IBM Security Verify for CIAM

Consumer Identity and Access Management (CIAM) has emerged from enterprise IAM into a distinct market focused on organizations that interact directly with consumers and citizens. Its purpose is to deliver better digital experiences while collecting, storing, and analyzing consumer data to improve product-market fit, personalization, and brand loyalty. CIAM systems provision, authenticate, authorize, and manage consumer identities across many domains, often ingesting data from multiple unauthoritative sources. They must also support diverse business purposes—ranging from access decisions to marketing analytics and Anti-Money Laundering initiatives—while operating at massive scale, potentially serving millions of identities and processing billions of daily logins. SaaS delivery is increasingly the default model.

Core CIAM capabilities include broad authentication options (including social logins, biometrics, FIDO, and risk-adaptive/continuous authentication), privacy and consent management driven by regulations (GDPR, PIPEDA, CCPA), IoT device-to-human identity association, identity analytics, API accessibility for integration, account recovery, and account takeover protection using fraud and compromised-credential intelligence. Many vendors are shifting to “API-first” CIAM architectures aligned with microservices and Identity Fabrics, creating opportunities for closer collaboration between IT and Marketing.

IBM Security Verify (renamed from IBM Cloud Identity in 2020) supports workforce, B2B, and B2C use cases via multi-tenant SaaS and flexible on-premises/IaaS deployment. It offers white-labeling, bulk provisioning, social registration with OAuth2 scope control, progressive profiling, LDAP-based identity storage with extensible attributes, governance features, extensive authenticator and federation protocol support, and adaptive authentication enhanced by IBM Trusteer. It includes device intelligence SDKs, reporting and BI/CRM integrations, OAuth2 Device Flow support for IoT association, and integrations with QRadar SIEM and MaaS360 UEM. Strengths center on scalability, standards support, APIs, and authentication breadth, while challenges include consent-model gaps and limited built-in family management.

• CIAM systems may need to manage many millions of identities and process potentially billions of logins and other transactions per day.
• SaaS delivery of CIAM services is trending upward and is likely to remain the default choice for most organizations.
• IBM renamed IBM Cloud Identity to IBM Security Verify in 2020.
• IBM Security Verify SaaS operates in IBM Cloud and Amazon AWS in globally distributed data centers.
• IBM Security Verify can be deployed on-premises on CentOS, Debian, RHEL, SuSE, and Ubuntu Linux.
• IBM Security Verify supports social registration through providers including Apple ID, Baidu, Facebook, Google, LinkedIn, WeChat, Weibo, and Microsoft.
• The default user data repository in IBM Security Verify is an LDAP database.
• Up to 150 custom attributes can be defined in consumer profiles, with further extension possible through an advanced rule concept.
• IBM Security Verify supports OAuth2 Device Flow for device-to-human identity association.
• IBM Security Verify is ISO 27001/27018 certified, PCI-DSS Level 1, and SSAE 18 SOC 2 Type 2 attested.

• “CIAM solutions are designed to meet evolving technical requirements for businesses and other organizations that deal directly with consumers and citizens.”
• “Unlike workforce IAM systems though, information about these consumers often arrives from many unauthoritative sources.”
• “SaaS delivery of CIAM services is trending upwards and will likely remain the default choice for most organizations.”
• “Many CIAM vendors are taking an ‘API-first’ approach to CIAM.”
• “API-driven CIAM architectures may be considered Identity API platforms and are best when instantiated as micro-services.”
• “Deploying CIAM functionality using Identity APIs aligns with the notion of Identity Fabrics.”
• “IT departments should welcome CIAM initiatives, as they provide an opportunity for IT, usually considered a cost center to closely team with Marketing, a revenue producing center.”
• “Opting out of data collection after registration requires consumer account deletion.”
• “IoT device identity management is more complex than simple one-to-one pairings.”
• “Home automation devices, electronics, connected cars, etc. are often used by multiple people within the same household, so one-to-many and many-to-many management schemes are necessary to support real-world identity relationships.”