The AI era is continuously evolving, with security becoming a crucial element alongside a flexible digital experience. To highlight this combined approach, ExtraMile by SecureITWorld presents its latest Q&A session. In every edition, we aim to simplify top technologies and security practices, enabling you to adopt them effectively.
In today’s conversation, we are excited to introduce our guest, Julia Molano Mazón, Liferay’s Director of Product Management. Liferay is a tech leader, helping organizations to create, manage, and scale powerful digital experiences. Julia looks after the company’s product strategy for digital experience, content management, and AI solutions. She merges her academic acumen and product leadership expertise to not only lead but also scale Liferay’s solutions.
As Julia joins today’s discussion, we intend to unravel her journey as a product leader, the launch of Liferay AI Hub, its headless CMS, Liferay DXP, the importance of security and compliance in flexible digital experience, and more. So, let’s dive right away.
Welcome, Julia; we’re glad you could join us today!
1. You are an accomplished product management leader. How has your academic background, including your PhD, influenced the way you approach customer challenges and product decision-making?
Julia. Writing and defending a PhD thesis is fundamentally an exercise in building a rigorous argument from incomplete information and then stress-testing it in front of people whose job is to find the holes in your reasoning. That experience translates directly into product management. When you are making a case for a roadmap decision or a strategic direction, you need to be able to articulate the problem clearly, support your position with evidence, and hold up under challenge from stakeholders who see things differently. The discipline carries over. I approach customer challenges the same way: define the problem precisely before proposing a solution, and stay honest about what you do not yet know.
2. In your view, what is the biggest mindset shift product managers need to make when transitioning into a platform-wide leadership role?
Julia. At the product level, you are optimizing for a specific set of users with well-defined needs. In a platform-wide role, your job is to make sure the platform enables an ecosystem of solutions. The shift is from solving for a specific use case to creating the conditions where many different use cases can succeed. That requires a lot more tolerance for ambiguity and a sharper focus on API stability, governance, and extensibility rather than just feature completeness.
3. What were some of the biggest technical or operational considerations your team faced while building Liferay’s Headless CMS, particularly in balancing innovation with enterprise governance requirements?
Julia. The central tension was between two legitimate but competing needs. Developers want the flexibility that comes with a headless architecture: the ability to use their preferred frontend frameworks and build without being constrained by the CMS's presentation layer. Content creators, on the other hand, want to be able to shape how their content looks and is experienced by end users, and they want to do that work independently without opening an IT ticket to make every change. Pure headless architectures tend to serve developers well and leave content teams dependent on technical resources to get anything done. We built Liferay CMS to address both sides of that problem. Developers get stable, well-documented APIs and full architectural freedom, while content creators receive the tools to manage, structure, and govern their content without needing to go through IT.
4. Security remains a major priority for enterprise organizations. How does Liferay DXP help organizations protect users, data, and services while maintaining flexibility and scalability?
Julia. Liferay DXP is designed so that security is part of the platform foundation, not a layer added on top. Role-based access controls, fine-grained permissions, and audit logging are built into the core platform and apply consistently across every capability, from content management to commerce to AI. That matters because enterprises are rarely running a single use case. When a new capability is introduced, it inherits the same governance framework rather than requiring a separate security implementation. For organizations managing multiple sites, brands, or regions, that consistency is what makes it possible to scale without introducing new risk exposure at each step.
5. Liferay was recently named Camunda’s Technology Partner of the Year. How do you approach aligning product strategy and roadmap priorities with strategic technology partners?
Julia. The recognition from Camunda reflected work that was already well underway, which is the right order of operations for a technology partnership. Our integration with Camunda connects Liferay DXP's digital experience layer with Camunda's agentic orchestration capabilities, which means organizations can automate complex, multi-step business processes while still delivering a coherent front-end experience to their users. The alignment we look for in a strategic partner is whether the combined solution solves a problem neither platform solves well on its own. In this case, it clearly does, and the award was a welcome confirmation of that.
6. As AI capabilities continue to evolve, how do you balance innovation and product optimization with responsible data privacy and ethical AI considerations?
Julia. We start from the position that AI features in an enterprise context have to operate within the governance framework the organization has already established. This is why Liferay AI Hub is built on top of Liferay DXP's existing access controls. AI agents act on behalf of authenticated users, which means they can only access data that the user is authorized to see. Every interaction is logged in a full audit trail, and sensitive information stays within the organization's own environment. The goal is to let enterprises move quickly on AI adoption without having to rebuild their security infrastructure from scratch to do so.
7. What metrics or indicators do you look at to determine whether an AI-driven feature is creating measurable business value for customers?
Julia. The most meaningful indicator is whether the feature reduces time-to-value for the people using it. For AI-assisted translation in Liferay CMS, that means faster multi-language publishing. For AI agents in Liferay AI Hub, it means business processes that used to require manual handoffs completing in hours rather than days. We also pay close attention to whether teams are actually using the feature in production or treating it as experimental, because adoption rate in a real workflow is a harder test than any internal benchmark.
8. Liferay AI Hub enables a low-code environment to build, deploy, and manage AI agents. How will this approach benefit enterprises while integrating and scaling AI agents?
Julia. One of the biggest reasons enterprise AI initiatives stall is the gap between what a business wants to automate and the engineering resources available to build it. A low-code environment closes that gap. With Liferay AI Hub, IT teams can configure and deploy agents through a visual, drag-and-drop interface without needing to write custom code from scratch. Pre-built agent templates cover common use cases like content translation, customer service triage, and user segmentation, so teams can have something running in production from day one and adapt it over time. For more specialized needs, teams can define bespoke agents grounded in their own data, product catalogs, and systems of record. The model-agnostic architecture means organizations are not locked into a single LLM provider, and they can swap or add models as the landscape evolves without rebuilding their agents or disrupting existing workflows.
9. As AI agents become more autonomous in enterprise workflows, governance cannot be an afterthought. How does Liferay AI Hub truly integrate higher trust, accountability, and governance in AI deployments?
Julia. The governance challenge with most AI tools is that they are built in isolation from the security infrastructure organizations already have. Liferay AI Hub takes a different approach: it is built on top of Liferay DXP's existing access control framework, so governance is not a separate layer to configure.
Liferay also holds ISO/IEC 42001 certification for its AI Management System, and the platform is designed to support compliance requirements including GDPR, HIPAA, and SOC 2. As AI agents move from pilots to production and start handling more complex, multi-step workflows, that foundation means organizations can scale without having to rethink their security posture at every step.
10. Open-source software providers often face challenges related to security, compliance, and monetization. What best practices have been most important for Liferay in navigating those challenges?
Julia. Transparency has been the constant. Liferay's open-source foundation means our code is visible to anyone, which is actually a security advantage when managed properly. Community scrutiny catches vulnerabilities quickly, and customers in regulated industries can audit the software themselves rather than taking our word for its security posture. On compliance, we maintain certifications across major frameworks and make that documentation available to customers and their auditors. On monetization, the model has always been to offer an enterprise subscription that wraps the open-source core with professional support, legal warranties, and the cloud infrastructure options that large organizations need. That separation has held up well because the value proposition is clear on both sides.
Discover More In-depth Interviews:
