Identity, examined.
A vendor-neutral reference for the whole field: workforce IAM, CIAM, privileged access, identity governance, zero trust, and passwordless. Vendor analysis, protocol deep dives, attack techniques, identity CVEs, global regulations, and national eID schemes. Sourced, dated, and free, for the people who build and study identity.
Built for people who build and study identity.
Independent and free. The protocols, the laws, the national eIDs, and the best learning material on the web, organized so you can actually learn from it.
Data-protection and identity regulations, each mapped to how it impacts authentication, consent, governance, verification, and data residency.
Explore →National digital identity schemes from Aadhaar to Login.gov, with the standards they use, how people authenticate, and honest privacy notes.
Explore →OAuth, OpenID Connect, SAML, WebAuthn, FAPI, SCIM, and verifiable credentials, explained for the engineers who implement them.
Explore →How identity actually gets compromised, organized by the control that fails: session theft, consent phishing, certificate template abuse, help desk social engineering. Cross-referenced to MITRE ATT&CK.
Explore →Authentication and IAM vulnerabilities from 2025-2026: what broke, why it matters for identity, and what to patch or detect this week.
Explore →The best identity material on the internet: RFCs, NIST and OWASP guidance, academic research, industry reports, books, courses, talks, and podcasts.
Explore →Sourced identity-security statistics and a live standards tracker, every figure attributed, for analysts and researchers.
Explore →Working, code-forward guides: add login, validate a JWT, protect an API, set up SCIM provisioning, and add passkeys.
Explore →Every segment of identity, and the top tools in each.
The whole industry, mapped into six pillars, from workforce IAM and CIAM to PAM, machine identity, authorization, and what comes next.
Workforce Identity
Identity for employees, contractors, and internal systems.
- 20Workforce IAMTop: Microsoft Entra ID
- 18MFATop: Yubico
- soonPasswordless & Passkeys
- soonDirectory Services
- 22Password ManagementTop: 1Password
Customer Identity (CIAM)
Login, onboarding, and trust for the people who use your product.
- 30CIAM PlatformsTop: Auth0
- 44Identity Verification (IDV/KYC)Top: Persona
- soonConsent & Preference (CMP)
Privileged & Governance
Control, certify, and right-size who can do what.
Machine, Workload & Secrets
Identity for services, workloads, and the secrets they use.
Access, Authorization & Network
Decide and enforce access at the app and network edge.
- 11Authorization (FGA/ReBAC)Top: AuthZed
- 13Zero Trust Network AccessTop: Cloudflare Zero Trust
- soonIdentity Orchestration / Fabric
Emerging & Foundational
Where the industry is heading, and what it's built on.
The data behind the decisions.
B2B SaaS Security Tools: The Stack That Gets You Through Enterprise Procurement
The security tooling a B2B SaaS product actually needs to close enterprise deals in 2026, from enterprise SSO and SCIM to audit logs, secrets scanning, and access reviews, with what buyers test and what blocks deals.
- ArticleAug 29, 2026Top 6 Open-Source Directory Services and LDAP Servers
The best open-source directory servers in 2026, from OpenLDAP and 389 Directory Server to FreeIPA, Samba AD, Kanidm, and LLDAP, compared on protocol support, Active Directory replacement, and operational fit.
- ArticleAug 29, 2026Top 6 Open-Source Machine and Workload Identity Tools
The best open-source machine identity tools in 2026, from SPIFFE and SPIRE to cert-manager, Athenz, Teleport Machine ID, Keylime, and OpenBao, compared on attestation, certificate lifecycle, and workload trust.
- ArticleAug 29, 2026Top 6 Open-Source PKI and Certificate Management Tools
The best open-source PKI tools in 2026, from EJBCA and step-ca to Dogtag, cert-manager, OpenXPKI, and Boulder, compared on protocol support, automation, and who each fits as certificate lifetimes shrink.
- ArticleAug 29, 2026Top 6 Open-Source Secrets Scanning and Non-Human Identity Tools
The best open-source secrets scanning tools in 2026, from TruffleHog and Gitleaks to detect-secrets, git-secrets, Kingfisher, and NHI Hound, compared on validation, coverage, and the shift from finding secrets to governing non-human identities.
- ArticleAug 29, 2026Top 7 Open-Source Active Directory Security Tools
The best open-source and free Active Directory security tools in 2026, from BloodHound Community Edition and PingCastle to Certipy, ADeleg, Impacket, adalanche, and Snaffler, with what each finds and how the licences differ.
- ArticleAug 29, 2026Top 7 Open-Source Cloud Entitlement and CIEM Tools
The best open-source cloud IAM and entitlement tools in 2026, from Prowler and Cloudsplaining to PMapper, policy_sentry, Cartography, ScoutSuite, and CloudQuery, with what each finds across AWS, Azure, and GCP.
- ArticleAug 29, 2026Top 7 Open-Source Decentralized Identity and Verifiable Credential Tools
The best open-source decentralized identity tools in 2026, from Credo and ACA-Py to walt.id, Veramo, SpruceID, CREDEBL, and Sphereon, compared on credential formats, protocol support, and readiness for the EUDI Wallet stack.
- ArticleAug 29, 2026Top 7 Open-Source Password Managers
The best open-source password managers in 2026, from Bitwarden and Vaultwarden to KeePassXC, Passbolt, Psono, Padloc, and Proton Pass, compared on licensing, self-hosting, and team credential sharing.
Vendors we'd actually recommend.
Scored against a published capability matrix and re-evaluated on a published cadence.
Microsoft Entra ID
4.7/ 5Best for: Microsoft 365 and Azure-centric organizations
Read the profile →Okta
4.7/ 5Best for: Workforce SSO and lifecycle for mid-to-large enterprises
Read the profile →HashiCorp Vault
4.7/ 5Best for: Secrets management with dynamic, short-lived credentials for cloud infrastructure
Read the profile →A world where every identity and security professional, in every country, has free and independent access to the knowledge to master IAM, and where the field's best practices are shaped openly by its practitioners, not its vendors.
We are a non-profit, vendor-neutral community. We curate trustworthy IAM knowledge, news, and jobs; connect practitioners across backgrounds and borders; and give the next generation of identity professionals a place to contribute, be credited, and grow, all in the open and free of commercial influence.
No sponsorship and no pay-for-placement. Opinions are clearly opinions; facts are sourced.
Every claim, score, and statistic carries a citation and a date you can check.
Authored by people who've actually shipped identity at scale.
The capability matrix is open. You can see what we scored and how.
Free for everyone, written for a global audience, and welcoming AI and search engines that learn from it.
Identity is a community of practice.
Behind every identity system are the people who designed it, shipped it, broke it, and rebuilt it better. We document their work, and connect you to where the conversations are happening.
Occasional. Useful.
We send when something material ships: an annual report, a major vendor profile, a fresh interview. Maybe twice a month at peak. Often less.
Subscribe