AINEWS
Forrester's Q3 2026 customer identity landscape says login and fraud systems are being rebuilt to authenticate AI agents acting on a human's behalf, while the same vendors turn their own AI agents loose on the security stack.
The login box on a retail site used to assume the requester was a person. Forrester's Q3 2026 customer identity and access management (CIAM) landscape, published this month, says that assumption no longer holds. The systems that handle sign-up, sign-in, account recovery, and fraud checks for online services are being rebuilt to authenticate bots acting on a human's behalf as well as the humans themselves, and the same vendors are turning their own AI agents loose on parts of the security stack.
Forrester's blog post names three changes. First, AI agents are being treated as a new identity type: a shopping agent launching from an AI platform against an e-commerce portal is now part of the traffic a CIAM system has to sort. Second, the vendors themselves are using AI agents to run parts of the platform, including migrating a customer from one CIAM product to another, running A/B tests on user flows, redesigning profile pages, detecting account takeovers, and handling fraud. Third, CIAM is drifting outward into identity verification, behavioral biometrics, and reusable digital credentials, including frameworks such as eIDAS 2.0 and the EU Digital Identity Wallet (paywalled full report).
When a personal shopping agent asks a merchant's API to add an item to a cart, complete a checkout, or pull order history on the user's behalf, the merchant's CIAM system has to decide whether to trust that call. The agent does not have a password. It has a token issued to software on behalf of a real principal, and the merchant needs a way to verify who issued the token, what it is allowed to do, and whether to bill the action to a human account. The Forrester post puts the question in plain terms: can CIAM let an AI agent act on a customer's behalf at a merchant site, and how is that interaction governed?
The same logic cuts the other way. CIAM vendors are now shipping their own AI agents to handle migration, threat detection, account-takeover response, and digital fraud work that used to mean a re-implementation project. "Back to square one" re-platforming is the phrase Forrester uses for the old pattern; the new pitch is that an AI agent can move a deployment, run an experiment, or chase a fraud signal without a human in the loop.
A new fraud surface opens whenever a merchant has to accept delegated agent traffic without a clear way to tie each action back to a consenting human. Consent and accountability questions follow: if a bot spends the user's money or files a dispute on the user's behalf, the merchant, the agent's vendor, and the user all need a paper trail. On the upside, the same plumbing can cut password resets, identity-verification loops, and the kind of step-up authentication that pushes checkout abandonment rates higher.
"AI agents are a new identity type" is partly vendor marketing, and Forrester's three-change taxonomy doubles as a sales motion: a new Forrester Wave on CIAM is scheduled to kick off at the end of September 2026, updating the last CIAM Wave from December 2024, and the landscape report is a way of pre-loading that conversation. The full Q3 2026 CIAM landscape is paywalled, so vendor placements, inclusion lists, and the detailed scoring that usually anchors a Wave are not in the public material yet.
Independent confirmation that CIAM vendors are shipping bot-as-principal authentication in production, rather than listing it on a roadmap, is thin outside the analyst's own framing. A real customer deployment, a competing analyst read, or a security researcher on the record would be the next reference to land before the September 2026 Wave reshapes the leaderboard.
Forrester's Wave evaluation on CIAM opens at the end of September 2026. Whatever vendors can show in production by then is what the next public ranking will grade.