Customer identity teams are usually measured on two numbers that pull against each other: how many attacks the login stops and how many real customers get in. This health check puts both on one scorecard of 10 KPIs, so a security change that hurts conversion, or a conversion change that opens a door to account takeover, shows up in the same monthly review. It builds on the Customer IAM (CIAM) Guide, which explains how to design registration, sign-in, recovery and consent; this page measures whether that design is working in production. It is a programme-level review: the configuration of the identity platform itself (enrolment settings, token lifetimes, administrator access, tenant settings) is measured in the companion Customer identity (CIAM) platform health check.
It is written for CIAM product owners, fraud and identity security teams, and the digital teams who own the login journey. Every metric is vendor-neutral and can be built from the event data any customer identity platform, web application firewall or bot defence layer produces.
What this health check covers
Scope is every customer-facing sign-up, sign-in, step-up, recovery and session flow across web, mobile apps and customer APIs, including partner and delegated access where customers authorise third parties. It measures business outcomes: phishing-resistant sign-in, attack absorption, takeover and fraud rates, legitimate success rates, recovery journeys, cross-channel identity, consent records and business ownership. It does not cover workforce identity or platform configuration.
- Who runs it: the CIAM product owner assembles the scorecard; fraud operations supplies confirmed takeover and fraud cases; security operations supplies attack telemetry; the privacy team owns consent coverage.
- How it differs from the CIAM guide: the guide tells you to offer passkeys, harden recovery and check breached passwords. The health check asks how many customers use passkeys, how often recovery is abused and what share of password sets are actually checked.
- What it catches: passkey enrolment that stalls after launch, bot traffic slipping past defences, recovery becoming the main takeover route, friction that drives legitimate customers away, and sessions that outlive policy.
Key takeaways
- Pair every security metric with a conversion metric. A falling takeover rate is only good news if the login success rate held.
- Confirmed takeover is the outcome that matters. Blocked attempts show attack volume; the account takeover rate per 100,000 active accounts shows whether customers were actually harmed.
- Recovery is a separate front door. Measure its abuse on its own, because strong sign-in pushes attackers towards password reset and support channels.
- Every journey needs a business owner. Registration, sign-in and recovery cross product, fraud, security and support teams; without a named owner per journey, metrics are reported and nobody acts.
- Consent coverage is part of identity health. A customer record with no consent evidence is a privacy finding even when the login is secure.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this Customer Identity Programme Health Check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Attack and recovery signals (CX-03, CX-07) | Daily dashboard, weekly review | Fraud and identity security operations | Head of fraud or security operations | Weekly snapshot, confirmed case list |
| Conversion and friction (CX-06, CX-09) | Weekly | CIAM product owner | Digital product lead | Funnel export per channel |
| Sign-in and password metrics (CX-02, CX-10), cross-channel identity (CX-01) | Monthly | CIAM product owner | Identity security lead | Authenticator enrolment and usage export |
| Ownership, incidents and launch readiness (CX-04, CX-05, CX-08) | Quarterly | CIAM product owner; privacy team | Data protection officer and chief digital officer | Journey ownership register, incident register, launch sign-off records |
| Full health check report | Quarterly | CIAM product owner | CISO and chief digital officer | Scorecard for three periods, findings log, signed approval |
Metrics
Calculate per channel (web, iOS, Android, API) as well as overall, because one weak channel is hidden by a strong average. NHI Mgmt Group recommended thresholds; adjust to your risk appetite. This page measures the programme. Platform measures such as account takeover rate, fake signup rate and consent record coverage sit in the CIAM Platform Health Check (CIAM-03, CIAM-06, CIAM-11); read the two together.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| CX-01 | Duplicate customer identity rate | Customers holding more than one identity record across channels, brands or acquired systems / all active customers (active = signed in within 90 days) | Customer profile store, identity matching or linking results | Under 2% | 2 to 5% | Over 5% |
| CX-02 | Passkey share | Successful sign-ins completed with a passkey / all successful sign-ins | CIAM authentication event logs | Rising each quarter and over 25% | Flat for two quarters | Falling, or under 5% a year after launch |
| CX-03 | Credential stuffing block rate | Sign-in attempts from automated credential testing that were blocked or challenged / all sign-in attempts classified as credential testing | Bot defence and web application firewall logs, CIAM risk engine events | Over 99% | 95 to 99% | Under 95% |
| CX-04 | Customer identity incidents with business impact, and time to customer notification | Customer identity incidents in the period that caused financial loss, regulatory notification or service withdrawal / all confirmed customer identity incidents; reported with the median hours from confirmation to notifying affected customers | Incident register, customer communications records | All affected customers notified within 72 hours and no incident with business impact | All affected customers notified within 7 days, with one or more incidents with business impact or any notification after 72 hours | Any affected customers notified after more than 7 days, or not notified |
| CX-05 | Customer identity requirements met at product launch | Products, channels and brands launched in the last 12 months that met the agreed customer identity requirements (shared identity, approved sign-in and recovery methods, consent capture) at go-live / all launches in the last 12 months | Launch sign-off records, architecture review board minutes | 100% | 80% to below 100% | Below 80% |
| CX-06 | Login success rate | Sign-in journeys started by legitimate users that end in a session / all such journeys started (exclude traffic classified as automated) | Front-end analytics funnel and CIAM authentication events | Over 95% | 90 to 95% | Under 90% or down 3 points in a period |
| CX-07 | Recovery abuse rate | Account recoveries later confirmed as fraudulent / all completed account recoveries | Recovery flow events, support desk records, fraud case management | Under 0.5% | 0.5 to 2% | Over 2% |
| CX-08 | Journey ownership coverage | Customer identity journeys (registration, sign-in, step-up, recovery, support-assisted recovery, partner and delegated access) per channel with a named business owner and agreed KPIs reviewed this quarter / all such journeys | Journey ownership register, quarterly review minutes | 100% | 80% to below 100% | Under 80% |
| CX-09 | Recovery journey abandonment | Account recovery journeys started by legitimate customers that end without regaining access / all such recovery journeys started (exclude traffic classified as automated) | Front-end analytics funnel, recovery flow events, support desk records | Below 15% | 15% to below 30% | 30% or above |
| CX-10 | Breached password check coverage | Password creations, changes and resets checked against a compromised password blocklist / all password creations, changes and resets | CIAM password events, blocklist service logs | 100% | 95% to below 100% | Under 95% |
Where the thresholds come from
- CX-10: NIST SP 800-63B-4 section 3.1.1.2 requires verifiers to compare a prospective password against a blocklist of commonly used, expected or compromised passwords, which is why anything below full coverage is amber.
- CX-03: attempts are capped by NIST's rate limit of no more than 100 consecutive failed attempts per account (section 3.2.2), but distributed stuffing rarely trips per-account limits, so the block rate has to be measured at the traffic layer.
- CX-02: NIST SP 800-63B-4 requires verifiers to offer at least one phishing-resistant option at AAL2 and notes that passwords are not phishing-resistant, so passkey share is the measure of how much sign-in is actually phishing-resistant.
Long-tail questions this scorecard answers
- What CIAM KPIs should we report to the board? CX-04 and CX-06 together, with CX-02 as the trend that explains both and the platform takeover rate from the CIAM Platform Health Check as supporting detail.
- How do we measure account takeover? Takeover rate is a platform measure (CIAM-03 in the CIAM Platform Health Check); at programme level, track CX-04 for the incidents that reached the business and how fast customers were told.
- Which customer identity metrics show friction? CX-06 by channel, read against any change to challenges, step-up rules or bot defences in the same week.
How to collect the data
- CIAM authentication events: every sign-in attempt with result, authenticator type, client, channel and risk decision. Feeds CX-02, CX-06 and the risk-engine part of CX-03.
- Customer profile store: active accounts with last sign-in date, plus identity linking or matching results across channels, brands and acquired systems. Feeds CX-01.
- Edge and bot telemetry: web application firewall, bot defence and API gateway logs with automation classification and action taken (allow, challenge, block). Feeds CX-03. Agree one definition of "credential testing traffic" with the security operations team and keep it stable between periods.
- Front-end analytics: funnel events from login page view to session creation, per channel, with automated traffic removed. Feeds CX-06 and CX-09.
- Fraud case management: confirmed recovery fraud cases with dates and entry route. Feeds CX-07. Confirmation lags: recalculate the previous period when late cases arrive.
- Recovery and support records: password reset, authenticator reset and support-assisted recovery events, including those raised through chat or voice channels. Feeds CX-07.
- Journey ownership register: each journey per channel with its business owner, KPIs and date last reviewed. Feeds CX-08.
- Incident register and launch records: customer identity incidents with impact and notification dates, and launch sign-offs against the customer identity requirements. Feeds CX-04 and CX-05.
- Password event logs: every password set, change and reset with the blocklist check result. Feeds CX-10.
Customer identity data is personal data. Build the scorecard from aggregated counts, restrict access to raw event exports, and apply your retention schedule to the extracts as well as to the source logs.
Red flags that need action now
- A sudden rise in failed sign-ins with a stable or falling share of challenged traffic: stuffing is getting past the edge. See the Credential Stuffing Attack Response Playbook.
- Confirmed takeovers clustered on one channel, client or recovery method.
- Recovery abuse rate rising while sign-in takeover falls: attackers have moved to the reset or support route.
- Any recovery path that completes without sending a notification to the customer; NIST SP 800-63B-4 section 4.2 states account recovery SHALL cause a notification.
- An authenticator added to an account with no out-of-band notice to the customer.
- Login success rate on one channel down more than 3 points after a release.
- A new channel, brand or acquired customer base launched with its own separate customer identities and no linking plan.
- A product or brand due to launch without sign-off against the customer identity requirements.
- Password resets that bypass the breached password check.
Findings log
| Finding ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-CIAM-01 | [Example: recovery by SMS code alone accounts for 70% of confirmed takeovers] | CX-07 | [High] | [CIAM product owner] | [DD/MM/YYYY] | [Open] |
| HC-CIAM-02 | [Example: support-assisted recovery has no business owner and no KPIs] | CX-08 | [Medium] | [Head of customer service] | [DD/MM/YYYY] | [Open] |
| HC-CIAM-03 | [Finding] | [CX-xx] | [Critical, High, Medium, Low] | [Named owner] | [DD/MM/YYYY] | [Open, In progress, Closed, Risk accepted] |
Close a finding only when the next period's metric has moved. Record the conversion effect of every fix alongside the security effect.
Remediation map
| Finding type | Metrics | Where the fix is described |
|---|---|---|
| Low passkey sign-in share | CX-02 | Passkey Rollout Guide; Passkey Autofill and Conditional UI |
| Stuffing traffic getting through | CX-03 | Bot Management Guide; Credential Stuffing Attack Response Playbook |
| Incidents with business impact or slow customer notification | CX-04 | Account Takeover Response Playbook |
| Launches that miss customer identity requirements | CX-05 | Customer identity (CIAM) platform rollout playbook |
| Friction and failed legitimate sign-ins | CX-06 | Customer IAM (CIAM) Guide, risk-based step-up |
| Recovery abuse | CX-07 | Account Recovery and Help Desk Security Guide; Passkey account recovery |
| Duplicate identities across channels; journeys without owners | CX-01, CX-08 | Customer identity (CIAM) platform rollout playbook |
| Customers abandoning recovery | CX-09 | Account Recovery and Help Desk Security Guide |
| Passwords set without a breach check | CX-10 | Passwordless and Passkeys Guide |
Related guides
- Customer IAM (CIAM) Guide: the design this health check measures.
- Customer identity (CIAM) platform health check: the tool-level companion for platform configuration.
- CIAM Maturity Model: where your scorecard places you and what the next level needs.
- Security Metrics and KPIs Programme Guide: reporting these KPIs to leadership.
- Account Takeover Response Playbook: the response playbook when a red flag becomes an incident.
- Account Takeover Statistics: external figures to set your baseline against.
References
- NIST: SP 800-63B-4 Digital Identity Guidelines, Authentication and Authenticator Management
- OWASP: Credential Stuffing Prevention Cheat Sheet
- OWASP: Forgot Password Cheat Sheet
- NIST: SP 800-53 Rev. 5 (IA-5(1) Password-based Authentication, AU-6 Audit Record Review, Analysis, and Reporting)
- NIST: Cybersecurity Framework 2.0 (PR.AA-03, DE.CM-03, GV.OV-03)
Related NHI Mgmt Group resources: Customer IAM (CIAM) Guide · CIAM Maturity Model · Account Takeover Prevention Guide · Passkey Rollout Guide