Market and trends

3 min read · Chapter 6 of 10

Who holds the power

Customers' directories hold the employees. Every SSO connection ends at Okta, Entra or Google Workspace; WorkOS says Okta is about 40% of the directory traffic it sees, and Okta's annual report names Microsoft its principal competitor.
Apple, Google and Microsoft hold passkeys: creation, sync, recovery and the prompt users see. Apple's automatic passkey upgrades in 2025 show the platforms steering the experience.
Clouds and backend platforms give login away to win the database or the hosting, setting price anchors for everyone else.
Security reviewers, auditors and insurers write the de facto roadmap through questionnaires.
Standards groups (the IETF, the OpenID Foundation, the W3C and FIDO Alliance) decide what makes vendors swappable, and move slower than agent products.
Security platforms (Palo Alto Networks, CrowdStrike, Cisco, ServiceNow) set exit prices by buying identity companies.

Tailwinds and headwinds

These are the forces I'd watch over the next couple of years. Players that already hold the employee directory, the cloud account or the developer's backend come out ahead on most.

Tailwinds:

What's changing	Who gains	Who loses
Agents and service accounts need credentials, scopes and audit trails. Reported deals with a machine, agent or authorization angle since November 2025 total about $29 billion, $25 billion of it CyberArk, while Okta calls its agent revenue immaterial this fiscal year.	Palo Alto Networks, CrowdStrike, Cisco, ServiceNow; Okta; Clerk and WorkOS	Vendors with only a per-user meter
AI app builders create apps by the million, each needing login. Supabase raised $500 million at a $10.5 billion valuation in June 2026.	Supabase, Clerk, Firebase; whichever login the coding tools default to	Vendors that need a sales call to start
AI companies sell to large enterprises within months, so SSO and SCIM are launch requirements. WorkOS raised at a $2 billion valuation in March 2026 and names OpenAI and Anthropic as customers.	WorkOS, Clerk, Stytch, Descope; Okta and Entra	Apps that price SSO too high; in-house builds
Security platforms buy identity companies to control people, machines and agents in one place.	Okta; identity startups with an agent angle	Independents without a niche
Passkeys, NIST's 2025 rules and the EU wallet make phishing-resistant sign-in the default; the FIDO Alliance estimates about 5 billion passkeys in use.	Apple, Google, Microsoft; vendors that make passkeys easy	SMS code vendors; apps on passwords alone

Headwinds:

What's changing	Who gains	Who loses
Free tiers keep growing: Clerk went from 10,000 free users to 50,000 retained users in February 2026, and WorkOS gives away a million.	App builders; clouds and backend platforms	Vendors priced only per user; Auth0 at the low end
Open-source libraries and AI-written login code reduce the need to buy; Vercel bought Better Auth, which reports 4.7 million weekly downloads.	Vercel, Supabase	Closed developer-first vendors; owners of AI-written checks that are wrong
Independents are squeezed: Stytch went from a $1 billion valuation to a reported $104 million sale, and standalone authorization vendors are sold small.	Strategic buyers; platforms that bundle permissions	Standalone authorization and second-tier login startups
The SSO tax backlash: CISA's pledge, and Supabase including SAML on a $25 plan.	Buyers; flat-priced vendors	Connection revenue at WorkOS, Clerk, Stytch and Auth0; apps with steep enterprise uplifts
Security budgets are flat for a second year in IANS's survey, AI takes the new money, and Okta guides to 10-11% growth.	Bundles in existing contracts (Microsoft 365 E5, Palo Alto)	Identity vendors that need new budget

The one thing I'd watch is a published price for an agent from Okta or Microsoft, because whichever meter wins there decides who earns from the fastest-growing kind of identity.