Identity is not one market. It is four adjacent ones with different buyers, different economics and largely different vendors, and the single most common mistake in an identity conversation is treating them as interchangeable. This chapter maps them, names the leaders with the analyst report and date attached, and gives real pricing where real pricing exists.

This is the one segment with genuine price transparency, and the transparency is one-sided — Microsoft publishes everything, Okta has recently published less.

Customer identity is priced per monthly active user, and Auth0's published table is the most instructive artefact in the whole category because it shows exactly where the economics break.

• Free up to 25,000 MAU, for both B2C and B2B. A genuinely large free tier.
• Then a cliff. At 25,001 MAU on B2C Essentials you go from $0 to roughly $1,750 a month at the flat $0.07 per MAU rate — about a $21,000 annual step change triggered by one additional user.
• B2C Essentials has no volume discount at all — it is flat at $0.070 per MAU across every published band.
• B2B costs three to four times B2C at the same MAU. At 5,000 MAU it is $350 against $1,300 a month.
• Self-serve ends at 20,000 MAU on B2C Professional and 10,000 on B2B Professional — note the oddity that the free plan tolerates more users than the paid plan handles without a salesperson.
• Machine-to-machine tokens are a separate meter. This is where AI agent and service-to-service traffic lands, and it is the line that surprises people building agent-heavy products.

The alternatives are the cloud-native services (Entra External ID, free to 50,000 MAU; Amazon Cognito; Firebase Auth), the newer specialists (Frontegg, Descope, Stytch), and Keycloak, which is Apache-licensed and free but hands you an operational burden that is not free.

Two structural facts define this segment in 2026.

• Gartner retired the Magic Quadrant for Identity Governance and Administration and replaced it with a Market Guide, the current edition published 2 October 2025. The stated logic is market maturity and low differentiation. The practical consequence: there is no ‘Gartner Leader in IGA’ any more, and anyone claiming one is citing a 2023 or older report. That is a useful thing to know when a vendor puts a slide in front of you.
• Nobody publishes a price. SailPoint, Saviynt and Omada are all sales-led. The one defensible public anchor: SailPoint reported total ARR of $1.125 billion across 3,235 customers for its fiscal year ended January 2026, which works out at roughly $348,000 average ARR per customer. That average is skewed by large enterprises, but it establishes the order of magnitude better than any vendor comparison blog.

Gartner's own figures put IGA growth at 9.2% from 2023 to 2024 with 10.7% forecast into 2025 — noticeably lower than the 14–15% the market-research firms publish. The two are measuring different things: Gartner is measuring vendor revenue, the others are forecasting a broader market definition. Present both and say which you believe.

Privileged access is the fastest-growing sub-market in identity — roughly a $4 to $5.5 billion market growing at about 20% a year, against about 12% for IAM overall — and it just lost its largest independent vendor.

And for access management, the 2025 Gartner Magic Quadrant published in November 2025 named Microsoft (ninth consecutive year), Okta (ninth consecutive year) and Transmit Security among its Leaders. Note that CyberArk was not a Leader in that report — it leads the separate PAM quadrant. Conflating the two is a common error in vendor decks.

Look at the Doppler and Infisical rows together, because they are the whole strategic argument of 2026 in two lines. For a company with 150 engineers and 300 service accounts, ‘agents ride free’ against ‘$20 per identity’ is roughly $38,000 a year against $108,000. Microsoft sits in the middle at $3 per workload identity per month. Meter it, give it away, or charge full price — three vendors, three positions, and the answer is not yet settled.

Machine identities substantially outnumber human ones in most large estates, and the specialist vendors that grew up around that problem have mostly been bought.

• SailPoint acquired Entro Security for a reported ~$200 million, closing 29 June 2026, to accelerate what it calls its Agentic Fabric — secrets discovery, mapping human identities to the non-human ones they own, and AI-agent threat detection.
• Palo Alto folded CyberArk plus the Venafi machine-identity assets into Idira's Machine and Agentic pillars in May 2026.
• Okta acquired Axiom Security in September 2025 for identity-centric PAM, citing that only about one in ten organisations has a developed strategy for non-human identity.
• Reports also place Cisco moving on Astrix and Cyera on Oasis Security during 2026. I could not corroborate either from a primary source, so treat both as unconfirmed — which is itself the right habit with acquisition rumours.
• Remaining independents worth knowing: Aembit (runtime access and policy enforcement), Token Security (access certification designed for machine identities rather than inherited from human IAM), Clutch, GitGuardian.

A caution on the statistics you will see quoted here — ratios like ‘144 machine identities per human’ and ‘over 80% of identity breaches involve non-human credentials’ are vendor-sourced. They are useful for framing a conversation and they are not independent research. Cite them as marketing figures or not at all.

Gartner forecasts Indian information-security end-user spending at about $3.4 billion in 2026, up 11.7%, against roughly $249 billion worldwide. India is therefore around 1.4% of global security spend while hosting a very large share of the world's enterprise operations, and that single ratio explains most of how vendors price and staff here.

What a GCC actually decides. A global capability centre is a cost centre inside a foreign parent, so the identity stack is usually not chosen in India at all — the parent's Entra or Okta tenant is extended to the Indian entity. The India team's genuine discretion runs to three things: PAM for locally operated infrastructure, whatever the Indian regulator requires that the global standard does not already cover, and the operational headcount to run all of it. The third is the one that matters for hiring.

The arithmetic below uses published list prices where they exist and states its estimates. Rupee figures at approximately ₹96 to the dollar.

Three conclusions that are worth more than the numbers themselves:

• Okta Core Essentials at $840,000 costs more than the entire thin-IdP plus SailPoint plus PAM stack at its midpoint, while delivering weaker governance and weaker privileged access than the specialists. What it buys is one contract, one renewal, one integration surface. Whether that is worth the premium is exactly the question a platform product manager is paid to answer — and it is the question Okta's repackaging was designed to provoke.
• Open source moves the cost from the licence line to the headcount line, and headcount is the one line item that is several times cheaper in India. The India-run and US-run open-source stacks differ by nothing except where two engineers sit, and that difference is roughly $300,000 a year. That is a real, defensible reason a GCC reaches a different build-versus-buy answer than its parent.
• But Keycloak and OpenBao have no IGA. No certification campaigns, no segregation-of-duties analysis, no attestation reporting. Under DPDP Rule 6 plus the RBI Master Direction, that is not a feature gap — it is an audit failure. The cheap stack is only cheap because it is incomplete, and the honest version adds either a commercial IGA product or two more engineers building certification workflows that will not satisfy an auditor.
• And the list price is the least interesting number. Several of these stacks cost similar money; they differ in contract count, renewal leverage, integration surface, and which capability you are quietly paying for twice.