Passkeys and CIAM consolidation are reshaping customer identity in 2023

At a glance

What this is: This is a year-end analysis of two CIAM shifts: passkeys gaining traction and platform consolidation reducing customer identity options.

Why it matters: It matters because customer IAM teams need to plan for phishing-resistant authentication, vendor concentration risk, and migration-ready journey design at the same time.

Context

Customer identity and access management is moving through two changes at once: passwordless authentication is becoming more visible, and the platform market is concentrating. In practice, that means brands are being asked to redesign login journeys while also thinking about future platform flexibility.

For IAM practitioners, the governance issue is not only authentication choice. It is whether customer login, registration, MFA, and identity proofing journeys can survive a vendor roadmap shift without creating rework, user friction, or migration pressure.

Key questions

Q: How should organisations roll out passkeys without breaking customer login flows?

A: Start with journeys that already tolerate fallback, such as signup, account recovery, and step-up authentication. Keep passwords or other alternatives available during transition, but define when they apply and who owns exceptions. That lets teams prove value through measurable improvements in sign-in success, user experience, and support load before expanding passkeys more broadly.

Q: When does CIAM consolidation become a security governance problem?

A: It becomes a governance problem when customer login, recovery, federation, and admin workflows are tightly coupled to one vendor's roadmap or product direction. At that point, a merger or acquisition can change support models, transition timing, and technical dependencies fast enough to become an operational risk.

Q: What breaks when customer identity journeys are split across disconnected systems?

A: Disconnected identity systems create friction, duplicated data, and weaker governance. Teams lose a consistent view of the customer, which makes adaptive authentication, consent management, and lifecycle controls harder to enforce. The result is usually slower onboarding, less reliable fraud detection, and more operational overhead when users move across web, mobile, contact centre, and partner channels.

Q: What is the difference between passkeys and passwordless MFA?

A: Passkeys use public key cryptography and local user verification, while many passwordless MFA schemes still rely on a shared secret, a push approval, or an OTP. That means passkeys are generally more resistant to phishing and replay. For practitioners, the important question is whether the workflow remains secure once recovery and exception paths are included.

Technical breakdown

Why passkeys change customer authentication patterns

Passkeys are built on FIDO2 and replace passwords with device-bound, phishing-resistant authentication using biometrics or local device unlock. The important shift is not just stronger login security, but a change in how users recover and reuse access across devices. In CIAM, that alters session design, device trust, and the balance between convenience and account takeover risk. When customers no longer rely on a shared secret, attackers lose the easiest credential harvesting path. That does not eliminate identity abuse, but it raises the cost of opportunistic phishing and password replay.

Practical implication: treat passkey support as a customer authentication architecture decision, not a feature checkbox.

How CIAM consolidation affects identity roadmap control

CIAM consolidation changes the operating assumption that customer identity capabilities are stable across product cycles. When two major platforms are tied to merger decisions, brands may face migration timing, feature overlap, and support uncertainty even before a technical change is announced. That matters because customer identity is usually embedded in sign-up, login, federation, MFA, and branded journey logic. Once those flows are deeply coupled to a single platform, switching costs rise sharply. The real technical issue is dependency concentration: the more identity logic lives inside one vendor stack, the less portable the programme becomes.

Practical implication: map which customer journeys are portable before platform decisions force the issue.

Why low-friction journeys still need governance

Low-friction customer identity is often described as a user experience goal, but in CIAM it is also a control-design problem. Features such as remember-my-device, enterprise SSO, social login, and document verification all change assurance levels across different entry paths. The challenge is keeping the experience consistent without flattening the risk model. A good CIAM design separates authentication strength, identity proofing, and journey orchestration so that business teams can adapt flows without weakening governance. Passkeys, MFA choices, and hosted verification components all need that separation.

Practical implication: design customer journeys so security policy and experience logic can change independently.

NHI Mgmt Group analysis

Passkeys are becoming a customer expectation, not just an authentication option. Once major consumer brands normalize passwordless login, customer identity programmes inherit a new baseline for usability and phishing resistance. That shifts the CIAM discussion away from whether passkeys are interesting and toward whether current journey design can support them without breaking recovery, device continuity, or federation. The implication is that password-first login is now a legacy assumption, not a neutral default.

CIAM consolidation turns roadmap risk into an identity governance problem. When market concentration reduces the number of viable customer identity platforms, migration planning stops being an IT contingency and becomes part of governance. The brands most exposed are the ones that embedded login, MFA, and sign-up logic too deeply into one vendor stack. The implication is that platform concentration should be assessed as part of identity architecture risk, not procurement afterthought.

Customer identity programmes now need portability by design. Branded login experience, identity proofing, and MFA policy are no longer separable from exit planning. If those capabilities cannot be reconstituted outside one platform, the organisation has accepted vendor-defined operating limits. The practical conclusion is that customer identity architecture should be reviewed for journey portability before consolidation narrows the available options further.

CIAM is converging on a dual mandate: stronger authentication and lower switching cost. Security teams cannot treat those as competing goals. Passkeys reduce credential risk, while modular journey design reduces concentration risk, and both are required if customer identity is going to remain resilient through market change. The implication is that programme maturity now depends on authentication strength and architectural exit flexibility together.

What this signals

Passkey adoption is becoming a design pressure on customer identity teams, not just an authentication trend. Programmes that still treat passwords as the centre of the customer journey will increasingly carry more friction, more recovery complexity, and more exposure to credential-based attacks.

Identity portability gap: The hardest part of CIAM consolidation is not replacing a platform, but untangling embedded journey logic from the vendor stack. Teams should assume that migration difficulty grows with every custom login branch, recovery rule, and federation path they add today.

For practitioners

• Prioritise passkey rollout for customer journeys Identify sign-in paths where phishing resistance and device-based authentication will have the most impact, then sequence passkey support around those flows first.
• Map CIAM platform dependency before consolidation forces migration Catalogue which customer identity functions are platform-bound, including login orchestration, MFA policy, federation, and profile data dependencies.
• Separate assurance design from journey design Keep authentication strength, identity proofing, and user experience decisions independently configurable so one policy change does not require a full rebuild.
• Test exit readiness for branded identity journeys Validate whether sign-up, social login, enterprise SSO, and recovery flows can be recreated without losing policy control or customer continuity.

Key takeaways

• Customer identity programmes are being pushed in two directions at once: stronger login security through passkeys and greater platform concentration in CIAM.
• The main risk is not only phishing exposure but also roadmap and migration dependence when critical journeys sit too deeply inside one vendor stack.
• Teams should design customer identity flows so authentication policy, proofing logic, and platform choice remain separable.

Key terms

• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Customer Identity And Access Management: Customer Identity and Access Management is the discipline of governing how external users sign in, recover access, and move through digital services. It combines authentication, profile management, and lifecycle control so organisations can deliver secure, low-friction experiences at scale.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Platform concentration risk: The operational risk that arises when multiple security functions are merged into one system of record or control. It can simplify administration, but it also increases the blast radius of outages, policy errors, and misconfigurations.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.