Topic starter
20/01/2026 12:55 pm
TL;DR: Most organisations still treat IAM as a catch-all, but Descope notes that 51% use it for customer-facing functions while only 8% would choose that path today, reflecting the scale, UX, and consent demands of external identity. The governance gap is not just user experience, but misaligned control design for different identity populations.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “IAM vs CIAM: Differences, Use Cases, and How to Choose”.
By the numbers:
- 51% of companies use IAM for customer-facing functions, but only 8% would choose to do so if starting fresh today.
- 600 million daily identity attacks were caught by Microsoft in 2024, and 99% were password-based.
- 60% of US-based external users said they gave up accessing an app in the last month because they forgot their password.
Key questions
Q: What breaks when organisations use workforce IAM for customer identity journeys?
A: The usual failure mode is rigidity.
Q: Why do external identity programmes need different controls than internal IAM?
A: Because the risk profile changes with the user population.
Q: What is the difference between CIAM and traditional IAM in this context?
A: Traditional IAM usually focuses on workforce access and internal control boundaries, while CIAM focuses on consumer-facing identity flows and digital experiences.
Practitioner guidance
- Separate workforce and customer identity governance Define distinct policy, UX, and data-handling requirements for internal IAM and external CIAM instead of forcing one platform to serve both populations.
- Tune authentication for customer abandonment risk Use adaptive MFA, passkeys, and step-up rules that balance abuse resistance with the reality that external users leave when flows become too hard.
- Test CIAM for consumer-scale load Validate performance, recovery, and login reliability under peak traffic so identity outages do not turn directly into lost sales or support escalation.
Bottom line: External identity exposes a control mismatch when workforce IAM is reused for customer-facing access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 6:52 pm
External identity is not a scaled-down version of workforce IAM. The control assumptions are different because the subject population is different. Employees sit inside organisational boundaries and operate within a smaller, more governable access surface, while customers, partners, and suppliers create higher-volume, higher-friction, higher-privacy obligations. Practitioners should treat CIAM as a separate control domain, not a deployment variant.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should organisations decide between IAM and CIAM?
A: Choose IAM when the primary users are employees or internal contractors and the main goals are policy enforcement, productivity, and enterprise integration. Choose CIAM when the users are customers, partners, or other external identities and the programme must support scale, consent, and smoother authentication journeys. In many organisations, both are required, but they should not share the same governance assumptions.
👉 Read our full editorial: IAM vs CIAM: why external identity needs different controls