The Client
Alcon is a global leader in eye care, developing and manufacturing a broad portfolio of products for eye health professionals and patients across more than 60 countries. From surgical equipment and implants to contact lenses and eye care solutions, the company's mission is to help people see brilliantly.
The Situation
With Drupal's end-of-support timelines creating real deadline pressure, Alcon needed to upgrade its platform to Drupal 11 — not as a routine maintenance task, but as a strategic investment. The goal was to reduce risk, ensure compliance, improve operational efficiency, and future-proof the digital platform to support business growth at scale, including greater use of AI modules and reduced maintenance overhead.
The Challenge
Upgrading to Drupal 11 is a significant platform modernization effort, not a simple in-place upgrade, and Alcon's environment made it especially complex. With approximately 150 sites on Acquia Site Factory, even minor inconsistencies in module versions, configuration drift, or site-specific exceptions could cause upgrade failures or unpredictable behavior across the factory. Centralized governance and normalization had to come first.
At the code level, Drupal 11 removes a large set of deprecated APIs from earlier versions, meaning custom modules and Acquia Site Studio components that still relied on legacy hooks, services, or render arrays would break at runtime. This required genuine refactoring rather than version bumps, making existing technical debt immediately visible. Contributed module compatibility added another layer of decisions – Alcon had to determine whether to update, replace, refactor, or retire functionality across every site.
Stakeholder management added further pressure: content teams faced changes to editor experience and temporary feature freezes, while competing business initiatives and hard security deadlines limited flexibility.
The Solution
Alcon structured the upgrade as a disciplined, multi-phase program. Before they touched any code, Alcon’s web team conducted a thorough discovery and readiness assessment — inventorying the platform's current state, auditing contributed modules, custom code, themes, and Site Studio components, and identifying deprecated APIs through deprecation reports and static code analysis. This produced a clear picture of the upgrade scope, a module compatibility matrix, and a risk register that would guide every subsequent decision.
From there, the team defined a target architecture and upgrade strategy, locking in the upgrade approach, a standard module allowlist, a configuration normalization strategy, and a phased rollout plan. Infrastructure preparation ran in parallel, upgrading PHP, database, and Composer tooling to Drupal 11-supported versions, updating CI/CD pipelines, and standing up isolated upgrade environments and factory-level test clones to validate changes safely before they touched production.
The upgrade itself proceeded in deliberate sequence. Drupal core was upgraded via Composer, followed by Symfony and third-party dependencies, with deprecated core functionality and legacy shims removed and all breaking changes resolved. Contributed modules were updated, replaced, or retired as needed, with cross-site compatibility validated at every step. The team refactored custom code and themes to address deprecated APIs and Twig changes, and enforced modern PHP and Symfony best practices throughout. They validated and refactored Acquia Site Studio components, realigned style systems and component libraries, and regression-tested authoring workflows to protect the editor experience.
With the codebase stable, the team turned to configuration normalization — resolving conflicts and drift across the factory and validating content types, media handling, editorial workflows, and CKEditor configurations to ensure consistent multisite behavior ahead of go-live. A rigorous testing phase followed, combining functional, regression, and visual diff testing with security scans, performance benchmarks, accessibility conformance validation, and factory-wide dry runs. The team executed the production rollout in phased waves, with defined deployment windows, content freeze timelines, and rollback plans in place throughout. After go-live, Alcon’s web team removed temporary workarounds, enforced dependency hygiene, documented new operating standards, and established regular health audits to keep the platform sustainable long term.
The Results
The upgrade delivered across every dimension. Alcon's Bitsight security score reached an all-time high of 760, Apdex performance hit .95, and the platform achieved full compliance with no security challenges. The upgrade also unlocked access to AI modules and significantly reduced the maintenance pressure that had burdened the team, leaving Alcon with a stable, modern platform built for the demands ahead.