Who IAM – a Closer Look at IAM and CIAM

The speakers open by framing identity and access management (IAM) as a long-standing pillar of information security. They explain that the growth of online services has pushed IAM systems to evolve, leaving buyers with many variants to choose from. They sort these systems into two families: workforce IAM, which serves employees, contractors and partners inside an organisation, and customer IAM (CIAM), which serves external consumers, citizens and clients of a service provider.

They then walk through the core IAM functions, including directories, provisioning, authentication, single sign-on, authorization, lifecycle management, and logging and auditing. Next they show how CIAM handles registration, social login, progressive profiling, consent capture and adaptive authentication, using illustrative examples from insurance and tax services. The comparison covers what the two share, such as multi-factor authentication, federation, API protection and account lifecycle. It also covers where they diverge: role-based policies and approval workflows on the workforce side, versus self-service, user experience, branding and hard-to-predict traffic on the customer side.

The closing part contrasts security posture, privacy obligations and trust assumptions. Workforce IAM leans toward least privilege under HR and IT control, while CIAM balances protection against friction and must meet privacy regulations such as GDPR. The takeaway is that the two designs serve different goals, so teams choosing an IAM platform should first decide whether access control or user experience matters more.