Identity, examined.
A vendor-neutral reference for the whole field: workforce IAM, CIAM, privileged access, identity governance, zero trust, and passwordless. Vendor analysis, protocol deep dives, attack techniques, identity CVEs, global regulations, and national eID schemes. Sourced, dated, and free, for the people who build and study identity.
Built for people who build and study identity.
Independent and free. The protocols, the laws, the national eIDs, and the best learning material on the web, organized so you can actually learn from it.
Data-protection and identity regulations, each mapped to how it impacts authentication, consent, governance, verification, and data residency.
Explore →National digital identity schemes from Aadhaar to Login.gov, with the standards they use, how people authenticate, and honest privacy notes.
Explore →OAuth, OpenID Connect, SAML, WebAuthn, FAPI, SCIM, and verifiable credentials, explained for the engineers who implement them.
Explore →How identity actually gets compromised, organized by the control that fails: session theft, consent phishing, certificate template abuse, help desk social engineering. Cross-referenced to MITRE ATT&CK.
Explore →Authentication and IAM vulnerabilities from 2025-2026: what broke, why it matters for identity, and what to patch or detect this week.
Explore →The best identity material on the internet: RFCs, NIST and OWASP guidance, academic research, industry reports, books, courses, talks, and podcasts.
Explore →Sourced identity-security statistics and a live standards tracker, every figure attributed, for analysts and researchers.
Explore →Working, code-forward guides: add login, validate a JWT, protect an API, set up SCIM provisioning, and add passkeys.
Explore →Every segment of identity, and the top tools in each.
The whole industry, mapped into six pillars, from workforce IAM and CIAM to PAM, machine identity, authorization, and what comes next.
Workforce Identity
Identity for employees, contractors, and internal systems.
- 20Workforce IAMTop: Microsoft Entra ID
- 18MFATop: Yubico
- soonPasswordless & Passkeys
- soonDirectory Services
- 22Password ManagementTop: 1Password
Customer Identity (CIAM)
Login, onboarding, and trust for the people who use your product.
- 30CIAM PlatformsTop: Auth0
- 44Identity Verification (IDV/KYC)Top: Persona
- soonConsent & Preference (CMP)
Privileged & Governance
Control, certify, and right-size who can do what.
Machine, Workload & Secrets
Identity for services, workloads, and the secrets they use.
Access, Authorization & Network
Decide and enforce access at the app and network edge.
- 11Authorization (FGA/ReBAC)Top: AuthZed
- 13Zero Trust Network AccessTop: Cloudflare Zero Trust
- soonIdentity Orchestration / Fabric
Emerging & Foundational
Where the industry is heading, and what it's built on.
The data behind the decisions.
Stopping Account Takeover in CIAM: Bot, Fraud and ATO Defense
How customer accounts actually get taken over, and the four layers of defense a CIAM program needs: bot and stuffing controls, phishing-resistant credentials, risk-based step-up after login, and a recovery flow held to the same bar as sign-in.
- ArticleOct 16, 2026Identity for Automotive: Connected Cars, Dealers, and UN R155
Automotive identity spans owners and drivers in connected-car apps, a large dealer and supplier network, and the cryptographic identity of vehicles, ECUs, and backends, all under UN Regulation No. 155 and ISO/SAE 21434.
- ArticleOct 16, 2026Identity for Crypto and Web3: Wallet Login, KYC, and Travel Rule
Crypto identity combines self-custodial wallet authentication such as Sign-In with Ethereum, decentralized identifiers and verifiable credentials, and bank-grade KYC under the FATF Travel Rule and MiCA, while defending users against wallet drainers and seed-phrase theft.
- ArticleOct 16, 2026Identity for Education: School SSO, Rostering, FERPA, and COPPA
Education identity has to serve students, staff, parents, researchers, and alumni at once, keep app rosters in sync through OneRoster or Clever, and protect student records under FERPA and children's data under the amended COPPA Rule.
- ArticleOct 16, 2026Identity for Energy and Utilities: NERC CIP, OT Access, and NIS2
Energy and utility identity protects critical infrastructure where a compromised account can have physical consequences. This guide covers OT privileged access, remote access, and what NERC CIP and NIS2 require of identity programs.
- ArticleOct 16, 2026Identity for Manufacturing: OT Access, Machine Identity, and NIS2
Manufacturing identity spans the plant floor and the supply chain: privileged access to operational technology, machine identity for connected equipment, and governed access for suppliers and integrators, under IEC 62443 and NIS2.
- ArticleOct 16, 2026Identity for Media and Streaming: Sharing, Profiles, and TV Sign-In
Streaming identity ties login directly to revenue: it enforces households and paid sharing, limits concurrent streams, separates profiles, signs users in on TVs through the device authorization grant, and has to hold up against credential stuffing at massive scale.
- ArticleOct 16, 2026Progressive Profiling: Collect Customer Data Without Friction
Progressive profiling replaces the long signup form with small, well-timed questions asked when the answer is actually needed. How the pattern works, where the data comes from, how to implement it in CIAM, and how to keep each step compliant.
- ArticleOct 16, 2026Social Login: Benefits, Risks, and How to Implement It
Social login lets customers sign up with an account they already have at Google, Apple, or another provider. What it gains you, the account-linking and dependency risks most teams miss, and how to implement it correctly with OpenID Connect.
Vendors we'd actually recommend.
Scored against a published capability matrix and re-evaluated on a published cadence.
A world where every identity and security professional, in every country, has free and independent access to the knowledge to master IAM, and where the field's best practices are shaped openly by its practitioners, not its vendors.
We are a non-profit, vendor-neutral community. We curate trustworthy IAM knowledge, news, and jobs; connect practitioners across backgrounds and borders; and give the next generation of identity professionals a place to contribute, be credited, and grow, all in the open and free of commercial influence.
No sponsorship and no pay-for-placement. Opinions are clearly opinions; facts are sourced.
Every claim, score, and statistic carries a citation and a date you can check.
Authored by people who've actually shipped identity at scale.
The capability matrix is open. You can see what we scored and how.
Free for everyone, written for a global audience, and welcoming AI and search engines that learn from it.
Identity has named authors.
The protocols have editors. The platforms have founders who wrote the first version themselves. Least privilege, role-based access control, and the protocol underneath Kerberos were all somebody's paper first. The experts directory documents 96 of those people, grouped by what they actually contributed, with each profile linked to the standards, platforms, and research their work produced.
The editors of OAuth, OIDC, SAML, SCIM, WebAuthn, and the credential formats replacing them.
People who built an identity platform from nothing, and often the category with it.
Maintainers of the identity software a large part of the internet actually runs on.
The academics behind least privilege, RBAC, Kerberos, and the end of password complexity rules.
People who break these systems in public so they get fixed.
NIST digital identity guidance, trust frameworks, and population-scale national systems.
The organizers and educators who turned scattered practitioners into a profession.
People who run identity systems for a living and teach from what breaks.
People who set the terms the rest of the field still argues inside.
Identity is a community of practice.
This site is written and reviewed by volunteer practitioners, and everyone who contributes is credited by name. There is no sponsorship and no paid placement.
Curate news, scout jobs, write a guide, host an interview, or correct something we got wrong. See the open volunteer roles, the contributors, and how we score vendors.
Occasional. Useful.
We send when something material ships: an annual report, a major vendor profile, a fresh interview. Maybe twice a month at peak. Often less.
Subscribe