Customer Identity and Access Management (CIAM) is the identity layer used for external users such as customers, members, or partners. It handles registration, login, password resets, multi-factor authentication, account linking, and session management. Unlike workforce IAM, CIAM must support large, unpredictable user populations and often multiple sign-in methods, including social login, passkeys, and federation through OpenID Connect or OAuth 2.0.
CIAM matters because it concentrates sensitive functions that attackers target: sign-up abuse, credential stuffing, phishing, token theft, and weak account recovery. A poorly designed recovery flow can bypass strong login controls, while weak session handling can let an attacker reuse a stolen token. Defenders use CIAM to reduce password reliance, enforce step-up checks, log suspicious behavior, and isolate customer identities from internal systems. In practice, secure CIAM is less about branding and more about whether the architecture can authenticate users safely without turning recovery and federation into the weakest links.