When your CMS goes down or gets breached, it's more than an IT problem. See how Kontent.ai and Fastly stop attacks before they reach the platform and keep content online under peak load.
Written by Madeleine Salisbury
A bank's rate page, an insurer's claims guidance, a hospital's advice on a new medication: in regulated industries, published content carries obligations of its own. When that content goes offline, or someone tampers with the path it travels, the problem stops being technical and turns into a question of compliance and trust.
Security teams often think of the CMS as the place where content is stored. With a headless CMS, the delivery layer matters just as much, because every website, app and channel pulls content through it. That layer has to absorb traffic nobody planned for and turn away attacks before they reach the platform, often in the same hour.
In a headless architecture, content leaves the CMS through APIs and travels to every channel the organization runs. That design lets one team publish to a website, a mobile app and a kiosk from a single source. It also puts the delivery layer in front of everything: it is the first thing an end user reaches and the first thing an attacker probes.
Traffic rarely grows on schedule. A major match, a product recall or a regulatory announcement sends readers to the same pages within minutes, and attackers use busy moments to hide in the noise. A platform that handles load well but leaves its delivery layer open to attack fails the customer just as surely as a secure platform that buckles under demand.
For a CTO evaluating a CMS, that makes two questions inseparable. Will the content stay available, and what stops an attack before it reaches the content API?
Fastly runs a global edge cloud platform that delivers and protects websites, apps, and APIs from servers close to the people using them. It has been part of Kontent.ai since the early days: Fastly carries content from the CMS to every customer channel worldwide, while our engineering team focuses on the content platform itself. Fastly's Next-Gen WAF sits at the edge of the platform and applies rate limiting, geolocation-based blocking, and rule sets that automatically shut down entire classes of attacks before that traffic reaches the CMS.
The edge is the first layer, not the only one. "We obviously apply defense in depth and a layered security approach, but at the same time, having Fastly at the edge is essential for us to basically just easily defeat whole classes of attacks," said Matej Zachar, Chief Digital Officer at Kontent.ai.
For customers that store protected health information in Kontent.ai, the same layered protection covers delivery as well as storage.
During the last football championship, sports websites running on Kontent.ai took heavy traffic as millions of viewers pulled up content around key matches. There were no outages, and none of those customers raised a complaint about delivery. That result matters well beyond sports. The same delivery and security layer serves a bank's product pages and a healthcare provider's patient guidance, and the people reading that content are the first to notice when it fails. Fastly covered that weekend, and how we run delivery and security on their platform, in their customer story on Kontent.ai.
Kontent.ai runs delivery and security on one platform. "You have one platform to manage everything, teams that are very capable of managing that, whether through infrastructure as code or through knowledge about that platform and architecture," Matej said. "It saves time and improves the knowledge of the teams working with the platform." Less time operating a global delivery layer means more time spent on the CMS itself.
For a CTO, consolidation also means fewer parties in the security review: one edge provider to assess and one set of delivery controls to document.
Matej puts the stakes plainly: "Security is absolutely essential for realizing our business potential." Kontent.ai publishes its security documentation. Kontent.ai's Trust Center lists ISO/IEC 27001, SOC 2 Type 2, HIPAA and ISO/IEC 42001:2023, along with a pentest report and a security whitepaper. It was also named the first CMS to earn ISO/IEC 42001 certification.
Before content from a regulated business goes through a new platform, put these to the vendor:
Our answers are on the record. Review Kontent.ai's security documentation in the Trust Center.
What if we told you there was a way to make your website a place that will always be relevant, no matter the season or the year? Two words—evergreen content. What does evergreen mean in marketing, and how do you make evergreen content? Let’s dive into it.
Lucie Simonova
How can you create a cohesive experience for customers no matter what channel they’re on or what device they’re using? The answer is going omnichannel.
Zaneta Styblova
To structure a blog post, start with a strong headline, write a clear introduction, and break content into short paragraphs. Use descriptive subheadings, add visuals, and format for easy scanning. Don’t forget about linking and filling out the metadata. Want to go into more detail? Dive into this blog.
Lucie Simonova
