experiments for emails are roadmap items only, so experimentation depends on an external tool and sits in the 20–40 band, credited slightly for the ready-made Tag Manager template.
The AIRA Agentic Marketing Suite now names four agents: SEO & GEO Specialist, Content Strategist, Customer Journey Optimization Specialist, and Campaign Manager. Kentico's docs flag every one of them as a 'Preview feature' subject to breaking changes, even though the previous score treated them as GA. They have real governance: an admin-managed Agents tab with enable/disable and custom instructions, 'Allow' approval prompts that since August 2026 persist until answered, and permission-aware tool use. Because the agents are chat-invoked, single-scenario, and all in preview, this sits in the early/beta band rather than the GA 55–75 band.
Kentico maintains official open-source integrations for Lucene.NET (local code-defined indexes with auto-indexing), Algolia and Azure AI Search, each with index sync on content changes. There is no native search service with relevance tuning or analytics in the product, so it sits at the integration ceiling.
Native customer journey analytics (with prebuilt journeys in the September 2026 Dancing Goat), campaign reporting, email statistics and contact activity logs give marketing-level performance insight. There is no built-in web analytics or content performance dashboard; Kentico points to Google Analytics or Clarity for page analytics, so it stays below 60.
Mass-upload image description (alt text) and auto-tagging to taxonomy fields are GA. The SEO & GEO Specialist agent analyzes pages for keyword targeting, SEO best practice, and AI readability, but the docs mark it as a Preview feature, and it returns recommendations in chat rather than auto-writing metadata. Nothing in the docs covers dedicated meta-description, OG, or schema-markup generation (editors can only enable generic 'Generate content' on such fields), so this is partial automation at 40–60, not the 67 previously credited on the assumption the agent was GA.
AIRA translations are a native MT feature, not a TMS hookup. They translate pages (including Page Builder content) and content items into new language variants as reviewable drafts, and bulk jobs run through mass translation and a Translation queue application. Admins can configure brand terminology, words to leave untranslated, formatting rules, custom instructions, and the global tone of voice. Held just below 70 because there is no translation quality scoring and links are not re-targeted automatically.
Server-side global events cover content, workflow, form and object lifecycle in code, the official Zapier module sends outbound events and accepts inbound actions, and automation custom triggers can be fired from webhooks. There is no native configurable outbound webhook service with signing, retries and delivery logs, so it sits in the mid band.
The official Management MCP server (@kentico/management-api-mcp) left preview on 2026-09-03. It exposes schema-aware CRUD over content types, content items, pages, Page Builder components, channels, languages, and, since September, custom modules and classes, with tool groups (--enabled-groups). Kentico's docs, however, restrict it to local development instances with only basic authentication and no per-operation authorization, and say not to enable it in production. That means it lacks the permissions and production publish path the 75+ tier requires. A Documentation MCP server and a Content Modeling MCP server complete the roster, which keeps it at the top of the official-GA-with-limits band.
Governance covers brand guardrails (global tone of voice, per-agent custom instructions, and the Content Strategy artifact behind View/Manage artifacts permissions), human-in-the-loop 'Allow' prompts before agents save, AI output created as drafts, permission-aware tool use, and per-feature or per-agent disable switches. Privacy terms state that prompts and responses are neither stored nor used for training. The docs say nothing about an AIRA audit trail of who invoked AI and what it generated (the earlier 'logs all agent activity' claim is unsupported), and there is no hallucination scoring or IP indemnification, which puts it at the bottom of the 50–70 band.
Kentico maintains an official Shopify connector that syncs products through the Storefront and Admin APIs on a schedule and supports cart and checkout via Shopify. There are no first-party connectors for commercetools, BigCommerce, SAP or Salesforce Commerce, so breadth limits it below the integration ceiling.
Kentico maintains an official, fully supported CRM integration (github.com/Kentico/xperience-by-kentico-crm, 7-day bug-fix policy, active September 2026) with plug-and-play packages for Salesforce Sales Cloud and Microsoft Dynamics Sales. It sends form submissions to the CRM as leads and shows sync status in the admin UI. Earlier scoring runs missed this connector, so the old claim that XbK had no Salesforce connector was wrong. The official Tag Manager package covers analytics and engagement tags (GA4, GTM, Clarity, VWO, Intercom). Bynder (DAM), Phrase/XTM (localization), Campaign Monitor (email sending) and Zapier round out the pre-built connectors. Marketing automation became much more extensible in 2026: custom actions (June 2026), then custom triggers and custom conditions (July 2026). All three show up in the marketer's Automation Builder, and triggers can start processes from external-system inputs or purchases. There is still no MAP connector (Marketo, HubSpot, Pardot), no CDP or ad-platform connector, and no native outbound webhooks. The CRM connector syncs leads one way and does not sync contacts both ways. Pre-built connectors now cover CRM, analytics/tags, DAM and email, with code-level event triggers, which puts this item in the middle of the 35–55 band.
Video files can be uploaded and stored as content item assets and served through the CDN, but there is no transcoding, adaptive streaming, captions management or player. Most implementations embed YouTube, Vimeo or a DAM, so it sits just under the basic-upload band.
The published support policy guarantees at least 12 months of backward compatibility after a feature is deprecated or an API is marked obsolete, with the replacement running alongside it. Each release lists its obsolete APIs. Removals are staged: media library support ended Jul 24, 2026 and the removal was then postponed past the Sept Refresh. Migration tooling covers the KX13 exit (Migration Tool plus the KentiCopilot kx13-migration plugin). Not higher because AI tooling (Management MCP/API) is explicitly exempt and was renamed without notice in 31.9.0, and 31.8.0 shipped a content sync regression that needed a hotfix four days later.
Native email channels with Email Builder, recipient lists and newsletters, regular and automation-triggered emails, widget personalization, statistics, preview and content locking, sent through SMTP or the official SendGrid integration. There is no native email A/B testing (Kentico points to its roadmap) and no HubSpot, Marketo or SFMC connector, but native send still covers subscriber management, triggered sends and preview, so it stays above 70.
Kentico maintains a set of official integrations (Algolia, Azure AI Search, Lucene, CRM for Dynamics 365 and Salesforce, Shopify, Bynder, SendGrid, Zapier, Tag Manager) with a bug-fix policy, plus a Community Integrations Hub. The catalog is a directory of a few dozen items installed via NuGet rather than a 50+ marketplace with one-click install, so it sits in the high 40s.
The docs changelog is a single versioned feed with fixed sections per release: New features, Updates and changes, Known issues, Manual update steps, Newly obsolete API, Fixed issues, and Fixed issues – security, which links to a dated security advisory. Upcoming removals are announced ahead of time with migration guides (media libraries → Content hub assets, .NET 8/9 end of support, KX13 end of support). The whole feed is also published as Markdown. Not higher because there is no per-change machine-readable feed or codemod linkage.
Kentico's official How to Buy page (now kentico.com/platform/how-to-buy; /pricing redirects there) lays out the four-step structure — channels, Standard vs Advanced tier, AIRA credit package, SaaS cloud level — but a fetch on 2026-09-28 found no dollar figures and no pricing PDF link, and every path ends in 'Speak to an expert'. The widely quoted 'from $990/mo self-managed, $1,990/mo SaaS' figures now come only from third-party listings, so buyers can see the price structure but not verifiable vendor prices. Not lower because the structure is public and third-party starting prices are consistent across sources.
Core XbK has no built-in site search. Kentico does ship three official, fully supported search integrations (7-day bug-fix policy, all updated September 2026): Algolia, Azure AI Search and Lucene.NET. Each one indexes content tree pages and reusable items using a code-first approach. Developers can build faceted and relevance-tuned search, including blended content-product results, on Algolia or Azure AI Search, and those engines provide synonym management. That configuration happens in the search service and in code, though. There is no marketer-facing search merchandising, no CMS-managed search landing pages and no commerce-specific product discovery layer. Basic search with enrichment through official connectors puts this item in the lower-middle of the 35–55 band.
The built-in Xperience Tag Manager lets marketers add GTM, GA4, Microsoft Clarity, VWO, Intercom and custom tags with consent awareness, and official CRM integrations sync contacts with Dynamics 365 and Salesforce. There is no first-party Adobe Analytics, Segment or Amplitude connector, so it sits in the high 60s.
Native content item assets offer taxonomy, smart folders and usage tracking but no asset versioning, rights or approval tooling beyond content workflow, so enterprise DAM comes through the official Bynder integration. Integration packaging caps it, and the native library alone would land in the basic band.
Kentico has published at least one security advisory almost every month of 2026 for its own codebase, most rated high: SQL injection in Form Builder (CVSS 8.7, Jun 4), Segments condition builder SQLi (8.6) and content-sync SQLi (7.5) (Jul 9), macro input validation (8.6, Aug 13), shared-cache leakage of media resources (8.2, Sep 10), and an account-recovery flaw (8.6, Sep 24). That follows May's critical 9.4 admin-UI SQLi. Most affect every version back to 22.0.0, and the only fix is updating to the latest version, so each one means a NuGet update and a redeploy. Not lower because advisories are clear and scoped, fixes ship within a week through hotfixes, Kentico runs the SaaS infrastructure, and some flaws (e.g. the Sep 24 account-recovery issue) did not affect SaaS.
No built-in algorithmic recommendation engine is documented, and no first-party recommendation integration is listed among Kentico's integrations. Related content relies on editorial curation or taxonomy-driven queries built by developers.
Visual Form Builder with field visibility conditions, smart fields for progressive profiling, consent fields, submission storage, CSV export with an Export permission (August 2026), automation triggers on submission and CRM lead sync. No multi-step form wizard is documented out of the box, so it sits in the low 70s.
The 2026 advisory wave has continued past the May SQL injection (CVSS 9.4) and MFA bypass (8.6). Since July there have been three more SQL injections (segments builder 8.6, content sync 7.5, a macro 8.6), arbitrary file read through Email Builder MJML includes (7.1), shared-cache exposure of authenticated assets (8.2), an account-recovery admin takeover (8.6) and a workspace IDOR (7.1). Most issues span v22.0.0 to the current release. Communication is good: dedicated advisories with researcher credit and fast hotfixes. It is penalized for sustained frequency and severity in the active product line, on top of the older KX13 CVEs in CISA KEV and a disclosure program with no paid bounty.
The Content Strategist agent audits a page against a stored Content Strategy artifact for style compliance, tone, and voice alignment, returning findings graded Critical/Major/Minor/Suggestion with quoted text and suggested fixes. The SEO & GEO Specialist adds SEO and AI-readability audits. Both agents are Preview, work one page at a time, and have no accessibility scanning or site-scale duplicate or thin-content detection. That is one dimension done well, at the low end of 45–60.
Content items and pages keep version history with draft and published states, revert to a previous version, and author attribution, and content can be synced between environments with detailed selection. There is no branching or release-bundle model and no field-level visual diff for marketers, so it stays in the adequate band.
Custom workflows with any number of steps between Draft and Published, role-based step permissions, per-content-type assignment across pages, reusable items, emails and headless items, step comments and notification emails, and workflow history. Each content type can be in only one workflow and there is no parallel approval or conditional routing, so it stays in the low 70s.
Native digital commerce provides products as content items, a persistent cart entity, a price calculation pipeline (taxes, shipping, promotions), order management with statuses, catalog, order and free-shipping promotions with coupons (September 2026), and cart item promotions planned for October. It is a developer framework: cart and checkout UI, payment and delivery providers must be built, and it needs the Advanced tier, so it stays below 70.
In-platform translation UX includes a translations queue with bulk and linked-content translation, while TMS connectivity comes from vendor-built connectors (XTM, GPI's free XbyK connector) rather than Kentico-maintained Phrase or Smartling integrations. Packaging is integration because professional TMS workflows rely on partner connectors.
Channels, workspaces and roles let one organization separate brand teams while sharing a central Content hub and component library, with per-channel content type scopes. There is no cross-brand policy enforcement, brand override layer on shared components, or brand-level analytics, so it stays in the 40–60 band.
A visual automation builder with triggers, rule-based conditions and actions, extended in June and July 2026 with custom actions, custom triggers (including webhook and scheduled triggers) and custom conditions surfaced to marketers. Lead scoring is not a built-in feature and must be implemented as custom conditions, so it sits at the native threshold.
Kentico reported 2025 revenue of $56.7M, up 35% from $42M in 2024, plus record ARR growth driven by Xperience by Kentico SaaS uptake. CMS Critic and eCommerceNews both carried it, though the figures are self-reported. G2 Leader status continued into the Summer 2026 DXP grid. Part of the growth is a captive migration of KX13 customers ahead of its Dec 31, 2026 end of support, and enterprise logo announcements remain sparse.
XbK has no built-in search engine. The official Lucene.NET, Algolia and Azure AI Search integrations (fully supported, active September 2026) index channel content, so internal search with facets and AI-assisted relevance is possible on Azure AI Search or Algolia. All of it is code-first and aimed at public website search. There is no federated search across SharePoint, Confluence or Drive, and nothing tunes search for internal knowledge volumes. Intranet search quality depends entirely on custom implementation.
Kentico is privately held and backed by Expedition Growth Capital (2022). It reports $56.7M revenue in 2025 (+35%), a stated focus on profitability, and roughly 226 employees, with no layoff reports found. The CEO's year-end 2025 letter describes steady execution through a soft US market. Not higher because there is no recent growth round and all financials are self-reported.
The G2 listing shows 391 reviews at 4.4/5, with a high share of 4–5 star reviews and strong ease-of-use and support scores, and Kentico held G2 Leader status in the DXP grid in Winter, Spring and Summer 2026. Gartner Peer Insights averages about 4.5/5 and the Info-Tech NPS is +77. Scored at the low end of the 75–85 band because the G2 average sits just under 4.5 and the listing mixes KX13 and Xperience by Kentico reviews; no systemic pricing or reliability complaints were found.
The .NET CLI project templates were substantially modernized in 2026: the August 20 refresh (31.8.0) rebuilt Dancing Goat with Tailwind CSS, an esbuild pipeline, reworked Page Builder content, better SEO, and pre-configured MCP servers plus AI instruction files, and moved all templates to Central Package Management. The September 24 refresh (31.9.0) updated its visual design again. Alongside xperience-component-starter and the Admin Design Components reference project, this is a real example-content starter. Not higher because there is still no vendor-maintained Next.js/Nuxt/Astro starter for the headless channel.
Content types cover four targets (reusable content, web pages, emails, headless items) with a broad data type set, reusable field schemas for shared field groups, and since the August 2026 refresh (31.8.0) custom data types inside reusable field schemas with their own editing components. Content types can be created through the Management API and MCP server, but there is no first-class schema-as-code authoring model and no native union field type, so it stays below the 80+ band.
Fields support built-in validation rules (required, length, regex, ranges, allowed file types) and developers can register custom validation rules as code, which apply in the content form and the Management API. No declarative cross-field rule engine is documented, and validation on headless API writes depends on the management layer, so it lands in the high 60s.
Content overwrite protection (May 2026), opt-in content locking for pages, reusable and headless items (June 2026) and emails (July 2026) with lock-owner notifications and an override permission, plus workflow step comments and notification emails. There is no real-time co-editing, presence or inline commenting with mentions, so it sits in the locking-plus-async band.
One instance runs multiple website, email and headless channels, all drawing on a shared Content hub of reusable items, with per-channel languages, domains and content type scopes. Governance across channels is role and workspace based, which supports native shared-content multi-site at the low 70s.
Page Builder offers drag-and-drop sections and widgets with live in-context composition, page templates (including preset templates), restricted widget zones and section properties, plus Email Builder for emails and Management API support for Page Builder. It applies to website channels only, not headless frontends, which keeps it just below 75.
Content delivery for headless channels is a GraphQL API per channel with an auto-generated schema, API-key security and a built-in query browser; .NET consumers get the Content Item Query API and IContentRetriever (which gained IncludeContentTypeFields projection in v31.7.0). The previously credited 'preview Headless REST API' could not be found anywhere in the changelog or docs and has been removed; the only REST surfaces are headless tracking and the OpenAPI-described Management API, which is scoped to local development. Not higher because GraphQL is retrieval-only with no mutations or subscriptions and there is no REST content delivery API.
Admin SSO works with any OAuth/OIDC provider, with documented setups for Entra ID, Auth0 and Okta, but only one external provider can be active at a time and SAML is not supported natively. Admin MFA and token-bucket rate limiting protect the user-management endpoints, and the headless API uses API keys. Scored down because a second authentication-flow advisory followed the May MFA bypass: an account-recovery flaw (CVSS 8.6, v22.0.0–31.8.4, self-hosted only) that could grant unauthorized admin access.
The SaaS service plan table lists 'Uptime Service Level Availability: Designed for 99.9%'. SaaS also includes 24/7/365 availability management, root cause analysis, a public status page with opt-in notifications (status.xperience-portal.com), and per-channel uptime checkers. Down 2 because the uptime figure is a design target, not a contractual SLA with credits, and 99.9% trails the 99.95%+ tier.
The full platform runs locally from dotnet new templates with production parity, hot reload and .NET CLI code generation. Since July: the Management MCP server went GA for local agentic development and can start before the host app; the Dancing Goat template ships with preconfigured MCP servers and instruction files; and a --kxp-db-status command reports database readiness. Not 70+ because a local SQL Server is required and there is no lightweight emulator.
The official changelog shows a named Refresh every month of 2026 so far (Jan 22, Feb 23, Mar 23, Apr 16, May 14, Jun 29, Jul 28 31.7.0, Aug 20 31.8.0, Sep 24 31.9.0). Weekly hotfixes, SaaS updates and AIRA model updates land in between (31.8.1 to 31.8.4 in Aug and Sep, 31.9.1 and 31.9.2 on Oct 1 and Oct 8). Each Refresh ships real features: the Sept one added Management MCP tool groups, free-shipping promotions, CSV export on every listing page and a DB status CLI. Not higher because individual Refreshes are incremental rather than platform-shifting.
Catalog discounts and order discounts are production-ready (December 2025), and generic coupon codes are native (January 2026) — covering core promotional mechanics. The February 2026 refresh added promotion targeting flexibility, letting marketers scope a promotion to all customers or only those authenticated through member accounts — a step toward audience-specific promotional targeting. Free shipping promotions (September 2026) join catalog and order discounts: they remove shipping cost above a cart threshold, can be limited to specific shipping methods, and store managers configure them like any other promotion. Content scheduling via workflow and scheduled publishing allows time-activated promotional banners, and Page Builder widgets can display promotional content. However, dedicated countdown timer widgets, tiered pricing tables with display logic, and channel-specific promotional content targeting are still not documented as native features.
Several AI assists sit inside editorial and marketing work: auto-tagging and description of images on mass upload, bulk AIRA translation through the Translation queue, the AIRA Segment Condition Builder (off by default and requiring the CDP), and the Campaign Manager's asset-readiness checks. These count as multiple lightweight assists, but there is no AI-driven duplicate detection, content routing, smart scheduling, or stale-content lifecycle automation. The June 2026 extensible automation actions are developer extensions, not AI.
KentiCopilot has become a real agent-oriented developer toolkit: a GA Management MCP with an OpenAPI spec that agents are expected to discover, Documentation and Content Modeling MCP servers, a docs corpus published as llms-full.txt, and plugins and skills for automation actions, triggers, and conditions. Recent additions (July–September 2026) include a KX13 migration plugin, a --kxp-db-status CLI command built for agents and pipelines, and a Dancing Goat template with MCP servers and instruction files pre-configured. Held below 70 because this tooling targets development-time coding agents, and there are no agent-optimized content delivery or RAG endpoints and no LangChain or LlamaIndex guides.
Combined content and page reference fields allow many-to-many links to items of multiple types (polymorphic by allowed type list or reusable field schema), queryable through the ContentItemQueryBuilder with linked-item depth and through GraphQL for headless items. The May 2026 content reuse locator shows where an item is referenced, giving reverse visibility in the UI, but reverse traversal is not a first-class query concept like graph-native headless CMSs.
The rich text editor (Froala v5) supports configurable toolbars, custom plugins, links to content items and assets, and AIRA text refinement in place. Output is an HTML blob rather than a portable AST, so it stays in the standard WYSIWYG band.
Assets are stored as content item assets in the Content hub with smart drag and drop upload, focal point, WEBP/AVIF format conversion, quality settings and image variants for responsive delivery, plus usage tracking through the content reuse locator. Legacy media libraries are being retired and assets do not keep file version history, so it sits in the mid 60s.
Headless channels expose a GraphQL delivery API per channel secured by API keys, a headless REST API arrived in preview in April 2026, and a separate Management API covers content, pages and Page Builder. Coupled website channels use the in-process .NET content query API, and the REST delivery API is still maturing, so it sits at the low end of the REST + GraphQL band.
Every SaaS project runs behind a managed Cloudflare CDN with TLS, DDoS protection and security event monitoring in Xperience Portal, and cache dependencies drive output cache invalidation. Customers cannot bring their own CDN and there is no edge-side personalization or documented sub-second purge API, so it stays in the low 70s.
One Content hub feeds website, email and headless channels, with GraphQL and preview REST APIs for external frontends and official Next.js guidance from the community. Official SDKs are .NET-centric, rich text is HTML, and headless delivery needs the Advanced tier, so it sits as a traditional DXP with a capable API layer.
Native contact management with activity tracking, dynamic contact groups built in a rule builder, unified Profiles merging contacts, members and customers (March 2026) and identity resolution with extensible APIs (April 2026), all usable directly in personalization and automation rules. Segments are evaluated in-platform rather than streamed from a named enterprise CDP, which keeps it in the mid 70s.
Extensibility is deep and .NET-based: custom modules and object types, global event handlers, Page/Form/Email Builder components, custom data types and React admin UI pages. The Refreshes since July added custom Marketing Automation triggers and conditions (v31.7.0), custom data types in reusable field schemas (v31.8.0), and an opt-in CSV Export action for any admin listing page (v31.9.0). The main constraint is that every extension requires C#/.NET and React skills; there is no low-code path.
Continuous Integration serializes database objects to XML for source control, and Continuous Deployment restores them to target environments. SaaS offers QA, optional STG and (on Custom plans) UAT environments, a deployment API with personal access tokens, zero-downtime slot-swap deployments and content sync between instances. The new --kxp-db-status command lets pipelines branch on database state, and the KentiCopilot project-lifecycle plugin generates CI/CD repository configuration. Not higher because there are no branch-per-PR content environments or standalone schema migration CLI, and content sync broke in 31.8.0 until hotfix 31.8.1.
docs.kentico.com is comprehensive and current: detailed changelogs per Refresh and hotfix, dedicated security advisories, API reference, guides, and the Learn portal. Every page is also available as Markdown, with llms.txt indexes and whole-area llms-full.txt dumps for AI tooling. Not higher because code samples are C# only and there is no interactive playground beyond the per-channel GraphQL browser.
Kentico maintains a structured Developer Learning Map, Developer Kickstart guide, training-guides repo and a Certified Developer path, and has layered AI-assisted onboarding on top: the KentiCopilot marketplace was reorganized in July 2026 into workflow plugins (kentico-web-development walks agents from wireframe through bootstrapping, content modeling and implementation), and the Management MCP server came out of preview on Sept 3, 2026 (31.8.3) with a recommendation to use it on all projects. Not higher because there is still no in-app interactive developer tour and no framework-specific (Next.js) guided learning path.
Monthly Refreshes shipped every month of 2026 (31.7.0 Jul 28, 31.8.0 Aug 20, 31.9.0 Sep 24) as NuGet package updates plus a database update, and 31.9.0 added a `--kxp-db-status` command so pipelines can detect a required database update without starting the app. But updates are not frictionless: 31.5.0 bumped Microsoft.Data.SqlClient across majors 6 and 7 with possible breaking changes, and upgrading to 31.7.0–31.7.3 could fail with a command timeout on databases with many orphaned sync tasks (the fix is to skip to 31.7.4). Not higher because every update, even on SaaS, needs a developer to update NuGet, update the database and redeploy.
Native Form Builder supports lead capture with validation rules, conditional logic, and field visibility conditions (January 2026). Lead scoring, email marketing, and marketing automation with value-based activity signals (January 2026) are all native. 'Used in' tracking shows which pages each form appears on across channels. Form Builder improvements shipped October 2025. Form submissions can be exported to CSV (August 2026), and the official CRM package pushes form submissions to Salesforce or Dynamics as leads. Not a marketing automation powerhouse, but well above headless CMS baseline with genuine out-of-the-box lead capture, scoring, and nurture.
Page Builder with template-based page creation, version history for pages, content sync from staging to production (May 2025), and shareable preview URLs (December 2025) support a reasonable content velocity workflow. AIRA inline text generation and transformation was expanded to text fields across all content type targets including headless items (May 2026), extending assisted authoring beyond the rich text editor. Content overwrite protection (May 2026) and globally configurable content locking (June 2026) prevent lost edits and rework from concurrent editing, and a content reuse locator surfaces cross-channel usage during editorial decisions. Drag-and-drop asset uploading during content creation (November 2025) reduces friction. 'Save and create another' (August 2026) creates the next page or content item with the previous page's content type, template and tree position already filled in, which speeds up batch authoring. Content locking was extended to emails (July 2026). True bulk editing is still not featured, and new page types still require developer setup of widgets.
Xperience by Kentico is modestly improving, led by Build Simplicity (+1.1), Compliance & Trust (+0.9) and Platform Velocity (+0.6), as Kentico keeps shipping its AI and developer tooling, most visibly the Management MCP server, which left preview on 2026-09-03 with schema-aware content operations. Collaboration is the clearest practical gain: content locking now covers web pages, reusable and headless items and emails, and conflict handling spans the whole product, though there is still no real-time co-editing with presence indicators. Evaluators should note that experimentation rose sharply but still has no native content-level or server-side A/B testing, and the small dip in Operational Ease (-0.4) means the day-to-day running story is not improving alongside the feature work.
Score Changes
Xperience by Kentico has no native content-level or server-side A/B testing — all first-party A/B testing documentation still references legacy KX12/KX13 only, and the XbK changelog contains no native experimentation feature. However, Kentico now maintains an official Tag Manager package (github.com/Kentico/xperience-by-kentico-tag-manager) that lets marketers enable a VWO integration directly from the administration UI, injecting VWO SmartCode into a website channel for front-end A/B testing and experimentation (added December 2025). This is client-side experimentation via a tight third-party integration: experiment design, targeting, and statistical significance/winner selection all live in VWO's own platform, and the integration can manipulate only front-end data (no backend experimentation). Email Builder subject/content variants remain per-segment personalization, not statistically validated experiments. This fits the 'experimentation via tight integration' tier at the lower end — a real optimization path exists, but nothing native or content-model-aware.
There is no real-time co-editing with presence indicators. Conflict handling now covers the whole product: content overwrite protection (May 2026), opt-in global content locking for pages, reusable items and headless items (June 29, 2026), and, from the July 28, 2026 refresh (31.7.0), locking for emails as well, including Email Builder, properties and plain-text tabs. It has override permissions, automatic lock release and workflow comment notifications. This is solid lock-based collaboration, but it is not Google-Docs-style co-authoring.
The official Management MCP server (@kentico/management-api-mcp) left preview on 2026-09-03. It exposes schema-aware CRUD over content types, content items, pages, Page Builder components, channels, languages, and, since September, custom modules and classes, with tool groups (--enabled-groups). Kentico's docs, however, restrict it to local development instances with only basic authentication and no per-operation authorization, and say not to enable it in production. That means it lacks the permissions and production publish path the 75+ tier requires. A Documentation MCP server and a Content Modeling MCP server complete the roster, which keeps it at the top of the official-GA-with-limits band.
The AIRA application's Overview tab shows the credit balance and the next renewal. The Usage tab breaks down consumed credits and request counts by source for the last 30 days or since renewal, and admins can export 90 days of usage as CSV. That is basic usage and cost visibility. It scores below 65 because there are no per-user metrics, prompt-effectiveness analytics, or quality trend monitoring.
Content locking now covers web pages, reusable content items and headless items (June 2026) plus emails, including their properties and plain-text tab (July 28, 2026 refresh). It has a role-based override and releases on publish, workflow change or revert, and basic overwrite protection applies even when locking is off. Workflow step comments add some asynchronous discussion. Still 40 because there is no simultaneous co-editing, presence indicators or inline commenting.
Workspaces segregate Content Hub content into distinct role-scoped areas, with granular per-workspace permissions (View, Create/Update, Delete) assigned per role and per application — e.g., full Content hub permissions in Workspace A but View-only in Workspace B — so editors only see and act on the content in their workspace. Page permission management adds hierarchical page-level access control. This moves beyond simple content-type RBAC toward content-instance/area-based visibility control. SSO with OAuth/OIDC providers (Microsoft Entra ID, Auth0, Okta) is native, and Membership Roles (March 2026) add tiered visitor-facing content access with channel-tree inheritance. Fine-grained department/team partitioning for classic intranet use is still primarily an editorial-governance construct rather than audience-org-unit content targeting, so it lands solidly above content-type RBAC but short of full audience-based visibility.
With 'Log object actions' enabled, the Event log records create, edit and delete actions on objects, and an AfterExportListingEvent hook supports auditing of data exports. Retention is set by entry count through the Event log size setting and CMSLogKeepPercent, not by time. Logging goes through Microsoft.Extensions.Logging providers, and SaaS adds an Application Insights integration viewable in Xperience Portal, so logs can reach Azure Monitor and SIEM tools. There is no dedicated audit-log product, native SIEM connector or compliance reporting.
The native Automation Builder supports behavioral triggers, drip sequences with waits, rule-based branching, and scheduled time-based triggers. Custom automation actions shipped in June 2026, followed by custom triggers and custom conditions in the July 28, 2026 refresh, so processes can start from any project event (purchases, inbound webhooks) and branch on code-evaluated logic, and KentiCopilot skills generate these steps. Held at 66 because there is no native lead scoring (Kentico's own examples compute a contact score in a custom step) and multi-channel orchestration beyond web and email is thin.
Kentico has published at least one security advisory almost every month of 2026 for its own codebase, most rated high: SQL injection in Form Builder (CVSS 8.7, Jun 4), Segments condition builder SQLi (8.6) and content-sync SQLi (7.5) (Jul 9), macro input validation (8.6, Aug 13), shared-cache leakage of media resources (8.2, Sep 10), and an account-recovery flaw (8.6, Sep 24). That follows May's critical 9.4 admin-UI SQLi. Most affect every version back to 22.0.0, and the only fix is updating to the latest version, so each one means a NuGet update and a redeploy. Not lower because advisories are clear and scoped, fixes ship within a week through hotfixes, Kentico runs the SaaS infrastructure, and some flaws (e.g. the Sep 24 account-recovery issue) did not affect SaaS.
The official Tag Manager package (github.com/Kentico/xperience-by-kentico-tag-manager) lets marketers enable Google Analytics 4, Google Tag Manager, and Microsoft Clarity (session recording, heatmaps, scrollmaps) directly from the administration UI per website channel — first-class configuration of standard analytics tags without developer template edits, though the metrics themselves still live in the external tools. In-platform, customer journey analytics (March 2025) visualizes contact progression and drop-off through journey stages with date-range filtering, AIRA Campaign Insights evaluates KPI performance across campaigns (March 2026), and the Campaign Manager Agent (April 2026) generates final reports comparing success across multiple campaigns. Form submission tracking with channel and language metadata (October 2025) surfaces form performance. Still no native web analytics module comparable to KX13's visitor tracking — page views, sessions, and source attribution remain in GA4/GTM.
The SaaS offering supports 20 Azure regions across the US, Canada, the EU, UK, Switzerland, East Asia, Japan, Australia and the UAE. Kentico states that all customer data is stored in a single-tenant account in the region the customer picks at provisioning. Two things leave the chosen region: Xperience Portal account data (usernames, project names, Auth0, logs) always sits in Kentico's European data center, and Cloudflare CDN caching is global. No contractual residency guarantee could be verified.
KentiCopilot has become a real agent-oriented developer toolkit: a GA Management MCP with an OpenAPI spec that agents are expected to discover, Documentation and Content Modeling MCP servers, a docs corpus published as llms-full.txt, and plugins and skills for automation actions, triggers, and conditions. Recent additions (July–September 2026) include a KX13 migration plugin, a --kxp-db-status CLI command built for agents and pipelines, and a Dancing Goat template with MCP servers and instruction files pre-configured. Held below 70 because this tooling targets development-time coding agents, and there are no agent-optimized content delivery or RAG endpoints and no LangChain or LlamaIndex guides.
Kentico maintains a structured Developer Learning Map, Developer Kickstart guide, training-guides repo and a Certified Developer path, and has layered AI-assisted onboarding on top: the KentiCopilot marketplace was reorganized in July 2026 into workflow plugins (kentico-web-development walks agents from wireframe through bootstrapping, content modeling and implementation), and the Management MCP server came out of preview on Sept 3, 2026 (31.8.3) with a recommendation to use it on all projects. Not higher because there is still no in-app interactive developer tour and no framework-specific (Next.js) guided learning path.
Kentico maintains an official, fully supported CRM integration (github.com/Kentico/xperience-by-kentico-crm, 7-day bug-fix policy, active September 2026) with plug-and-play packages for Salesforce Sales Cloud and Microsoft Dynamics Sales. It sends form submissions to the CRM as leads and shows sync status in the admin UI. Earlier scoring runs missed this connector, so the old claim that XbK had no Salesforce connector was wrong. The official Tag Manager package covers analytics and engagement tags (GA4, GTM, Clarity, VWO, Intercom). Bynder (DAM), Phrase/XTM (localization), Campaign Monitor (email sending) and Zapier round out the pre-built connectors. Marketing automation became much more extensible in 2026: custom actions (June 2026), then custom triggers and custom conditions (July 2026). All three show up in the marketer's Automation Builder, and triggers can start processes from external-system inputs or purchases. There is still no MAP connector (Marketo, HubSpot, Pardot), no CDP or ad-platform connector, and no native outbound webhooks. The CRM connector syncs leads one way and does not sync contacts both ways. Pre-built connectors now cover CRM, analytics/tags, DAM and email, with code-level event triggers, which puts this item in the middle of the 35–55 band.
Centralized user management, advanced permissions with page-tree-level ACLs, and workflow approvals are available across all channels within a single XbK instance. Workspaces add content-area governance: content can be segregated into workspaces with per-workspace role permission scoping (View/Create/Update/Delete per application), giving central teams a first-class way to enforce who can act on which content across brands while preserving per-channel autonomy. Content publishing workflows with notifications and a content reuse locator further strengthen editorial governance. Cross-brand content-standard enforcement (schema policies per brand) and cross-brand approval routing remain limited; governance is primarily at the user/permission/workspace level rather than enforced per-brand content schemas.
The security page claims GDPR, CCPA and Australia Privacy Act alignment. It also claims DORA alignment and Digital Services Act readiness, and a dedicated Australian Privacy Act page maps Kentico's practices to the Australian Privacy Principles. These are self-attested alignments, not audited frameworks. There is no FedRAMP, IRAP, C5, PCI-DSS or HITRUST, and no LGPD or PIPEDA commitment specific to Kentico. That puts it modestly above the GDPR + CCPA baseline.
Admin SSO works with any OAuth/OIDC provider, with documented setups for Entra ID, Auth0 and Okta, but only one external provider can be active at a time and SAML is not supported natively. Admin MFA and token-bucket rate limiting protect the user-management endpoints, and the headless API uses API keys. Scored down because a second authentication-flow advisory followed the May MFA bypass: an account-recovery flaw (CVSS 8.6, v22.0.0–31.8.4, self-hosted only) that could grant unauthorized admin access.
The official changelog shows a named Refresh every month of 2026 so far (Jan 22, Feb 23, Mar 23, Apr 16, May 14, Jun 29, Jul 28 31.7.0, Aug 20 31.8.0, Sep 24 31.9.0). Weekly hotfixes, SaaS updates and AIRA model updates land in between (31.8.1–31.8.4 in Aug–Sep). Each Refresh ships real features: the Sept one added Management MCP tool groups, free-shipping promotions, CSV export on every listing page and a DB status CLI. Not higher because individual Refreshes are incremental rather than platform-shifting.
The published support policy guarantees at least 12 months of backward compatibility after a feature is deprecated or an API is marked obsolete, with the replacement running alongside it. Each release lists its obsolete APIs. Removals are staged: media library support ended Jul 24, 2026 and the removal was then postponed past the Sept Refresh. Migration tooling covers the KX13 exit (Migration Tool plus the KentiCopilot kx13-migration plugin). Not higher because AI tooling (Management MCP/API) is explicitly exempt and was renamed without notice in 31.9.0, and 31.8.0 shipped a content sync regression that needed a hotfix four days later.
The community portal publishes content on a sustained near-monthly cadence (through the June 29, 2026 Refresh), runs an MVP/Community Leaders recognition program that grew its cohort into 2026, and held Community Program Summits in 2026. Kentico team members actively contribute to the community blog and run UX feedback and early-access sessions with program members. Engagement appears genuine for a mid-market B2B product; forum response times not independently verified.
The .NET CLI project templates were substantially modernized in 2026: the August 20 refresh (31.8.0) rebuilt Dancing Goat with Tailwind CSS, an esbuild pipeline, reworked Page Builder content, better SEO, and pre-configured MCP servers plus AI instruction files, and moved all templates to Central Package Management. The September 24 refresh (31.9.0) updated its visual design again. Alongside xperience-component-starter and the Admin Design Components reference project, this is a real example-content starter. Not higher because there is still no vendor-maintained Next.js/Nuxt/Astro starter for the headless channel.
Setup requires the .NET SDK, .NET CLI template registration, SQL Server provisioning, and admin/presentation wiring, which is moderate for experienced .NET developers. 2026 tooling trims friction: templates use Central Package Management, the KentiCopilot project-lifecycle plugin generates CD repository.config, and 31.9.0 added a --kxp-db-status command so scripts and agents can check database readiness without starting the app. That same release made SystemEmailOptions.ServiceDomain or AllowedHosts mandatory on self-hosted projects for user-invite and password-reset emails, adding one more non-obvious config value, so the score holds.
A Certified Developer exam still exists and is strongly expected for agency partners, covering Page Builder internals, custom modules, content modeling, GDPR, and CI/CD — not just general .NET skills, and the platform remains inaccessible to JS/Python-only developers. Kentico's 2026 AI-dev push (KentiCopilot skills, MCP servers, Claude Code/Cursor/Copilot support) explicitly aims to 'lower the seniority bar,' modestly reducing the platform-specific expertise needed before first delivery. Not higher because the proprietary Page Builder/module model and certification expectation persist.
A dedicated Campaigns feature (March 2026) combines campaign briefs, associated digital assets, and linked customer journeys with AIRA Campaign Insights for AI-driven KPI evaluation. The May 2026 refresh added a guided campaign-brief authoring flow: the Campaign Manager Agent asks marketers a structured series of questions (brand, goals, audiences, KPIs, channels, messaging) and restructures the answers into a formatted brief. The production-ready Campaign Manager Agent (April 2026) evaluates campaign performance against KPIs, audience groups, and journey metrics and generates final reports comparing success across multiple campaigns — a significant step toward portfolio-level campaign orchestration. Email Builder (production March 2025) provides visual drag-and-drop email authoring. Marketing automation with conditional branching is native. Multi-channel coordination and a dedicated content calendar UI are still absent.
Page Builder with template-based page creation, version history for pages, content sync from staging to production (May 2025), and shareable preview URLs (December 2025) support a reasonable content velocity workflow. AIRA inline text generation and transformation was expanded to text fields across all content type targets including headless items (May 2026), extending assisted authoring beyond the rich text editor. Content overwrite protection (May 2026) and globally configurable content locking (June 2026) prevent lost edits and rework from concurrent editing, and a content reuse locator surfaces cross-channel usage during editorial decisions. Drag-and-drop asset uploading during content creation (November 2025) reduces friction. 'Save and create another' (August 2026) creates the next page or content item with the previous page's content type, template and tree position already filled in, which speeds up batch authoring. Content locking was extended to emails (July 2026). True bulk editing is still not featured, and new page types still require developer setup of widgets.
Catalog discounts and order discounts are production-ready (December 2025), and generic coupon codes are native (January 2026) — covering core promotional mechanics. The February 2026 refresh added promotion targeting flexibility, letting marketers scope a promotion to all customers or only those authenticated through member accounts — a step toward audience-specific promotional targeting. Free shipping promotions (September 2026) join catalog and order discounts: they remove shipping cost above a cart threshold, can be limited to specific shipping methods, and store managers configure them like any other promotion. Content scheduling via workflow and scheduled publishing allows time-activated promotional banners, and Page Builder widgets can display promotional content. However, dedicated countdown timer widgets, tiered pricing tables with display logic, and channel-specific promotional content targeting are still not documented as native features.
A single XbK instance provides a central admin who can manage users across all brand channels. Workspaces let central teams give brand/project groups autonomous content areas with role permissions scoped per workspace (View/Create/Update/Delete per application), so brand teams operate independently while central admin retains oversight. Per-channel role scoping allows brand teams autonomous editorial permissions within their channel. SSO via OAuth/OIDC (Microsoft Entra ID, Auth0, Okta) works across all channels from a single identity provider, and users can hold roles across multiple channels. Comfortably meets the central-admin-with-autonomous-brand-teams-and-SSO bar.
EU residency is real (West/North Europe, Germany West Central, Switzerland North, UK regions) and Kentico's privacy policy relies on the EU-U.S. Data Privacy Framework and SCCs for transfers. Consent management is built in. However, the Data protection application is only a framework: the docs say that by default Xperience provides no personal data collection or erasure functionality, so developers must implement collectors and erasers. No public DPA or sub-processor list could be fetched; the trust center sits behind a Cloudflare challenge. That keeps the score in the 60–78 band.
Xperience Portal offers self-service manual and automatic exports: the database as a bacpac file plus blob storage, in separate Restore points and Exports apps since 30.1.0. That gives customers complete data portability. However, personal-data erasure is not built in, because developers must write custom erasers. No post-termination retention or deletion period is published.
There is still no WCAG 2.1 AA conformance statement or stated conformance target for the administration UI. The changelog does show ongoing accessibility work. The September 24, 2026 Refresh made AIRA guidance fully keyboard accessible and added focus rings to dashboard tiles and the image focal-point control. An earlier refresh gave date/time inputs keyboard navigation and ARIA. That is concrete progress, but it is incremental and not measured against a standard.
Content delivery for headless channels is a GraphQL API per channel with an auto-generated schema, API-key security and a built-in query browser; .NET consumers get the Content Item Query API and IContentRetriever (which gained IncludeContentTypeFields projection in v31.7.0). The previously credited 'preview Headless REST API' could not be found anywhere in the changelog or docs and has been removed; the only REST surfaces are headless tracking and the OpenAPI-described Management API, which is scoped to local development. Not higher because GraphQL is retrieval-only with no mutations or subscriptions and there is no REST content delivery API.
XbyK uses a structured content type system with code-generated C# models, making schema changes type-safe and refactorable, with CI/CD serialization for schema-as-code. The Management MCP server (GA Sept 2026) manages content types, reusable field schemas, and as of 31.9.0 custom module classes and UI forms. 31.8.0 also let custom data types be used in reusable field schemas. There are no documented severe field-count limits, but the reusable-content vs. page vs. headless-item split needs upfront planning, and media library removal forces an asset-model migration on older projects.
Page Builder lets marketers self-serve page layout, widget placement, and content edits post go-live, with read-only inspection reducing editor friction, and AIRA now assists marketers directly: the April 2026 refresh added SEO & GEO Specialist and Campaign Manager agents plus segment-condition building, and the May 14, 2026 refresh (31.5.0) extended AIRA text-field assistance across all content type targets including headless items. Not higher because new widget types, page templates, and new content types still require developers.
Built-in workflows, content locking (June 2026), form usage tracking ('Used in' tab) and the AIRA agents (Content Strategist, SEO & GEO Specialist) reduce day-to-day editorial overhead, and 31.9.0 adds CSV export on listing pages, which helps with manual audits. There is still no native broken-reference detection, orphaned-content alerting, stale-content identification or content health dashboard, so hygiene remains manual or depends on paid third-party tools such as Siteimprove. Not lower because locking and the AIRA agents lighten the load; not higher because content hygiene is not automated.
Xperience by Kentico is essentially stable this cycle with a slight upward tilt, as Capability edged up 0.6 points while Platform Velocity, Cost Efficiency, Build Simplicity, Operational Ease, and Compliance & Trust all held flat. The Capability gain comes from meaningful improvements in native A/B and multivariate testing (now covering both pages and marketing emails) and in product content management, where Content Hub-based modeling allows fully customizable product schemas. Practitioners should weigh those gains against a notable security track record decline tied to a May 2026 critical SQL injection advisory (CVSS 9.4) in the admin interface, along with the impending July 2026 removal of legacy Media libraries as Content Hub becomes the platform's unified DAM.
Score Changes
Xperience by Kentico offers native A/B testing for both pages and marketing emails with variant creation, conversion goal configuration, and built-in analytics for evaluating results. The December 2025 refresh added an official VWO integration as an additional optimization path. Held at 55 because multivariate testing depth and statistical significance reporting are less mature than dedicated experimentation platforms.
Products are modeled as content items in the Content Hub rather than fixed SKU objects, giving fully customizable schema, versioning, localization, and workflow, plus taxonomy-based organization by category/brand/custom attributes and SEO-friendly descriptions reusable across channels. This is a stronger pattern than generic content types repurposed for products. Held at 65 because product-specific UI patterns (variant pickers, attribute matrices) still require developer setup.
May 21, 2026 security advisory disclosed a critical SQL injection vulnerability (CVSS 9.4) in Xperience by Kentico admin UI affecting versions 22.0.0–31.5.0 and an MFA bypass (CVSS 8.6), both directly in the active product line — not just legacy KX13. Older 2025 CVEs continue to appear on CISA KEV (CVE-2025-2746/2747/2749). Vulnerability Disclosure Program exists but is reward-free. The frequency and severity of high-impact CVEs across both Xperience 13 and Xperience by Kentico significantly worsens the track record.
SSO via external authentication providers including OIDC through ASP.NET Core Identity integration; MFA available for admin users; API-key authentication for headless GraphQL/REST endpoints. The May 2026 MFA-bypass advisory (CVSS 8.6, brute-forceable MFA codes without account lockout) has since been patched, partially restoring the prior deduction. Not higher because SAML still requires custom configuration beyond built-in OIDC, and the MFA weakness was recent.
Legacy Media libraries will be removed July 24, 2026, with the Content Hub serving as the unified DAM going forward: metadata schemas via content types, custom tagging/taxonomy, folder structures, asset reuse tracking, smart cropping with focal points, and AIRA-assisted auto-tagging. The Bynder integration extends to full enterprise DAM. Held at 62 because Content Hub assets do not support file versioning (only the latest file is retained) and rights/expiry management of purpose-built DAMs is still missing.
Xperience by Kentico SaaS is publicly documented as designed for 99.9% uptime, with Kentico responsible for SaaS environment, Xperience Portal, and deployment API availability 24/7/365. Public status page at status.xperience-portal.com with uptime history. The April 2026 Refresh added extensible SaaS uptime monitoring supporting up to 6 checker configurations across regions. Not higher because 99.9% is mid-tier vs. 99.95%+ from headless leaders, and historical uptime data not granularly published.
Configurable multi-stage workflows are supported across all content types with role-based transitions and comment-enabled step notifications. The April 2026 refresh added a Role management app with permission evaluation API for the admin UI. The May 14, 2026 refresh added Workspaces and page permission management for hierarchical access control, a Content reuse locator surfacing cross-channel usage during editorial decisions, granular content synchronization between environments, and content publishing workflows with notifications — together a substantial editorial-governance upgrade.
Native digital commerce became production-ready in July 2025 with product catalog, orders, customers, and granular promotions; 2026 additions include catalog discounts, stock tracking, and a faceted product-listing filter (AND/OR taxonomy logic with URL state). Products are modeled as content items in the Content Hub for full versioning/localization/workflow. Held at 58 because it remains a framework — storefront UI, tax calculation, and payment processing still require custom implementation, unlike turnkey commerce platforms.
SaaS deployment includes built-in CDN delivery for assets with per-field image format conversion and max width/height configuration. The April 2025 refresh added a copy-CDN-URL button, and AIRA delivers 1-click image optimization with smart cropping and focal point preservation. Held at 65 because WebP/AVIF support and responsive image presets are not explicitly documented as first-class delivery features.
Xperience by Kentico supports scheduled publishing, workflow-based publishing states, and (May 2026 refresh) Content Sync Detailed Selection providing granular control over content item promotion across environments with dependency selection. Held at 58 because a calendar-style content calendar UI is not prominently documented as a first-class XbyK feature, and atomic multi-item release bundles remain implicit via Content Sync rather than first-class bundles.
Dedicated STG (Staging) environment for SaaS plans was added May 2025, with Content Sync between environments. The May 2026 refresh added Content Sync Detailed Selection for granular content promotion with dependency selection. Page Builder provides in-context live preview for .NET-rendered sites; branch-based preview environments can be configured via CI/CD. Held at 65 because universal preview for arbitrary headless frontends and shareable external draft preview links are not first-class UI features.
Page Builder widgets support native content personalization rules tied to contact groups with in-editor preview per segment, and the June 2025 refresh added Email Builder widget-level personalization for email campaigns. G2 Winter 2026 reports 90% personalization satisfaction. Held below 75 because variant-level visual preview for arbitrary headless frontends remains less seamless than top-tier DXPs.
Xperience by Kentico supports per-language content variants in the Content Hub with locale fallback chains, field-level locale variants via the content item model, and (April 2026 refresh) basic admin UI localization for date and time formats. Marketers can create language variants of content items and web pages directly in the CMS. Held at 70 because advanced locale-specific publishing rules and locale routing still require developer configuration.
Comprehensive .NET extensibility: custom modules with DI, global event handlers for content lifecycle hooks, custom Page Builder widgets and sections, custom form components, and custom admin UI pages built with React. The June 2026 Refresh released configurable custom Marketing Automation actions (registered actions appear in the marketer's automation step dialog) and the KentiCopilot Management MCP Server with Management API extensions enables agentic content-creation workflows. Limited only by the requirement for .NET/C# skills — no low-code extension approach exists.
Rich text editing is powered by Froala WYSIWYG editor (v5.0.0), with inline rich text editors available within Page Builder widgets. AIRA refinements went GA in April 2026, and the May 14, 2026 refresh expanded AIRA generation/refinement to text fields across pages, emails, headless items, and reusable content items — using linked items and page previews as context. Output remains HTML-based rather than a portable AST, limiting channel portability.
Asset management is consolidating into the Content Hub — legacy Media Libraries and their APIs are scheduled for full removal by July 24, 2026, with non-destructive migration into content item assets (files copied into a dedicated Content Hub workspace; GUIDs, folders, and custom fields preserved). AIRA offers AI-driven focal point suggestion and improved responsive image support, and first-party Bynder DAM integration remains available. Legacy ~/getmedia/ links to migrated assets lose URL-based resizing and no documented on-the-fly transformation pipeline (WebP/AVIF, arbitrary resize) exists — the unified Content Hub with AI focal points modestly improves the native asset story amid short-term migration burden.
The .NET global event system supports custom code handlers for object create/update/delete and lifecycle events on content items, web pages, and headless items. Zapier integration Phase 2 added inbound actions in 2026, providing webhook-like data exchange with 6,000+ external tools by triggering create/update/delete based on Xperience events. Native webhook documentation still lacks public detail on HMAC signing, filtering, retry logic, and delivery logs — Zapier brokers much of the integration surface rather than the platform exposing a first-class webhook framework.
Xperience by Kentico is a hybrid DXP — Page Builder for traditional website channels plus headless channels with GraphQL and (as of April 2026) a preview Headless REST API for external apps. Primary SDK is .NET/ASP.NET Core with an official Next.js integration. The May 2026 Management API additions for Page Builder components plus granular content synchronization improve programmatic multi-channel publishing flows. Rich text output is HTML (not AST), limiting format-agnostic portability versus purpose-built headless platforms.
Xperience by Kentico ships a native CDP with rule-based Contact Groups, behavioral activity-based conditions, and unified Profiles that merge customers, contacts, and members. The April 16, 2026 refresh added admin-configurable identity resolution with flexible matching on external identifiers or native fields plus new segmentation tools and extensible APIs. Not higher because B2B firmographic enrichment and pre-built Segment/mParticle/Tealium connectors remain absent.
Community Integrations Hub hosts integrations from Kentico, partners, and the community as NuGet packages. Official integrations include Algolia search, Azure AI Search, Zapier, Google Tag Manager, GA4, Application Insights, and Cloudflare CDN. Digital Commerce integrations in preview. The May/June 2026 Refreshes expanded KentiCopilot with a Management MCP Server (content creation via Management API extensions) and Page Builder support. Total catalog remains modest compared to larger platforms, with gaps in DAM, translation, and general AI service connectors.
Xperience by Kentico is on a clear improving trajectory, with gains across nearly every composite dimension and no regressions. The April 2026 AIRA refresh is the dominant driver — the AIRA Usage Overview dashboard doubled AI observability scoring, while the new Segment Condition Builder, Campaign Manager Agent, and SEO & GEO Specialist Agent collectively lifted Capability, Build Simplicity, and Operational Ease. Practitioners should note that the AI tooling story has shifted from aspirational to operationally instrumented, and the auto-generated GraphQL endpoints per headless channel meaningfully strengthen the API delivery posture for composable builds.
Score Changes
The April 16, 2026 refresh introduced the AIRA Usage Overview — a dedicated tracking dashboard that displays credit consumption and request counts by feature over the last 30 days, directly addressing the prior observability gap. This moves Kentico into the 'basic usage tracking and cost visibility' band (45–65). Scores below 65 because per-user metrics, prompt effectiveness analytics, and quality trend monitoring are not yet documented.
The April 16, 2026 refresh introduced the AIRA Segment Condition Builder, which uses AI to translate references to pages and forms into segment condition rules, plus Identity Resolution that unifies customers, contacts, and members into singular profiles using configurable identifiers. These elevate the platform from rule-only to AI-assisted personalization where rules are AI-generated but execution remains traditional (per the 40–60 band). A genuine ML scoring/predictive segment engine comparable to Bloomreach Loomi or Sitecore CDP is still absent.
The SEO & GEO Specialist Agent (April 2026, production-ready) reviews pages for both classic SEO attributes and AI readability/comprehension, provides keyword-based scoring and prioritized recommendations — closing the previously noted gap of no in-box SEO audit/scoring tool. Multiple vanity URLs per page with canonical URL selection (June 2025), URL management application for centralized redirect management (May 2025), and forward-slash support in custom URLs (July 2025) give solid SEO URL hygiene. Standard meta title/description fields are on all content types. The community XperienceCommunity.SEO package adds automatic sitemap generation, dynamic robots.txt, and llms.txt. GEO scoring for AI crawler readability is a forward-looking differentiator.
The April 16, 2026 refresh added the Campaign Manager Agent to the AIRA Agentic Marketing Suite, completing the trio alongside Content Strategist and SEO & GEO Specialist. The Campaign Manager evaluates journey statistics against KPIs, analyzes audience contact group performance, and generates final campaign reports. Agents operate under admin permissions with approval gates. Scores below 75 because the roster is still smaller than Contentstack Agent OS and agent marketplaces are absent.
Each headless channel auto-generates a strongly-typed GraphQL API endpoint for content delivery, with polymorphic query optimization added in 2025. The April 2026 refresh (31.4.0) introduced a Headless REST API in preview for retrieving content items over HTTP with JSON responses, closing the previous GraphQL-only gap. Both REST and GraphQL are now available for delivery (REST still preview), and the May 2026 Management API additions for Page Builder components further round out the API surface.
Identity Resolution (April 2026, production-ready) unifies customer, contact, and member profiles under single identities and automatically merges profiles when visitors log in with existing accounts — a meaningful upgrade from the earlier preview-only CDP unified profiles. AIRA Segment Condition Builder (April 2026, production-ready) uses AI to assist marketers in defining complex multi-rule segment conditions. Widget-level personalization in Page Builder delivers separate content variants per contact group based on behavioral, demographic, and activity-based segments. Email widget personalization (June 2025) allows per-segment email variants. Membership Roles (March 2026) enable tiered channel-specific content access. No full page-level rules engine or real-time behavioral personalization yet.
The April 16, 2026 refresh added the AIRA Segment Condition Builder, letting marketers construct audience segments through natural language with AI translating references into condition rules. Combined with existing AIRA auto-tagging, campaign management, Customer Journey insights, and Content Strategist rewrite/publish via API, Xperience now has multiple AI workflow assists woven into editorial. Still short of the 70+ tier due to lack of documented bulk enrichment or stale content lifecycle automation.
A dedicated Campaigns feature (March 2026) combines campaign briefs, associated digital assets, and linked customer journeys with AIRA Campaign Insights for AI-driven KPI evaluation. The new production-ready Campaign Manager Agent (April 2026) evaluates campaign performance against KPIs, audience groups, and journey metrics and generates final reports comparing success across multiple campaigns — a significant step toward portfolio-level campaign orchestration. Email Builder (production March 2025) provides visual drag-and-drop email authoring with A/B testing of email subject/content. Marketing automation with conditional branching is native. Multi-channel coordination and a dedicated content calendar UI are still absent.
Built-in CDP unifies customers, contacts, and members into a single profile with admin-configurable identity resolution (April 2026), new segmentation tools, and extensible APIs. Identity resolution matches on external identifiers or native fields (e.g., member email) to merge profiles across touchpoints, enabling unified data for personalization and automation. Held at 71 because external CDP connectors (Segment, mParticle, Tealium) remain absent and B2B firmographic enrichment is limited.
Xperience by Kentico SaaS is publicly documented as designed for 99.9% uptime, with Kentico responsible for SaaS environment, Xperience Portal, and deployment API availability 24/7/365. Public status page at status.xperience-portal.com with uptime history. April 2026 Refresh added extensible SaaS uptime monitoring supporting up to 6 checker configurations across regions. Not higher because 99.9% is mid-tier vs. 99.95%+ from headless leaders, and historical uptime data not granularly published.
SaaS Portal includes extensible uptime monitoring (up to 6 custom checkers per environment with configurable URLs/HTTP methods/response codes, multi-region execution, and historical reporting) added in the April 16, 2026 Refresh — alongside existing dashboards for server errors, response time, CPU/memory, and Cloudflare-integrated security events. An AIRA Usage Overview dashboard tracks AI credit consumption. Microsoft Application Insights is bundled. Not higher because self-hosted deployments have no built-in monitoring and require custom APM, and even SaaS customers must configure alerting thresholds beyond Portal defaults.
Customer journey analytics (March 2025) visualizes contact progression and drop-off through journey stages with date-range filtering. AIRA Campaign Insights evaluates KPI performance across campaigns (March 2026), and the new Campaign Manager Agent (April 2026) generates final reports comparing success across multiple campaigns — extending the in-platform marketing analytics surface beyond single-campaign dashboards. Form submission tracking with channel and language metadata (October 2025) surfaces form performance. No native web analytics module comparable to KX13's visitor tracking — page views, sessions, and source attribution still require external tools (GA4/GTM).
The April 16, 2026 refresh added two KentiCopilot plugins: a Kentico Xperience 13 content auditor CLI tool and an AI-assisted content migration tool. These join the existing KentiCopilot MCP-based content modeling APIs, AIRA SDK for custom content agents, and Azure AI Search RAG-ready indexing. Still short of the 70+ tier because official LangChain/LlamaIndex integration guides and agent-optimized delivery endpoints remain undocumented.
Rich text editing is powered by Froala WYSIWYG editor (v5.0.0), with inline rich text editors available within Page Builder widgets. AIRA refinements went GA in April 2026, and the May 14, 2026 refresh expanded AIRA generation/refinement to text fields across pages, emails, headless items, and reusable content items — using linked items and page previews as context. Output remains HTML-based rather than a portable AST, limiting channel portability.
Xperience by Kentico ships a native CDP with rule-based Contact Groups, behavioral activity-based conditions, and unified Profiles that merge customers, contacts, and members. The April 16, 2026 refresh added admin-configurable identity resolution with flexible matching on external identifiers or native fields plus new segmentation tools and extensible APIs. Not higher because B2B firmographic enrichment and pre-built Segment/mParticle/Tealium connectors remain absent.
Comprehensive .NET extensibility: custom modules with DI, global event handlers for content lifecycle hooks, custom Page Builder widgets and sections, custom form components, and custom admin UI pages built with React. May 2026 Refresh adds configurable custom Marketing Automation actions and a KentiCopilot Management MCP Server with Management API extensions, enabling agentic content creation workflows via a pluggable architecture. Limited only by the requirement for .NET/C# skills — no low-code extension approach exists.
Kentico has tightened its Refresh cadence from ~6–8 weeks toward near-monthly: documented Refreshes include March, May, July, October, December 2025 and January, February, March 2026, with an April 16, 2026 Refresh landing back-to-back with March. Each Refresh bundles meaningful features (digital commerce GA, AIRA agents, form field conditions). Not higher because patch-level cadence between named Refreshes is still not independently visible.
SaaS cloud infrastructure is described as ready in 30 minutes, and the Kickstart .NET CLI workflow gives developers a running local instance quickly. However, content type modeling, channel setup, and Kentico-specific conventions add a half-day to full day before a working site is live for an experienced .NET developer. Monthly refresh cadence (Apr 16, 2026 release) continues to ship DX improvements but doesn't fundamentally accelerate first-value.
Kentico maintains a structured Developer Learning Map, Developer Kickstart guide, community quickstarts, a training-guides GitHub repo (v31+), and a Certified Developer path. The April 16, 2026 refresh added KentiCopilot Migration Tools (Content Auditor CLI + Content Migration Claude Code skill) that meaningfully improve the onboarding story for KX13 teams upgrading to XbyK — a major onboarding pathway. Still no in-app tour or first-class framework-specific (Next.js) guided path, so not higher.
Page Builder already lets marketers self-serve page layout, widget placement, and content edits post go-live, and the read-only inspection mode reduces friction for editors. The April 16, 2026 refresh further reduces developer dependency: AIRA now assists with segment condition building, a Campaign Manager agent provides cross-campaign lifecycle insights, and an SEO & GEO Specialist agent runs keyword-based page scoring — tasks that previously required dev or specialist involvement. Not higher because new widget types, page templates, and new content types still require developers.
The April 16, 2026 refresh expanded the AIRA SEO & GEO Specialist agent to analyze both 'human and AI readability and comprehension' and provide optimization recommendations for traditional search and AI-powered discovery experiences. Combined with one-click fixes for SEO titles, meta descriptions, schema markup, and auto alt-text on mass image upload, this is now a robust GA offering. Scores below 70 because on-page scoring dashboards and bulk metadata generation at scale are still not fully confirmed.
Xperience by Kentico holds entirely stable this review period, with no movement across any composite dimension — Capability remains at 62.3, Platform Velocity at 69.6, Cost Efficiency at 53.1, Build Simplicity at 56.5, Operational Ease at 59.8, and Compliance & Trust at 55.9. The platform continues to show its strongest positioning in Platform Velocity while Cost Efficiency and Compliance & Trust remain its relative weak points, suggesting Kentico's investment in product iteration has not yet translated into gains on the cost or governance fronts. All scores remain unchanged since the last review, reflecting a period of consolidation rather than active momentum in either direction.
Xperience by Kentico is Kentico's rebuilt platform on ASP.NET Core with monthly releases, a shared content hub, SaaS hosting and the AIRA AI service. Kentico Xperience 13 reaches end of support on December 31, 2026, and migrating means rewriting custom code.
Xperience by Kentico suits mid-market .NET teams that want an integrated marketing suite and managed SaaS on a smaller budget. Sitecore wins for large enterprises needing deeper personalization, native experimentation and a bigger partner network; Kentico has no native A/B testing.
Xperience by Kentico wins when a .NET team wants built-in marketing automation, email, personalization and native commerce in one licensed product. Umbraco wins on cost and flexibility: its open-source core is free, its community is larger, and marketing features come from add-ons.
Reviewers most often praise Xperience by Kentico's ease of use and its responsive support from in-house engineers. Kentico held G2 Leader status in the digital experience platform grid in Winter, Spring and Summer 2026, with 391 reviews averaging 4.4 out of 5.
Xperience by Kentico pricing is quote-only: Kentico's How to Buy page lists channels, license tier, AI credits and SaaS cloud level but no dollar figures. Third-party listings start near $1,990 a month for SaaS, and implementations typically take three to six months.
The closest alternatives to Xperience by Kentico are Umbraco and Sitefinity for .NET teams, Optimizely and Sitecore for larger enterprise budgets, and Contentful for teams moving to headless. Each trades Kentico's integrated marketing suite for more flexibility, scale or ecosystem.
Yes, Xperience by Kentico includes AIRA, a credit-metered AI service for content generation, translation, image tagging and segment building. Its four marketing agents are still preview features, and AIRA runs only on Kentico-managed Azure OpenAI with no bring-your-own-model option.
Xperience by Kentico is moderate to implement for a .NET team and harder for anyone else. Projects typically take three to six months, and monthly releases plus frequent security hotfixes mean a developer must update packages and the database, then redeploy, even on SaaS.
Reviewers criticize Xperience by Kentico's rising subscription costs, with some reporting annual increases of up to 25 percent, and note that adding modules pushes cost higher. Others want faster turnaround on development-service requests and more detailed technical documentation.
Reach out to these highly trusted implementation partners, agencies and specialists.
Agencies, dev shops, and systems integrators vary wildly in how well they deliver on Xperience by Kentico. We don't take on implementation work ourselves.
Tell us what you're building and we'll come back with a shortlist of firms with a genuine track record on this platform.
