New Vendor-Neutral IAM Reference Publishes Its Scoring Methodology and Invites You to Prove It Wrong

Start with Identity launches a free, vendor-neutral IAM reference: protocol deep dives, 293 dated vendor evaluations, and 86 national eID schemes.

SAN FRANCISCO, CA, UNITED STATES, July 28, 2026 /EINPresswire.com/ -- Start with Identity is live today as an independent, practitioner-led technical reference for identity and access management. It was founded by Deepak Gupta, who founded LoginRadius and built its CIAM platform from first commit to more than a billion managed user identities, serving as its CTO and CISO. The site is free to read, free to cite, carries no sponsorship, and accepts no paid placement. This is an initial launch, and the community is recruiting volunteers across seven roles.

The identity landscape shifted in 2026, and the shift cuts in more than one direction. Verizon's 2026 Data Breach Investigations Report, drawing on more than 31,000 incidents and 22,000 confirmed breaches across 145 countries, found that exploitation of software vulnerabilities has overtaken stolen credentials as the top single initial access vector for the first time in the report's 19-year history, at 31% against 13% for credential abuse. That finding is inconvenient for anyone selling identity products, and it is on the site.

The rest of the 2026 data points the other way. Credential abuse remains the single most pervasive technique across full breach chains. Palo Alto Networks' 2026 Identity Security Landscape, the successor to CyberArk's annual survey following the $25 billion acquisition, puts machine identities ahead of human ones by 109 to 1, with 79 of those 109 being AI agents. The FIDO Alliance's State of Passkeys 2026 estimates five billion passkeys now in active use, with 68% of organizations deploying or piloting them for workforce sign-in, which means a generation of authentication architecture is being rebuilt right now.

Every one of those figures is contested, differently sourced, and easy to quote out of context. That is precisely the problem. The engineer choosing between OIDC and SAML for a federation, or deciding whether to implement SCIM push or pull, still ends up reading a whitepaper written to close a deal. And the industry's independent voices are consolidating: the most-cited machine identity statistic in security now belongs to the same company that acquired the vendor who published it.

Start with Identity was built to be the thing you cite in an architecture review instead.

Built for engineers first
- 12 protocol deep dives on OAuth 2.0, OpenID Connect, SAML, WebAuthn, FAPI, SCIM, and verifiable credentials, written at implementation depth rather than marketing depth
- Developer recipes that are code-forward: add login, validate a JWT, protect an API, wire up SCIM provisioning, ship passkeys
- 84 practitioner guides covering migration without downtime, multi-tenant B2B architecture, enterprise readiness for SSO and audit logs, and CIAM pricing models
- A live standards tracker and a sourced research data set where every figure carries an attribution and a date
- Breach teardowns that trace real incidents back to the identity control that failed
- A 123-term glossary and a curated library of 87 external resources: RFCs, NIST 800-63, OWASP guidance, academic research, and industry reports

Reference data the field did not have in one place
- 293 vendor profiles across 17 categories, from workforce IAM and CIAM to PAM, IGA, CIEM, ITDR, machine identity, secrets, PKI, authorization, ZTNA, decentralized identity, and agentic AI identity. Each scored against a published capability matrix, dated, and signed.
- 86 national digital identity schemes across 51 countries, from Aadhaar to Login.gov, with the standards each uses, how citizens authenticate, and candid privacy notes
- 39 identity and data-protection regulations across 20 countries, each mapped to its effect on authentication, consent, governance, verification, and data residency
- 14 vertical breakdowns covering the identity constraints specific to financial services, healthcare, government, gaming, telecom, and more

Independence is enforced rather than asserted. Every evaluation is dated and signed. The scoring matrix is published so anyone can check what was measured and how. Opinions are labeled as opinions, facts carry citations, and disclosures appear on any page that needs one. There is no email wall and no registration.

The corpus is also structured to be machine-readable and citable, so the AI assistants and answer engines that engineers increasingly query about identity are learning from sourced, vendor-neutral material rather than from marketing copy.

From the founder
Deepak Gupta founded LoginRadius and served as its CTO and CISO, architecting the customer identity platform from scratch and scaling it past one billion managed identities while running the security program through SOC 2, ISO, GDPR, and CCPA compliance. He holds three patents spanning DDoS defense, IoT authentication, and searchable encryption. His publishing record in the field is academic as well as commercial.

Gupta co-edited the Handbook of Computer Networks and Cyber Security: Principles and Paradigms (Springer, 2019) and the Handbook of Research on Multimedia Cyber Security (IGI Global, 2020), and contributed to Computer and Cyber Security: Principles, Algorithm, Applications, and Perspectives (2018). He has written for the Forbes Technology Council and Entrepreneur, publishes technical analysis at guptadeepak.com, and has spoken at Identity North, SaaStr, and Microsoft's India VC Summit.

"I spent a decade inside the CIAM category, and I watched good engineers make irreversible architecture decisions off vendor PDFs, because that was what existed," said Gupta. "Nobody publishes an honest comparison of the thing they sell. That is not malice, it is structure. So the field ends up with a knowledge base that is fluent about products and vague about tradeoffs."

"Start with Identity is the reference I wanted when I was implementing this stuff: sourced, dated, signed, and answerable to practitioners instead of sponsors," he added. "This is an early launch and there is a lot still missing. That is deliberate. The gaps are where contributors come in, and every contribution ships with the contributor's name on it."

On consolidation, Gupta was direct: "In one year the field lost an independent research voice to a $25 billion acquisition, and the DBIR told us that the thing we have all been repeating about credentials needs revising. Both of those are arguments for a reference nobody can buy."

The scoring methodology is published in full and open to challenge at https://startwithidentity.com/methodology/. The methodology is published. Prove it wrong.

Most vendor rankings ask readers to trust a score. Start with Identity publishes the capability matrix behind every score, so anyone can see which criteria were measured, how they were weighted, and when the evaluation was last run. Every profile carries an author, a date, and a confidence level.

Start with Identity runs on contribution. Most roles take one to four hours a week, and every contribution ships with a public byline. For engineers early in an identity career, this is a citable public track record in a field where hiring still runs on reputation. Corrections and challenges to any published evaluation are welcomed and credited the same way. Applications are open at startwithidentity.com/community.

Availability
Start with Identity is live and free at startwithidentity.com. No paywall, no registration, no email wall.

About Start with Identity
Start with Identity is a vendor-neutral, non-commercial community and technical reference for identity and access management professionals worldwide. It publishes protocol deep dives, implementation guides and developer recipes, dated vendor evaluations, global regulation and national eID references, breach teardowns, practitioner interviews, and a free IAM jobs board.

The project accepts no sponsorship and no paid placement, publishes its scoring methodology in full, and credits every contributor by name. It was founded by Deepak Gupta, who founded LoginRadius and built its CIAM platform as CTO and CISO. Learn more at startwithidentity.com.

SWI Media Team
Start With Identity
community@startwithidentity.com
Visit us on social media:
LinkedIn
X
Other

Legal Disclaimer:

EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.