Of 79 cybersecurity vendor homepages we could read on 28 October 2026, 19 run on WordPress, 15 on a headless CMS behind a JavaScript front end, 12 on Webflow and 11 on Adobe Experience Manager. HubSpot CMS runs six. W3Techs puts Webflow on 1.2% of all sites with a known CMS, so in security marketing it shows up at more than ten times its web-wide rate.
This page sets our check of 90 vendors against W3Techs share by site rank, HTTP Archive field speed by platform and two vendor reports on CMS risk and technical debt. Every figure carries its source and date. We build marketing sites in Webflow, so the bias is stated; the counts are what each site's own code shows.
What 90 cybersecurity vendors run their websites on
No one publishes a census of security vendor website platforms. W3Techs reports share by traffic rank, not by industry, so we built a sample.
Method. We listed 93 vendors across six groups: endpoint and XDR, network and SASE, identity and access, cloud and application security, data, email and security operations, and compliance, risk and exposure management. It is a judgement sample of well-known brands, so treat it as a picture of the funded and listed end of the market. On 28 October 2026 we fetched each homepage and its /blog path with an ordinary browser request and read the HTML and headers for platform fingerprints: WordPress's wp-content paths, Adobe's /content/dam and clientlibs paths, Webflow's page attributes, HubSpot's template markup, Drupal's settings block, generator tags and the asset hosts of headless content stores. Red Canary now redirects to Zscaler and CyberArk to Palo Alto Networks, and Lacework's domain did not respond, so we dropped all three, leaving 90. Cybereason's domain redirects to LevelBlue, so we counted LevelBlue's site. Eleven homepages returned a bot challenge, a 403 or no response, and we did not try to get round that.
| Platform | Homepages | Share of 79 readable | Examples |
|---|---|---|---|
| WordPress | 19 | 24% | Check Point, Netskope, Arctic Wolf, Malwarebytes, Imperva, Veracode, Checkmarx |
| Headless CMS behind Next.js | 15 | 19% | Wiz (DatoCMS), SentinelOne (Contentstack), Rapid7 (Contentstack), 1Password (Contentful), SailPoint (Sanity) |
| Webflow | 12 | 15% | Darktrace, Vanta, Sysdig, Cyera, Island, Vectra AI, ThreatLocker |
| Adobe Experience Manager | 11 | 14% | CrowdStrike, Palo Alto Networks, Fortinet, Okta, Splunk, OneTrust |
| HubSpot CMS | 6 | 8% | KnowBe4, Varonis, Delinea, Saviynt, Corelight, LevelBlue |
| Drupal | 5 | 6% | Zscaler, Proofpoint, Tenable, HackerOne, WatchGuard |
| JavaScript framework, CMS not identified | 4 | 5% | Cloudflare, Snyk, Teleport, UpGuard |
| Custom build, no CMS fingerprint | 3 | 4% | Duo, Keeper Security, Semgrep |
| Framer | 2 | 3% | Twingate, Panther |
| Other packaged CMS | 2 | 3% | ESET (TYPO3), Mimecast (Sitecore, inferred) |
| Blocked or no response | 11 | not counted | Sophos, Huntress, Akamai, Rubrik, Drata, BitSight |
Source: Octo Agency check of 90 cybersecurity vendor homepages, 28 October 2026
Two calls need a note. Zscaler renders Drupal content through a Next.js front end; we counted it under Drupal, because that is the system the marketing team edits. Mimecast shows no explicit Sitecore string, but its static paths and asset links match Sitecore's patterns on an ASP.NET stack, so that call is an inference. Recorded Future runs Adobe's Edge Delivery Services, which we counted with Adobe Experience Manager.
Large platform vendors run Adobe; Webflow and headless spread wider
The split by product category is sharper than the overall count.
| Platform | Endpoint and XDR | Network and SASE | Identity and access | Cloud and application security | Data, email and SecOps | Compliance, risk and exposure | All |
|---|---|---|---|---|---|---|---|
| Vendors in segment | 12 | 17 | 13 | 14 | 19 | 15 | 90 |
| WordPress | 3 | 3 | 2 | 5 | 2 | 4 | 19 |
| Webflow | 1 | 2 | 0 | 4 | 3 | 2 | 12 |
| HubSpot CMS | 1 | 1 | 2 | 0 | 2 | 0 | 6 |
| Adobe Experience Manager | 3 | 2 | 2 | 0 | 3 | 1 | 11 |
| Drupal | 0 | 2 | 0 | 0 | 2 | 1 | 5 |
| Headless CMS | 1 | 3 | 3 | 2 | 4 | 2 | 15 |
| Framer | 0 | 1 | 0 | 0 | 1 | 0 | 2 |
| Other packaged CMS | 1 | 0 | 0 | 0 | 1 | 0 | 2 |
| JavaScript framework | 0 | 1 | 1 | 1 | 0 | 1 | 4 |
| Custom | 0 | 0 | 2 | 1 | 0 | 0 | 3 |
| Blocked | 2 | 2 | 1 | 1 | 1 | 4 | 11 |
Source: Octo Agency check, 28 October 2026
Adobe is the incumbent's platform. All 11 Adobe sites belong to large, established vendors, and 9 of them declare five or more language versions in their hreflang tags. Of the 12 Webflow sites, two do. Localisation at that scale is one of the main reasons big vendors stay on an enterprise CMS, and it is a fair test for anyone planning to leave one.
Cloud and application security is where Webflow is strongest. Sysdig, Aikido, GitGuardian and Endor Labs run Webflow; Wiz and Chainguard run headless builds. Five more, including Orca, Aqua and Checkmarx, run WordPress, so no single platform owns the segment.
Identity has no Webflow at all in our sample. Okta and Ping Identity run Adobe, Delinea and Saviynt run HubSpot CMS, and 1Password, Descope and SailPoint run headless builds.
How this compares with B2B SaaS and the whole web
Security vendors are B2B software companies, so the obvious comparison is our post on B2B SaaS website CMS statistics, which checked the Forbes Cloud 100. There, 53 of 100 homepages ran a JavaScript framework and only 13 ran WordPress. Security vendors are more conservative: WordPress is the largest single platform, and Adobe holds a block of large sites that the Cloud 100 barely touches.
| Platform | Share of all sites with a known CMS | Top 1 million | Top 10,000 | Cybersecurity sample, readable homepages |
|---|---|---|---|---|
| WordPress | 58.3% | 48.1% | 50.6% | 24% |
| Webflow | 1.2% | 1.5% | 2.3% | 15% |
| Adobe Experience Manager | 0.1% | 1.0% | 5.2% | 14% |
| HubSpot CMS | 0.2% | 1.1% | 1.1% | 8% |
| Drupal | 0.9% | 3.7% | 6.9% | 6% |
Source: W3Techs ranking breakdowns, 28 October 2026; Octo Agency check, 28 October 2026. The sample share counts headless and custom builds in the denominator, which W3Techs often cannot classify, so read the comparison as direction, not as a like-for-like rate
Field speed by platform
A platform does not decide a site's speed, but it sets a base rate. The HTTP Archive publishes Core Web Vitals pass rates by detected technology from Chrome's field data.
| Platform | Mobile pass rate | Desktop pass rate | Mobile origins tested |
|---|---|---|---|
| Drupal | 58.6% | 62.5% | 11,658 |
| WordPress | 50.1% | 55.8% | 110,537 |
| Webflow | 49.8% | 72.3% | 2,635 |
| All origins | 46.6% | 61.9% | 747,521 |
| HubSpot CMS | 45.2% | 64.8% | 704 |
| Sanity | 35.3% | 60.4% | 1,043 |
| Adobe Experience Manager | 33.2% | 43.0% | 4,542 |
| Contentful | 28.0% | 49.8% | 2,259 |
| Contentstack | 27.8% | 51.7% | 471 |
Source: HTTP Archive Core Web Vitals technology report, top 1 million origins, September 2026
The headless stores that 15 security vendors chose pass least often on mobile. That is mostly about the JavaScript front end and the tags loaded on top, not the content store, but it is the base rate a team inherits. Adobe sites sit near the bottom on both devices, which matches what we would expect from heavy, multi-language enterprise pages carrying analytics and consent scripts.
Risk and maintenance: what security buyers will ask
A security vendor's own website is evidence in the sale. A buyer's security team can see the stack in a few seconds, as we did.
WordPress plugin risk is real and measurable. Patchstack, which sells WordPress security services, reported 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% increase over 2024. About 91% sat in plugins and 9% in themes; core had six, all low priority. 46% had no developer fix at public disclosure. Nineteen security vendors run WordPress anyway, which tells you the risk is manageable with a small plugin list, managed hosting and fast patching. Our Webflow vs WordPress comparison covers that trade in more detail.
Technical debt hits the technical side hardest. Webflow's 2026 State of the Website report, a vendor-commissioned survey run by Vanson Bourne in June and July 2025, asked 1,000 director-level leaders in the US, UK and Canada; 29.2% worked in IT or tech, the closest group to security vendors. It found that 97% of technical leaders say technical debt hurts their team's ability to manage the website, and only 47% of leaders are completely confident their web infrastructure can support rapid innovation without new security risks. Webflow sells the platform it recommends as the fix, so read the direction, not the precision.
Consent tooling is standard. 46 of the 79 readable homepages load a known consent platform, and 23 of those use OneTrust. Any CMS change has to keep that working on every template.
HubSpot, Marketo and the form layer
Most security vendors run marketing automation alongside the CMS. HubSpot's scripts load on 21 readable homepages, Marketo's on 16 and Eloqua's on four; these are floors, because a tag manager can hide scripts from the first HTML response. Marketo shows up on 5 of the 11 Adobe sites and 6 of the 19 WordPress sites, and on none of the headless builds we could read.
The Webflow sites pair with HubSpot: 8 of 12 load HubSpot scripts, which usually means HubSpot forms or tracking on a Webflow front end. Our Webflow vs HubSpot CMS comparison covers when the CRM should own the pages and when it should only own the forms. Only six vendors run HubSpot CMS for the site itself.
What this means for choosing a cybersecurity website CMS
The sample suggests three common paths. Large, multi-language vendors stay on Adobe or Drupal and accept slower base rates for governance and localisation. Vendors that want a lighter stack pick Webflow or a headless store, and the Webflow route keeps editing in marketing's hands. Teams on WordPress keep it lean and patch fast.
Whichever you pick, test the same five pages before you commit, in this order.
| Order | Page | What to test |
|---|---|---|
| 1 | Demo request page | Form tool, routing and consent banner working together; field data on mobile |
| 2 | Main platform or product page | Can marketing change copy, proof and screenshots without a developer |
| 3 | Threat research or blog post | Template speed with long text, code blocks and images; author and date fields |
| 4 | Trust or security page | Who can publish certifications and policy changes, and how fast |
| 5 | Homepage in a second language | hreflang output, translated slugs and how edits flow between locales |
Source: Octo Agency, based on the platform split and field data above
Measure each page's mobile Core Web Vitals against the 27.8% to 58.6% range above, and time how long a marketer takes to publish a change. If you want the editing side in detail, our guide to a website your marketing team can edit sets out the rules and a ticket test to run before launch.
In our own work, as a white-label partner to Web Tonic, we built more than 20 Webflow sites in twelve months at two to three weeks each, and the largest CMS held over 1,200 items. We run a four-week process for marketing sites, build them in Webflow and applications in Next.js, and quote each build per project. Our marketing websites service page explains how we scope a cybersecurity site.
