[](https://www.paloaltonetworks.com/?ts=markdown)

* Sign In
  
  * Customer
  * Partner
  * Employee
  * [Login to download](https://www.paloaltonetworks.com/login?ts=markdown)
  * [Join us to become a member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown)

* EN
  
  * [USA (ENGLISH)](https://www.paloaltonetworks.com)
  * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au)
  * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br)
  * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca)
  * [CHINA (简体中文)](https://www.paloaltonetworks.cn)
  * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr)
  * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de)
  * [INDIA (ENGLISH)](https://www.paloaltonetworks.in)
  * [ITALY (ITALIANO)](https://www.paloaltonetworks.it)
  * [JAPAN (日本語)](https://www.paloaltonetworks.jp)
  * [KOREA (한국어)](https://www.paloaltonetworks.co.kr)
  * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat)
  * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx)
  * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg)
  * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es)
  * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw)
  * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk)

* ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)

* [What's New](https://www.paloaltonetworks.com/resources?ts=markdown)

* [Get Support](https://support.paloaltonetworks.com/SupportAccount/MyAccount)

* [Under Attack?](https://start.paloaltonetworks.com/contact-unit42.html)
  ![x close icon to close mobile navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/x-black.svg) [![Palo Alto Networks logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)](https://www.paloaltonetworks.com/?ts=markdown) ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg)

* [](https://www.paloaltonetworks.com/?ts=markdown)

* Products  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Products  
  [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)
  
  * [AI Security](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)
  
  * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)
  
  * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)
  
  * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)
  
  * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)
  
  * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)
  
  * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)
  
  * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)
  
  * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)
  
  * [Enterprise Device Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)
  
  * [Medical Device Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)
  
  * [OT Device Security](https://www.paloaltonetworks.com/network-security/ot-device-security?ts=markdown)
  
  * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)
  
  * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)
  
  * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)
  
  * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)
  
  * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)
  
  * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)
  
  * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)
  
  * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)
  
  * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)
  
  * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)
  
  * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)
  
  * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)
  
  * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)
  
  * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)
  
  * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)
  
  * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)
  
  * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)
  
  * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)  
    [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)
  
  * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
  
  * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
  
  * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)
  
  * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)
  
  * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)
  
  * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)
  
  * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)
  
  * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)
  
  * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)
  
  * [Cortex AgentiX](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown)
  
  * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)
  
  * [Cortex Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown)
  
  * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)
  
  * [Cortex Advanced Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown)
  
  * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)
  
  * [Unit 42 Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)  
    [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberark/Seamless_IDs_small.jpg)  
    Identity Security](https://www.paloaltonetworks.com/identity-security?ts=markdown)

* Solutions  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Solutions  
  Secure AI by Design
  
  * [Secure AI Ecosystem](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)
  * [Secure GenAI Usage](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)  
    Network Security
  * [Cloud Network Security](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)
  * [Data Center Security](https://www.paloaltonetworks.com/network-security/data-center?ts=markdown)
  * [DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)
  * [Intrusion Detection and Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)
  * [Device Security](https://www.paloaltonetworks.com/network-security/device-security?ts=markdown)
  * [OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown)
  * [5G Security](https://www.paloaltonetworks.com/network-security/5g-security?ts=markdown)
  * [Secure All Apps, Users and Locations](https://www.paloaltonetworks.com/sase/secure-users-data-apps-devices?ts=markdown)
  * [Secure Branch Transformation](https://www.paloaltonetworks.com/sase/secure-branch-transformation?ts=markdown)
  * [Secure Work on Any Device](https://www.paloaltonetworks.com/sase/secure-work-on-any-device?ts=markdown)
  * [VPN Replacement](https://www.paloaltonetworks.com/sase/vpn-replacement-for-secure-remote-access?ts=markdown)
  * [Web \& Phishing Security](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)  
    Cloud Security
  * [Application Security Posture Management (ASPM)](https://www.paloaltonetworks.com/cortex/cloud/application-security-posture-management?ts=markdown)
  * [Software Supply Chain Security](https://www.paloaltonetworks.com/cortex/cloud/software-supply-chain-security?ts=markdown)
  * [Code Security](https://www.paloaltonetworks.com/cortex/cloud/code-security?ts=markdown)
  * [Cloud Security Posture Management (CSPM)](https://www.paloaltonetworks.com/cortex/cloud/cloud-security-posture-management?ts=markdown)
  * [Cloud Infrastructure Entitlement Management (CIEM)](https://www.paloaltonetworks.com/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown)
  * [Data Security Posture Management (DSPM)](https://www.paloaltonetworks.com/cortex/cloud/data-security-posture-management?ts=markdown)
  * [AI Security Posture Management (AI-SPM)](https://www.paloaltonetworks.com/cortex/cloud/ai-security-posture-management?ts=markdown)
  * [Cloud Detection \& Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown)
  * [Cloud Workload Protection (CWP)](https://www.paloaltonetworks.com/cortex/cloud/cloud-workload-protection?ts=markdown)
  * [Web Application \& API Security (WAAS)](https://www.paloaltonetworks.com/cortex/cloud/web-app-api-security?ts=markdown)  
    Security Operations
  * [Cloud Detection \& Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown)
  * [Security Information and Event Management](https://www.paloaltonetworks.com/cortex/modernize-siem?ts=markdown)
  * [Network Security Automation](https://www.paloaltonetworks.com/cortex/network-security-automation?ts=markdown)
  * [Incident Case Management](https://www.paloaltonetworks.com/cortex/incident-case-management?ts=markdown)
  * [SOC Automation](https://www.paloaltonetworks.com/cortex/security-operations-automation?ts=markdown)
  * [Threat Intel Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown)
  * [Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)
  * [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management?ts=markdown)
  * [Compliance Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/compliance-management?ts=markdown)
  * [Internet Operations Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/internet-operations-management?ts=markdown)
  * [Extended Data Lake (XDL)](https://www.paloaltonetworks.com/cortex/cortex-xdl?ts=markdown)
  * [Agentic Assistant](https://www.paloaltonetworks.com/cortex/cortex-agentic-assistant?ts=markdown)  
    Endpoint Security
  * [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown)
  * [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/detection-and-response?ts=markdown)
  * [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown)
  * [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown)  
    [Industries](https://www.paloaltonetworks.com/industry?ts=markdown)
  * [Public Sector](https://www.paloaltonetworks.com/industry/public-sector?ts=markdown)
  * [Financial Services](https://www.paloaltonetworks.com/industry/financial-services?ts=markdown)
  * [Manufacturing](https://www.paloaltonetworks.com/industry/manufacturing?ts=markdown)
  * [Healthcare](https://www.paloaltonetworks.com/industry/healthcare?ts=markdown)
  * [Small \& Medium Business Solutions](https://www.paloaltonetworks.com/industry/small-medium-business-portfolio?ts=markdown)  
    [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberark/Seamless_IDs_small.jpg)  
    Identity Security](https://www.paloaltonetworks.com/identity-security?ts=markdown)

* Services  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Services  
  [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)
  
  * [Assess](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)
  
  * [AI Security Assessment](https://www.paloaltonetworks.com/unit42/assess/ai-security-assessment?ts=markdown)
  
  * [Attack Surface Assessment](https://www.paloaltonetworks.com/unit42/assess/attack-surface-assessment?ts=markdown)
  
  * [Breach Readiness Review](https://www.paloaltonetworks.com/unit42/assess/breach-readiness-review?ts=markdown)
  
  * [BEC Readiness Assessment](https://www.paloaltonetworks.com/bec-readiness-assessment?ts=markdown)
  
  * [Cloud Security Assessment](https://www.paloaltonetworks.com/unit42/assess/cloud-security-assessment?ts=markdown)
  
  * [Compromise Assessment](https://www.paloaltonetworks.com/unit42/assess/compromise-assessment?ts=markdown)
  
  * [Cyber Risk Assessment](https://www.paloaltonetworks.com/unit42/assess/cyber-risk-assessment?ts=markdown)
  
  * [M\&A Cyber Due Diligence](https://www.paloaltonetworks.com/unit42/assess/mergers-acquisitions-cyber-due-diligence?ts=markdown)
  
  * [Penetration Testing](https://www.paloaltonetworks.com/unit42/assess/penetration-testing?ts=markdown)
  
  * [Purple Team Exercises](https://www.paloaltonetworks.com/unit42/assess/purple-teaming?ts=markdown)
  
  * [Ransomware Readiness Assessment](https://www.paloaltonetworks.com/unit42/assess/ransomware-readiness-assessment?ts=markdown)
  
  * [SOC Assessment](https://www.paloaltonetworks.com/unit42/assess/soc-assessment?ts=markdown)
  
  * [Supply Chain Risk Assessment](https://www.paloaltonetworks.com/unit42/assess/supply-chain-risk-assessment?ts=markdown)
  
  * [Tabletop Exercises](https://www.paloaltonetworks.com/unit42/assess/tabletop-exercise?ts=markdown)
  
  * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown)
  
  * [Respond](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)
  
  * [Cloud Incident Response](https://www.paloaltonetworks.com/unit42/respond/cloud-incident-response?ts=markdown)
  
  * [Digital Forensics](https://www.paloaltonetworks.com/unit42/respond/digital-forensics?ts=markdown)
  
  * [Incident Response](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown)
  
  * [Managed Detection and Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown)
  
  * [Managed Threat Hunting](https://www.paloaltonetworks.com/unit42/respond/managed-threat-hunting?ts=markdown)
  
  * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)
  
  * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown)
  
  * [Transform](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)
  
  * [IR Plan Development and Review](https://www.paloaltonetworks.com/unit42/transform/incident-response-plan-development-review?ts=markdown)
  
  * [Security Program Design](https://www.paloaltonetworks.com/unit42/transform/security-program-design?ts=markdown)
  
  * [Virtual CISO](https://www.paloaltonetworks.com/unit42/transform/vciso?ts=markdown)
  
  * [Zero Trust Advisory](https://www.paloaltonetworks.com/unit42/transform/zero-trust-advisory?ts=markdown)  
    [Global Customer Services](https://www.paloaltonetworks.com/services?ts=markdown)
  
  * [Education \& Training](https://www.paloaltonetworks.com/services/education?ts=markdown)
  
  * [Professional Services](https://www.paloaltonetworks.com/services/consulting?ts=markdown)
  
  * [Success Tools](https://www.paloaltonetworks.com/services/customer-success-tools?ts=markdown)
  
  * [Support Services](https://www.paloaltonetworks.com/services/solution-assurance?ts=markdown)
  
  * [Customer Success](https://www.paloaltonetworks.com/services/customer-success?ts=markdown)  
    [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-unit-42.svg)  
    UNIT 42 RETAINER
    Custom-built to fit your organization's needs, you can choose to allocate your retainer hours to any of our offerings, including proactive cyber risk management services. Learn how you can put the world-class Unit 42 Incident Response team on speed dial.
    Learn more](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown)

* Partners  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Partners  
  NextWave Partners
  
  * [NextWave Partner Community](https://www.paloaltonetworks.com/partners?ts=markdown)
  * [Cloud Service Providers](https://www.paloaltonetworks.com/partners/nextwave-for-csp?ts=markdown)
  * [Global Systems Integrators](https://www.paloaltonetworks.com/partners/nextwave-for-gsi?ts=markdown)
  * [Technology Partners](https://www.paloaltonetworks.com/partners/technology-partners?ts=markdown)
  * [Service Providers](https://www.paloaltonetworks.com/partners/service-providers?ts=markdown)
  * [Solution Providers](https://www.paloaltonetworks.com/partners/nextwave-solution-providers?ts=markdown)
  * [Managed Security Service Providers](https://www.paloaltonetworks.com/partners/managed-security-service-providers?ts=markdown)
  * [XMDR Partners](https://www.paloaltonetworks.com/partners/managed-security-service-providers/xmdr?ts=markdown)  
    Take Action
  * [Portal Login](https://www.paloaltonetworks.com/partners/nextwave-partner-portal?ts=markdown)
  * [Managed Services Program](https://www.paloaltonetworks.com/partners/managed-security-services-provider-program?ts=markdown)
  * [Become a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=becomepartner)
  * [Request Access](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=requestaccess)
  * [Find a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerlocator)  
    [CYBERFORCE
    CYBERFORCE represents the top 1% of partner engineers trusted for their security expertise.
    Learn more](https://www.paloaltonetworks.com/cyberforce?ts=markdown)

* Company  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Company  
  Palo Alto Networks
  
  * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
  * [Management Team](https://www.paloaltonetworks.com/about-us/management?ts=markdown)
  * [Investor Relations](https://investors.paloaltonetworks.com)
  * [Locations](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
  * [Ethics \& Compliance](https://www.paloaltonetworks.com/company/ethics-and-compliance?ts=markdown)
  * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
  * [Military \& Veterans](https://jobs.paloaltonetworks.com/military)  
    [Why Palo Alto Networks?](https://www.paloaltonetworks.com/why-paloaltonetworks?ts=markdown)
  * [Precision AI Security](https://www.paloaltonetworks.com/precision-ai-security?ts=markdown)
  * [Our Platform Approach](https://www.paloaltonetworks.com/why-paloaltonetworks/platformization?ts=markdown)
  * [Accelerate Your Cybersecurity Transformation](https://www.paloaltonetworks.com/why-paloaltonetworks/nam-cxo-portfolio?ts=markdown)
  * [Awards \& Recognition](https://www.paloaltonetworks.com/about-us/awards?ts=markdown)
  * [Customer Stories](https://www.paloaltonetworks.com/customers?ts=markdown)
  * [Global Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
  * [Trust 360 Program](https://www.paloaltonetworks.com/resources/whitepapers/trust-360?ts=markdown)  
    Careers
  * [Overview](https://jobs.paloaltonetworks.com/)
  * [Culture \& Benefits](https://jobs.paloaltonetworks.com/en/culture/)  
    [A Newsweek Most Loved Workplace
    "Businesses that do right by their employees"
    Read more](https://www.paloaltonetworks.com/company/press/2021/palo-alto-networks-secures-top-ranking-on-newsweek-s-most-loved-workplaces-list-for-2021?ts=markdown)

* More  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) More  
  Resources
  
  * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
  * [Unit 42 Threat Research](https://unit42.paloaltonetworks.com/)
  * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
  * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
  * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
  * [Tech Insider](https://techinsider.paloaltonetworks.com/)
  * [Knowledge Base](https://knowledgebase.paloaltonetworks.com/)
  * [Palo Alto Networks TV](https://tv.paloaltonetworks.com/)
  * [Perspectives of Leaders](https://www.paloaltonetworks.com/perspectives/?ts=markdown)
  * [Cyber Perspectives Magazine](https://www.paloaltonetworks.com/cybersecurity-perspectives/cyber-perspectives-magazine?ts=markdown)
  * [Regional Cloud Locations](https://www.paloaltonetworks.com/products/regional-cloud-locations?ts=markdown)
  * [Tech Docs](https://docs.paloaltonetworks.com/)
  * [Security Posture Assessment](https://www.paloaltonetworks.com/security-posture-assessment?ts=markdown)
  * [Threat Vector Podcast](https://unit42.paloaltonetworks.com/unit-42-threat-vector-podcast/)
  * [Packet Pushers Podcasts](https://www.paloaltonetworks.com/podcasts/packet-pusher?ts=markdown)  
    Connect
  * [LIVE community](https://live.paloaltonetworks.com/)
  * [Events](https://events.paloaltonetworks.com/)
  * [Executive Briefing Center](https://www.paloaltonetworks.com/about-us/executive-briefing-program?ts=markdown)
  * [Demos](https://www.paloaltonetworks.com/demos?ts=markdown)
  * [Contact us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)  
    [Blog
    Stay up-to-date on industry trends and the latest innovations from the world's largest cybersecurity
    Learn more](https://www.paloaltonetworks.com/blog/)

* Sign In  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Sign In
  
  * Customer
  * Partner
  * Employee
  * [Login to download](https://www.paloaltonetworks.com/login?ts=markdown)
  * [Join us to become a member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown)

* EN  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Language
  
  * [USA (ENGLISH)](https://www.paloaltonetworks.com)
  * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au)
  * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br)
  * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca)
  * [CHINA (简体中文)](https://www.paloaltonetworks.cn)
  * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr)
  * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de)
  * [INDIA (ENGLISH)](https://www.paloaltonetworks.in)
  * [ITALY (ITALIANO)](https://www.paloaltonetworks.it)
  * [JAPAN (日本語)](https://www.paloaltonetworks.jp)
  * [KOREA (한국어)](https://www.paloaltonetworks.co.kr)
  * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat)
  * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx)
  * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg)
  * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es)
  * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw)
  * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)

* [What's New](https://www.paloaltonetworks.com/resources?ts=markdown)

* [Get support](https://support.paloaltonetworks.com/SupportAccount/MyAccount)

* [Under Attack?](https://start.paloaltonetworks.com/contact-unit42.html)

* [Demos and Trials](https://www.paloaltonetworks.com/get-started?ts=markdown)  
  Search  
  All

* [Tech Docs](https://docs.paloaltonetworks.com/search)  
  Close search modal
  [Deploy Bravely --- Secure your AI transformation with Prisma AIRS](https://www.paloaltonetworks.com/deploybravely?ts=markdown)  
  [](https://www.paloaltonetworks.com/?ts=markdown)

1. [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
2. [Identity Security](https://www.paloaltonetworks.com/cyberpedia/identity-security?ts=markdown)
3. [Access Management](https://www.paloaltonetworks.com/cyberpedia/access-management?ts=markdown)
4. [What Is CIAM?](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam?ts=markdown)  
   Table of Contents

* [What Is Access Management?](https://www.paloaltonetworks.com/cyberpedia/access-management?ts=markdown)
  * [Understanding Access Management](https://www.paloaltonetworks.com/cyberpedia/access-management#understanding?ts=markdown)
  * [What Are the Key Components of Access Management?](https://www.paloaltonetworks.com/cyberpedia/access-management#what?ts=markdown)
  * [Types of Access Management Solutions](https://www.paloaltonetworks.com/cyberpedia/access-management#types?ts=markdown)
  * [Implementing Access Management](https://www.paloaltonetworks.com/cyberpedia/access-management#implementing?ts=markdown)
  * [Access Management FAQs](https://www.paloaltonetworks.com/cyberpedia/access-management#faqs?ts=markdown)
* [What Is Access Control?](https://www.paloaltonetworks.com/cyberpedia/access-control?ts=markdown)
  * [Access Control Explained](https://www.paloaltonetworks.com/cyberpedia/access-control#explained?ts=markdown)
  * [What Are Different Types of Access Control?](https://www.paloaltonetworks.com/cyberpedia/access-control#different?ts=markdown)
  * [Benefits of Effective Access Control Systems](https://www.paloaltonetworks.com/cyberpedia/access-control#benefits?ts=markdown)
  * [Access Control Use Cases](https://www.paloaltonetworks.com/cyberpedia/access-control#use-cases?ts=markdown)
  * [DSPM and Access Control](https://www.paloaltonetworks.com/cyberpedia/access-control#dspm?ts=markdown)
  * [Access Control FAQs](https://www.paloaltonetworks.com/cyberpedia/access-control#faqs?ts=markdown)
* What Is CIAM (Customer Identity and Access Management)?
  * [CIAM Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#ciam?ts=markdown)
  * [CIAM Architecture and Security Components](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#architecture?ts=markdown)
  * [CIAM Versus Traditional IAM for Workforce Users](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#users?ts=markdown)
  * [CIAM and the Zero Trust Security Model](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#model?ts=markdown)
  * [CIAM Implementation: Attacker Behavior and Mitigation](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#mitigation?ts=markdown)
  * [Customer Identity and Access Management (CIAM) FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#faqs?ts=markdown)
* [What Is Single Sign-On (SSO)? Benefits, Risks, And Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-single-sign-on-sso?ts=markdown)
  * [Why Single Sign-On Matters](https://www.paloaltonetworks.com/cyberpedia/what-is-single-sign-on-sso#why?ts=markdown)
  * [How Single Sign-On Works](https://www.paloaltonetworks.com/cyberpedia/what-is-single-sign-on-sso#how?ts=markdown)
  * [SSO Features and Functions](https://www.paloaltonetworks.com/cyberpedia/what-is-single-sign-on-sso#sso?ts=markdown)
  * [Business Benefits of Single Sign-On](https://www.paloaltonetworks.com/cyberpedia/what-is-single-sign-on-sso#business?ts=markdown)
  * [Security Cautions and Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-single-sign-on-sso#security?ts=markdown)
  * [SSO FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-single-sign-on-sso#faqs?ts=markdown)
* [What Is Passwordless Authentication?](https://www.paloaltonetworks.com/cyberpedia/what-is-passwordless-authentication?ts=markdown)
  * [Passwordless Authentication Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-passwordless-authentication#explained?ts=markdown)
  * [The Problem With Passwords](https://www.paloaltonetworks.com/cyberpedia/what-is-passwordless-authentication#problem?ts=markdown)
  * [How Passwordless Authentication Works](https://www.paloaltonetworks.com/cyberpedia/what-is-passwordless-authentication#how?ts=markdown)
  * [How Passwordless Fits With SSO and MFA](https://www.paloaltonetworks.com/cyberpedia/what-is-passwordless-authentication#fits?ts=markdown)
  * [Passwordless Authentication Benefits](https://www.paloaltonetworks.com/cyberpedia/what-is-passwordless-authentication#benefits?ts=markdown)
  * [FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-passwordless-authentication#faqs?ts=markdown)
* [Authentication and Authorization Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-authentication-and-authorization?ts=markdown)
  * [Authentication and Authorization Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-authentication-and-authorization#explained?ts=markdown)
  * [Differentiating Authentication from Authorization](https://www.paloaltonetworks.com/cyberpedia/what-is-authentication-and-authorization#authentication?ts=markdown)
  * [Authorization Models: RBAC, ABAC, and Policy Enforcement](https://www.paloaltonetworks.com/cyberpedia/what-is-authentication-and-authorization#models?ts=markdown)
  * [Lateral Movement and Attacker Workflow](https://www.paloaltonetworks.com/cyberpedia/what-is-authentication-and-authorization#workflow?ts=markdown)
  * [Cloud Security Implications for Authorization](https://www.paloaltonetworks.com/cyberpedia/what-is-authentication-and-authorization#cloud?ts=markdown)
  * [Zero Trust Alignment with Access Control](https://www.paloaltonetworks.com/cyberpedia/what-is-authentication-and-authorization#control?ts=markdown)
  * [Authentication and Authorization FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-authentication-and-authorization#faqs?ts=markdown)
* [What is BeyondCorp?](https://www.paloaltonetworks.com/cyberpedia/what-is-beyondcorp?ts=markdown)
  * [Why Organizations Use BeyondCorp](https://www.paloaltonetworks.com/cyberpedia/what-is-beyondcorp#why?ts=markdown)
  * [How BeyondCorp Works](https://www.paloaltonetworks.com/cyberpedia/what-is-beyondcorp#how?ts=markdown)
  * [How BeyondCorp Relates to Zero Trust](https://www.paloaltonetworks.com/cyberpedia/what-is-beyondcorp#relate?ts=markdown)
* [What is the Evolution of Multifactor Authentication](https://www.paloaltonetworks.com/cyberpedia/what-is-the-evolution-of-multi-factor-authentication?ts=markdown)
  * [Drivers for the Evolution of MFA](https://www.paloaltonetworks.com/cyberpedia/what-is-the-evolution-of-multi-factor-authentication#drivers?ts=markdown)
  * [Brief History of Multi-Factor Authentication](https://www.paloaltonetworks.com/cyberpedia/what-is-the-evolution-of-multi-factor-authentication#brief?ts=markdown)
  * [The Future of Authentication](https://www.paloaltonetworks.com/cyberpedia/what-is-the-evolution-of-multi-factor-authentication#future?ts=markdown)
  * [Evolution of MFA FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-the-evolution-of-multi-factor-authentication#faqs?ts=markdown)
* [What Is the Principle of Least Privilege?](https://www.paloaltonetworks.com/cyberpedia/what-is-the-principle-of-least-privilege?ts=markdown)
  * [How does the principle of least privilege (PoLP) work?](https://www.paloaltonetworks.com/cyberpedia/what-is-the-principle-of-least-privilege#how?ts=markdown)
  * [Why Is the Principle of Least Privilege Important?](https://www.paloaltonetworks.com/cyberpedia/what-is-the-principle-of-least-privilege#why?ts=markdown)
  * [What Are the Benefits of the Principle of Least Privilege?](https://www.paloaltonetworks.com/cyberpedia/what-is-the-principle-of-least-privilege#what?ts=markdown)
  * [How to Implement PoLP in your organization](https://www.paloaltonetworks.com/cyberpedia/what-is-the-principle-of-least-privilege#organization?ts=markdown)
  * [Get PoLP with ZTNA 2.0 on Prisma Access](https://www.paloaltonetworks.com/cyberpedia/what-is-the-principle-of-least-privilege#get?ts=markdown)
  * [Principle of Least Privilege Access FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-the-principle-of-least-privilege#faqs?ts=markdown)
* [What Is Cloud Infrastructure Entitlement Management (CIEM)?](https://www.paloaltonetworks.com/cyberpedia/what-is-ciem?ts=markdown)
  * [Why Is CIEM Important to Your Cloud Security Strategy?](https://www.paloaltonetworks.com/cyberpedia/what-is-ciem#why?ts=markdown)
  * [What Are the Components of CIEM?](https://www.paloaltonetworks.com/cyberpedia/what-is-ciem#what?ts=markdown)
  * [How Is CIEM Used?](https://www.paloaltonetworks.com/cyberpedia/what-is-ciem#how?ts=markdown)
  * [How Does CIEM Improves Cloud Security?](https://www.paloaltonetworks.com/cyberpedia/what-is-ciem#security?ts=markdown)
  * [Key Security Benefits of CIEM](https://www.paloaltonetworks.com/cyberpedia/what-is-ciem#key?ts=markdown)
  * [Discover CIEM | Prisma Cloud](https://www.paloaltonetworks.com/cyberpedia/what-is-ciem#discover?ts=markdown)
  * [CIEM FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-ciem#faqs?ts=markdown)
* [What is Multifactor Authentication (MFA) Implementation?](https://www.paloaltonetworks.com/cyberpedia/what-is-mfa-implementation?ts=markdown)
  * [Why MFA Implementation is Important](https://www.paloaltonetworks.com/cyberpedia/what-is-mfa-implementation#why?ts=markdown)
  * [Planning Your MFA Implementation Strategy](https://www.paloaltonetworks.com/cyberpedia/what-is-mfa-implementation#planning?ts=markdown)
  * [Step-by-Step Guide to Implementing MFA](https://www.paloaltonetworks.com/cyberpedia/what-is-mfa-implementation#step?ts=markdown)
  * [Overcoming Challenges in MFA Implementation](https://www.paloaltonetworks.com/cyberpedia/what-is-mfa-implementation#overcoming?ts=markdown)
  * [Best Practices for Maintaining Effective MFA](https://www.paloaltonetworks.com/cyberpedia/what-is-mfa-implementation#best?ts=markdown)
  * [Evaluating the Success of MFA Deployment](https://www.paloaltonetworks.com/cyberpedia/what-is-mfa-implementation#evaluating?ts=markdown)
  * [MFA Implementation FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-mfa-implementation#faqs?ts=markdown)
* [What Is Identity and Access Management (IAM)?](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-and-access-management?ts=markdown)
  * [What Is Identity and Access Management?](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-and-access-management#what?ts=markdown)
  * [Why Is IAM Important?](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-and-access-management#why?ts=markdown)
  * [IAM vs. PAM](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-and-access-management#iam-vs-pam?ts=markdown)
  * [Cloud IAM vs. On-Prem IAM](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-and-access-management#vs?ts=markdown)
  * [IAM Security](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-and-access-management#iam-security?ts=markdown)
* [Identity and Access Management FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-and-access-management#faq?ts=markdown)

# What Is Customer Identity and Access Management (CIAM)?

3 min. read  
[Explore Identity Security](https://www.paloaltonetworks.com/identity-security?ts=markdown)  
Table of Contents

* * [CIAM Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#ciam?ts=markdown)
  * [CIAM Architecture and Security Components](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#architecture?ts=markdown)
  * [CIAM Versus Traditional IAM for Workforce Users](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#users?ts=markdown)
  * [CIAM and the Zero Trust Security Model](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#model?ts=markdown)
  * [CIAM Implementation: Attacker Behavior and Mitigation](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#mitigation?ts=markdown)
* [Customer Identity and Access Management (CIAM) FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#faqs?ts=markdown)

1. CIAM Explained

* * [CIAM Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#ciam?ts=markdown)
  * [CIAM Architecture and Security Components](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#architecture?ts=markdown)
  * [CIAM Versus Traditional IAM for Workforce Users](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#users?ts=markdown)
  * [CIAM and the Zero Trust Security Model](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#model?ts=markdown)
  * [CIAM Implementation: Attacker Behavior and Mitigation](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#mitigation?ts=markdown)
* [Customer Identity and Access Management (CIAM) FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-ciam#faqs?ts=markdown)

Customer Identity and Access Management (CIAM) manages the entire lifecycle of a customer's digital identity, governing how consumers sign up, log in, and securely interact with public-facing applications. Built for massive scalability (millions to billions of users), CIAM prioritizes a frictionless user experience (UX) and strict data privacy compliance, serving as a specialized, consumer-grade extension of traditional IAM.  
Key Points

* 

**Customer Scope**: CIAM manages customer identities across public-facing services, demanding massive scale.
\*

**Core Objective**: Its primary goal is balancing security (verification, adaptive authentication, etc.) with a seamless user experience (social login, passwordless, etc.).
\*

**Regulatory Focus**: Unlike traditional IAM, CIAM heavily emphasizes privacy, consent management, and adherence to regulations (GDPR, CCPA).
\*

**Attack Vector**: Flawed CIAM processes create entry points for credential theft and account takeover (ATO).
\*

**Business Value**: The system serves as a revenue generator by reducing login and security friction to boost customer loyalty.
\*

**Zero Trust Alignment**: Implementing CIAM is a critical step in extending the Zero Trust principle to external users.

## CIAM Explained

CIAM is a specialized subset of identity management focused exclusively on external user identities. These users include consumers, partners, and citizens accessing digital services. Unlike employees, external users are often non-technical, use a variety of devices, and demand near-instant access, which drives CIAM's emphasis on simplicity and scalability.

CIAM is a business enabler that bridges security, marketing, and IT operations. Collecting and centralizing customer data securely enables deep personalization while maintaining strict adherence to privacy regulations. This capability prevents identity sprawl, which can lead to security gaps and frustrated customers.

### Key Features of a Modern CIAM Solution

A competitive CIAM deployment must deliver security without disrupting the customer journey. These features are critical for high-E-E-A-T identity management:

* **[Single Sign-On (SSO)](https://www.paloaltonetworks.com/cyberpedia/what-is-single-sign-on-sso?ts=markdown) and Social Login**: Allows customers to use a single set of credentials or their existing social media accounts (Google, Facebook) to access multiple applications. This eliminates password fatigue and boosts user adoption with seamless access.
* **Adaptive Authentication**: Automatically adjusts the security level based on context, such as device, location, time of day, or behavioral analytics. A high-risk login attempt triggers a challenge, such as multi-factor authentication (MFA).
* **Self-Service Management**: Empowers customers to manage their own profiles, security settings, passwords, and data consent preferences. This drastically reduces help desk overhead and improves data control perception.
* **Consent and Privacy Management**: Provides granular tools for customers to explicitly grant or revoke consent for data use, ensuring compliance with global data protection mandates.
* **Identity Orchestration**: Uses a visual workflow engine to integrate various identity services, from anti-fraud to identity proofing, ---to create optimized, consistent user journeys across all digital properties.

## CIAM Architecture and Security Components

The architecture of a CIAM solution is built to manage identities across diverse customer interaction points, including web, mobile, and Internet of Things (IoT) applications. It centralizes identity data from these decentralized sources into a secure, unified repository. This prevents siloed customer data that can lead to inconsistent policies and security exposure.

A resilient CIAM platform relies on several foundational components to deliver both security and scale:

|    **CIAM Component**     |                        **Primary Function**                         |                                               **Security Outcome**                                                |
|---------------------------|---------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------|
| **Universal Directory**   | Centralized, high-availability database for customer profiles.      | Creates a Single Source of Truth for identity data, streamlining policy enforcement.                              |
| **Authentication Engine** | Verifies a user's identity (e.g., password, MFA, biometrics).       | Prevents unauthorized access and protects against credential theft and ATO.                                       |
| **Federation Services**   | Supports standard protocols (OIDC, SAML) for cross-platform trust.  | Enables secure SSO and third-party partner access without password sharing.                                       |
| **API Gateways \& SDKs**  | Tools for developers to embed identity services into customer apps. | Enforces policy directly at the application layer, reducing integration errors and simplifying access management. |
| **Risk and Fraud Engine** | Analyzes login behavior and contextual factors in real time.        | Facilitates adaptive authentication to detect and mitigate fraudulent login attempts in real time.                |

***Figure 1**: The architecture of a CIAM platform*

[Unit 42 security researchers](https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report?ts=markdown) observe that attackers frequently exploit inconsistent API access policies. Therefore, using CIAM's granular API authorization controls is paramount for preventing a compromised customer session from enabling [lateral movement](https://www.paloaltonetworks.com/cyberpedia/what-is-lateral-movement?ts=markdown) to more valuable data stores.

## CIAM Versus Traditional IAM for Workforce Users

CIAM is distinct from traditional Identity and Access Management (IAM), which focuses on internal users, employees, and privileged accounts. While both manage identity, their design priorities and scale requirements diverge significantly.

|      **Feature**      |           **Customer Identity and Access Management (CIAM)**           |           **Traditional Workforce Identity and Access Management (IAM)**           |
|-----------------------|------------------------------------------------------------------------|------------------------------------------------------------------------------------|
| **Primary User Base** | External users: Consumers, citizens, partners (B2C, B2B2C).            | Internal users: Employees, contractors, administrators (B2E).                      |
| **Scale of Users**    | Massive (Millions to Billions); high volume of transactions.           | Limited (Hundreds to Thousands); managed user base.                                |
| **Key Priority**      | User Experience (UX), privacy, consent, and conversion rates.          | Governance, security, compliance, and operational efficiency.                      |
| **User Onboarding**   | Frictionless, self-service, social login, rapid enrollment.            | Heavily governed, often manual HR/IT workflows, deep provisioning/de-provisioning. |
| **Core Risk Focus**   | Account takeover, credential stuffing, fraud, data privacy violations. | Privilege escalation, lateral movement, internal threat, excess entitlements.      |

***Table 2**: CIAM vs. Traditional Identity and Access Management (IAM)*

CIAM often has a much larger attack surface than internal IAM. Because customers may access systems via less-secure personal devices, the CIAM system must enforce dynamic, risk-based controls.

Conversely, IAM focuses on securing fewer, but highly privileged, accounts where the blast radius of a compromise is exponentially larger. [Unit 42 research](https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report?ts=markdown) emphasizes that all digital identities---human and machine---require robust protection, whether they are internal administrators or external customers.

## CIAM and the Zero Trust Security Model

CIAM is crucial for extending the[zero trust](https://www.paloaltonetworks.com/cyberpedia/what-is-a-zero-trust-architecture?ts=markdown) security model beyond the corporate perimeter and to the external customer environment. Zero Trust operates on the principle of "never trust, always verify" for every access request, regardless of whether the user is inside or outside the network.

When applied to customer identities, this requires continuous verification and adaptive access controls that treat every customer session as potentially malicious. This shifts security from relying on a static password to continuous, context-aware risk scoring.

### How CIAM Supports the Zero Trust Model

CIAM delivers the technical capabilities necessary to enforce a Zero Trust approach for external users.

1. **Continuous Verification**: CIAM uses real-time context---such as user behavior, device posture, and session data---to assess trust levels during the session, not just at login.
2. **Least Privilege Access** : Authorization components ensure customers only have access to the specific applications or data necessary for their current role or subscription level. This prevents excess entitlements if a user's tier changes, aligning with the principle of[least privilege](https://www.paloaltonetworks.com/cyberpedia/what-is-the-principle-of-least-privilege?ts=markdown).
3. **Microsegmentation** : While not traditional[network segmentation](https://www.paloaltonetworks.com/cyberpedia/what-is-network-segmentation?ts=markdown), CIAM acts as an identity [microsegmentation](https://www.paloaltonetworks.com/cyberpedia/what-is-microsegmentation?ts=markdown) layer. It gates access to specific application resources and APIs, preventing a compromised user in one application from accessing another.
4. **Device Trust**: Modern CIAM solutions incorporate checks to evaluate the security state of the customer's device before granting access, ensuring it meets minimum trust requirements.  
   ![Customer identity attack lifecycle disruption infographic showing a left-to-right attacker journey with icons and arrows: Reconnaissance (gathering information) → Initial Compromise (credential theft/phishing) → Account Takeover (unauthorized access) → Privilege Escalation (access and lateral movement) → Fraud \& Abuse (data theft/fraud). A red vertical divider near the center highlights 'DISRUPT ATTACK CHAIN.'](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/what-is-ciam/customer-identity-attack-lifecycle-disruption.webp "Customer identity attack lifecycle disruption infographic showing a left-to-right attacker journey with icons and arrows: Reconnaissance (gathering information) → Initial Compromise (credential theft/phishing) → Account Takeover (unauthorized access) → Privilege Escalation (access and lateral movement) → Fraud & Abuse (data theft/fraud). A red vertical divider near the center highlights 'DISRUPT ATTACK CHAIN.'") ***Figure 1**: Customer Identity Attack Lifecycle Disruption*

## CIAM Implementation: Attacker Behavior and Mitigation

Successful CIAM implementation requires anticipating and disrupting modern attack behaviors. Attackers view the massive, decentralized pool of customer identities as a valuable opportunity for large-scale credential theft and fraud.

### Attacker Workflows Targeting CIAM Systems

Attacks against customer identity systems generally follow steps similar to the MITRE ATT\&CK framework's Initial Access and Credential Access tactics.

1. **Reconnaissance and Brute Force** : Attackers use credential stuffing and [password spray attacks](https://www.paloaltonetworks.com/cyberpedia/password-spraying?ts=markdown) against public-facing login pages, exploiting weak passwords or credentials stolen in breaches elsewhere.
2. **Initial Access**: A successful login using stolen credentials grants the attacker initial access to the customer environment, often resulting in an account takeover (ATO).
3. [**Data Exfiltration**](https://www.paloaltonetworks.com/cyberpedia/data-exfiltration?ts=markdown): The attacker then uses the legitimate session to steal [personally identifiable information (PII)](https://www.paloaltonetworks.com/cyberpedia/pii?ts=markdown) or payment data, or to pivot to other applications if authorization policies are overly permissive.

### Critical Implementation Steps to Disarm Attackers

To deliver a high-security CIAM deployment, organizations must move beyond basic password requirements and focus on risk-based controls.

1. **Implement Adaptive, Risk-Based Authentication**: Utilize AI-driven risk engines to profile baseline customer behavior. Any deviation (e.g., login from a new country, a new device, or at an unusual hour) must immediately trigger a mandatory MFA step-up.
2. **Adopt [Passwordless Authentication](https://www.paloaltonetworks.com/cyberpedia/what-is-passwordless-authentication?ts=markdown)**: Migrate away from passwords entirely using solutions like passkeys, biometric verification, or magic links. This eliminates the vulnerability associated with storing and managing traditional passwords.
3. **Enforce Policy for Machine Identity Risks**: If customer-facing applications use APIs, ensure that the machine identities (tokens, keys) used for inter-service communication are managed with the same rigor as human identities to prevent exposure.
4. **Use JIT Privilege Flow for Sensitive Tasks**: For highly sensitive customer actions (e.g., changing payment methods or deleting an account), implement Just-in-Time (JIT) access. This requires the customer to re-authenticate or perform a strong MFA step-up only for that specific, time-bound action.

According to Unit 42, ATO is a constant threat. By combining passwordless authentication with adaptive risk scoring, CIAM systems can effectively deny Initial Access while maintaining a low-friction experience for verified, legitimate customers.

The core objective is to raise the cost of privilege escalation for attackers while reducing friction for legitimate users. All these security events must be continuously monitored, ideally through a [unified security platform](https://www.paloaltonetworks.com/cyberpedia/what-is-cybersecurity-platformization?ts=markdown).

## Customer Identity and Access Management (CIAM) FAQs

### What is the primary difference between CIAM and IAM?

The key difference lies in scale and priority. CIAM is designed for millions of external users, prioritizing user experience and data privacy compliance. Traditional IAM is for a defined set of internal employees, prioritizing operational governance and deep security controls for privileged access. [Identity security](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-security?ts=markdown) must be holistic enough to cover both domains.

### How does CIAM support regulatory compliance, such as GDPR?

Compliance Support. CIAM centralizes data governance by providing customers with self-service tools to manage their consent preferences. This centralized mechanism ensures organizations can demonstrate consent for data processing and respond quickly to data deletion or access requests, which are mandatory under regulations such as GDPR and CCPA.

### Can CIAM prevent account takeover (ATO)?

Preventing ATO. Yes, CIAM is a primary defense against ATO. It leverages capabilities such as adaptive authentication, strong Multi-Factor Authentication (MFA), and real-time fraud analysis to detect suspicious login attempts. By dynamically challenging high-risk sessions, it stops attackers using stolen credentials before they can compromise the account.

### Is identity orchestration necessary for a modern CIAM solution?

Identity Orchestration. Yes, identity orchestration is now essential. It allows security teams to create flexible, no-code/low-code security journeys by integrating disparate security and IT tools. This capability streamlines complex processes such as fraud detection and identity proofing, making the customer experience seamless and highly secure.

### How does CIAM relate to cloud security?

Cloud Security. CIAM is natively integrated with cloud security environments and is often delivered as a cloud service. It provides the identity layer for securing customer access to cloud-hosted applications and data. Strong CIAM mitigates cloud misconfiguration risks associated with improperly managed external user roles and entitlements.
Related Content  
[Identity is the New Perimeter
A comprehensive guide on why IAM and CIAM are the first line of defense in a cloud-first world.](https://www.paloaltonetworks.com/prisma/cloud/cloud-infrastructure-entitlement-mgmt?ts=markdown)  
[Unit 42 Cloud Threat Report
Expert research highlighting how identity-based attacks are evolving and how to secure them.](https://www.paloaltonetworks.com/prisma/unit42-cloud-threat-research?ts=markdown)  
[Prisma Access \& Identity Integration
Learn how to stop credential breaches by securing users, devices, and applications through one platform.](https://www.beyondidentity.com/integrations/palo-alto-networks)  
[Securing AI Without Guesswork
A technical webinar on governing identities and securing the AI lifecycle from development to deployment.](https://www.bankinfosecurity.com/webinars/securing-ai-without-guesswork-proven-approaches-that-work-w-6764)  
![Share page on facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/facebook-circular-icon.svg) ![Share page on linkedin](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/linkedin-circular-icon.svg) [![Share page by an email](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/email-circular-icon.svg)](mailto:?subject=What%20Is%20CIAM%20%28Customer%20Identity%20and%20Access%20Management%29%3F&body=Secure%20customer%20experiences%20with%20CIAM.%20Learn%20how%20Customer%20Identity%20and%20Access%20Management%20balances%20seamless%20user%20login%20with%20robust%20protection%20against%20identity-based%20threats.%20at%20https%3A//www.paloaltonetworks.com/cyberpedia/what-is-ciam)  
Back to Top  
[Previous](https://www.paloaltonetworks.com/cyberpedia/access-control?ts=markdown) What Is Access Control?  
[Next](https://www.paloaltonetworks.com/cyberpedia/what-is-single-sign-on-sso?ts=markdown) What Is Single Sign-On (SSO)? Benefits, Risks, And Best Practices  
{#footer}

## Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)

* [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)

* [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown)

## Company

* [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
* [Customers](https://www.paloaltonetworks.com/customers?ts=markdown)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown)

## Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
* [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
* [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown)
* [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)
* [Documents](https://www.paloaltonetworks.com/legal?ts=markdown)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language