The friction-versus-security dial that never stops moving.

Once a CIAM deployment is live, the friction-versus-security dial never stops moving. Every added step measurably drops conversion, so MFA adoption stalls as marketing watches sign-in and sign-up rates fall. Pushing in the other direction, credential stuffing and bot-driven account takeover make more friction feel necessary. The two forces do not resolve; they have to be balanced continuously.

The way out of a fixed trade-off is to stop applying friction uniformly. Adaptive, risk-based authentication applies step-up only when the signals warrant it, so the low-risk majority stay frictionless and the risky minority get challenged. That depends on real signals: device and behavioral risk, bot-detection, and breached-password detection feeding a policy engine rather than a blanket MFA prompt.

Passkeys change the shape of this but do not end it. They remove the phishable password from the primary path, but users are spread across devices and ecosystems, and the fallback flow, the path for a user whose passkey is not available, quietly reintroduces the phishable methods passkeys were meant to eliminate. Evaluate the fallback as carefully as the happy path. See passkeys, adaptive risk-based authentication, and account-takeover defense.