When your system needs more than a CMS

Bespoke software versus an off-the-shelf platform — and how to tell which one your business actually needs.

When someone sets out to build a website or a business system, the default assumption is usually a CMS — a content management system like WordPress, Wix or Squarespace, or, further up the scale, an enterprise platform such as Umbraco or Sitecore built on Microsoft's .NET.

For a lot of projects, that assumption is perfectly reasonable. If you need a brochure site, a blog or a straightforward marketing presence, a CMS will get you live quickly and cheaply. For that kind of work, it is often exactly the right tool, and I would tell you so.

But it is worth being clear about what a CMS actually is. It is a set of decisions someone else has already made on your behalf. The structure, the admin area, the way your content and data are modelled, the security model, the update cycle — all of it comes as standard, and all of it was designed for the average case. Not for your business.

For many established businesses, that is where the cracks start to show.

A CMS gives you someone else's structure. Bespoke software gives you your own.

You inherit everyone else's risk

Security is the clearest example, and it is the one most businesses underestimate.

WordPress now runs more than 40% of all websites, and around 60% of every site built on a CMS, according to W3Techs. That ubiquity is exactly what makes it a target. Attackers do not hand-pick your site; they run automated bots that scan the whole internet for known weaknesses in popular platforms and their add-ons.

And there are plenty to find. In 2024 alone, almost 8,000 new vulnerabilities were disclosed across the WordPress ecosystem — a 34% jump on the year before, according to the security firm Patchstack. Around 96% of them were not in the WordPress core software at all. They were in the third-party plugins and themes people bolt on to make the platform do what they need. More than 40% could be exploited without an attacker even logging in.

That is the uncomfortable truth about the plugin model. Every plugin is code written by someone you have never met, running on your site, with access to your data. The more you add to make a general-purpose platform fit your needs, the larger your attack surface becomes.

This is not just a problem at the cheaper end of the market. In September 2025, a critical flaw in Sitecore — one of the most expensive enterprise CMS platforms there is — was being actively exploited to run code on affected servers. It was rated nine out of ten for severity, and serious enough that the US Cybersecurity and Infrastructure Security Agency ordered urgent patching. The flaw traced back to a sample security key that had been published in Sitecore's own deployment guides years earlier.

The point is not that Sitecore is bad software. The point is that when you build on a shared platform, you inherit its flaws — and a single platform-wide weakness can expose thousands of sites at once, on someone else's timetable, not yours.

With purpose-built software, your attack surface is your own. There is no army of third-party plugins, no widely published shared codebase for automated bots to scan, and every security decision is made deliberately by the people who built the system.

The "cheap" option that gets more expensive

A CMS looks inexpensive on day one. Over time, the picture changes.

Premium plugins and themes come with annual licences. Updates break things. Plugins conflict with one another. Something needs patching most months, and someone has to test that the patch has not quietly broken your checkout or your contact form. None of that work adds anything new to your business. It just keeps the assembled contraption running.

That is the part people rarely budget for: the platform tax. You are effectively renting structure, and paying — in subscriptions, add-ons and developer time — to keep renting it.

Bespoke software works the other way around. You invest more up front, and then you own it. There are no per-seat platform fees, no plugin renewals, and updates happen when your business needs them — not when a third party ships a change you did not ask for and cannot refuse.

It fits your business — front and back

The visible website is only half the story.

The back end — how your team adds content, manages orders, handles customers, sees reporting — matters just as much, and it is where a CMS quietly imposes the most. You are handed a generic admin area built for everyone, and your team has to adapt to it.

In my experience working with clients, that generic back office is where the daily friction lives. Staff end up working around the tool rather than with it: exporting to spreadsheets, rekeying data between systems, doing manual steps the platform never anticipated because it was never built with their process in mind.

Bespoke software removes that friction by design. The admin is built around how your team actually works. Your data is modelled around your business, not forced into a generic "posts and pages" shape. The front end and the back end are made to fit exactly what is required — no more, no less.

We do not fit your business around the platform. We build the platform around your business.

Fast to run, quick to change

There are two kinds of speed that matter here, and bespoke software wins on both.

The first is performance. A CMS carries the weight of everything it might conceivably need — general-purpose code, themes, and every plugin you have installed — whether a given page uses it or not. That bloat shows up as slower pages, and slower pages cost you in search rankings and conversions. A purpose-built site ships only the code it actually needs. It is lean, and it is fast.

The second is the speed of change. When you need a new feature on a CMS, you are at the mercy of whether a plugin exists for it, whether it is any good, and whether it will keep working after the next update. With your own software, you simply change your own software.

The old objection to bespoke development was that it was slow to build in the first place. That has genuinely changed. With AI-assisted development, experienced engineers can now design, build and refine custom functionality far faster than traditional bespoke timelines allowed — without handing the important judgement to a machine. We use AI to accelerate the work, not to replace the expertise behind it. AI-assisted, human-accountable.

So when is a CMS the right choice?

To be fair to the alternative: often.

If you need a simple content-led site, you will update it only occasionally, and you have no deep operational requirements, a CMS is frequently the pragmatic and cost-effective choice. There is no sense in commissioning bespoke software to do a job an off-the-shelf platform does perfectly well.

A CMS starts to work against you when:

• you need it to fit specific business processes rather than the other way round
• the back office is central to how your team works day to day
• security, reliability and uptime genuinely matter to your operation
• you are steadily accumulating plugins to fill gaps in what the platform offers
• you are paying a growing stack of licences and subscriptions
• you want to add and change features quickly, without waiting on a third party

In those situations, the question is not whether a CMS is "good" or "bad". It is whether renting someone else's structure is the right long-term foundation for your business.

The right foundation for the way you work

For a simple website, a CMS may well be the sensible answer, and if that is what you need, we are probably not the right people to call.

But if your website or system needs to fit your business, stay secure, perform properly and be genuinely yours, then purpose-built software is the stronger long-term investment. You get a front end and a back end designed around your operation, a smaller and better-understood security surface, no platform tax, and the freedom to change your own software whenever the business demands it.

And thanks to AI-assisted development, bespoke software no longer has to move at the slow pace many businesses still expect.

We do not build around a platform. We build around your business.

Next step

Let's talk about your system.

If your website or software needs to fit your business rather than the other way round — with the security, performance and control that come from owning it — we can help.

Discuss your system View our services