The Structural Silence of Drupal in Brazil
We analyzed over 21,000 Brazilian domains. What we found reveals a silent contradiction between stability and risk.
Code and Soul
Engineering Team
There is a silent contradiction operating in the digital platforms of some of Brazil's largest companies. It's not a bug. It's not a visible failure. It's something deeper: the growing distance between what the platform was designed to deliver and what the operation demands today.
We analysed more than 21 thousand Brazilian domains. We found around 300 running Drupal. The number is no surprise. Drupal was never a mass platform. It has always been the choice of those who need structural control, interoperability and content governance at scale. Telecoms, healthcare, government, finance. Operations where the site is not a channel, it is infrastructure.
What is surprising is the state of those installations.
67% operate without official support
Two-thirds of the Drupal installations we identified in Brazil run versions that no longer receive security patches. Drupal 7, launched in 2011 and discontinued in 2023, still supports the majority. Drupal 8, discontinued since 2021, follows.
Only 26% have migrated to Drupal 10 or 11.
Migrating an enterprise Drupal platform is not switching versions. It's rethinking architecture, integrations, content flows, permissions, personalization. It's an engineering project, not an upgrade.
This is not negligence. It is structural inertia. And when the platform "works", the urgency disappears. Until it stops working.
The problem is that "working" and "being secure" are different things. And the distance between the two grows with every month without support.
Analysis based on a scan of 21,148 .br domains carried out in April 2026.
The distribution reveals the profile
The concentration by sector is not accidental. Government leads by far. Courts, city halls, federal agencies. Drupal has always been strong in government: security, accessibility, permission control, multilanguage. But most run Drupal 7, which means public infrastructure exposed without security coverage.
Financial services and benefits come second. Platforms that process sensitive data, operate under regulation and depend on integrations with multiple systems.
Healthcare sits at the most delicate intersection: patient data, integrations with hospital systems, and a digital experience that has to be accessible and trustworthy.
In financial services, the platform version is not a technical choice. It's a compliance decision. In healthcare, the risk of operating without support is not technical. It's clinical.
What the version says about the operation
The Drupal version a company runs is, in practice, a silent indicator of how it thinks about its digital platform. Drupal 7 indicates a platform built over a decade ago that survived through stability. The module ecosystem has disintegrated. Specialized developers are increasingly rare.
Drupal 8 and 9 are transition states. The architecture changed radically between 7 and 8: Symfony, Composer, configuration as code. Whoever got this far has already invested in modernising, but stopped halfway. The migration window from 9 to 10 is the smoothest the platform has ever offered. But windows close.
Drupal 10 and 11 indicate operations that actively invest in the platform. But the version alone doesn't say enough. Most modern installations underutilize what Drupal can deliver.
Headless, behavioural personalisation, semantic search, real-time integrations. The platform supports it, but the implementation rarely explores it.
The distance between what most organisations run and what the platform can deliver is the real gap.
The self-hosted illusion
Most installations we identified operate on their own infrastructure. Few use specialized managed hosting like Acquia or Pantheon. This provides flexibility but transfers all responsibility for security, performance, and scalability to the internal team. There is, however, a third path that the Brazilian market still underutilizes: running Drupal on scalable, highly resilient cloud-native infrastructure, purpose-built for the operation. At Code and Soul, we architect environments where Drupal runs on managed containers on AWS, distributed behind load balancers with automatic health checks and failover across availability zones. RDS Multi-AZ databases with automatic backups, read replicas, and encryption. CloudFront as a global CDN with HTTP/2 and H3 up front. WAF with SQLi rules and rate limiting protecting the application. And CI/CD pipelines that run automated security scans. OWASP ZAP, Nuclei, TLS validation, before any deploy touches production. The practical difference: Drupal remains Drupal, with its modules, permissions, and content workflows. But the infrastructure that sustains the operation scales horizontally on demand, recovers automatically from failures, and costs proportional to actual usage. This is not generic managed hosting with a limited dashboard. It is scalable infrastructure designed for the specific context of your Drupal operation, with the same rigor applied to financial-grade platforms.
When Drupal runs an unsupported version on self-hosted infrastructure, the company is operating without a safety net. Managed hosting solves part of the problem. But a purpose-built cloud-native architecture for Drupal solves the whole problem: patches applied via pipeline, WAF blocking attacks before they reach the application, elastic scalability during traffic spikes, and cost that follows actual demand, not a fixed monthly invoice.
It is not that self-hosted is wrong. It is that self-hosted demands a level of operational maturity not every organisation has, and rarely recognises it does not have.
What the data does not show
Numbers show versions and domains. They do not show the complexity behind each installation. How many custom modules exist. How many integrations depend on the platform. How many people publish content daily. What an hour of downtime actually costs.
In telecom operations we have seen Drupal platforms with more than 60 custom modules, semantic search with NLP, real-time behavioural personalisation and publishing pipelines that run from the design system straight to production. Drupal as an experience operating system, not as a CMS.
That is the potential. The distance between what most organisations run and what the platform can deliver is the real gap.
The stability paradox
Drupal's biggest risk in Brazil is not technical. It's perceptual. The platform is so stable that it masks its own aging. A well-configured Drupal 7 can run for years without visible incidents. This creates a false sense of security that postpones the decision to evolve until the migration cost becomes disproportionate.
The stability that protected the operation for a decade is the same one preventing its evolution.
For those operating Drupal today
This is not an argument to migrate. It's an argument to decide consciously. If the platform runs on Drupal 7 or 8, the question is not whether it works. It's whether you have visibility into the risks you're accumulating, and whether the decision to maintain is deliberate or by omission.
If you run Drupal 9, the migration window to 10 is the cleanest the platform has ever offered. The complexity will not shrink with time.
If you run Drupal 10 or 11, the question is whether the current implementation is extracting what the platform can deliver. Headless, personalisation, intelligent search, complex integrations. Modern Drupal is an experience platform, not a page manager.
In every case, the most expensive decision is the one that is not made.
Analysis based on a scan of 21,148 .br domains carried out in April 2026. Detection data via HTTP fingerprinting with manual version validation.
Code and Soul. Applied engineering for platforms that cannot fail.
"The stability that protected the operation for a decade is the same one preventing its evolution. In all cases, the most expensive decision is the one not made."
Continuity: Intelligence, Engineering and Strategy
The thinking behind this article connects directly to Code and Soul's vision: systems that learn, platforms that evolve, and applied intelligence that transforms complex operations into sustainable competitive advantage.
