Topic starter
23/06/2026 9:12 pm
TL;DR: Passkeys are moving from standard-setting to mainstream adoption, while CIAM market consolidation is forcing brands to reassess platform roadmaps, migration risk, and customer login experience, according to Strivacity. The governance lesson is that customer identity programmes now need to balance phishing-resistant authentication with vendor concentration risk and future-proof journey design.
Editorial analysis by NHI Mgmt Group, based on content published by Strivacity: “2023 CIAM recap: Market and tech changes that matter”.
Key questions
Q: How should organisations roll out passkeys without breaking customer login flows?
A: Start with journeys that already tolerate fallback, such as signup, account recovery, and step-up authentication.
Q: When does CIAM consolidation become a security governance problem?
A: It becomes a governance problem when customer login, recovery, federation, and admin workflows are tightly coupled to one vendor's roadmap or product direction.
Q: What breaks when customer identity journeys are split across disconnected systems?
A: Disconnected identity systems create friction, duplicated data, and weaker governance.
Practitioner guidance
- Prioritise passkey rollout for customer journeys Identify sign-in paths where phishing resistance and device-based authentication will have the most impact, then sequence passkey support around those flows first.
- Map CIAM platform dependency before consolidation forces migration Catalogue which customer identity functions are platform-bound, including login orchestration, MFA policy, federation, and profile data dependencies.
- Separate assurance design from journey design Keep authentication strength, identity proofing, and user experience decisions independently configurable so one policy change does not require a full rebuild.
Bottom line: Customer identity programmes are being pushed in two directions at once: stronger login security through passkeys and greater platform concentration in CIAM.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 2:21 am
Passkeys are becoming a customer expectation, not just an authentication option. Once major consumer brands normalize passwordless login, customer identity programmes inherit a new baseline for usability and phishing resistance. That shifts the CIAM discussion away from whether passkeys are interesting and toward whether current journey design can support them without breaking recovery, device continuity, or federation. The implication is that password-first login is now a legacy assumption, not a neutral default.
A question worth separating out:
Q: What is the difference between passkeys and passwordless MFA?
A: Passkeys use public key cryptography and local user verification, while many passwordless MFA schemes still rely on a shared secret, a push approval, or an OTP. That means passkeys are generally more resistant to phishing and replay. For practitioners, the important question is whether the workflow remains secure once recovery and exception paths are included.
👉 Read our full editorial: Passkeys and CIAM consolidation are reshaping customer identity in 2023