A plain-English guide to the space you're building in. No jargon without a definition. Every concept gets a picture. Written for someone new to identity security who needs to understand it deeply — not just recite the buzzwords.
1. What "identity" actually means in cybersecurity — and why it's the most important surface to protect today.
2. The difference between authentication, authorization, and identity management — words often used interchangeably but meaning different things.
3. What MFA, SSO, PAM, IGA, ZTNA, IAM, and CIAM mean — and which one your customer actually needs.
4. How the Identity Security Platform space is structured, who the players are, and where e91 fits.
5. Why this matters commercially — and how to talk about it with any audience.
In the physical world, identity is who you are. In tech, it's a bit different — and the difference is the whole reason this industry exists.
When a human walks into a bank, three things happen invisibly. The guard looks at their face (recognition). They show an ID card (verification). The system decides whether to let them into the vault (authorization). In digital systems, none of those things happen automatically — every one of them has to be replicated in code. And every one of them is a place attackers can attack.
So in tech, "identity" is a bundle of three things: a claim ("I'm Priya"), proof (something only Priya would have), and permissions (what Priya is allowed to do once we believe her).
Think of identity like an airport. Your passport (the claim) says who you are. The immigration officer scanning your biometrics (the proof) verifies it. The visa stamp (the permission) tells you which gates you can go to. Identity security is the entire airport security system — not any single piece.
Most people lump all three of these together and call it "login." They're different problems, solved by different products, bought by (sometimes) different teams. A huge part of understanding this space is keeping them straight.
Identity didn't used to be a security category. For most of computing history, security was about the network perimeter — a firewall, a DMZ, a VPN. Identity was an afterthought. That changed for three reasons, all commercial.
Ten years ago, "inside the company network" meant safe. Today your employees work from a café in Bengaluru on a personal laptop, accessing an app hosted in AWS Singapore, to read a database in Azure. There is no perimeter anymore. The one thing that's still identifiable is who is logging in. Identity became the new perimeter.
Verizon's annual breach report has tracked this for a decade. In 2024, over 80% of breaches involved stolen credentials or compromised identity — not broken firewalls, not unpatched servers. Attackers don't break in, they log in.
RBI, SEBI, IRDAI, CERT-In, DPDP — every Indian regulator now mandates identity controls: multi-factor authentication, access reviews, audit logs, privileged-access restrictions. Identity moved from "IT hygiene" to "board-level compliance requirement."
Identity is where the breaches happen, where the regulators look, and where buyers have budget. That's why identity security grew from a ₹200cr Indian market in 2018 to a projected ₹3,500cr+ market by 2028 — and why every global cybersecurity leader (Okta, CyberArk, SailPoint, Microsoft) is now an identity company.
If you internalize only one thing from this document, let it be this chapter. Authentication, authorization, and identity management are three different things — and every conversation, pitch, and RFP response depends on knowing the difference.
Authentication is immigration checking your passport and face. Authorization is the boarding pass scanner deciding whether you can enter gate 47 at 2pm. Identity management is the airline issuing your ticket, cancelling it if you miss the flight, reissuing it for a new destination, and eventually archiving your booking history.
"We have MFA, so we're covered for identity."
MFA is authentication only. It answers "is this really Priya?" It does not answer "what is Priya allowed to do?" or "should Priya still have access after changing roles?"
"We have MFA for authentication. We need PAM for privileged authorization, IGA for lifecycle, and eventually ZTNA to tie it all together."
Identity security requires all three pillars. Missing one leaves a specific type of breach vector uncovered.
When a CISO says "we need identity," you have to figure out which of the three they mean. Most of the time, they conflate them — and part of your job is to help them see the full picture without making them feel uneducated. A good discovery question: "When you say 'identity,' are you thinking about proving who someone is, controlling what they can do, or managing the lifecycle of user accounts?"
Let's walk through what really happens when an employee logs into an enterprise app. Once you see this flow, everything in the identity space clicks — you'll know exactly where each product fits.
Imagine a bank employee trying to access the core banking system in the morning. Here's what happens in the ~2 seconds between typing their password and seeing their dashboard:
Every identity product maps to a specific step in this flow. MFA is step 3. SSO compresses steps 1-4 across many apps. IGA controls what happens at step 5. PAM intervenes at step 6. And the audit log at the bottom is the one thing every regulator asks about first.
The reason identity security is a platform business, not a product business, is that these steps are all connected — a weakness at any one of them compromises the whole chain. That's why customers eventually want one vendor across all of it.
Every product in this space fits into a layered stack. Once you see the layers, you'll understand why vendors like Okta, CyberArk, and SailPoint are built the way they are — and where the gaps are for e91 to own.
Think of identity security as a six-layer stack. The lower layers handle foundational plumbing (storing who exists). The middle layers handle authentication and authorization. The upper layers add intelligence and governance. Most buyers start with the middle and grow outward.
Okta plays from Layer 2 upward — they own SSO/MFA and stretch into ZTNA and IGA. They treat the directory layer as something they can replace (Okta Universal Directory).
CyberArk plays from Layer 4 downward — they own PAM and expand into broader privileged identity.
SailPoint plays Layer 5 mainly — IGA is their home turf.
e91 starts at Layer 2 (MFA) but is architecturally designed to expand upward through SSO, PAM, IGA, and ZTNA — without requiring the customer to replace their directory (Layer 1). That IdP-agnostic approach is the key strategic difference.
Identity security is drowning in acronyms. Here are the ones that actually matter — in plain English, with why each exists and when it comes up in a customer conversation.
Don't throw all the acronyms at a buyer. Listen for which one they use first — that tells you where their mental model starts. If they say "MFA," they're thinking authentication. If they say "IGA," they're thinking audit. If they say "PAM," they have a concrete regulatory pressure. Meet them where they are, then widen the conversation.
A huge mistake new identity-security entrepreneurs make is treating all buyers the same. "The CISO" is not one person — they behave very differently depending on the segment, the product, and the compliance pressure they're under.
Almost every buyer in identity security follows the same journey: MFA (compliance pressure) → SSO (user experience) → PAM (audit pressure) → IGA (next audit cycle) → ZTNA (strategic modernization). This is why the MFA anchor is so strategically important — it's the front door to every subsequent sale.
Identity security is a ~$20 billion global market, growing at 15% annually. In India, it's smaller (~₹3,000cr in 2024) but growing faster. Here's who the competition actually is.
The map above matters for three reasons:
Okta can't do air-gap. Microsoft Entra forces you into M365. CyberArk is too expensive for mid-market. Each has a gap — e91's strategy targets those gaps deliberately.
ARCON has been around since 2006 — its architecture shows its age. eMudhra is strong in digital signing but weak in modern identity. The space is open for a next-generation Indian challenger.
Most new entrants pick one slice (passwordless, CIAM, device trust). e91's platform approach — starting at MFA and expanding through the stack — is uncommon, and it's what creates the long-term defensibility.
Now, with the full map of the space in front of you, it's obvious where we play — and why.
Modern, cloud-native, stateless, horizontally scalable. Not a repackaged 2010s stack.
Cloud, on-premises, or fully air-gapped. The air-gap capability is uniquely ours in India.
DPDP, RBI, SEBI, IRDAI, CERT-In pre-mapped. Not an afterthought.
IdP-agnostic. Plugs into whatever they already have. No rip-and-replace.
Post-quantum cryptography ready today. When RBI mandates it, we flip a flag.
MFA → SSO → PAM → IGA → ZTNA, on one unified architecture.
Everything in this document, distilled. If you remember only this page, you'll sound fluent in any identity security conversation.
Identity security is not a feature, it's a foundation. Every security initiative now starts with identity and builds outward. The companies that win in this space are the ones with a platform thesis — not single-product specialists.
India has a unique opportunity. Global leaders can't easily serve air-gapped, data-residency-bound, or rupee-priced environments. Indian incumbents have aging architectures. The middle is wide open for a modern, India-first platform.
e91's job is to own that middle. Start with MFA because that's where budget is clearest and compliance pressure is highest. Use the MFA anchor to land, then expand through the identity stack — methodically, with platform leverage on every new product.
That's the space. That's why we're in it. That's how we win.