Pillar
Identity and Access
Identity is the control plane for everything else on this site. A perfect SIEM will still lose if the session was stolen and the admin role was standing. The job is not ‘buy SSO.’ The job is who is in the token, how long it lives, and whether a human still has a permanent privileged role.
Identity protection
Stolen sessions and standing admin
Open the list
Privileged access management
Expire the admin session
Open the listSecrets management
Keep the key out of git
Open the list
Passkey tools
Ship WebAuthn without a science fair
Open the listQuestions about Identity and Access
What does the identity protection list compare?
How each product handles a stolen session and a standing privileged role. Can you step-up, revoke, and expire. Can you see the admin path. We put Okta and Entra next to Keycloak, authentik, and Zitadel so the self-hosted options are not a footnote, and CyberArk for the privileged-access job the directories keep postponing.
Is this IAM, CIAM, or PAM?
Those are vendor shelves. The user still has a session and a role. We keep one list and say which job each row is actually good at, instead of sending you to three categories that all sell the same token.
How does this relate to API security?
The IdP issues the token. Your API must still check it. Identity lists cover the issuer and the privileged path. API lists, when they ship, will cover what the resource server does with the subject and the object id.
Why is session theft on the job line?
Because MFA at login does not save you if the cookie or refresh token is copied later. A product that cannot revoke or bind that session is incomplete no matter how many social logins it offers.
Do you list passkeys and WebAuthn?
Not as a separate published list yet. When we do, it will sit here, judged on whether the session after the passkey is still stealable.
