Unlocking the Future: Rethinking CIAM and Identity Management

Yeah, we were discussing how to pronounce Siam earlier, and I've, I've heard it pronounced very differently across the globe, actually. I, I sometimes just say CIAM, which is, it's harder to say. So I thought I'd introduce myself before I, I talk about rethinking the way SIAM is, is run within organizations. So I'm Ben, I, I run the sales organization for Own id now Own ID was born out of an idea we had, so the founding team of, of our company now, we founded a company called Gigia, which was a Siam vendor. And we run that company for seven, eight years.

And, and we actually sold that company to SAP. And whilst I was there, the team and I were thinking about what, what, what were the, what were the main problems that we're facing our customers. And at Giga we were slightly different to a lot of the Siam vendors. We focused very much on, on the business, on the marketing teams, on the digital and e-commerce teams.

And, and we realized actually that whilst Siam is a great market and we provide a lot of value to our customers, there was still this barrier. Yeah. We weren't making the experiences of our customer's customers better. And so we thought, how can we as an organization actually make a step change in how consumers are interacting with CIM? And so that's how we, that's how we created Own id.

And so we, we spun own ID out of SAP, and now we have built this platform. It's all around passwordless authentication. So we are looking at opportunities of how our customers, customers can use the unlock device mechanism, whether that be on mobile or desktop, to actually authenticate with, with the brands that they, that they want to. And making this, it's, it's, it's very much about making the user experience a better one. So we all know, I, I sometimes go to these meetings and go, who hates passwords? And everybody sticks their sticks their hands up.

We, we, we, we all understand that the friction of passwords, it is out there when we're registering, when we're logging in, when we're checking out, when we've forgotten our password. All of those, all of those points are, are, are broken today.

And we, we, when I speak to go out there and speak to brands, typically you'll see a 30 to 40% drop off when a user is faced with a password. And that's huge. Yeah. So all of these brands that we're talking to, they're spending all of these marketing dollars to try and get people to their websites. And then when people abandon just at the end, it's, you know, they're pouring money down the drain. And we all know in this room that, you know, security is a big thing. Passwords are one of the main forms of fraudulent behavior that, that companies are experiencing. I love this.

When you're actually go, you know, you, you're actually trying to do something. Yeah. You're actually committed to doing something with a, with a company, you wanna buy something. Yeah. And then they say, are you human? And actually, as I've got older, my eyesight's got worse as well. Yeah. And so I'm useless at these things and I often give up. Yeah. This is a frustrating one. I hope there's nobody from BT in the room today, but they, they have the worst kind of login experience. And this is a point where most people go, I know, and this is, you see abandonment rates go even higher. Yeah.

So abandonments then go to 50, 60%. What a waste of money. Yeah. I also hate this one, and this is another BT one, so apologies for anybody from bt, but it's like a, it's like a puzzle.

It's like, you know, how long does it need to be? How different does it need to be? What does it include, what doesn't include? And so again, drop off rates.

Now, way back, way back when we started gig year, actually we thought social was the answer to all of the CM problems. And it was for a long time actually. So people were using Facebook and Twitter and all of those social media sites to actually authenticate, but what they didn't realize was actually they were getting a lot of data on consumers. Yeah. And so consumers hate it now. And actually brands don't like it because actually they like to keep their own data.

So whilst I think, you know, I do see a lot of people still using Google and Apple on sites, but most of the clients I'm talking to are, are, are looking to deprecate most of the other social login mechanisms. So some clever people have come up with some, some, some solutions. So Web Health and Fido Alliance and more recently pass keys, apple, Microsoft, Google, you know, they really care about their consumers and making their lives easier. They like the data as well. Yeah. But they built this technology that uses the device unlock mechanism. I'm sure a lot of you know about it.

It's called pass keys and it's great. It's, it's a fundamental change in the industry yet is just a technology. Yeah. And so I'm gonna explain why it's not as easy as they make make out to be, make it out to be.

In fact, Google have done a really good job. I dunno whether anybody's used pass keys to enable their Google account. They've done a really good job. User experience is really good. Devices have changed. So most of our clients are actually kind of 80, 90% mobile. Their customers tend to to be more skewed onto the mobile side of things. So from our customers, because we analyze what devices they are using, 90% of those consumers are actually interacting with brands that have biometric on them and they're enabled.

And actually Fido's survey, if, if you haven't read it, if you haven't seen it, it's a great survey. A consumers are actually saying that actually they would prefer to use biometrics to interact. We talked about this huge problems with passwords and, and, and phishing and the fraudulent behavior. So just a little bit more on pass keys. Yeah. Not only is it a better user experience, it's actually more secure. Yeah. Because there's no password, it's automatically generated. It's more phishing resistant than passwords. It's not easy to compromise it.

One of the biggest problems is it's, it's not been extensively adopted across the globe. Now people like TikTok, Amazon, Google Meta, you know, they're really helping actually this movement. The more people see, see pass keys and interact biometrically the better for all of us. So what not, what not to do.

So, but I, I talked about Pasky being a, a technology, a lot of people are actually going out there and trying to build this themselves in their own organizations, but it's actually not that easy. You need to think about the devices that people using, the operating systems that people are using and the user experience. So in this example, you've got your login screen on the left hand side and it's saying, sign in with a pass key. Everybody in this conference probably knows what a pass key is, but not many consumers know what a pass key is.

Yet we then, we then faced with another choice as a user, do you want to use a phone or a tablet or a USB security key? Hang on, I'm a consumer, I have none of that. And then it's asking me to do something on my, on, on my laptop. It's telling me to turn on Bluetooth and then I get this QR code.

Now, little secret, this is actually Best Buy in the us This is the experience that they have built and they've built this themselves using past keys technology. A lot of other people are doing this. And actually I think Amazon started doing this, is that they're enabling past keys, but they're not actually making it really good user experience. You've gotta remember to go into your account profile and turn pasties on. Nobody's gonna do it. That last example, best buy 3% of adoption of, of people using it. So what do we need to do?

We need to think, think about all of the different devices that people are using and the different user journeys. So most people are doing this just on login and registration. We need a checkout, we need a forgotten password. We need it when we get an email, a marketing email, and we go in into log in. We don't need to have a password at all anymore. And actually from what we are seeing from, from, from our customers, remember the stat I gave you at the beginning, 60 to 70% of people convert or 34% abandoned.

We are seeing those numbers go all the way up to 90% of those that are using IES or biometric authentication. Now it's not easy, as I said, if you're gonna go away and build this yourself, you need to understand all of the user journeys and build user journeys that enable a good customer experience. You've gotta do it for device, every device, every browser, every ls. And actually when they don't have IES enabled, you need an alternative like the QR code. And then consumers have their own preferences.

And so what own Id have done, we've built this adaptive UX that understands what devices people are using, what operating systems they have, what they did last time they authenticated. And so I've just got a couple of real life examples. This is Carnival Cruises, one of our clients. And here you, you, you log in, you put in your email address and you just click on the face id, there's an explanation of what that button does as well. And it is a native looking button so I understand what it does. Yeah. And then when you click on it, we've got these native sliders that come up.

So it's like an in-app experience that says, oh yeah, this is exactly what I do. 90 to on average 90 times a day to unlock my device. Another real life example, this is NFL don't have a lot of NFL in, in in in Europe, but they are a big sports organization in the us.

Again, really simple user interface, very native looking. And what NFL have done, they, they've created a, a single ID across all of their sites, but also all of the teams. So they're starting to roll this out across all of their team sites as well. Another example, Nestle is a big customer of ours. And this is what I talked about kind of returning user. And this is, this is where we're seeing a huge adoption and a huge uplift in, in terms of authentication. So I've gone back to an Nestle site, I haven't even clicked on sign in or create account or anything like that.

It's recognized me and just said, Hey Ben, use your email. Click on this button authenticate. That's the type of experience people will expect. Last real life example is account recovery.

You know, the drop off rate from 30 40% goes all the way to 50 to 60% at this point. And so why get them to recreate a password when they don't need to use biometrics to authenticate an NFL saw seven outta 10 people using this mechanism rather than going to the forgotten password. And just finally, what's the, what, what, what's the impact?

So we, we look across all, all of our, all of our customers and the impact of implementing this. Typically we'll see about 20 to 25% of consumers choosing to use biometrics in the early stages. But over time, if you're using biometrics on all of those authentication points, we see that go all the way up to 60 to 70%. So 60 to 70% of consumers are choosing not to use a password. And so we increase, we see an increase in new accounts, 10%. Typically the biggest uplift is, is is the conversion rates on, on, on login or checkout.

And then interestingly enough, we didn't expect this when we started the company, but everybody we were speaking to, they were saying yeah actually when we speak to our support centers, the top three support calls typically are forgotten password. And so by doing this, we've seen about a, a 50% reduction in, in calls to the support center. So thank you. Thanks Ben. So we have one question. Oops. One question here from the app and I'll invite anybody to queue up other questions 'cause we have some full time. Hello. I dunno what's going on here. Do you have numbers?

How many of the customers have biometrics plus secure elements on their devices? And then regionally, what's that picture?

Sorry, what was the question? So biometrics on the device, does the device have a secure element and like, does that, is it different around the world?

Yeah, so we do see vast differences across the world and and typically it it, it, it depends on, on what devices they have. Yeah. And in the US you see the prevalence of, of iPhones and IMAX and, and that sort of thing. In Europe it's much more di diverse. Yeah. And actually to be honest with you, the, the experience on on on MAC and iOS is, is better than let's say Windows. And so you do see a, a, a higher adoption in, in markets where, where Mac, Mac and iOS are, are more Relevant. Thank you.

A question, another question that I have actually is like, what is the relation of this kind of passwordless experience to payment? Are you integrating with payment or is that sort of taking over the experience for the user?

Yeah, so actually what what what we did, and we did this on purpose when we started the company, is we, we are not actually trying to compete with any of the, the Siam vendors. Yeah.

So, so we integrate with most of the IDPs out there. So Okta Forge, ForgeRock Ping or Zero. And we see a lot, actually we've integrated a lot with, with Giga because that's kind of where we came from. But what we also see is, is a lot of people have custom built their own built. And a lot of our customers are commerce customers. So a lot of them are actually using Salesforce commerce identity.

So yeah, we, we, we, we did it on purpose. We're not trying to compete.

We, we integrate, we don't store any data. All of the data is stored within the customers. Either their IDP or or or their commerce platform. We're just enabling the technology for our customers. Question from the audience here, lemme bring this to you. Yeah. I still notice that there's still an password option on all the screens. Is there ever a customer bold enough to say remove the option, just Don't do it?

Well, so we get, we are getting this close to that. We have a couple of customers, so Nest Layer are thinking about it on a couple of brands, but it, they're not really transactional brands and we, we actually, so it's about giving customers options. Yeah. And so I don't think we're there. A lot of the people we speak to go, right, we wanna be passwordless by 2026. So you know, it typically it's a vision for everybody. But you know, it just all depends on the brand, the users and, and that sort of thing.

Maybe one last question here, if I don't see any other hands and no other questions in the thing. Is there any relationship to password managers? Like I noticed that usage of password managers is up to like one third in the general population. Any thoughts on that?

Yeah, We not really. No we don't.

We we, you know, we don't have any relationships with any or or anything like that. But yeah, it's an option. Yeah. Cool. Well let's thank Ben for his Contact. Well I think there was one last Question.

Oh, sorry. Yeah, one more question.

Oh, I'm sorry. Yeah, No worries. I'm glad that you're here.

Yeah, just a short question. You showed a lot of face ID logins, but what about desktop or Google and all of this, but then, then that's, then this doesn't work.

Yeah, Yeah. Yeah. So desktop is kind of a very similar experience. I could have shown you some, some slides on, on desktop, but you know, it's a very similar experience.

As I said, Mac works really well there, there is some complexities around kind of Windows machines where people actually have to enable it on, on their machines before they do it. So you see a slightly lower kind of a adoption rate in, in those devices. All right. And Actually you have both as well. Often people will go from mobile to desktop and, and Mac have got it.

Sorry, apple have got it really good 'cause it gets stored in the key chain so you don't need to enroll new devices. Yeah, they're very ver vertically integrated, aren't they? Yeah.

Yeah, they'll be good. Fantastic. Well help me thank Ben for his presentation. Thank you.