Beyond Identity Secure Customers

Over the last decade, organizations have increasingly needed to store and manage identity data for partners, suppliers, and especially customers within enterprise identity systems. Consumer Identity and Access Management (CIAM) solutions address these evolving requirements, but customer authentication in many CIAM deployments still relies heavily on passwords, which remain a primary source of friction and security risk. Password practices such as simplicity and reuse expose both users and organizations to compromise, and while multi-factor authentication (MFA) is often positioned as a fix, customer adoption has been slow. Legacy MFA approaches that keep passwords as the first factor also remain vulnerable to social engineering, SIM swaps, and man-in-the-middle attacks, while attackers continue to find ways to bypass MFA.

Rising threats and regulatory pressure are pushing stronger approaches, including a U.S. government zero trust memorandum that emphasizes integrating MFA broadly and prioritizing phishing-resistant MFA, explicitly highlighting weaknesses in one-time codes and push notifications. In response, passwordless authentication has emerged as a safer, simpler alternative, but implementations differ: some retain passwords for recovery while others fully eliminate them, requiring organizations to match solutions to user experience, security posture, and technology constraints.

Beyond Identity’s Secure Customers is presented as an “invisible,” passwordless MFA solution intended to remove passwords and other phishable factors while improving experience. Delivered via embeddable SDKs for mobile and web, it generates public-private key pairs and self-signed X.509 certificates during registration, binding identity to a specific device with private keys stored in secure hardware (TPM or similar). Authentication uses challenge-response signing plus real-time, risk-based decisions from device and user posture signals. Strengths include frictionless login, adaptive access, privacy-preserving tamper-resistant credentials, and reduced account takeover fraud; challenges include limited support for legacy password-dependent on-premises systems and missing built-in identity proofing for stronger initial registration trust.

• CIAM systems must be able to manage many millions of identities and potentially process billions of logins and transactions per day.
• Password reuse and overly simple passwords are common behaviors that increase organizational security risk.
• Customer adoption of MFA solutions has been surprisingly slow.
• Legacy MFA that uses passwords as a first factor is vulnerable to social engineering, SIM swaps, and man-in-the-middle attacks.
• A U.S. government memorandum calls for integrating and enforcing MFA across applications involving authenticated access to federal systems.
• The memorandum emphasizes phishing-resistant MFA and calls out one-time codes and push notifications as vulnerable to phishing attacks.
• Beyond Identity was founded in early 2019 and is headquartered in New York.
• Secure Customers was launched in September 2021.
• Secure Customers deploys via embeddable SDKs for native mobile and web applications.
• The solution is compliant with PSD2 Strong Customer Authentication.

• “Nonetheless, the problem with existing solutions of customer authentication is that they do not eliminate the root cause of friction and security risk - the password.”
• “In many organizations, users have a tendency to keep their passwords simple, easy to remember, and reuse them across applications, which puts the user and the overall organization's security at risk.”
• “Since attackers are continuously finding new ways to bypass MFAs of all types, it is important to understand the pitfalls of legacy MFA and how important it is to choose the right solution for your organization.”
• “Passwordless authentication solutions should provide organizations with a smooth and frictionless user experience, but not at the expense of security.”
• “Passwordless solutions vary in the technology they leverage to remove the password.”
• “By eliminating passwords and phishable factors, Beyond Identity offers Secure Customers, which is a secure and frictionless authentication solution.”
• “In order to implement MFA more securely and conveniently, passwords should be removed from the equation altogether.”
• “Secure Customers provides an innovative implementation of asymmetric cryptography that underpins TLS to eliminate passwords from the customer experience and the organization's database.”
• “Secure Customers also validates and ensures that each registered device is registered to a known and authorized user by continuously verifying whether or not the device meets the security requirements.”
• “Going passwordless is not something that can be achieved in a single step, but Beyond Identity provides frictionless MFA and makes it easier for customers to authenticate and easier for development teams to implement.”