Forrester includes Strivacity in CIAM best practice report

Forrester has published a new best-practice report titled "Four Essential Principles for Successful CIAM," subtitled "Show Business Value To Avoid Unnecessary Implementation Delays." It's a clear-eyed look at what separates a CIAM program that keeps earning budget from one that stalls out in committee. You can get a copy of the March 2026 report here.

Key takeaways

• CIAM is an ongoing program, and Forrester organizes that work into four pillars: governance, measurement, architecture, and testing
• Forrester sets specific KPI benchmarks for good vs. great: NPS, account opening success, and sign-in success rates
• Most CIAM builds need a rebuild well before their intended lifespan because technical debt piles up faster than planned
• Structured testing is what should justify flow changes
• CIAM sits underneath nearly every customer-facing system (security, IT, compliance, CX, & product), so a CIAM leader's job is proving its value across all of them. It goes beyond registration and sign in.

Security and risk teams that adopt this mentality can build a stronger case for continued CIAM investment.

Governance

CIAM touches nearly every part of a company's IT and security stack, so getting support for it means proving its value in terms other teams understand.

• Define benefits up front, before asking for budget or headcount
• Build a RASCI matrix across the teams CIAM depends on
• Keep a current, living picture of the use cases the program actually supports

A media company's VP of CIAM, interviewed for the report, said leaders who don't spend at least 30% of their time mapping business processes with outside teams end up with a program that underdelivers

Measurement

A CIAM program needs KPIs that speak to all stakeholders and impacted departments.

• Customer NPS*: Forrester considers above 65% to be good, above 80% to be great
• Account opening success rate: above 60% is good, above 85% is great
• Sign-in success rate: above 90% is good, above 95% is great
• Fraud metrics should be correlated with these KPIs

Having these numbers ready is what makes the case for continued investment when leadership asks what CIAM is delivering.

Architecture

Most CIAM implementations are built for a five to seven year lifespan but end up needing a rebuild sooner than expected as technical debt piles up faster than teams plan for.

• Build for the full range of identities a business needs to support, including AI agents
• Rely on open standards like OIDC and FIDO2 instead of proprietary lock-in
• Choose solutions designed for easier upgrades and migrations down the line

Forrester names Strivacity directly here, citing it as an example of standardized SaaS CIAM solutions that helps avoid overcustomization. 

Testing

Testing is often the first thing to get cut when timelines tighten, but Forrester treats it as essential.

• Availability and disaster recovery testing
• Functional and regression testing
• Performance testing under real load
• Structured experiments to validate changes before a full rollout. Lead decision-making with data.

According to the report, a US bank tested new terms and conditions language on just 5% of registration traffic, saw a 10 to 12% lift in conversion over 90 days, and used that data to justify the full rollout.

Why this matters right now

These are not new ideas, but the stakes have changed. As AI agents continue registering, authenticating, and transacting on behalf of customers, demands on CIAM keep growing.

A program without solid governance, measurable KPIs, a modern architecture, and real testing discipline is going to struggle to keep up, let alone prove its value to the business.

Forrester's full report is available now. Access Four Essential Principles For Successful CIAM.

*Net Promoter, NPS, and the NPS-related emoticons are registered U.S. trademarks, and Net Promoter Score and Net Promoter System are service marks, of Bain & Company, Inc., Satmetrix Systems, Inc. and Fred Reichheld. 

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here .