What is CIAM,
and who wins in 2026.
CIAM is customer identity: registration, login, MFA, profile, consent, and authorization for the people who use your product. Workforce IAM is the same job for employees. They share protocols. They are not the same product.
50 vendors on one matrix, last verified 19 August 2026. No aggregate score. No vendor money. Signed by Deepak Gupta.
| Job | 2026 pick | Not this |
|---|---|---|
| Native passkeys | MojoAuth or Stytch | Descope (orchestration) |
| Enterprise SSO, transparent price | SSOJet | Clerk |
| B2B Admin Portal | WorkOS | Cognito |
| Next.js / Node.js app | Clerk | Ping, Keycloak |
| Visual identity orchestration | Descope | MojoAuth (wrong category) |
| Full surface, agents, FedRAMP | Auth0 | SSOJet as the only vendor |
Last verified 19 August 2026. Full table and caveats: best CIAM vendors 2026.
- Vendor profiles
- 50
- Head-to-heads
- 117
- CIAM guides
- 82
New tool
Not sure where your CIAM program stands?
The maturity assessment scores you across ten dimensions and names your priority gaps in about five minutes. No sign-in.
What's inside.
One matrix. Dated verdicts.
CIAM at mid-year 2026.
Passkeys as default, WebAuthn Level 3 in Advisory Committee review, agent identity as a CIAM object, SMS OTP leaving AAL2, and Twilio-Stytch. Four themes, dated and signed. The 2025 annual report stays as the yearbook.
Read the brief2026
Vendors
Profiles for every CIAM platform, scored on the same 30+ capability matrix with TCO bands and an editorial verdict.
Compare
Side-by-side head-to-heads with feature matrix, pricing at four MAU bands, and explicit "when A wins / when B wins" verdicts.
Alternatives
Switching guides ranked by pain: Auth0, Clerk, Stytch, WorkOS, Keycloak, FusionAuth, Firebase, Entra, Cognito, and open source.
Pain points
The walls enterprises hit with homegrown identity, in three phases, each mapped to the vendor capabilities that solve it: migration, multi-brand, scale, lifecycle, and more.
Verticals
Industry-by-industry CIAM reads, finance, travel, government, retail, B2B SaaS, D2C, consumer apps, with the vendors that excel in each and the 2027-2030 outlook.
CIAM guides
Practitioner-grade guides on passkeys, MFA, RBAC vs ABAC, agentic identity, B2B SSO, post-quantum auth, and more.
Glossary
Definition-first terms across authentication, authorization, privacy, and compliance.
Tools
Vendor selector, TCO calculator, build-vs-buy worksheet, RFP builder.
Playbooks
90-day runbooks for Auth0 to SSOJet, WorkOS, or MojoAuth, and Azure AD B2C P1 to Entra External ID.
Capability matrix
The dated dataset: CSV and JSON of every vendor axis and TCO band. Last verified 19 August 2026.
Methodology
How vendors are evaluated, scored, and updated. The trust contract behind every page.
By industry
CIAM, vertical by vertical.
Every industry uses CIAM for a slightly different job. Each vertical page covers the dominant use cases, the regulatory floor, the vendors we see excel in that space, and where the category is heading through 2030.
- Financial services
Financial services & banking
Strong customer authentication, fraud signals at every step, and a compliance posture that survives a regulator's audit.
5 vendor picks · 6 trends
- Travel & hospitality
Travel & hospitality
Loyalty identity that survives a brand portfolio, anonymous browse-to-book conversion, and PCI-clean payment flows.
4 vendor picks · 5 trends
- Government & cities
Government & cities
Citizen-scale identity proofing, accessibility, FedRAMP / IL controls, and a procurement cycle that rewards open standards.
5 vendor picks · 6 trends
- Retail & e-commerce
Retail & e-commerce
Guest checkout that converts, loyalty profiles that reconcile, and account-takeover defenses that don't add friction.
5 vendor picks · 5 trends
- B2B SaaS
B2B SaaS
Organizations-as-the-primary-object, enterprise SSO that ships on time, SCIM at scale, and a per-tenant audit story buyers will accept.
7 vendor picks · 5 trends
- D2C brands
Direct-to-consumer (D2C) brands
Frictionless signup, marketing-grade consent, social and Apple Sign-In coverage, and a profile graph that connects every touchpoint.
5 vendor picks · 5 trends
- Consumer apps
Consumer apps & marketplaces
Mobile-first signup, social and phone-number identity, abuse defense, and trust signals that scale with the network.
6 vendor picks · 6 trends
- Gaming
Gaming & interactive entertainment
Player identity at platform scale, cross-platform progression, anti-cheat tied to accounts, and parental-control flows that survive a regulator.
5 vendor picks · 6 trends
- iGaming & gambling
iGaming, online gambling & sports betting
License-grade KYC, source-of-funds and AML checks, geo-fencing per jurisdiction, responsible-gambling registers, and audit trails regulators will ask for.
5 vendor picks · 5 trends
- Healthcare
Healthcare & life sciences
HIPAA-grade patient identity, IAL2 proofing for prescription access, telehealth video-visit identity, and a provider-side workforce identity that bleeds into CIAM.
5 vendor picks · 5 trends
- Education
Education & EdTech
Rostering for K-12, federated SSO for higher ed, FERPA-grade record handling, and a B2B-meets-B2C identity model that respects both.
5 vendor picks · 5 trends
- Media & streaming
Media & streaming
Household sub-profiles, concurrent-stream enforcement, password-sharing controls, ad-tier identity, and rights-driven geo-fencing.
5 vendor picks · 5 trends
- Automotive
Automotive & connected vehicle
Driver and household profiles, vehicle-bound identity, OTA-update consent, EV-charging account portability, and a strict separation between safety and convenience flows.
5 vendor picks · 5 trends
- Energy & utilities
Energy & utilities
Account-holder identity for billing, premise-and-meter binding, demand-response participation, EV-charging interop, and a regulator-aware audit trail.
5 vendor picks · 5 trends
- Insurance
Insurance
Quote-to-bind identity, policyholder portal accounts, broker and agent federation, claims-side identity proofing, and a fraud posture that survives the auditor.
5 vendor picks · 5 trends
- Real estate
Real estate & proptech
Renter, owner, and agent identity, property-bound access, smart-lock and tour identity, and a transaction-side identity that integrates with title and escrow.
5 vendor picks · 5 trends
- Crypto & Web3
Crypto & Web3
Wallet-bound identity, KYC at the regulated boundary, decentralized-identifier (DID) emerging, and a security posture where the user's keys are the asset.
5 vendor picks · 5 trends
- Non-profit & civic
Non-profit & civic
Donor identity, volunteer onboarding, beneficiary access without surveillance, and a budget-aware vendor choice that doesn't sacrifice privacy.
5 vendor picks · 5 trends
The contract
Vendor-neutral. Editorially gated. Receipts attached.
Every vendor scored on the same matrix. Every claim sourced. Every page dated and signed. No sponsored placements, no affiliate links, no premium tier. The trust moat is the asset.
Read the methodology