IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index › Identity and access › CIAM › Small business › September 2026 Edition

Customer identity and access management for small business buyers

Asked as “customer identity platform”, and as “CIAM solution for a product's users”, on behalf of a small B2B company. 48 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Clerk
Contested
27% of first choices, contested.
ShowinginAll 67 categories in the September 2026 Edition →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small businessClerk27%ContestedThis pageMid-marketAuth022%ContestedStanding →EnterpriseAuth047%Clear leaderStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Clerk27%5%38accepted challenger
02Auth025%51%61criticized challenger
03Frontegg15%5%19accepted challenger
04WorkOS10%6%31accepted challenger
05LoginRadius4%11%18accepted challenger
06Amazon Cognito4%50%20criticized challenger
07Descope2%5%20accepted challenger
08Firebase Authentication2%22%18accepted challenger
Show the six products at 0%, ordered by negative rate
14Okta0%79%14criticized challenger
13Microsoft Entra External ID0%42%12criticized challenger
12Keycloak0%36%14criticized challenger
11FusionAuth0%6%16accepted challenger
09Stytch0%0%26accepted challenger
10Supabase Auth0%0%15accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.
Head to head
Auth0 vs WorkOSAuth0 vs FronteggWorkOS vs Frontegg

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
12
13
14
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01Clerk27%
02Auth025%
03Frontegg15%
04WorkOS10%
05LoginRadius4%
06Amazon Cognito4%
07Descope2%
08Firebase Authentication2%
09Stytch0%
10Supabase Auth0%
11FusionAuth0%
12Keycloak0%
13Microsoft Entra External ID0%
14Okta0%

02What they warned about

Three of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Auth0
51%
31 of 61 labels negative · 11 of 12 models · 9 hard negative
“What to Avoid for a Small Business ... Auth0 ... too expensive and complex for a small business” GLM 4.7 FlashX, paraphrase prompt
Okta
79%
11 of 14 labels negative · 8 of 12 models · 8 hard negative
“small businesses should be cautious about or avoid the following types of customer identity platforms: **Enterprise-focused CIAM platforms** ... such as Okta (for customer use cases)” Mistral Small, negative prompt
Amazon Cognito
50%
10 of 20 labels negative · 8 of 12 models · 4 hard negative
“Only suitable if your entire application is already deeply embedded in AWS ... Otherwise, avoid.” DeepSeek V4 Flash, negative prompt
ForgeRock
100%
5 of 5 labels negative · 5 of 12 models · 4 hard negative
“ForgeRock can be a significant investment, potentially making it less accessible for smaller businesses or startups with limited budgets.” Claude Haiku 4.5, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

62 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 861 links across 189 sites, every framing counted. Ranked by the number of answers carrying the site or page.

loginradius.com
vendor site · LoginRadius45 answers · 67 citations · 10 models
startwithidentity.com
34 answers · 56 citations · 10 models
expertinsights.com
vendor site · Expert Insights29 answers · 31 citations · 10 models
descope.com
vendor site · Descope24 answers · 29 citations · 9 models
ibtimes.com
18 answers · 18 citations · 9 models
worldmetrics.org
18 answers · 18 citations · 9 models
workos.com
vendor site · WorkOS17 answers · 33 citations · 7 models
g2.com
15 answers · 32 citations · 8 models
guideflow.com
vendor site · Guideflow15 answers · 15 citations · 6 models
clerk.com
vendor site · Clerk13 answers · 21 citations · 7 models
securityboulevard.com
12 answers · 14 citations · 6 models
miniorange.com
vendor site · miniOrange12 answers · 13 citations · 6 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

loginradius.com/blog/identity/top-ciam-for-small-and-medium-businesses
39 answers · 10 models
expertinsights.com/identity-and-access-management/top-customer-identity-and…
29 answers · 10 models
ibtimes.com/top-5-best-customer-identity-access-management-ciam-solutions-2…
18 answers · 9 models
worldmetrics.org/best/customer-identity-management-software
17 answers · 9 models
descope.com/blog/post/ciam-solutions
16 answers · 7 models
startwithidentity.com/articles/top-7-ciam-platforms-b2b-saas
16 answers · 8 models
guideflow.com/blog/ciam-software
15 answers · 6 models
startwithidentity.com/rankings/best-ciam-for-startups
14 answers · 7 models
miniorange.com/blog/ciam-vendors
11 answers · 6 models
startwithidentity.com/rankings/best-ciam-platforms
11 answers · 6 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best customer identity platform for a small B2B company?”Paraphrase“Which CIAM solution for a product's users would you recommend to a small business that sells to other businesses?”Comparative“What are the top customer identity platforms for a small team and how do they differ?”Budget-constrained“What is the best customer identity platform for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a customer identity platform. What should we look at?”Negative“Which customer identity platforms should a small business avoid or be cautious about?”
Claude Haiku 4.5Frontegg
Two alternativesSSOJet, WorkOS
Auth0Changed
One alternativeOkta
against: Amazon Cognito, Firebase Authentication, SupabaseDescope
Four alternativesAmazon Cognito, Auth0, Frontegg, Keycloak
Descope
One alternativeFrontegg
against: Amazon Cognitono first choiceagainst: Auth0, ForgeRock, Google Cloud Identity, Okta, Ping Identity
GPT-5.4 miniAuth0
Three alternativesClerk, Descope, WorkOS
Auth0Held
One alternativeFusionAuth
against: Auth0Clerk
Three alternativesDescope, Stytch, WorkOS
against: Auth0Amazon Cognito, Clerk
One alternativeFusionAuth
against: Auth0/Okta Customer Identity Cloudno first choiceagainst: Amazon Cognito, Auth0, Descope, Okta
Gemini 3.5 FlashKinde
Two alternativesPropelAuth, WorkOS
against: Auth0, ClerkKindeHeld
Three alternativesClerk, Frontegg, WorkOS
against: Auth0, Microsoft EntraClerk
Five alternativesDescope, Firebase Authentication, Stytch, Supabase Auth, WorkOS
against: Auth0Clerk
Three alternativesBetter Auth, Kinde, Supabase Auth
against: Auth0Clerk
Three alternativesFrontegg, Kinde, WorkOS
against: Auth0against: Amazon Cognito, Auth0, IBM Verify, Keycloak, Microsoft Entra External ID, Ping Identity / ForgeRock
Perplexity SonarWorkOS
Three alternativesClerk, Descope, Frontegg
against: Auth0WorkOSHeld
Four alternativesAuth0, Descope, Frontegg, LoginRadius
Clerk, WorkOS
Four alternativesMojoAuth, SSOJet, Stytch, SuperTokens
against: Amazon Cognito, Auth0Amazon Cognito, Clerkagainst: Auth0, WorkOSno first choiceagainst: Auth0, ForgeRock, Microsoft Entra / Azure Active Directory-style service CIAM, OneLogin, PingOne for Customers
Grok 4.1 FastClerk, Frontegg
Three alternativesStytch, Supabase Auth, WorkOS
against: Amazon Cognito, Auth0, OktaWorkOSChanged
One alternativeStytch
against: Auth0, Frontegg, Keycloak, OktaClerk
Five alternativesAuth0, FusionAuth, Stytch, Supabase Auth, WorkOS
against: Amazon Cognito, Auth0Clerk
Five alternativesAmazon Cognito, Firebase Authentication, Keycloak, Stytch, Supabase Auth
against: Auth0Auth0
Five alternativesClerk, Frontegg, LoginRadius, Stytch, WorkOS
against: Okta, Ping Identityagainst: ForgeRock, Google Cloud Identity, Okta, Persona, Ping Identity, SailPoint, Saviynt, Twilio Segment, mParticle
Mistral SmallFrontegg
Two alternativesMicrosoft Entra External ID, MojoAuth
Auth0, ClerkChanged
One alternativeFusionAuth
Frontegg, LoginRadius
Three alternativesAuth0, FusionAuth, Microsoft Entra External ID
against: Auth0Auth0, LoginRadius
One alternativeMicrosoft Entra External ID
no first choiceagainst: Microsoft Entra ID, Okta
DeepSeek V4 FlashSSOJet, WorkOS
One alternativeStytch
against: Auth0ZitadelChanged
Two alternativesFrontegg, SSOJet
against: Auth0, Clerk, Firebase Authentication, WorkOSClerk
Six alternativesAmazon Cognito, Auth0, Firebase Authentication, FusionAuth, Supabase Auth, WorkOS
Auth0
Five alternativesClerk, Firebase Authentication, FusionAuth, Keycloak, Supabase Auth
no first choice
Four alternativesAuth0/Okta, Clerk, Stytch, WorkOS
against: ForgeRock, Microsoft Entra External ID, Ping Identityagainst: Amazon Cognito, Auth0/Okta Customer Identity Cloud, Keycloak, Microsoft Entra External ID, Ping Identity / ForgeRock, Thales OneWelcome
Llama 4 MaverickFronteggno first choiceChangedDescopeLoginRadius
Two alternativesJumpCloud, OneLogin
no first choiceagainst: Okta
Qwen 3.7 FlashClerk
Two alternativesAuth0, SuperTokens
against: Firebase AuthenticationAuth0, ClerkChangedagainst: Microsoft Entra External IDDescope
Two alternativesLoginRadius, Stytch
against: Auth0Auth0, Clerk
One alternativeSupabase Auth
against: Amazon CognitoAuth0, Clerk
One alternativeFirebase Authentication
against: Keycloak, Microsoft Entra ID, Okta, Ping Identity, Supabaseagainst: Auth0, Firebase Authentication, Keycloak, Microsoft Entra ID, Oracle Identity Governance, SailPoint, Zitadel
Kimi K2Frontegg
Five alternativesAuth0, Clerk, FusionAuth, Kinde, Stytch
Frontegg, WorkOSChanged
Two alternativesKinde, Stytch
against: Auth0, OktaClerk
Four alternativesDescope, Frontegg, FusionAuth, Stytch
against: Auth0Firebase Authentication
Five alternativesAuth0, FusionAuth, Keycloak, Microsoft Entra External ID, Stytch
no first choiceagainst: Auth0, IBM Verify, Okta Workforce Identity, Ping Identity / ForgeRock
GLM 4.7 FlashXFrontegg
Five alternativesAmazon Cognito, Auth0, Descope, LoginRadius, WorkOS
KindeChanged
Two alternativesStytch, WorkOS
against: Auth0, LoginRadiusClerk
Seven alternativesDescope, Frontegg, FusionAuth, Stytch, Supabase Auth, WorkOS, miniOrange
against: Amazon Cognito, Auth0Auth0
Two alternativesDescope, miniOrange
against: FusionAuthno first choiceagainst: Auth0, CyberArk, ForgeRock, Microsoft Entra External ID, Okta, OneLogin, Ping Identity
MiniMax M2.5Clerk
Three alternativesAuth0, Supabase Auth, WorkOS
Auth0Changed
Three alternativesAzure AD B2B, Keycloak, OneLogin
against: PingOne for CustomersClerk
Five alternativesAmazon Cognito, LoginRadius, MojoAuth, Stytch, WorkOS
against: Auth0Clerk
One alternativeSuperTokens
against: Auth0, LoginRadiusno first choicenothing named
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:53yes98 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:36yes45 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:37yes1724 s
Direct recommendationPerplexity Sonarsonar2026-09-17 12:19yes206 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:50yes3820 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 11:05yes55 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:31yes1817 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:54yes52 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:43no037 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:50yes1334 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 11:29yes1450 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:31yes1534 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:18no05 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:26yes36 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:03yes2030 s
ParaphrasePerplexity Sonarsonar2026-09-17 10:46yes206 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:04yes3918 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 09:55no02 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:48yes1924 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:58yes53 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:29no042 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:42yes1438 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:09yes2640 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:03no044 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:26yes1510 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:05yes58 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:06yes1827 s
ComparativePerplexity Sonarsonar2026-09-17 14:05yes209 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:16yes3015 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 10:08yes1413 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:49yes2022 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:00yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:49yes544 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:18yes2742 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:33yes20108 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:39yes1337 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:47yes97 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:46yes45 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:04yes2727 s
Budget constrainedPerplexity Sonarsonar2026-09-17 09:24yes196 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:01yes4921 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 13:00yes58 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 14:04yes2020 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:57yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:23yes1043 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:38yes926 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 11:40yes2492 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 14:06yes1833 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:38no07 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:45no08 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:18yes1226 s
Scale constrainedPerplexity Sonarsonar2026-09-17 13:35yes2010 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:09yes2013 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 10:48no07 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:56yes916 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 09:50yes53 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:35no038 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:19yes1525 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 11:18yes14135 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:14yes534 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:36yes1610 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 14:04yes49 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 14:11yes1626 s
Negative framingPerplexity Sonarsonar2026-09-17 11:13yes206 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:36yes2215 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 13:10yes55 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-09-17 13:49yes2660 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:17yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:18no037 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:23yes2332 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:51yes29131 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:26yes1027 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
Firebase read as Firebase Authentication
Ping read as Ping Identity
Unresolved, counted raw
Azure AD B2B
Better Auth
Microsoft Entra / Azure Active Directory-style service CIAM
PocketBase
Tealium AudienceStream
Discontinued, still offered
No shut-down product was recommended here.

Also in identity and access

The other categories of this function, with the leader in each.
← Password managersIGA →