What if keeping your Adobe Commerce platform secure didn't compete with making it better?

None of that work is optional, but nor is it wasted effort. It's part of running a secure, stable Adobe Commerce or Magento platform.

The problem comes when the resource required to look after the platform is the same resource you're relying on to move it forward.

Suddenly, every necessary piece of maintenance has an opportunity cost.

The patch gets done, but the customer experience improvement waits. An unexpected issue takes priority, so something on the roadmap moves another month down the line. The eCommerce team spends its time managing what needs doing rather than thinking about what should happen next.

For Southern Sheeting, that distinction had become very real, and changing it was one of the first things we needed to do.

When keeping the platform running consumes the roadmap

Before working with GENE, Southern Sheeting operated within a traditional support model based around a 48-hour monthly retainer.

Those hours weren't sitting idle.

Security patches and essential maintenance needed doing, so naturally they consumed some of the available resources. That meant the same finite pool of hours wasn't available for the work Southern Sheeting wanted to do to improve its eCommerce experience.

As Southern Sheeting’s Joanna Morfield described it, it felt as though the platform was “running up time” that could otherwise have been invested back into making the website better.

That is a difficult dynamic for any eCommerce team, because the choice isn't really between valuable and unnecessary work. Both sides matter.

A secure, well-maintained platform is fundamental, but so are the changes that improve customer experience, increase conversion, respond to changing customer behaviour and help the business grow.

The problem is the model that repeatedly puts the two in competition with each other. GENE's answer was to separate them.

Platform Management changes what you're paying for

Southern Sheeting moved onto GENE's unlimited, 24/7 Platform Management service.

The important word there isn't really unlimited. It's management.

Because managing an Adobe Commerce platform isn't the same as waiting for somebody to raise a ticket and then deducting the time it takes to deal with it from a monthly allowance.

It means taking responsibility for the ongoing stewardship of the platform.

Security. Monitoring. Patching. Upgrades. Investigation. QA. Deployment. The work required to keep the technology secure, stable and performing properly.

That work still happens. It simply stops arriving as a series of decisions about whether this is what you want to spend this month's development resource on.

For Southern Sheeting, that meant the conversation could start moving beyond maintenance.

Once the basics of running the platform were being taken care of, we could spend more time understanding the business, looking at customer behaviour and working with the team to determine where investment could create the most value.

That ultimately helped identify Southern Sheeting's trade customers as a significant opportunity and checkout as the right place to start.

The distinction matters: Platform Management didn't replace the roadmap. It created more room for it.

What happens when something unexpected happens?

The value of that model becomes particularly tangible when the platform ecosystem needs to respond quickly.

A recent Magento and Adobe Commerce security incident gave us a useful example.

When attacks associated with the StyleSmuggler vulnerability began on a Saturday, GENE was aware of the activity immediately, but our response didn't begin that Saturday.

Long before the incident, we'd made the decision to standardise Sansec Shield across our Platform Management clients, including Southern Sheeting. It provides an additional layer of protection and continuous monitoring specifically designed for Magento and Adobe Commerce environments, so when the vulnerability emerged, protection was already in place.

Our team received alerts and carried out additional human checks across the affected client estate to verify the position. We then proactively contacted clients rather than waiting for them to hear about the issue elsewhere and come to us asking what they needed to do.

When Adobe released its patch on Monday, we deployed it. When a further patch followed later that afternoon, we dealt with that too.

For Southern Sheeting, all of that happened within Platform Management.

There was no additional bill.

No question about whether enough support hours remained.

No choice between dealing with security and preserving resources for something else.

It was simply part of managing the platform.

Good security should be part of the machinery

Any major commerce platform requires active security management. Adobe Commerce and Magento are no different.

The objective isn't to create a platform that somehow never requires another security patch. It's to build an operating model capable of responding properly when action is required.

That means thinking beyond the patch itself.

It means monitoring that gives you visibility early. Specialist protection that can add another layer of defence. Experienced people who know what they're looking at. Processes for checking, testing and deploying changes safely. And clear communication so the merchant isn't left trying to work out what's happening.

It also means recognising where specialist expertise makes the whole model stronger.

GENE doesn't need to reinvent security technology that organisations such as Sansec specialise in building. Our job is to know where that expertise adds value, put the right protections in place before they're needed, and combine them with the human oversight and platform knowledge required to act on what they tell us.

That's the ecosystem around good Platform Management: technology, specialist partners, experienced people and established processes working together. When something does require attention, the machinery is already there.

Proactive shouldn't mean exceptional

There's a temptation with incidents like this to make the story about speed.

How quickly did the agency react? How many people worked over the weekend? How rapidly was the patch deployed?

Those things matter, but we'd rather the interesting part was how little Southern Sheeting needed to do. The team didn't need to spot the vulnerability themselves, they didn't need to raise a ticket, they didn't need to decide whether it was sufficiently serious to use their remaining support hours. They didn't need to approve unexpected expenditure before anyone could act, and they didn't need to become security experts for the weekend.

The service had already been designed on the assumption that looking after the platform was our responsibility.

That's what proactive platform management should look like. Not an exceptional rescue every time something happens, but a routine, established response because the people, technology and processes are already in place.

The hidden cost of maintenance isn't just the maintenance bill

There's another way to look at the economics of all this.

When businesses calculate the cost of running Adobe Commerce or Magento, they naturally look at the money being spent on hosting, licences, support, development and maintenance, but there's another cost that's harder to see.

What isn't getting done because your available resource is being consumed by keeping the platform running?

If an eCommerce team has a fixed number of agency hours each month and a chunk of those hours routinely disappears into patches, upgrades and maintenance, the cost isn't simply those hours.

It's the roadmap work those hours could have delivered.

The customer problem that remains unsolved.

The improvement that gets pushed into next month.

The opportunity sitting in the analytics that nobody has enough headspace to investigate.

For Southern Sheeting, moving away from that model changed what the agency relationship could be used for. Instead of conversations being dominated by how the available hours should be spent, we could start having much more useful conversations about customers, priorities and business value. That work led us into the data, the data led us towards Southern Sheeting's valuable trade customers, and understanding those customers helped us identify checkout as the first place where investment could make a measurable difference.

The resulting checkout transformation went on to deliver a 12.5% increase in mobile checkout conversion in its first week, with checkout conversion subsequently increasing 38.7% month-on-month.

That's roadmap work, and it becomes much easier to get to when keeping the platform running isn't constantly competing for the same pot of resources.

Keeping it secure and making it better shouldn't be competing priorities

Security patches will continue to happen, platforms will need upgrading, and monitoring will surface things that need attention. That's part of running business-critical eCommerce technology properly.

The question is what happens inside your business when they do.

Does somebody need to decide whether there's enough budget?

Does another roadmap item have to move?

Does your eCommerce team need to raise the issue, chase the response and manage the process?

Or is the ongoing stewardship of the platform already accounted for?

For Southern Sheeting, Platform Management changed that equation. The essential work didn't disappear. It just stopped getting in the way of the work that could move the business forward.