Vendor differentiation and the four-veto evaluation.

On paper every CIAM vendor supports passwordless, orchestration, and fraud protection. The claims are identical because the category has converged on the same vocabulary, which means the marketing surface tells you almost nothing. Worse, workforce-IAM vendors rebrand as CIAM without the scale, latency, or consumer UX the job demands, and the rebrand is invisible on a feature grid.

The real differences surface only in a POC, and meaningful POCs are expensive to run. That expense collides with the other structural problem: CIAM is one of the few purchases where four stakeholders hold veto power. Marketing wants zero friction and progressive profiling, security wants step-up and device checks, legal wants consent and data-residency guarantees, and product owns the roadmap. Any one of them can stall the deal, which is why evaluations routinely run six to twelve months.

The way through is to evaluate on the axes that actually diverge, peak-load behavior, consumer latency, orchestration depth, and fine-grained authorization, rather than the ones everyone claims, and to get the four vetoes into the same room early with a shared scorecard. The vendor selector and the neutral capability matrix exist to make that comparison on the same axes instead of on positioning.