CIAM pain points.

MAU-based pricing punishes exactly the businesses CIAM is for, and feature gating pushes SSO, advanced MFA, and audit logs into enterprise tiers. The quoted price and the real price diverge sharply once security requirements are on the table.

engineeringproductlegal

Engineering leadership consistently underestimates identity. Login looks like a two-week feature until the unhappy paths appear, and by the time teams reach a CIAM vendor a homegrown system has usually accumulated years of technical debt.

engineeringproduct

Every vendor claims passwordless, orchestration, and fraud protection, so real differences only surface in expensive POCs. Meanwhile four stakeholders with veto power (marketing, security, legal, product) stretch evaluations to 6-12 months.

engineeringsecuritymarketinglegalproduct

For B2B and B2B2C companies, multi-tenancy is its own category of pain: organization modeling, per-tenant SSO with each customer's IdP, SCIM provisioning, delegated administration, and invitation flows. Many platforms bolted these on after being built B2C-first, and it shows in the edge cases.

engineeringproductsecurity

Almost every enterprise arrives with the same human split across an email signup, a social login, a phone-number loyalty account, and a guest-checkout record. Deduplication is not a technical problem, it is a policy problem, and security holds veto power over the matching rules marketing wants.

engineeringsecuritymarketinglegal

The CIAM platform has to speak to legacy apps that predate OIDC, marketing stacks, fraud tools, and support systems. The identity data model rarely matches what is scattered across CRM and marketing databases, so the promised single customer view becomes a data-engineering project the vendor did not scope.

engineeringmarketing

User migration is the single most feared deployment workstream. Password hashes arrive in incompatible or unknown formats, and the choice between bulk import (which forces resets and kills 10-30 percent of dormant accounts) and lazy migration (two systems in parallel for months) has no painless option.

engineeringsecurity

Vendors default tenancy models rarely match brand reality. Shared identity helps cross-sell but forces per-brand consent partitions and GDPR purpose-limitation; separate identity stays clean but doubles operational load. Most large companies land on a hub model whose execution depends on unglamorous capabilities.

engineeringmarketinglegalproduct

AI agents authenticating on behalf of customers are a pressure current CIAM consent and session models were not designed for. An agent acting for a user needs scoped, attenuated identity distinct from the user's own session, with an audit trail that separates agent actions from human ones.

engineeringsecuritylegal

Tens of millions of dormant accounts are a credential-stuffing surface and an inflated MAU bill. GDPR and CCPA deletion sounds simple until it has to cascade across the CIAM store, the CDP, the warehouse, and support tooling, which is what makes the deletion-webhook and event layer core rather than an add-on.

engineeringsecuritylegal

The user store stops being a table and becomes a system. Sub-100ms global authentication, admin search across users, and bulk operations all break at once, and peak events produce 50-100x baseline login traffic on a path you cannot CDN. Rate limits are the hidden constraint.

engineering

Every added authentication step measurably drops conversion, so MFA adoption stalls, while credential stuffing and bot-driven account takeover push in the other direction. The dial never settles, and passkey rollout reintroduces phishable fallback paths it was meant to eliminate.

securitymarketingproduct