Deepak Gupta

Decision tool

CIAM maturity assessment.

Twenty questions across ten dimensions of customer identity. You get a maturity level, a dimension-by-dimension breakdown, and the specific guides and tools that close your biggest gaps. Scoring is transparent, nothing is stored, and no sign-in is required.

Optional context

These tune your recommendations. They don't affect your score, and you can skip them.

IndustryScale (MAU)

01
Authentication & login UX
How users prove who they are, and how much friction that costs.
What is your primary login method today?
Password onlyPassword with optional MFAPassword plus social loginPasswordless available alongside password (magic link, OTP, passkeys)Passwordless (passkeys) is the default
How do you manage login friction and drop-off?
One login flow; we don't measure drop-offBasic login with some analyticsTested login with localization and clear error handlingAdaptive flows tuned by funnel dataContinuously experimented on and optimized
02
MFA & passwordless posture
Strength and coverage of second factors and phishing resistance.
How is multi-factor authentication applied?
No MFAOptional MFA, low adoptionEnforced for admins and high-risk actionsRisk-based / adaptive MFAPhishing-resistant (passkeys / FIDO2) enforced
Which second factors do you offer?
SMS OTP onlySMS plus authenticator-app TOTPTOTP plus pushPush with number matching, WebAuthn availableWebAuthn / passkeys primary, SMS deprecated
03
Authorization model
How access decisions are modeled, managed, and enforced.
How do you model access control?
Ad-hoc checks scattered in app codeSimple roles (admin / user)RBAC with defined roles and permissionsAttribute- or policy-based (ABAC)Fine-grained / relationship-based (ReBAC, Zanzibar-style)
How is authorization policy managed and enforced?
Logic is scattered and undocumentedCentralized in the app, updated manuallyCentralized service or library, reviewedExternalized policy decision point, versionedPolicy-as-code: externalized, tested, and audited
04
Identity lifecycle & profiles
Registration, profiling, recovery, and account lifecycle operations.
How do you handle registration and profiling?
One large signup formBasic signup, manual profile editsVerified signup with profile managementProgressive profiling driven by product contextOrchestrated lifecycle with enrichment and consented data
How do recovery, merge, and deletion work?
Manual, ticket-based account changesSelf-service password reset onlySelf-service recovery, deletion, and exportAutomated lifecycle with merge and retention policiesFully orchestrated lifecycle with audit and policy-driven retention
05
B2B / organization model
Tenancy, enterprise SSO, provisioning, and delegated administration.
How do you model organizations / tenants?
We are B2C only; no organization modelnot scoredUsers are flat; no real tenantsOrganizations / tenants with rolesOrgs plus self-serve enterprise SSO (SAML / OIDC)Orgs plus SSO, SCIM provisioning, and delegated admin
How enterprise-ready is your customer identity?
We are B2C only; not applicablenot scoredNo enterprise featuresManual SSO setup per customerSelf-serve SSO with basic auditSSO, SCIM, JIT, delegated admin, and audit export
06
Consent & privacy governance
Consent capture and privacy rights (DSAR, deletion, residency).
How do you capture and manage consent?
No consent trackingA checkbox at signupConsent recorded with timestamp and versionGranular, purpose-based, revocable consentFull consent lifecycle with preference center and audit
How do you handle privacy rights (DSAR, deletion, residency)?
Ad-hoc, manual handlingDeletion on request, done manuallySelf-service export and deletion (GDPR / CCPA basics)Automated DSAR with data-residency controlsAutomated rights, regional residency, and provable audit
07
Fraud & abuse defense
Bot defense, credential stuffing, and account takeover resistance.
What bot and abuse defenses are in place?
NoneBasic rate limiting or CAPTCHARate limiting plus bot detectionAdaptive bot defense with anomaly detectionLayered: device intelligence, behavioral signals, ITDR
How do you defend against account takeover?
No specific ATO controlsBreached-password checksBreach checks plus suspicious-login alertsRisk-based step-up and credential-stuffing defenseContinuous risk scoring with automated response
08
Compliance readiness
Certifications, mapped controls, and audit evidence.
What is your compliance posture?
No formal compliance postureAware of requirements; gaps unmappedKey controls in place (e.g. SOC 2 in progress)Certified (SOC 2 / ISO 27001) with mapped controlsMulti-framework certified with continuous evidence
How complete is your identity audit logging?
No centralized audit logsBasic application logsAuth and identity events logged centrallyTamper-evident logs with a retention policyImmutable, exportable audit trail mapped to controls
09
Operations, observability & scale
Availability posture and how well you can see your identity system.
What is your scale and availability posture?
Limits unknown; no scale testingHandles current load; no headroom planCapacity planned; single regionMulti-region / HA design with tested failoverProven high scale, multi-region, DR-tested
How well can you observe your identity system?
No auth metrics or alertingBasic uptime monitoringLogin success and latency dashboardsFull observability with alerting on the auth funnelSLOs, anomaly alerting, and incident runbooks
10
Agentic / non-human identity
Machine, workload, and AI-agent identity and delegated access.
How do you manage machine and workload identity?
Shared secrets / long-lived API keysPer-service API keys, rotated manuallyOAuth client credentials with some rotationShort-lived, scoped tokens with automated rotationWorkload identity (mTLS / SPIFFE) or scoped agent tokens, audited
How do AI agents authenticate and get authorized?
No AI agents in our product yetnot scoredAgents reuse human or shared credentialsAgents have dedicated identitiesAgents use scoped, short-lived, consented delegationFine-grained agent authz: on-behalf-of, revocable, audited

0 of 20 answered · answer all to see your profile

Authentication & login UX

MFA & passwordless posture

Authorization model

Identity lifecycle & profiles

B2B / organization model

Consent & privacy governance

Fraud & abuse defense

Compliance readiness

Operations, observability & scale

Agentic / non-human identity