Today we released the Enterprise Portals Report 2009, which evaluates twelve major portal offerings.

Main conclusion: Major portal players are responding -- in some cases successfully -- to Microsoft SharePoint. (See our findings here). The major enterprise platforms are consolidating, while the open source projects are expanding as an alternative to Redmond.

You can download a free sample of the Portals Report here

Noted wiki vendor Socialtext has been busy appearing at high-profile conferences to promote their concept of business social software. However, recent experience suggests the still-young company may remain a little too fascinated by exciting new features rather than supporting and maintaining their customer base.

As we mentioned in the Socialtext review in the Enterprise Social Software Report 2008, customers were concerned earlier this year over quite a few upgrade problems with the hosted Socialtext service. Recent reports from customers suggest that the popular service remains quite a bumpy ride. Here's a few of the issues that Socialtext customers have reported over the past few month:

• The one and only reporting feature in Socialtext -- weekly usage reports -- stopped working back in May
• The search feature was suddenly substantially changed. Now search results no longer sort by default according to last edited date, but by relevance. This may seem an improvement, but try a search on a public Socialtext wiki and you'll find that it still takes some time getting used to.
• In another incremental upgrade, international characters were transformed to garbage, e.g., the Danish "æ" became an "Ål" and "å" became "Å¥."

It is also worth adding that while Socialtext formally announced version 3 back in April, the hosted service is today still running version 2.22, almost 5 months later.

The larger issue here is that as a SaaS customer you remain very much in the hands of the vendor. Often that's a good thing ("our upgrades happen automatically"); sometimes it's a bad thing ("we can't chose to postpone an upgrade"). How well your SaaS vendor prepares you and performs proper regression testing may seriously impact your project. Enterprises don't like surprises, but it appears like Socialtext still has some way to go here

Last week, European web analytics vendor Nedstat announced a new feature called "Live Segmentation," which enables you to develop customized behavioral analysis across unaggregated web data.

This is a big step for Nedstat. Readers of the Web Analytics Report know that this missing capability was somewhat of a downside to an offering that competes in Europe with the likes of Omniture, and WebTrends -- two vendors already providing a "data warehouse"-type of feature that enables deeper and more customizable analysis.

I've seen Live Segmentation, and at first blush it looks pretty straightforward...clean interface; drop and drag filter building, and so forth. However, Live Segmentation has a singular benefit that can't be found in the technology itself: availability to all SiteStat customers at no additional cost to the basic offering.

Nedstat argues that all web analytics solutions should provide for this level of behavioral segmentation analysis as part of their core, and I would have to agree. Although why it has taken so long for vendors to follow through on this has been somewhat of a mystery. NetGenesis (a "first generation," log file-based, licensed software package) provided segmentation functionality in 1997, but tag-based, SaaS vendors have been slow to catch up. This is problematic, because these sorts of custom queries really lie at the heart of contemporary web analytics, which tries to move beyond the limitations of "out of the box" analysis and reporting queries.

Nevertheless, the marketplace is moving. Coremetrics' announced their "deep dive" segmentation analysis offering, Explore, in May, 2008. Unica, in its latest release, 7.4, also just announced this level of custom analysis. The difference here is that Nedstat is essentially providing deep behavioral segmentation analysis for free.

You may sense that you need Component Content Management, but how can you be sure? Take our handy (and anonymous) Component Content Management "health quiz" and get a custom diagnosis...

At the TDWI Summit this week, I had the opportunity to talk about Web Analytics with enterprise Business Intelligence (BI) execs. I came away concluding that the worlds of enterprise data and web metrics still remain far apart.

I've argued before that the separation is partly technical and partly cultural. BI managers are wary of the firehouse of web traffic data, and most web managers just don't think much about non-web data stores and the value of website metrics to the broader enterprise.

Chatting with a BI manager at a major Omniture customer highlighted some of the issues. As Web Analytics Report readers know, Omniture is good at getting data into its system, but not very friendly about getting it out. Now, this customer wanted a small subset of key web data to bring back into their data warehouse. The key word here is small: you don't necessarily need and in fact can't handle all that extra traffic data for CRM-oriented enterprise datamarts. But you do want to know what your customers are doing. So, this enterprise put their own unique tag on key transaction pages (downloads, inquiries, and other form submissions) that wrote to a separate database, which they could then synch up with their master customer data to get a more holistic view. It's a useful work-around that seems to be working well for the BI team there.

At the same time, it made me a bit uncomfortable, because now they run two different tracking systems -- Omniture and the bespoke capture application -- and experience suggests that they will generate different metrics. The web managers will make decisions based on what they see coming out of Omniture, while the master enterprise data may show something different.

That's not the end of the world -- at least this customer actually made an effort to extract some web data for long-term enterprise use -- it's really just a first step.

Before you start to criticize Omniture, understand that no web analytics tool has been built to integrate with enterprise BI systems (indeed, the free Google Analytics service has no data access API at all). I think the marketplace still reflects the fact that within most enterprises, web managers and enterprise data managers live in two different worlds. But, if like the customer I met, you are trying to bridge that gap, be prepared for some custom development.

A few weeks ago, I questioned whether the SaaS Web CMS vendor Marqui was "going belly up" due to the fact that they had gone into receivership. Contraction within the Web Content Management marketplace has long been predicted by many analysts, but like many, many WCM products, it appears that Marqui will continue to linger. According to the Marqui site, the company has been sold to a group of private investors.

As indicated in the Marqui press release, the investor group also owns a fellow Vancouver-based company called WaterTrax that produces software to monitor water quality. Marqui customers should take some comfort that WaterTrax has experience with SaaS, but it remains to be seen how the new owners will go about creating what they are calling "a multi-brand software-as-a-service." We already know that the WaterTrax and Marqui will be sharing a CEO and CFO, Marqui customers will want to watch carefully how the new owners plan on sharing technical infrastructures. Sharing infrastructure could mean consolidation of technical and support resources.

Customers will want to carefully gauge how this impacts the Marqui service. Will the offering change or will divided attention keep Marqui in a state of dormancy? As always, we'll be watching...

Google has announced its new Search Appliance, version 5.2. As usual, this has been marked by a slew of presentations -- and of course, a video on YouTube. Probably the main upgrade: a 10 million document limit on one server.

The box, dressed in imperial yellow -- or somewhat more irreverently: the pizza quattro formaggi -- of course goes with the times. Faster (probably multi-core) processors allow for the higher document count. That's not so much Google's achievement, though you shouldn't forget that this is one enterprise search solution that actually comes with the hardware to run on, and the company makes sure it can handle its workload. But what else is new?

Well, according to the presentations and press release, you now get Kerberos, personalization, alerts, and better stats. Kerberos (no, not that Kerberos, but the security protocol) provides "single authentication for Sharepoint, file shares and non-Windows-based content systems, in addition to Windows-based systems". The personalization features mainly seem to be a form of collection-based biasing (i.e., for certain collections you can boost specific results; and it's now possible to do this based on metadata, too). The alerts are supposedly much like the regular Google Alerts we've come to love and hate. And as readers of the Enterprise Search Report will know, the GSA's statistics certainly had room for improvement.

I'll remain skeptical of these features until I've actually seen them, however. And none of the GSA integrators I talked to seemed to have hands-on experience with them as of yet. It took the previous GSA 5 release several months to be revealed as a bit of a disappointment: first meeting with enthusiasm, but slowly becoming a bit of a let-down. We'll have to wait and see what is actually delivered -- and how.

With the GSA, you get a whole lot out of the box. In this case, quite literally: many things touted as features actually rely on you installing them on external servers. That's not necessarily a bad thing, if you're aware of it before you commit (and Google's aggressive marketing doesn't really help a fair comparison). Helpful colleagues frequently remind that I should think outside the box; however, I tend to believe only what I can see with my own eyes, and I would advise you to do the same.

Big Blue recently released its IBM Internet Security Systems X-Force 2008 Mid-Year Trend Statistics report, and it contains more than a few eyebrow-raisers. For example: Web-application-based security vulnerabilities have begun to outnumber reports involving conventional viruses and trojans (of the kind that target the operating system). We're now at the point where 51 percent of newly discovered software vulnerabilities depend in some way on web-page interactions.

Also, there's been a sharp surge in the number of vulnerabilities that involve SQL injection (as opposed to cross-site scripting). Meanwhile, the use of infected image files (.gif or .jpg) as a way to inflict mayhem is on the decline.

What really got my attention, though, is the new Top Ten list of vendors with the most vulnerability disclosures. Normally you would expect Microsoft to be at the top of that list (I would, at least). Instead, it's at Number 3, behind Apple and... Joomla!. Fortunately, Joomla! can be secured, but it's quite possible that many novice Joomla! installers do not.

Numbers 8, 9 and 10 are interesting, as well: Drupal, WordPress, and Linux.

The finding that no fewer than four of the top ten vendors with the most reported vulnerabilities are open-source projects is, at first blush, quite striking. But the results should be viewed with caution. In part, the rankings reflect a recent change in IBM's data-gathering methodology (which the report's authors are quick to point out). Another important caveat is that the numbers are not normalized against adoption rates or installed seats or any other usage metrics. They're based on raw numbers.

It's worth remembering, too, that open source projects are extraordinarily open about security vulnerabilities. Hence you would expect a comparatively high rate of reporting for an open-source product. Finding, publishing, and fixing security vulnerabilities is something the open-source community has gotten quite good at, particularly in the Linux world, where every line of code for the entire operating system (including all encryption routines, random-number-generating code, and so on) is available free for the downloading. Security flaws in Linux tend to be found and corrected with astonishing alacrity.

On the other hand, it's striking that three of the Top Ten contenders on IBM's security worry-list have PHP in common. You can read whatever you want to into that, I suppose. I'm not a PHP expert, but I'm enough of a web developer to know that languages don't create security problems; programmers do.

If you have the time and the inclination, download the IBM report. At 85 pages, it' a well-worthwhile lunch-hour read, if you care about web-app security ... as I think we all should.

In collaboration with our partner, KM World, my colleague Tony Byrne will lead a free webinar, How to Evaluate SharePoint for the Enterprise, on the 28th of August at 2 p.m. US ET / 11 a.m. PT. It's a preview of the full-day seminar that Tony will teach in San Jose, CA on September 28th, closing out a packed week of content technology education at the San Jose Convention Center.

The webinar offers a high-level critical view of SharePoint, with candid, independent advice for both business and technology leaders alike.

You can register for the webinar here. See you online!

A question we are often asked is "Does CMS Watch provide consulting services?" In fact this question is asked so often, I thought a quick blog entry might be in order.

The answer should be prefaced by our raison d'être: CMS Watch evaluates content-oriented technologies, publishing head-to-head comparative reviews of leading solutions. We see our work primarily as informing and educating buyers of content technology via our reports and this web site. We admit that the constant work of updating reports such as The ECM Suites Report and the eMail Management and Archiving Report leaves us little time for consulting, but some of our customers do desire personal help and advice. In these cases we provide advisory and consulting services, most commonly to help with vendor and product selection. We don't do very large projects, nor do we compete with the big consultancies and integrators out there. Indeed why would we -- they are often our clients too, and many are among our subscribers, who receive analyst time built-in as part of our offering.

The engagements we do take on help keep our feet solidly on the ground. Buyers know they are getting tough, critical and truly independent advice, while at the same time, we remain rooted in the world of real projects and real buying issues. We help our clients distinguish marketing hype and hyperbole from the facts and real-world experience of others - something we work hard to ensure is reflected in our reports. If this kind of consulting is something you feel you could benefit from, just drop us a note. Remember, we consult only for buyers, and never for vendors.

Laserfiche is an ECM vendor we have been watching and writing about for a while, and our coverage of them in The ECM Suites Report is set to extend this year as we evaluate their new Rio offering. To some it may seem crazy for a mid-tier vendor like Laserfiche to expand their offerings in the wake of SharePoint, as there is a popular myth that SharePoint has all but finished off the ECM mid-tier. But a close look at the Rio offering shows us that there is thankfully no lack of innovation or useful products to compare, contrast, and chose among.

The new release from Laserfiche builds on its long history of records management and imaging, but adds deep integration with SharePoint. More importantly, with its set of connectors, Laserfiche now provides (relatively) out-of-the-box integration, along with an elegantly distributed architecture for capture and document management. Though these strengths might not seem as sexy as the name Rio suggests, these are product features that distinguish Laserfiche from many of their competitors, and add real value to many larger SharePoint environments.

We urge you to investigate the mid-tier of the ECM market for reasons such as these. As a buyer, you should never simply default to the big 4 or 5 'top right' vendors. ECM mid-tier vendors such as Laserfiche, Nuxeo, EVER and Objective often provide a better technical and cultural fit for you and your organization. They are also often the least turbulent of vendors, with healthy revenues, large (over 25,000 in Laserfiche's case) well-established and supportive customers, and a settled corporate culture - all important strengths in difficult economic times.

It is all too easy to select web analytics vendors for your shortlist based on their supposed "leadership" status in the market -- status either conferred by analyst firms or assumed by the vendors themselves. However, CMS Watch analyst Theresa Regli argues that you need to look more closely at product and vendor alike -- and understand where both are headed -- to properly evaluate your longterm risks and opportunities in an evolving marketplace...

We've been following Web CMS vendor Hot Banana for some time now. The little Barrie, Ontario start-up challenged pre-eminent ColdFusion-based vendor PaperThin with a somewhat simpler and very marketing-oriented offering.

Then online marketing roll-up vendor JL Halsey came calling, and Hot Banana agreed to get acquired. A thinly-capitalized former health-care company, JL Halsey was best known for its flagship Lyris e-mail marketing package and ultimately assumed that name. Then, as readers of The Web CMS Report 2008 know, Hot Banana seemed to stall a bit; customers complained of poor support and some internal disarray. Lately we've heard of a couple would-be buyers struggling to get Hot Banana's attention amid rumors of staff turnover and a difficult transition to a SaaS-based delivery model.

Turnover and organizational change are part of life in any software company, but something here is setting off little alarm bells in the back of my head.

You see, roll-ups are tricky: they seem so promising, but "synergies" among different products (in this case, really different companies) rarely pan out, and when it comes time to meet real quarterly revenue numbers, things can get tough. I don't know entirely what's going inside Hot Banana (they won't return our messages), but if you're considering them as a supplier, you'll want to make sure you perform careful diligence first.

I'm elated to invite you to two seminars and a full-day conference on enterprise search, findability and information architecture, taking place next month in the wonderful cities of Copenhagen and London.

In cooperation with our Denmark-based partner J. Boye, I'll be teaching a full-day seminar on Information Architecture for Findability and Web Publishing on September 11. This seminar is cumulative learnings from my time as a taxonomist and implementer of many a WCMS, as well as my more recent few years as an analyst (speaking with hundreds of users of CM, DAM and search systems), about what kinds of information structures help, or hinder, the implementation of specific technologies. If you're an information architect, web content manager, portal manager or search project manager, this class is geared towards the kinds of challenges you face.

In London a few days later, together with Claudia Urschbach, Senior Information Architect with the BBC, I'm chairing a full-day event on enterprise search. The speaker lineup includes Adriaan Bloem, Martin White, Janus Boye, James Robertson and others, and we'll spend the day discussing the current thinking on optimizing search within the enterprise. Our goal is both practical and tactical: we'll discuss search UI best practices, the vendor landscape, managing search projects, audio/video search, what you need to know about search in SharePoint 2007, and of course, we'll do some future-gazing.

Finally, Adriaan Bloem and I will teach a half-day intensive course on enterprise search in London on September 16th. If you're looking for a deep dive into today's search technology, join Adriaan and I for a combined presentation of our recent research. We hope to see you there!

As the buzz has it, public website search engine Cuil is the new Google challenger. "Cuil" is apparently pronounced "cool", and "an old Irish word for knowledge".

The search engine was officially launched a few days ago and is enjoying its time in the spotlight. There's two reasons for that: the company was started by ex-Google employees; and it has an index that's supposed to be three times as large as Google's. Now, that's all very nice, but since CMS Watch doesn't evaluate the public search engines, but enterprise search tools ("behind the firewall search"), you may ask: what's the relevancy?

Well, the word is still out on Cuil's relevancy ranking -- or the freshness of its index, for that matter. One thing is certain: a larger index doesn't necessarily mean better results. The Cuil folks must have realized, though, that to be any kind of competition, your index has to be huge; it's the old numbers game that especially Yahoo! and Google used to engage in. Google was the first to quit playing that game, but somewhat "coincidentally" suddenly made a statement about their 1 trillion pages indexed.

As for how relevant this is for enterprise search: well, Cuil doesn't play that particular game (though many search companies do both or at least used to: Microsoft, FAST, Exalead, Vivisimo, the list goes on... and oh yes, Google). What struck me as most interesting is that Cuil attempts to change the way people don't just search, but find, by using an innovative new results interface. And that's always pretty good news... since so far, most vendors have rather unimaginatively been copying Google's design of search results, since that's what most users have grown used to on the web.

Of course, again, they're not the first to innovate: notable examples are the public search engines of Exalead (exalead.com) and Vivisimo (Clusty). Both are quite experimental, and especially Exalead is continuously updating the interface. What you like best is rather personal, but for me, both are more useful than Cuil, where a static footer on the bottom takes up too much of my screen real estate: frames are soooo 1996 (even if they're not actual HTML frames). But Exalead and Vivisimo's public search engines are more interesting because they are not just marketing, but also ongoing research: what you see there might actually turn up in an enterprise search interface near you soon.

Still, if Cuil will get people used to more varieties than just plain vanilla Google behind the firewall, as well, that would be nice for anyone trying to implement search. I think many would be quite happy to have users clamor for something that's more like Cuil, rather than "why can't we just have Google". It's time to innovate the interfaces beyond just Googlesque results listings and Endeca's facets. That wouldn't just be old Irish knowledge, it would actually be pretty cool.

The SharePoint IT Pro Documentation Team recently published a blog post on the various Microsoft "enterprise" search technologies. The post did a nice job of clarifying the role of each of Microsoft's various search tools, save FAST (but more on that in a bit). Even the post's author, Kathy Narvaez, admits she has trouble distinguishing the various "...flavors of Microsoft enterprise search;"  hence the blog post.

This post is significant for two reasons: first, she used the word "enterprise" when describing SharePoint search, as well as Search Server Express and Search Server 2008 (although she also used the term "entry level"); and second, there was absolutely no mention of FAST. In some ways, the exclusion of FAST could be a result of the continuing ambiguity around how Microsoft will integrate the tool into the overall product set. Further, this blog post is coming from the IT Pro Documentation group (think Infrastructure Team - TechNet, not MSDN subscribers) and they don't seem to be as close to the product teams as the developer-based bloggers.

As our Enterprise Search Report 2008 and SharePoint Report 2008 both point out, Microsoft does not have a particularly strong native search offering, especially when we consider search across multiple repositories of various types. I don't think anyone but Microsoft considers their offerings outside of FAST truly enterprise class or scale. And that's why this blog post is a bit surprising: it strikes me as odd that they have so much trouble controlling the language they use to describe their own products.

Microsoft SharePoint goes open source? Shock, horror! Ok, well not quite, but an open source alternative to SharePoint is now an option with the release of Alfresco's Lab 3 Beta product. Alfresco's new module allows you to hook Office into Alfresco, giving you the option to use Alfresco as opposed to SharePoint as your collaboration platform.

It's an interesting option. As readers of our ECM Suites Report 2008 know, Alfresco is one of the more interesting ECM vendors around. The question you might ask yourself however is, why would anyone want to do use Alfresco instead of SharePoint? Clearly open source enthusiasts will herald this as a major breakthrough - and those enterprises that espouse open source may well become customers. But then again, if you are going to dump Microsoft for the back end, why use Office at all, given there are open source alternatives?

But this release has appeal beyond the open source community, for the simple fact that by using the Alfresco alternative you are not locked into the Microsoft stack. This isn't so much an issue now, but will be when Office and SharePoint effectively merge at the next major release. Unhooking the two from each other (or at least having the option to do so) is good risk mitigation, and a powerful thing to have in your armory when negotiating with Microsoft.

Where Alfresco may find a particular sweet spot is with those organizations looking to take SharePoint beyond its limits. In some of those cases Alfresco may well be more developer-friendly both in terms of the technology (AJAX and RESTful) and more digestible in terms of pricing. It's a David and Goliath situation - and certainly that's how Alfresco would like to pitch it. But outside the Book of Samuel, David and Goliath-style battles seldom turn out in quite the same way.

One does need to be aware that Lab 3 is a beta release and an open source product, so it's really not to everyone's tastes. Nevertheless, while many ECM vendors have released SharePoint add-ons and related products, Alfresco's new module goes for the SharePoint jugular. Despite the small size of Alfresco, the product is likely to gain some real attention over the coming year. Worth remembering though (as we detail in our ECM Suites Report) is that while Alfresco may well be open source, it's not free, and just as some people think SharePoint is free, of course it is not. In other words, if you are thinking that Alfresco is a free alternative to SharePoint then you are mistaken, it's simply an alternative, albeit a very intriguing one.

As with any beta release we urge you to be cautious. We're currently looking at the product as a part of our evaluations for the ECM Suites Report, and of course in the context of our SharePoint Report. In time Alfresco Lab 3 may turn out to be a damp squib, but for now it's got our attention.

As we enter the peak of the vacation season, those of us fortunate enough leave the rat race and head off to distant shores. And it was whilst on a very distant shore this past week that I came across an advertisement that stopped me dead in my tracks: check it out here.

We all give lip service to the idea of the global village, and that the internet is redefining the business geography. But to most of us that means little more than outsourcing to India or former Eastern Bloc countries. However, this job is located on the Isle of Lewis, a stunning windswept island in the North Atlantic. Getting there requires a two-hour ferry journey from the mainland (when the weather allows the ferry to run at all). It's metaphorically, if not literally, a million miles from San Jose, London or Bangalore. But looking at the actual job requirements, it's also about as far from corporate America as you could get. No Windows NT here, it's Ubundu, PHP5 and the LAMP stack, fairly cutting edge by anyone's standards.

This may seem just a blog post for the end of a vacation week, but there is food for thought here. If evidence were still needed that the global village is with us and expanding faster than the cubicle paradigm of corporate America cares to acknowledge, this may be it. And what a phenomenal opportunity for a top developer to live "the dream"!

In prior blogs as well as the past several editions of The Web CMS Report 2008 (in the chapter on Day Software), we've mentioned the agonizingly long buildup to the release of Version 5 of Day Communiqué. The last major release (4.0) of Day CQ was in 2005. There have been two point-releases since then (4.2 is current), but the product's lackluster user interface remains a glaring sore point in what is otherwise a very capable and elegantly architected (if pricey) WCM platform.

The company promises that Version 5 will have much improved usability for administrators and content contributors alike. The problem is, Day has made many promises before regarding CQ 5. And they remain only that: just promises.

To be sure, Day has been plenty busy with product development. In the past year, the Basel, Switzerland-based firm released a DAM offering and a social-software package. And the core repository, CRX, underwent a major revision (1.4 was released only two weeks ago). But time and again, the CQ 5 release date gets pushed off.

Today comes word that the wait for CQ 5 may be almost over (yes, again): apparently, the product is finally in beta, actually being put through its paces by major customers, having undergone (and completed) a long "technical preview" phase. According to Jean-Michel Pittet (writing in a blog at dev.day.com), "There are about 80 editors producing content [with CQ 5 beta] already. This number is expected to increase into several hundred very soon." Anticipated final release date? Still late 2008.

I'm tempted to say Don't hold your breath. But you know what? This time, based not just on Pittet's blog but on recent conversations I've had with a number of Day insiders, I think the promises might actually come true.