Notifications
Clear all
Topic starter
23/06/2026 9:12 pm
TL;DR: Passkeys are moving from standard-setting to mainstream adoption, while CIAM market consolidation is forcing brands to reassess platform roadmaps, migration risk, and customer login experience, according to Strivacity. The governance lesson is that customer identity programmes now need to balance phishing-resistant authentication with vendor concentration risk and future-proof journey design.
NHIMG editorial — based on content published by Strivacity: a year-end CIAM analysis covering passkeys, consolidation, and product enhancements
Questions worth separating out
Q: How should organisations roll out passkeys in customer identity journeys?
A: Start with the journeys that see the most password fatigue, phishing exposure, or reset volume, then add passkeys where device-bound authentication improves both experience and risk.
Q: When does CIAM consolidation become a security governance problem?
A: It becomes a governance problem when customer login, recovery, federation, and admin workflows are tightly coupled to one vendor's roadmap or product direction.
Q: Why do passkeys change the way teams think about customer identity risk?
A: Passkeys remove the reusable secret that attackers usually target, so the main risks shift toward device trust, recovery abuse, and fallback methods.
Practitioner guidance
- Prioritise passkey enablement for high-volume customer journeys Identify the sign-in flows that create the most password-reset demand or credential abuse exposure, then pilot passkeys where device-bound authentication will remove the most friction and risk.
- Document your CIAM exit assumptions now Map which customer journeys depend on a single platform's federation, branding, recovery, and administration features so you can estimate migration effort before market consolidation forces change.
- Review fallback authentication and recovery paths Test how users regain access when a passkey device is lost, replaced, or unavailable, and make sure fallback methods do not become a weaker takeover path than the password they replace.
What's in the full article
Strivacity's full post covers the operational detail this analysis intentionally leaves for the source:
- Specific product enhancements to the CIAM admin console, including layout and workflow changes
- Implementation detail for enterprise SSO, private-label configurations, and multi-organisation management
- Native document verification flow support and how hosted components change customer journey delivery
- Option-level discussion of MFA and remembered-device settings for different sign-in paths
👉 Read Strivacity's year-end analysis of passkeys and CIAM market consolidation →
Passkeys and CIAM platform consolidation: what IAM teams should watch?
Explore further
25/06/2026 2:21 am
Passkeys are forcing customer identity programmes to move from password control to device-bound trust. That changes the centre of gravity in CIAM because reusable secrets are no longer the main defensive object. The governance question becomes how organisations validate device continuity, recovery, and exception handling without rebuilding password-era assumptions. Practitioners should treat passkey adoption as a shift in trust architecture, not just a login upgrade.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
A question worth separating out:
Q: What should IAM teams do before their CIAM platform roadmap changes?
A: Inventory the journeys, integrations, and recovery flows that would be hardest to move, then document the operational dependencies that would block a rapid transition. If the platform changes direction, those dependencies are what determine whether the organisation can adapt cleanly or ends up with a costly migration.
👉 Read our full editorial: Passkeys and CIAM consolidation are reshaping customer identity in 2023
