WEBVTT 00:00:14.200 --> 00:00:19.200 Welcome to the KuppingerCole Analyst Chat. I'm your host. My name is Matthias Reinwarth. 00:00:19.400 --> 00:00:23.350 I'm an analyst and advisor with KuppingerCole 00:00:23.350 --> 00:00:27.300 Analysts. We want to talk about CIAM. And for 00:00:27.300 --> 00:00:33.200 I have invited my dear colleague, John Tolbert, hailing from Seattle. Hi, John. 00:00:34.200 --> 00:00:35.800 Hello, Matthias. Good to see you again. 00:00:36.400 --> 00:00:41.200 Good to have you again. It's been a while. Last time we talked about security practices 00:00:41.500 --> 00:00:47.800 for everyday life. Now we're back to your research. And you have just completed and 00:00:48.400 --> 00:00:57.300 published a leadership compass, a market segment analysis for CIAM. And this is a 00:00:57.300 --> 00:01:02.000 we are following this from the advisory perspective as well. But if we go to the 00:01:02.000 --> 00:01:08.700 mere basics, CIAM, IAM is Clear Identity and Access Management. But what does C stand for 00:01:08.700 --> 00:01:13.000 in that context? And that seems like a simple question, but it isn't, right? 00:01:14.300 --> 00:01:17.004 Yeah, you're right. It is a bit more of a 00:01:17.004 --> 00:01:20.500 complex question than you might think so at first. So 00:01:20.500 --> 00:01:26.500 we've been covering CIAM as its own market for about 10 years now, probably about seven 00:01:26.500 --> 00:01:29.381 different leadership compass reports over those 00:01:29.381 --> 00:01:32.200 10 years. And it has changed significantly. In 00:01:32.200 --> 00:01:38.600 the beginning, we started with calling it Customer Identity and Access Management. And I 00:01:38.600 --> 00:01:45.000 used to say that the C stood for customer, which can be, you know, a business-to-business 00:01:45.600 --> 00:01:52.500 customer or a consumer, someone who's, say, engaging with an online retail site. And then 00:01:52.500 --> 00:01:58.000 as the years progressed, we also included G2C, or government-to-citizen interactions, 00:01:58.200 --> 00:02:04.000 because many of them are intermediated by CIAM solutions, too. But this time, 00:02:04.300 --> 00:02:09.900 you know, we have seen enough of a shift in the overall CIAM market with the big C 00:02:11.700 --> 00:02:17.600 to justify breaking this into two different markets. So this time, I'm calling this 00:02:17.600 --> 00:02:22.900 Consumer Identity and Access Management. And it's really focused on use cases involving, 00:02:23.900 --> 00:02:31.200 you know, sites that do work with thousands, hundreds of thousands, millions, or in some 00:02:31.200 --> 00:02:37.000 cases, even billions of consumer identities for both e-commerce or lots of different use 00:02:37.000 --> 00:02:43.800 cases. But it's really not addressing the B2B CIAM use cases, because we're going to 00:02:43.800 --> 00:02:49.700 quickly follow this up with a special report just on B2B CIAM use cases. 00:02:50.000 --> 00:02:52.770 Exactly. And I know somebody who has asked for 00:02:52.770 --> 00:02:55.600 that quite a while, me, because I think this is 00:02:55.600 --> 00:02:58.037 really a different type of market. And 00:02:58.037 --> 00:03:01.500 especially when you talk to larger end-user companies, 00:03:01.500 --> 00:03:05.803 they are doing business in all areas, 00:03:05.803 --> 00:03:12.200 including the B2B CIAM or B2B CIAM segment. And this is 00:03:12.200 --> 00:03:15.434 something that we deal with in real life all the 00:03:15.434 --> 00:03:18.600 time. But this is for another episode. If we go 00:03:18.600 --> 00:03:22.007 back to the mass volume consumer business, 00:03:22.007 --> 00:03:25.900 and it's been a while since the last edition has 00:03:25.900 --> 00:03:29.065 been published. So what are new developments, 00:03:29.065 --> 00:03:32.300 new requirements that have been emerging since 00:03:32.300 --> 00:03:36.600 you last covered that market? Well, you know, a lot of the basic requirements, 00:03:36.600 --> 00:03:39.547 of course, remain the same, but we see an 00:03:39.547 --> 00:03:43.500 increased emphasis on integrations and interoperability 00:03:43.500 --> 00:03:46.183 with different kinds of third-party platforms. 00:03:46.183 --> 00:03:49.100 Examples of that might be customer data platforms, 00:03:49.800 --> 00:03:53.237 which are designed to pull in information from 00:03:53.237 --> 00:03:56.600 many different sources, CIM systems being one 00:03:56.600 --> 00:04:00.146 of those, but also CRM systems, or CRM systems 00:04:00.146 --> 00:04:04.000 too, should be able to integrate with CIM systems. 00:04:04.000 --> 00:04:07.537 There's increasingly interest in having built-in 00:04:07.537 --> 00:04:11.000 integration with chatbots, AI-powered chatbots, 00:04:11.100 --> 00:04:15.358 to help with customer service functions. Some 00:04:15.358 --> 00:04:19.900 solutions have integrations with payment service 00:04:19.900 --> 00:04:26.100 providers, just to make it easier for other customers or customer prospects to connect to 00:04:26.100 --> 00:04:29.279 payment services. There are third-party 00:04:29.279 --> 00:04:33.600 consent and privacy management solutions that you can 00:04:33.600 --> 00:04:38.324 integrate your CIM solution with if you feel 00:04:38.324 --> 00:04:43.800 like your own CIM solution does not have sufficient 00:04:43.800 --> 00:04:49.400 consent and privacy management capabilities. Of course, this is probably very relevant in 00:04:49.400 --> 00:04:52.166 jurisdictions like the EU or places where you 00:04:52.166 --> 00:04:55.300 have stringent privacy regulations. So yeah, we see 00:04:55.300 --> 00:04:59.232 much more emphasis on integrations out of the 00:04:59.232 --> 00:05:03.600 box. And you can look at this field, CIM, that is, 00:05:03.800 --> 00:05:06.954 in many different ways. There are turnkey 00:05:06.954 --> 00:05:10.800 solutions, which are kind of what they sound like. 00:05:10.800 --> 00:05:17.100 You sign up with a service and you just start using it. There are other developer-first 00:05:17.400 --> 00:05:20.600 types of solutions where there's an expectation 00:05:20.600 --> 00:05:23.800 that the customer will do some amount of custom 00:05:23.800 --> 00:05:26.505 coding to integrate it with their own 00:05:26.505 --> 00:05:30.600 applications or other directories. So being able to have 00:05:31.200 --> 00:05:34.070 connectors for these different services can make 00:05:34.070 --> 00:05:37.000 it quite a bit easier for a customer to get going 00:05:37.200 --> 00:05:39.198 and integrate with different kinds of 00:05:39.198 --> 00:05:42.600 applications. Probably the biggest thing, and this is not going 00:05:42.600 --> 00:05:53.800 to surprise anybody, but one of the biggest requirements now is, what do you do with AI 00:05:53.800 --> 00:05:56.705 in this? I think about, if I recall correctly, 00:05:56.705 --> 00:05:59.800 maybe five or six of the nearly 25 solutions that 00:05:59.800 --> 00:06:04.498 we surveyed have some capabilities with regard to 00:06:04.498 --> 00:06:09.100 being able to distinguish and register and track 00:06:09.300 --> 00:06:15.100 AI agents that are operating on behalf of consumers. So I expect that area will continue 00:06:15.100 --> 00:06:17.611 to grow significantly over the next couple of 00:06:17.611 --> 00:06:20.400 years. And I think from what you've just explained 00:06:20.400 --> 00:06:26.200 with these integrations being in place, I hope and I think that this narrows the overall 00:06:26.200 --> 00:06:28.626 definition of CIM so that you can say, this is CIM 00:06:28.626 --> 00:06:31.100 and this is what it does very well. Authentication, 00:06:31.800 --> 00:06:36.700 authorization, progressive profiling and many functionalities that previously have been 00:06:36.700 --> 00:06:43.000 included in these solutions because they just packaged it with that. Consent management or 00:06:43.000 --> 00:06:45.597 analytics, business intelligence, that is 00:06:45.597 --> 00:06:48.700 more moving towards integrations to have a proper 00:06:48.700 --> 00:06:53.500 platform approach with the right connections to the right systems. Do I get that right, 00:06:53.500 --> 00:06:57.462 or is this still all included if you want it? 00:06:57.462 --> 00:07:01.600 Well, you know, there are CIM solutions that do 00:07:01.600 --> 00:07:04.216 have really good consent and privacy management 00:07:04.216 --> 00:07:07.000 features built in. And for a lot of organizations, 00:07:07.800 --> 00:07:13.600 probably what is available in the CIM solution is sufficient for their needs. 00:07:13.600 --> 00:07:17.700 But there might be others that operate across many different jurisdictions, 00:07:18.900 --> 00:07:22.033 have lots of different regulations they have to 00:07:22.033 --> 00:07:25.500 contend with. And for that, having an out-of-the-box 00:07:25.900 --> 00:07:31.700 integration for a third-party CPM solution would probably be very helpful to them. 00:07:31.900 --> 00:07:34.275 Right. When it comes to using these systems, and 00:07:34.275 --> 00:07:36.600 usually when we are talking about solutions and 00:07:36.600 --> 00:07:39.097 especially in the cybersecurity area, where 00:07:39.097 --> 00:07:42.000 there's a limited amount of users, but we are all, 00:07:42.000 --> 00:07:44.850 if we are technical or not, users of CIM systems 00:07:44.850 --> 00:07:47.700 because we are using these platforms for logging 00:07:47.700 --> 00:07:51.419 into our favorite retailer into, I have to 00:07:51.419 --> 00:07:56.200 mention that, Amazon or even Netflix or something like 00:07:56.200 --> 00:07:58.980 that, where all this is built into this. So we 00:07:58.980 --> 00:08:01.700 are all the harshest critics of these systems 00:08:01.700 --> 00:08:04.751 sometimes. What are your top findings when you 00:08:04.751 --> 00:08:08.000 look at the market as of today? What has changed? 00:08:08.000 --> 00:08:14.300 What has improved? What is new? I was pleasantly surprised to see that 00:08:14.300 --> 00:08:17.157 Passkey authentication is accepted by, I 00:08:17.157 --> 00:08:20.800 counted, about 88% of the vendors that I looked at. 00:08:21.200 --> 00:08:28.100 So that's wonderful. That means just about every solution out there can accept Passkeys 00:08:28.100 --> 00:08:33.104 as authentication. And I like Passkeys for all 00:08:33.104 --> 00:08:38.000 the same reasons that most people do. They're 00:08:38.000 --> 00:08:41.279 the other methods that are out there. But yes, 00:08:41.279 --> 00:08:44.700 speaking as a consumer, I myself find that I get 00:08:44.700 --> 00:08:47.469 frustrated because there are not nearly as 00:08:47.469 --> 00:08:50.700 many sites that offer it, which also leads to the 00:08:50.700 --> 00:08:53.408 question, well, why not? Why aren't they 00:08:53.408 --> 00:08:57.200 offering Passkey authentication if they are using one of 00:08:57.200 --> 00:09:02.100 these modern solutions that we've reviewed? Other 00:09:02.100 --> 00:09:07.000 requirements that we see is sort of an increasing 00:09:07.000 --> 00:09:13.400 need for identity governance and lifecycle management. Some of the largest vendors here 00:09:13.600 --> 00:09:20.000 will say that they have, you know, multiple billions of identities under management. 00:09:21.000 --> 00:09:27.900 So you will see that very, very large sites probably have untold numbers of abandoned 00:09:27.900 --> 00:09:32.700 accounts. And abandoned accounts, first of all, take up space, but they're also a risk. 00:09:32.700 --> 00:09:35.269 You know, an account that could be 00:09:35.269 --> 00:09:39.500 potentially compromised and used for fraud or some other 00:09:39.500 --> 00:09:46.900 malicious means. So identity lifecycle governance has become a much stronger requirement, 00:09:47.200 --> 00:09:49.277 especially on the consumer side, you know, 00:09:49.277 --> 00:09:51.800 which leads to a discussion about account recovery. 00:09:53.000 --> 00:09:55.950 So I think we've all learned over the last couple 00:09:55.950 --> 00:09:58.900 of years that the account recovery process itself 00:09:59.600 --> 00:10:03.913 is highly targeted in both, let's say, insider 00:10:03.913 --> 00:10:08.600 IAM fraud or risk cases as well as consumer fraud. 00:10:09.400 --> 00:10:12.914 So being able to have really good account 00:10:12.914 --> 00:10:17.800 recovery processes that could do identity verification in 00:10:17.800 --> 00:10:20.838 order to get access to the account again, I think 00:10:20.838 --> 00:10:24.000 is, we're only going to see the need for that rise. 00:10:24.200 --> 00:10:28.500 And something else we're beginning to talk about too, just like we've been talking about 00:10:28.500 --> 00:10:31.734 continuous authentication for years, where we're 00:10:31.734 --> 00:10:34.900 evaluating factors like device intelligence and 00:10:34.900 --> 00:10:39.700 maybe behavioral biometrics, just to kind of constantly make sure that the user is 00:10:39.700 --> 00:10:42.768 who they purport to be. I think we need to start 00:10:42.768 --> 00:10:45.900 thinking about continuous identity assurance too, 00:10:45.900 --> 00:10:52.500 and how to implement that as a way to help with not only account recovery, but just 00:10:52.700 --> 00:10:56.700 in general, increasing security posture for consumers. 00:10:56.700 --> 00:10:58.900 Right. And the other thing you want to mention? 00:11:00.400 --> 00:11:04.200 Kind of going along with that built-in identity verification services, we see 00:11:04.500 --> 00:11:07.215 quite a few of the vendors now offering at least 00:11:07.215 --> 00:11:10.100 some level of identity verification out of the box, 00:11:10.100 --> 00:11:13.969 or if not, they will have connectors for several 00:11:13.969 --> 00:11:18.000 of the very many third-party identity verification 00:11:18.100 --> 00:11:24.900 services out there. And that too, I think is very useful for organizational customers of 00:11:24.900 --> 00:11:27.781 CIM solutions to be able to get up and running 00:11:27.781 --> 00:11:30.600 quickly and say, okay, yes, I do need to have 00:11:30.600 --> 00:11:36.100 a higher identity assurance level, and here's the service that my CIM solution provides. 00:11:36.600 --> 00:11:38.850 And hopefully that's good enough for a lot of 00:11:38.850 --> 00:11:41.300 them. If not, then yeah, there may be some custom 00:11:41.600 --> 00:11:45.000 coding to integrate other identity verification services. 00:11:45.300 --> 00:11:49.300 Right. And if you look at runtime, you've mentioned already that you're looking at 00:11:49.400 --> 00:11:52.578 continuous authentication at constant checks 00:11:52.578 --> 00:11:55.900 and in-session governance to understand, yeah, 00:11:55.900 --> 00:11:59.800 that this is still Matthias who is using this account. Does this also 00:11:59.900 --> 00:12:01.902 lap over to device intelligence to 00:12:01.902 --> 00:12:05.200 understand, yeah, this is Matthias and he has been using 00:12:05.200 --> 00:12:10.000 this device for quite a while and it's unchanged and it's not jailbroken or whatever? 00:12:10.500 --> 00:12:12.800 Is this something that is available as a service? 00:12:14.200 --> 00:12:18.600 It is built into many of the CIM solutions that are out there today. 00:12:19.400 --> 00:12:21.300 Yeah, I would think that's a very 00:12:22.800 --> 00:12:28.300 highly desirable requirement if you're looking for a CIM solution, especially the device 00:12:28.200 --> 00:12:30.835 intelligence. Behavioral biometrics, you know, 00:12:30.835 --> 00:12:33.700 how you interact with your computer or your phone, 00:12:34.500 --> 00:12:41.600 that's not as common, but it's definitely another risk signal that could be used. 00:12:42.800 --> 00:12:46.500 But those two can certainly help reduce account takeovers. 00:12:46.500 --> 00:12:50.100 Right. When we look at other devices, depending on the service provided, 00:12:50.800 --> 00:12:56.400 the association of IoT device, is this something that is more common right now? 00:12:56.500 --> 00:13:00.300 Yeah, that's been there for a while. IoT device identity management 00:13:00.500 --> 00:13:04.600 is still a pretty key requirement for many organizations. 00:13:05.800 --> 00:13:11.100 We have lots of different kinds of IoT devices we interact with as consumers, 00:13:11.100 --> 00:13:17.500 everything from home electronics to smart thermostats and smart lights and things like 00:13:17.500 --> 00:13:20.550 that. And yes, we do want to be able to control 00:13:20.550 --> 00:13:23.600 those and use our favorite ID from our favorite 00:13:23.600 --> 00:13:27.360 identity provider to do so. And having a really 00:13:27.360 --> 00:13:31.200 good experience built into the CIM solution that 00:13:31.200 --> 00:13:36.100 enables that, I think is a big plus for organizations that are looking for that. 00:13:37.000 --> 00:13:39.500 So some will merely offer API level 00:13:39.500 --> 00:13:43.500 connectivity for you to build your own self-service user 00:13:43.500 --> 00:13:46.387 interface for that. Others have some 00:13:46.387 --> 00:13:51.600 pre-constructed and extensible user self-service portals that can 00:13:51.600 --> 00:13:56.400 be used for controlling those kinds of devices. So this report has been published already, 00:13:56.400 --> 00:13:59.697 so it's available. So if you are interested 00:13:59.697 --> 00:14:03.300 as the audience in learning more about consumer 00:14:03.300 --> 00:14:06.000 identity and access management and the state of 00:14:06.000 --> 00:14:08.700 the art there, just head over to cupingacol.com 00:14:09.000 --> 00:14:12.081 and have a look at this document. So it should be 00:14:12.081 --> 00:14:15.100 easy to find. It's the latest Leadership Compass 00:14:15.400 --> 00:14:18.208 and it's about CIM. Before we close down, 00:14:18.208 --> 00:14:21.700 John, any final detail that struck you when you did 00:14:21.700 --> 00:14:24.300 the analysis? I'm still struggling with the AI 00:14:24.300 --> 00:14:26.900 agent stuff. I don't know what I would tell an 00:14:27.000 --> 00:14:34.100 agent to do on Amazon for me, but maybe I'm not thinking hard enough. What are the key 00:14:36.100 --> 00:14:39.250 facts that you took home from this research? I 00:14:39.250 --> 00:14:42.400 would say that the most commonly cited example 00:14:42.400 --> 00:14:46.634 of AI agents acting for consumers are the 00:14:46.634 --> 00:14:51.900 travel agent AI agents. You configure your agent to 00:14:51.900 --> 00:14:55.437 be interested in looking for flights to a given 00:14:55.437 --> 00:14:59.200 city. You prefer window seats if you like to leave 00:14:59.200 --> 00:15:02.432 at this time of the day, and you empower it to buy 00:15:02.432 --> 00:15:05.600 the lowest fare that meets all your requirements. 00:15:05.900 --> 00:15:14.800 I think that's an interesting example, but of course they could be problematic if not 00:15:15.000 --> 00:15:18.450 configured properly, that's true, but they're 00:15:18.450 --> 00:15:21.900 also AI agent-powered financial applications, 00:15:22.100 --> 00:15:24.887 so I think it's going to be very, very 00:15:24.887 --> 00:15:28.700 important for those who are deploying those kinds of 00:15:29.400 --> 00:15:33.077 AI agents to be very careful in how do you go 00:15:33.077 --> 00:15:37.000 about authenticating, of course, the user before 00:15:37.000 --> 00:15:39.950 they configure it, but how do you authenticate, 00:15:39.950 --> 00:15:42.900 so to speak, the agent and how do you authorize 00:15:42.900 --> 00:15:48.000 what the agent can do, and at what point do you want to bring the human back into the loop 00:15:48.100 --> 00:15:51.364 to do an authorization for, let's say, a very 00:15:51.364 --> 00:15:54.700 high-value transaction. I think there is a lot 00:15:54.700 --> 00:15:58.452 of work that needs to be done to ensure that 00:15:58.452 --> 00:16:02.800 this doesn't greatly increase fraud or just general 00:16:02.900 --> 00:16:09.200 errors that lead to loss. Yeah, that was also my fear a bit, do I really trust that agent, 00:16:09.200 --> 00:16:12.500 but this is a general topic that we're just discussing in the industry anyways, 00:16:12.700 --> 00:16:18.050 how far can we trust the agent and how can we 00:16:18.050 --> 00:16:23.400 tell the agent what our intent is and that it 00:16:23.400 --> 00:16:28.000 pursues it in the platform. I think that's an interesting part, but anyway, it will not go 00:16:28.000 --> 00:16:31.200 away, so we have to be prepared for that, we have 00:16:31.200 --> 00:16:34.400 to govern that and have to make sure that we have 00:16:34.400 --> 00:16:41.100 the human in the loop or just to kill the agent if things go wrong, and so I think the 00:16:41.100 --> 00:16:48.000 agent governance is also an important part. Thank you, John, for telling us about this 00:16:48.000 --> 00:16:50.809 new research about CIM. This is a really 00:16:50.809 --> 00:16:54.600 heavily changing market. Maybe we pick up with the B2B 00:16:54.600 --> 00:16:57.436 topic in an upcoming episode because this is 00:16:57.436 --> 00:17:00.400 shortly before being finished and published as 00:17:00.600 --> 00:17:03.250 well, and that is the different angle that we 00:17:03.250 --> 00:17:05.900 should have a look at as well. So, thank you, 00:17:05.700 --> 00:17:11.600 John. I'm looking forward to having you then again soon and bye-bye. Thank you. 00:17:30.600 --> 00:17:30.900 you