IAM — Identity and Access Management (Workforce SSO and MFA, IGA, PAM and Customer Identity)
Entry signal — what decides who wins here
One thing must be trueEntry turns on a single condition that can be named and tested before much is spent. Clear it and this becomes an execution question; fail it and no amount of operating skill helps.
Displace an incumbent the screen found well defended — payments attached to the workflow, data that does not leave, a contract that renews itself. Share here means giving a buyer a reason to break something that currently works, which is a higher bar than being better.
Measured, not forecast: the share of US establishments opening in one year that were still active later. It counts good operators and bad ones together, which is exactly why it is the honest answer to “what are the odds”. It is for the whole sector rather than this market, and the ten-year figure comes from an older cohort because no younger one has reached ten years.
This is not a probability of success, and it is not a verdict on you. No survival probability is published per market, and inventing one would be worse than saying so. What the bar reads is how much of the outcome sits inside an operator's control: green means the hurdles are ones a better operator clears, red means the binding constraint is capital, an asset or a permission rather than execution. Someone arriving with an advantage this screen did not assume can win a market shown in red.
Companies named in this market · 21
The binding constraint — incumbent vulnerability
Microsoft gives the core of this market away with the licence the buyer already holds, and the independents are being bought. Microsoft Entra ID P1 (single sign-on, conditional access, MFA) is included with Microsoft 365 E3 and Business Premium, and P2 with E5; standalone it lists at $7 and $10 per user a month [C, vendor pricing page, opened 2026-10-18]. Okta, the largest independent, lists workforce plans from $6 to $17 per user a month [C, vendor] against that bundle. Okta is a large and now profitable business: revenue of $2.919B in the year to 2026-01-31, up 12%, after 15% the year before, with net income of $235M, more than 20,000 customers and 5,100 above $100,000 of annual contract value — but dollar-based net retention has slipped from 111% to 107% to 106% [A, 10-K]. The category is consolidating into security platforms. Palo Alto Networks completed its purchase of CyberArk, the privileged-access leader, on 2026-02-11 for total consideration of $21.1B [A, PANW 10-K]; cyberark.com now redirects to Palo Alto's 'Idira' identity platform. CyberArk had earned $1.0007B in 2024, up 33%, with ARR of $1.169B [A, 20-F]. Thoma Bravo took ForgeRock private for about $2.3B in August 2023 and folded it into Ping Identity [B, Thoma Bravo release]. Thoma Bravo also re-listed SailPoint in February 2025 and still controls about 85% of its votes; SailPoint earned $1.071B in the year to 2026-01-31, up 24%, with ARR of $1.125B, a net loss of $270.1M, and it names Microsoft, Oracle, IBM, Palo Alto Networks (CyberArk), Okta and One Identity as competitors [A, 10-K]. Cisco paid $2.025B for Duo in 2018 [A, Cisco 10-K] and Okta $5.671B for Auth0 in 2021 [A, Okta 10-K]. The developer-auth wedge that looked open in 2021 has been repriced. Stytch raised $90M at a $1B valuation in November 2021 [C, company announcement]; Twilio bought it on 2025-11-14 for $104.1M in cash, $58.5M net of cash acquired [A, Twilio 10-K]. Capital still reaches the edges — Saviynt raised $700M at about $3B led by KKR in December 2025 [B, company release], and Clerk raised a $50M Series C in October 2025 [C, company blog] — and every one of them, along with Okta, SailPoint and Palo Alto, is now marketing identity for AI agents and non-human identities. The newest wedge already has funded owners. A strong open-source tier sets the floor at zero from below. Keycloak (Apache-2.0, a CNCF incubation project, about 37,000 GitHub stars), authentik, Ory and Zitadel all implement the open standards — OIDC, SAML, SCIM, passkeys — that make the protocol layer a commodity [A, GitHub API]. Incumbent vulnerability decides it: an entrant faces a free bundle from above, free software from below, and platform owners buying anything that reaches scale in between. How this differs from its neighbours. This record is workforce and customer identity: who signs in, with what factor, to which application, and who approved that access. Cloud entitlement scanning belongs to the CNAPP record; device enrolment to the MDM/UEM record; audit evidence collection to the GRC record. Consumer identity proofing and KYC — document checks, selfies, bureau data — belong to the fraud-prevention and identity-verification record; Transmit Security straddles both and is listed here for its customer-identity platform.
Sectors joined: Cybersecurity · SaaS · Technology · Dev Tools · B2B SaaS · AI
[UNVERIFIED] Sector-to-NAICS mapping is analyst judgment — see data/angel-sector-map.json. Counts are a per-record cross-reference and are not additive across records.
The incumbent
Who owns this market and who is coming for it. Fields a screen never reached say so rather than guessing.
Financials & market size — sourced
Figures that came from a filing, a results release or reputable reporting, each carrying its evidence tier.
Market size, derived
Built from the competitor set upward rather than quoted from a forecast. Published TAMs in these categories are frequently reverse-engineered from each other, so any published figure is checked against the vendor arithmetic rather than trusted on its own.
Disclosed revenue from 3 of 14 named vendors. The market is at least this large.
No vendor has both a disclosed revenue and a published share.
Only a revenue floor is known — the true market is larger by whatever the undisclosed vendors earn.
Competitor set · 14 named · 3 disclose revenue
| Name | Revenue | Share | Note |
|---|---|---|---|
| Microsoft EntraNASDAQ: MSFTC | not disclosed | — | Not broken out. Entra ID Free comes with Azure and Microsoft 365; P1 is included in Microsoft 365 E3 and Business Premium and P2 in E5; standalone P1 $7, P2 $10 and Entra Suite $12 per user a month, annual commitment [C, vendor pricing page, opened 2026-10-18] |
| OktaNASDAQ: OKTAA | $2.9B | — | FY2026 (year ended 2026-01-31) revenue $2,919M, +12% (FY2025 $2,610M, +15%); net income $235M; RPO $4,827M; 5,100 customers above $100,000 ACV; more than 20,000 customers; dollar-based net retention 106% (107%, 111% the two years before). Owns Auth0, acquired 2021-05-03 for a total purchase price of $5.671B [A, 10-K filed 2026-03-05; Auth0 price from FY2022 10-K]. Workforce list prices $6–$17 per user a month [C, vendor] |
| CyberArk (Palo Alto Networks)NASDAQ: PANWA | $1.0B | — | Revenue is CyberArk's last stand-alone year: 2024 $1,000.7M, +33.1%; ARR $1.169B, +51%; more than 9,700 customers [A, 20-F filed 2025-03-12]. Palo Alto Networks completed the acquisition on 2026-02-11 for total purchase consideration of $21.1B [A, PANW 10-K for the year to 2026-07-31]; Nasdaq delisting (Form 25) filed 2026-02-11. cyberark.com now redirects to Palo Alto's Idira identity-security platform, which combines PAM, access management and IGA |
| SailPointNASDAQ: SAILA | $1.1B | — | FY2026 (year ended 2026-01-31) revenue $1,071.4M, +24%, 94% subscription; ARR $1,124.8M (from $876.7M); SaaS share of ARR 66%; about 3,235 customers, 215 above $1M ARR; net loss $270.1M. Re-listed via IPO priced 2025-02-14; Thoma Bravo controls about 85% of the votes [A, 10-K filed 2026-03-19] |
| Ping IdentityB | not disclosed | — | Private (Thoma Bravo). Thoma Bravo completed its all-cash purchase of ForgeRock for about $2.3B on 2023-08-23 and combined it into Ping Identity [B, Thoma Bravo release]. No revenue published |
| SaviyntB | not disclosed | — | Private. $700M Series B growth equity at about a $3B valuation, 2025-12-09, led by KKR with Sixth Street Growth and Ten Eleven; Carrick Capital Partners is the existing Series A investor [B, company release]. Cloud IGA and PAM. No revenue published |
| Duo (Cisco)NASDAQ: CSCOA | not disclosed | — | Cisco completed the acquisition of Duo Security on 2018-09-28 for purchase consideration of $2,025M; Duo revenue sits inside Cisco's security category and is not broken out [A, Cisco FY2019 10-K] |
| BeyondTrustC | not disclosed | — | Private; Francisco Partners lists it as a current buy-and-build holding [C, Francisco Partners portfolio page]. PAM and remote access. beyondtrust.com returned a Cloudflare block, so nothing else was checked |
| DelineaC | not disclosed | — | Private. Formed when TPG Capital bought Thycotic and Centrify and merged them in April 2021 (ThycoticCentrify), renamed Delinea [C, company blog]. Current ownership beyond that was not verified. PAM |
| One IdentityC | not disclosed | — | Part of Quest Software, which Clearlake Capital agreed to buy from Francisco Partners in 2021 (reported). Owns OneLogin. oneidentity.com and quest.com both returned a bot challenge, so ownership and products could not be confirmed. SailPoint's 10-K names it as a competitor [A] |
| JumpCloudB | not disclosed | — | Private. Closed a $225M Series F on 2021-10-19 at a $2.625B valuation, bringing total capital raised to over $400M; Sapphire Ventures led the first close, with Atlassian Ventures, CrowdStrike Falcon Fund and NTT Docomo Ventures in the extension [B, company release]. Directory, SSO, MFA and device management for SMEs |
| Transmit SecurityB | not disclosed | — | Private. $543M Series A, 2021-06-22, led by Insight Partners and General Atlantic, at a $2.2B pre-money valuation [B, release on Insight Partners' site]. Customer identity (CIAM) and fraud prevention |
| Stytch (Twilio)NYSE: TWLOA | not disclosed | — | Raised $90M at a $1B valuation from Coatue, Benchmark, Thrive and Index, November 2021 [C, company announcement]. Twilio acquired it on 2025-11-14 for $104.1M in cash, $58.5M net of cash acquired [A, Twilio 10-K for 2025] |
| 1PasswordB | not disclosed | — | Private, Toronto. $620M Series C, January 2022, at a $6.8B valuation, led by ICONIQ Growth with Tiger Global, Lightspeed and Accel [B, Crunchbase News]. Password and secrets management; adjacent to IAM rather than a directory or SSO provider |
Startups & challengers
Newer and smaller vendors going at the incumbent — funded challengers first. Named, not researched to the depth of the field above; a company with a page here links to it.
| Company | Stage | What it does | Raised |
|---|---|---|---|
| Clerk | Funded challenger | Developer authentication and user management; $50M Series C from Menlo and Anthropic's Anthology Fund, October 2025 | — |
| Frontegg | Funded challenger | Tel Aviv customer identity and user management for B2B SaaS; $40M Series B co-led by Stripes and Insight Partners, July 2022 | $70m |
| Silverfort | Funded challenger | Identity threat protection that adds MFA to legacy and on-prem systems; $116M Series D led by Brighton Park Capital, January 2024 | $222m |
| Descope | Startup | Customer and agentic identity platform with drag-and-drop auth flows | — |
| Ory | Startup | Open-source (Apache-2.0) identity and OAuth2 servers — Kratos and Hydra — with a managed cloud | — |
| Veza | Startup | Access-graph identity security and authorisation governance | — |
| WorkOS | Startup | APIs that add enterprise SSO, SCIM directory sync and audit logs to SaaS apps | — |
| Zitadel | Startup | Open-source (AGPL-3.0) multi-tenant identity infrastructure; $9M Series A led by Nexus Venture Partners, November 2024; 150+ customers claimed | — |
| authentik | Scrappy competitor | Self-hosted open-source identity provider (MIT core, separate enterprise licence); about 26,000 GitHub stars | — |
Vendor landscape
Market leaders, the full paid field, and every open-source alternative. Where a free tier exists it is what sets the price floor, so it is analysis rather than an appendix.
Included with Microsoft 365 E3, E5 and Business Premium; no revenue line or seat count published [C, vendor]
$2.919B FY2026 revenue, +12%; 20,000+ customers [A, 10-K]
$1.0007B 2024 revenue; bought for $21.1B, closed 2026-02-11 [A]
$1.071B FY2026 revenue; ARR $1.125B [A, 10-K]
Paid field · 13 vendors
Default for Microsoft 365 tenants; P1 from Business Premium and E3, P2 in E5
Largest independent SSO, MFA and lifecycle platform; also sells governance and privileged access
Okta's CIAM platform since 2021
Thoma Bravo-owned; strong in banks and large consumer brands
PAM leader now sold as Palo Alto's identity-security platform
Identity governance reference vendor; SaaS 66% of ARR
Converged cloud governance; KKR-led $700M round
PE-owned privileged-access vendors
IGA, PAM and OneLogin access management inside Quest
MFA and device trust sold through Cisco security
Cloud directory with SSO, MFA and device management
CIAM with fraud prevention, sold to banks and retailers
Toronto; adjacent credential layer, not a directory
Open source · 4 projects — the price floor
CNCF incubation project; the default self-hosted SSO and OIDC server, about 37,000 GitHub stars
Self-hosted identity provider with SSO, MFA and proxy; about 26,000 stars
Headless identity and OAuth2/OIDC servers for developers
Multi-tenant identity infrastructure with a hosted cloud
Three layers decide this market: the protocol standards, the directory, and the governance record. OIDC, SAML, SCIM and FIDO2 passkeys are open, which makes sign-in itself a commodity that free software implements well. The value sits in the directory that every app trusts and in the access-review history auditors ask for — and the vendor that owns the office suite gives the directory away.
Evidence
Evidence. Market size UNVERIFIED — no category figure is used; analyst sizes circulate but none was opened, and Microsoft does not report Entra revenue. Vendor revenue is sourced: opened 2026-10-18 on SEC EDGAR [A]: Okta's FY2026 10-K (filed 2026-03-05; revenue $2,919M, +12%, net income $235M, 5,100 customers above $100,000 ACV, more than 20,000 customers, net retention 106%; competitor categories include authentication, governance, MFA and CIAM providers, and open-source technologies); Okta's FY2022 10-K (Auth0 acquired 2021-05-03, total purchase price $5.671B); SailPoint's FY2026 10-K (filed 2026-03-19; revenue $1,071.4M, ARR $1,124.8M, net loss $270.1M, Thoma Bravo ~85% of votes, HQ Austin; competitors named as IBM, Microsoft, Oracle, Palo Alto Networks (CyberArk), Okta and One Identity); CyberArk's 2024 20-F (revenue $1,000.7M, ARR $1.169B, 9,700+ customers, Petach-Tikva); CyberArk's S-8 POS of 2026-02-11 confirming the merger with Palo Alto Networks under the 2025-07-30 agreement, and its Form 25 the same day; Palo Alto Networks' 10-K for the year to 2026-07-31 ($21.1B total purchase consideration, closed 2026-02-11); Cisco's FY2019 10-K (Duo, $2,025M, closed 2018-09-28); Twilio's 2025 10-K (Stytch, $104.1M cash, closed 2025-11-14). Opened [B]: Thoma Bravo's ForgeRock completion release (2023-08-23, ~$2.3B, combined into Ping Identity); Saviynt's $700M release (2025-12-09, ~$3B valuation, KKR-led); JumpCloud's Series F close release (2021-10-19, $225M, $2.625B, over $400M total); Transmit Security's Series A release on Insight Partners' site (2021-06-22, $543M, $2.2B pre-money); Crunchbase News on 1Password (2022-01-19, $620M at $6.8B); Globes on Silverfort ($116M Series D, $222M total, 2024-01-23); The SaaS News on Frontegg ($40M Series B, $70M total, July 2022). Opened [C, vendor]: the Microsoft Entra pricing page (P1 $7, P2 $10, Entra Suite $12 per user a month; P1 in Microsoft 365 E3 and Business Premium, P2 in E5); Okta's pricing page (Starter $6, Core Essentials $14, Essentials $17 per user a month); Stytch's 2021 Series B announcement ($90M at $1B); Clerk's Series C post (2025-10-15, $50M, Menlo and Anthology Fund); Zitadel's Series A (VCA Online, 2024-11-20, $9M, Nexus); Delinea's blog on the TPG-backed Thycotic–Centrify merger; Francisco Partners' BeyondTrust portfolio page. cyberark.com was opened and returns a 301 to paloaltonetworks.com/idira. GitHub API (opened 2026-10-18) gives the open-source licences and star counts. Not verified: Ping's own revenue and its 2022 take-private price (Ping's newsroom path is disallowed by its robots.txt); One Identity's current ownership (oneidentity.com and quest.com returned bot challenges); BeyondTrust's homepage (Cloudflare 403); Ory's funding (VentureBeat behind a Vercel checkpoint); Veza's funding (Business Wire 403); Descope's and WorkOS's funding. Calcalist's ~$100M revenue estimate for Transmit is a press estimate and is NOT used. Verify before acting.
Where the industry talks
The associations, forums and events where people in this trade actually talk shop — where to listen before entering, and where the first customers are found. Each link was opened on the date shown.
Professional body for digital-identity practitioners; publishes the IDPro Body of Knowledge and runs the CIDPRO certification. No member count on the page opened.
Annual identity-industry conference; next edition listed for June 28 – July 1, 2027, Mandalay Bay, Las Vegas.
KuppingerCole's annual identity conference; the 2026 edition ran May 19–22 at bcc Berlin Congress Center.
Standards body behind OpenID Connect and related specs; working groups and conformance tools are open; conference listed for February 2–4, 2027 in London.
Industry association behind FIDO2 and passkeys; runs the Authenticate conference and certification programmes.
Vendor and practitioner alliance publishing identity-centric security frameworks; blog active July 2026.
Non-profit running NIST 800-63 and UK digital identity trust-framework certification, with member work groups.
Canadian digital-identity coalition; publishes the Pan-Canadian Trust Framework (PCTF) and runs a certification programme with a trusted list of certified providers.
Reddit's r/sysadmin, r/okta and r/IdentityManagement are active, but Reddit's robots.txt bars automated fetches, so they could not be checked and are left out. Gartner's IAM Summit was not opened. DIACC is the only vendor-neutral Canadian identity body found.