Identity, examined.
A vendor-neutral reference for the whole field: workforce IAM, CIAM, privileged access, identity governance, zero trust, and passwordless. Vendor analysis, protocol deep dives, attack techniques, identity CVEs, global regulations, and national eID schemes. Sourced, dated, and free, for the people who build and study identity.
Built for people who build and study identity.
Independent and free. The protocols, the laws, the national eIDs, and the best learning material on the web, organized so you can actually learn from it.
Data-protection and identity regulations, each mapped to how it impacts authentication, consent, governance, verification, and data residency.
Explore →National digital identity schemes from Aadhaar to Login.gov, with the standards they use, how people authenticate, and honest privacy notes.
Explore →OAuth, OpenID Connect, SAML, WebAuthn, FAPI, SCIM, and verifiable credentials, explained for the engineers who implement them.
Explore →How identity actually gets compromised, organized by the control that fails: session theft, consent phishing, certificate template abuse, help desk social engineering. Cross-referenced to MITRE ATT&CK.
Explore →Authentication and IAM vulnerabilities from 2025-2026: what broke, why it matters for identity, and what to patch or detect this week.
Explore →The best identity material on the internet: RFCs, NIST and OWASP guidance, academic research, industry reports, books, courses, talks, and podcasts.
Explore →Sourced identity-security statistics and a live standards tracker, every figure attributed, for analysts and researchers.
Explore →Working, code-forward guides: add login, validate a JWT, protect an API, set up SCIM provisioning, and add passkeys.
Explore →Every segment of identity, and the top tools in each.
The whole industry, mapped into six pillars, from workforce IAM and CIAM to PAM, machine identity, authorization, and what comes next.
Workforce Identity
Identity for employees, contractors, and internal systems.
- 20Workforce IAMTop: Microsoft Entra ID
- 18MFATop: Yubico
- soonPasswordless & Passkeys
- soonDirectory Services
- 22Password ManagementTop: 1Password
Customer Identity (CIAM)
Login, onboarding, and trust for the people who use your product.
- 30CIAM PlatformsTop: Auth0
- 44Identity Verification (IDV/KYC)Top: Persona
- soonConsent & Preference (CMP)
Privileged & Governance
Control, certify, and right-size who can do what.
Machine, Workload & Secrets
Identity for services, workloads, and the secrets they use.
Access, Authorization & Network
Decide and enforce access at the app and network edge.
- 11Authorization (FGA/ReBAC)Top: AuthZed
- 13Zero Trust Network AccessTop: Cloudflare Zero Trust
- soonIdentity Orchestration / Fabric
Emerging & Foundational
Where the industry is heading, and what it's built on.
The data behind the decisions.
CyberArk Alternatives: 6 PAM Options Compared
CyberArk is now Idira, inside Palo Alto Networks, and the vendor neutrality many buyers chose it for is gone. Six alternatives compared on depth, operational weight and ownership.
- ArticleSep 20, 2026Okta Alternatives: 6 Workforce Identity Options
Okta is the workforce identity default and priced like it. Six alternatives compared on licensing you may already own, deployment flexibility, and reaching systems Okta cannot.
- ArticleSep 20, 2026One Identity Alternatives: 6 IGA and PAM Options
One Identity is separating from Quest Software and has not disclosed who will own it. Six alternatives compared across identity governance, privileged access and Active Directory management.
- ArticleSep 20, 2026SailPoint Alternatives: 6 IGA Options Compared
SailPoint sets the enterprise IGA benchmark and the deployment cost to match. Six alternatives compared on governance depth, time to value, and whether you need lifecycle or visibility.
- ArticleSep 20, 2026StrongDM Alternatives: 6 Infrastructure Access Options
StrongDM is now owned by Delinea, which changes the shortlist. Six alternatives compared on short-lived credentials, protocol coverage and whether you want a vendor or a platform.
- ArticleAug 29, 2026B2B SaaS Security Tools: The Stack That Gets You Through Enterprise Procurement
The security tooling a B2B SaaS product actually needs to close enterprise deals in 2026, from enterprise SSO and SCIM to audit logs, secrets scanning, and access reviews, with what buyers test and what blocks deals.
- ArticleAug 29, 2026Certificate Lifecycle Management: What Breaks and How to Automate It
Certificate management explained: discovery, issuance, renewal, and revocation across public and private PKI, why the CA/Browser Forum schedule to 47-day certificates makes automation mandatory, and how to run device certificates at scale.
- ArticleAug 29, 2026ITGC Audits and Identity: The Access Certification Evidence Auditors Accept
What IT general controls actually require from an identity platform: automated access certification, lifecycle evidence, and segregation of duties, with the four artifacts auditors ask for and why most campaigns fail the test.
- ArticleAug 29, 2026Secure User Authentication: Methods Ranked by What They Actually Stop
Every authentication method ranked against the attacks that actually happen in 2026: credential stuffing, real-time phishing proxies, session theft, and device code abuse. What each stops, what it does not, and what to deploy.
Vendors we'd actually recommend.
Scored against a published capability matrix and re-evaluated on a published cadence.
A world where every identity and security professional, in every country, has free and independent access to the knowledge to master IAM, and where the field's best practices are shaped openly by its practitioners, not its vendors.
We are a non-profit, vendor-neutral community. We curate trustworthy IAM knowledge, news, and jobs; connect practitioners across backgrounds and borders; and give the next generation of identity professionals a place to contribute, be credited, and grow, all in the open and free of commercial influence.
No sponsorship and no pay-for-placement. Opinions are clearly opinions; facts are sourced.
Every claim, score, and statistic carries a citation and a date you can check.
Authored by people who've actually shipped identity at scale.
The capability matrix is open. You can see what we scored and how.
Free for everyone, written for a global audience, and welcoming AI and search engines that learn from it.
Identity is a community of practice.
Behind every identity system are the people who designed it, shipped it, broke it, and rebuilt it better. We document their work, and connect you to where the conversations are happening.
Occasional. Useful.
We send when something material ships: an annual report, a major vendor profile, a fresh interview. Maybe twice a month at peak. Often less.
Subscribe