Frustrated with login friction and security gaps? CIAM solves both.

FIND OUT HOW
close-button
Datasheet

Making sense of the Ping Identity & ForgeRock CIAM roadmap

Ping Identity’s acquisition of ForgeRock changed the CIAM vendor landscape overnight. This report provides insights into what that might mean for both new and existing customers.

READ THE REPORT

About this report

Ping Identity’s acquisition of ForgeRock – brokered by private equity firm Thoma Bravo – changed the customer identity and access management (CIAM) vendor landscape overnight. This report provides insights into what that might mean for both new and existing customers.

A quick history of how ForgeRock became Ping

Where once there were two CIAM competitors, now there’s one. But it took a while to get there.

To get some perspective, let’s go back to October 2022. Private equity firm Thoma Bravo, which already owned identity vendor SailPoint, was finalizing its $2.8 billion acquisition of Ping Identity. Then, they surprised pretty much everyone by making another big announcement. Thoma Bravo was also buying Ping’s arch rival, ForgeRock, for $2.2 billion. They planned to take the publicly traded company private.

“Not so fast!” said the U.S. Department of Justice (DOJ), which effectively paused Thoma Bravo’s acquisition of ForgeRock. The DOJ proceeded to spend 10 months investigating whether Thoma Bravo’s acquisition of two competitors would be detrimental for customers. In the meantime, Ping Identity and ForgeRock customers and employees wondered: “will they or won’t they?” More specifically, would Thoma Bravo keep Ping and ForgeRock as separate entities or would they mash ‘em together. Or perhaps do a triple-mash-up with SailPoint.

By October 2023, the long “Will they or won’t they” wait was over for CIAM customers of Ping Identity and ForgeRock.

Verdict: mashup it is.

And then, customers had one fewer CIAM choice.

With a nearly duplicative product portfolio (and little customer overlap) between these two competitors, it has naturally led to a lot of questions from current and prospective CIAM customers. Chief among those is which product could get killed? Or, put another way, will the Ping or ForgeRock CIAM customer base be force-migrated into a new product? It’s a doozie.

Of course, when a deal like this is announced everyone talks publicly about all the great new tech and capabilities that have come together. But the biggest challenge is often people. Post merger you’ve got two of everything: VPs of Product, VPs of Customer Success, Directors of Engineering? On each side you’ve got leaders that are emotionally invested in their products and customers. But someone has to make some hard calls because typically there are only so many R&D dollars togo around (remember, this is funded by private equity, not a growth-oriented VC firm).

For the products that don’t make it, even harder decisions await. How do you do the right thing for the existing customer? Do you provide a migration or upgrade path? Offer a replacement? Or – worst case – put the product in maintenance mode and slap an end of life date on it?

For the customer, none of the choices are ideal.

So what do we know so far about how Ping Identity is approaching these decisions?

Ping Identity’s CIAM strategy: 5 key takeaways

To their credit, Ping Identity has been pretty transparent about their CIAM strategy. In fact they released this 10-minute video where their Chief Product Officer reviewed their go-forward vision and strategy for bringing together the overlapping product suites they now own as a result of their acquisition of ForgeRock. You’ll get a glimpse of their detailed product roadmap at 9:26 in the video.

If you have questions, though, we suspect you’re not alone. The video states that Ping will “be supporting both platforms indefinitely into the future.” That sounds great. But when you dig deeper there’s lots and lots of talk about migration and integration through 2025. What we don’t see as much talk about is innovation, particularly when it comes to CIAM.

We like to think of ourselves as being customer obsessed – no matter whose customers they are.
In that spirit, here are our takeaways from the Ping roadmap presentation.

1. Ping won.

When the merger was announced, we pondered whether Ping or ForgeRock would be the CIAM platform of choice. Now we know. For virtually all of the major decisions that were up in the air Ping chose ... wait for it ... Ping’s products. It’s not surprising given that Thoma Bravo, the PE firm that acquired both Ping and ForgeRock, appointed Ping CEO, Andre Durand, to lead the new company.

What this means for CIAM customers:

While this Ping-centric product direction makes business sense for Ping, we think it will spark more than a few questions from ForgeRock’s CIAM customers as they try to figure out how and when the ForgeRock capabilities they’re using will migrate into the newly emerging Ping-branded portfolio.

2. PingOne is the go-forward cloud platform.

In their roadmap presentation, Ping Identity’s Chief Product Officer, Peter Barker, makes it clear that PingOne will be the cloud platform moving forward. An IAM vendor only needs one cloud platform, and it makes sense Ping would choose PingOne. However, left unsaid is what will happen to ForgeRock’s Identity Cloud? Presumably, it has no long-term future.

What this means for CIAM customers:

In the video, Chief Product Officer, Peter Barker, explains that “Ping came from a strength in workforce,” referring to their IAM offerings. But the scale and performance required for workforce IAM is quite different from what’s required for customer IAM. CIAM solutions need to scale to support millions of users globally. PingOne wasn’t designed to do that. Also notable is that PingOne is a multi-tenant solution. If you want the control that comes from a single dedicated cloud instance you’ll have to pay Ping extra for professional services from PingOne Advanced Services.

3. Innovation = integration.

While the video talks a lot about innovation, all of the examples are from the past. And all of the future roadmap items are focused on integration, unification, and migration – not new capabilities. From a migration standpoint, all paths point to PingOne as the north star. Also front and center is the massive undertaking of unifying two different directory stores, creating “migration tools” and “unifying” everything from authentication apps to admin portals. We don’t envy the position Ping is in right now.

What this means for CIAM customers:

‍While there are now bullets on a roadmap slide, there are still lots of outstanding “how” questions we suspect Ping is still figuring out. If you’re a Ping or ForgeRock CIAM customer, it’s fair to ask: is “migration” just a nicer word for “new implementation?” Either way, it’s unlikely to be “free,” so it’s also worth thinking about how much it will cost in terms of new budget asks and your team’s time.

4. Workforce IAM is at the center of the new roadmap.

This makes sense since Workforce IAM was Ping Identity’s bread and butter. The roadmap calls out how ForgeRock Identity Governance and ForgeRock Lifecycle Management will now be used for workforce use cases in combination with PingOne. But CIAM innovations are nowhere to be found in the 2-year roadmap.

What this means for CIAM customers:

Requirements are changing rapidly and – as expected – this roadmap looks pretty crowded with workforce-centric requirements. Can you afford to wait for new innovations (and migration of existing features)?

5. CIAM customers need to make a choice – speed vs control.

The video says that when it comes to SaaS deployment models “customers typically come at the situation from one of two angles – either from speed or control.” It goes on to say that for customers that want “speed” – think time to go-live – they’ll be offered the multi-tenant PingOne solution. But if they want “control” – think data residency and compliance requirements – they will need PingOne Advanced Services.

What this means for CIAM customers:

Why should you have to choose between speed and control? Why can’t you have both? In this case, it’s because PingOne’s architecture isn’t built for it. There’s a reason that ForgeRock (and Strivacity) chose single-instance cloud architectures. The security and performance requirements of CIAM demand it. But with ForgeRock Identity Cloud seemingly marching into the sunset, Ping only has a multi-tenant offering. Making it work as a single instance deployment requires lots of professional services to round out the rough edges. Ping calls this version PingOne Advanced. For more on the different CIAM cloud architectures check out this blog: “Choosing the right CIAM architecture: Navigating single-instance and multi-tenant SaaS solutions.”

Questions to ask Ping Identity about their CIAM roadmap

While the new info that Ping has shared about the roadmap is good progress, there’s obviously still a lotto sort out. That will take more time and will no doubt leave many existing and future CIAM customers wondering what it means for their business. Both ForgeRock and Ping customers have tough decisions ahead of them and for different reasons. If you’re in that camp, here are a few questions that are worth considering (and asking) as you await more news:

  • What does “supporting both platforms indefinitely into the future” really mean? Put another way,what’s the deadline for making a decision on your CIAM tech stack?
  • Apart from the migration and integration, what new CIAM features is Ping planning and how will these be supported across both platforms?
  • How will the roadmap affect the support and maintenance of existing products? Will there be any changes in customer support and response times?
  • Will there be assistance (besides tools) with data migration? Is “migration” really a re-install? And how will compatibility between Ping Identity and ForgeRock products be ensured?
  • Will there be any changes to licensing models or pricing structures for the merged products? How will existing contracts and pricing agreements be honored or modified as they come up for renewal?
  • What measures will be in place to ensure the security of customer data during and after migration? How will compliance with data protection and privacy regulations be maintained?

It’s important not to confuse migration with innovation. You need secure, accessible CIAM solutions that are keeping up with new requirements. Don’t let off the gas pedal when it comes to pushing your CIAM vendor on innovation and timelines.

A cheat sheet to Ping Identity’s CIAM roadmap

While both Ping and ForgeRock historically presented their CIAM offerings as a single solution, the reality is that they include multiple stand-alone products. In fact, following the ForgeRock acquisition Ping has assembled at least two products for most major IAM capabilities. So, it’s natural to ask, which overlapping products is Ping investing in?

While Ping’s roadmap presentations haven’t explicitly said “we chose X instead of Y,” it does drop a lot of hints. We parsed the sentences and pictures in the product roadmap update along with Ping’s relaunched website, and these are the big decisions that stood out to us.

If you see any big decisions we’ve missed or if you think we got anything wrong let us know. We want to make sure this is accurate and we’ll update it as more details come out so this can be a living resource for the broader CIAM community.

Strivacity’s take on Ping’s product roadmap decisions

What we were watching for What we learned
Which cloud platform? PingOne is the clear choice moving forward.
ForgeRock Identity Cloud was not even mentioned.
Which orchestration platform? It’s a bit of a split decision here. It seems Ping DaVinci will be used for cloud deployments while ForgeRock Intelligent Access (aka ForgeRock Trees) will be used for on-prem deployments.
Which identity store? Long-term this will likely be an altogether new product. As the video notes “both companies have a directory product” and as Ping looks “for opportunities to converge and unify core parts of those platforms” it’s starting with the directory.
Which identity verification (IDV)? This one’s easy; it’s a combination of PingOne Verify and Neo since ForgeRock didn’t have its own IDV offering.
Which governance platform? ForgeRock’s IGA solution.
Which MFA? Based on the info we’ve seen it looks like PingOne MFA will be the choice for cloud while ForgeRock MFA will be used for on-prem deployments.
Which authorization? This is a toss up. The combined company gives you 5 different products to choose from and ForgeRock Cloud is missing among them. But the roadmap suggests PingOne Authorize.
Which lifecycle management? Like IDV, this one’s also easy. It’ll be ForgeRock Lifecycle Management since Ping didn’t have an offering here and needed to fill this gap.
Which threat protection? We suspect this’ll be Ping Protect since it’s referenced in the roadmap and ForgeRock Autonomous Access is not.
Which authenticator app? TBD. We’ll keep you updated!
Which common SDKs and UIs? Also TBD. The roadmap has a bullet for “Common SDKs” in the second half of 2024, but it’s unclear what that will look like.

Looking for other CIAM options?

Of course we’re biased, but if you’re looking for other options, take a look at Strivacity.

Why Strivacity? Long story short, we’re 100% focused on CIAM. The capabilities that will take Ping/ForgeRock many coming quarters to rationalize and integrate are available right now from Strivacity in a single product delivered on a single-instance, cloud-native platform (no assembly required).

We’re also the only other CIAM vendor positioned as a Leader in The Forrester Wave™: Customer Identity and Access Management, Q4 2022 (no form).

From registration and self-service, to authentication methods, profile and consent management, and even identity verification and fraud detection, we’re here to help you innovate AND lower your total cost of ownership by 35%.

‍

Prefer a PDF?

Download the full Ebook to read offline or share.

GET THE EBOOK
Strivacity Logo

Schedule a time to meet with us

Just starting your CIAM research? Ready for a product demo? Curious about replacing your current CIAM solution? Schedule time with one of our identity experts for a meeting tailored to your specific needs.

Contact Sales