Customer Identity & Access Management (CIAM)

Gartner has not published a Magic Quadrant under the Customer Identity and Access Management name in the recent public record. The scorecard that covers the space is the Magic Quadrant for Access Management, whose November 2025 edition, published November 11, evaluates thirteen vendors, and its defining trend is the one that erased the difference between customer identity and everything else: machine identities, the bots and AI agents that authenticate like users.

The quadrant that absorbed the customer

CIAM and workforce identity used to be two markets with two scorecards, because the buyer was different: marketing owned the customer login, IT security owned the employee login, and the requirements barely overlapped.

The market erased the split from the outside. Consumer logins now carry payments, loyalty, and consent, which makes them security infrastructure. Workforce logins now include contractors, partners, and machines, which makes them customer-shaped. And the newest category of identity, the AI agent, is both at once: it acts for the company and touches customers on its behalf.

The agent is both an employee and a customer, and the quadrant now scores one access layer for both.

The November 2025 Magic Quadrant for Access Management, and the CIAM record inside it

The 2025 edition published November 11, 2025, authored by Brian Guthrie, Nathan Harris, Yemi Davies, and Steve Wessels, evaluating thirteen vendors across fifteen criteria.

Okta holds the longest streak in the market: a Leader for the ninth consecutive year, on its cloud-native portfolio, product execution, and global partner ecosystem, with Auth0, its acquired developer platform, as the CIAM side of the story. The axis splits are telling: Ping Identity leads Completeness of Vision, Microsoft leads Ability to Execute, and the field's shape, Ping's vision, Microsoft's execution, Okta's balance, has been stable across editions.

The CIAM record inside this quadrant lives mostly in Okta's Auth0 and the consumer-grade capabilities the other Leaders ship, but the quadrant's criteria are workforce-first, and the customer identity requirements sit inside them rather than getting their own columns.

The nine-year incumbent and its cautions

Okta's streak comes with the edition's most instructive cautions: high prices, sales execution challenges, a high concentration of customers in North America, and a lack of timely response to cybersecurity incidents.

Read that list as the market's maturity test. Nine consecutive years of leadership did not spare the incumbent from being cautioned on exactly the attributes a security vendor must never be weak on: incident response timing, above all. The vendor responded with bundled pricing, international expansion, and its Secure Identity Commitment, and the caution remains in the record.

Nine years is a credential and a target, and the caution list is where the target shows.

The machine-identity frontier

The 2025 edition's forward-looking content is about machines. The industry analysis around the report names machine identities, bots, and AI agents as the fastest-growing identity population, and the vendors are building for it directly: Okta's Auth0 Platform capabilities are aimed at letting developers build standards-based AI agents with full identity lifecycle management, alongside open standards work for secure AI ecosystems.

The CIAM buyer should read this as the future of their own category. The agent that logs into your customer systems to resolve a support case is a customer identity with elevated privileges, and the quadrant's machine-identity trend is the access management market admitting it.

What the old name still means

The CIAM name is not gone because the problem disappeared. It is gone from the quadrant system because the problem merged, and the merge cost the buyer some precision.

Consumer identity still has requirements the access quadrant only half-scores: consent management under privacy law, login recovery at consumer scale, progressive profiling for marketing, and the brand risk of a bad consumer authentication experience. The access quadrant covers authentication well. The consent and experience layers, the parts a marketing-owned CIAM purchase actually cares about, live between the criteria.

Consent is the CIAM requirement the access quadrant only half-scores, and the buyer who needs it in full is shopping in a scorecard that treats it as a line item.

The honest limit of the merged frame

The honest reading is structural. There is no CIAM-specific tier table to shortcut to, the access quadrant is the working map, and the criteria are weighted toward the workforce buyer.

The machine-identity frontier makes the merge more consequential, not less. The agent population is growing faster than the standards for governing it, and the next editions of the access quadrant will be where the CIAM market's future gets scored, under a name the pasted category no longer owns.

Four questions for the identity buyer

Is the purchase consumer or workforce, really? The quadrant is merged, but the requirements split. If consent, privacy, and consumer-scale recovery are the core, score vendors on those specifically, because the quadrant does not.

What is the incident response record? Okta's caution shows the question applies to incumbents. Ask for the vendor's public incident history and response timelines, in writing.

Does the platform govern agents like people? Machine identity is the frontier. Ask how agents authenticate, what they are permitted to touch, and how their sessions are revoked.

Which standards work is the vendor actually leading? The AI ecosystem standards are forming now. Ask what the vendor contributes, not what it consumes.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

The same shift shows up next door, in Digital Communications Governance and Archiving Solutions. By 2028, Gartner expects 80 percent of regulated firms to merge text and voice surveillance into one platform, up from under 20 percent in 2024, turning the old compliance archive into an AI-powered listening system.

The related category on this site is Identity And Access Management Services. There is no single Forrester evaluation of identity and access management. It runs as four distinct markets with four different vendor sets, and a Leader in one is not a Leader in the others.