Question 1

What is ITDR?

Accepted Answer

Identity threat detection and response: tools that watch identity systems such as Active Directory and cloud identity providers for attacks, and respond by blocking, challenging or ending sessions.

Question 2

What are non-human identities?

Accepted Answer

The accounts and credentials software uses to reach other software: service accounts, API keys, OAuth tokens, certificates, secrets and AI agents. OWASP publishes a Top 10 list of their risks for 2025.

Question 3

What is an MCP gateway?

Accepted Answer

A service between AI agents and the MCP servers that expose tools. Every call passes through it, so it can authenticate the caller, apply policy per call, supply credentials and record the decision.

Question 4

Is authorization required by the MCP specification?

Accepted Answer

No, it is optional. When an MCP server is reached over HTTP, the specification says implementations should follow its OAuth 2.1 based rules, which include checking that each token was issued for the server and never passing tokens through.

Question 5

What is an agent identity?

Accepted Answer

An account that belongs to an AI agent itself, separate from the person who started it and the platform it runs on, so it can have its own permissions, logs and off switch.

Question 6

What is the difference between workforce IAM and CIAM?

Accepted Answer

Workforce IAM is for employees and contractors signing in to company tools. CIAM is for customers signing in to a company's own product. They are usually bought, priced and run separately.

Question 7

What makes sign-in phishing-resistant?

Accepted Answer

The method only works with the real site. Passkeys and FIDO2 security keys sign a challenge tied to the site's address, so a fake page receives nothing it can reuse. Passwords and one-time codes can be relayed.

Question 8

Which vendors on this site publish prices?

Accepted Answer

In workforce IAM, Okta, Microsoft Entra, Ping Identity, Google Cloud Identity and JumpCloud publish per-user prices. Aembit publishes a free-forever tier, Semperis's Purple Knight assessment is free and CyberArk's Conjur is open source. The other products, NewCore included, do not publish prices on the pages reviewed.

Question 9

What does Okta cost?

Accepted Answer

Okta publishes Starter at $6, Core Essentials at $14 and Essentials at $17 per user per month, billed annually, with a $1,500 annual minimum. Professional and Enterprise are priced on request.

Question 10

What does Microsoft Entra ID cost?

Accepted Answer

Microsoft publishes Entra ID Free, P1 at $7.00 and P2 at $10.00 per user per month. P1 is included in Microsoft 365 E3 and Business Premium, and P2 in Microsoft 365 E5.

Question 11

What does Ping Identity cost?

Accepted Answer

PingOne for Workforce Essential is $3 and Plus is $6 per user per month, based on an annual contract with a 5,000-user minimum.

Question 12

Are there free tools to start with?

Accepted Answer

Several. Semperis's Purple Knight is a free assessment of Active Directory, Entra ID and Okta. Aembit offers a free-forever tier. Microsoft Entra ID Free and Google Cloud Identity Free exist, and CyberArk's Conjur is open source.

Question 13

Does NewCore publish pricing?

Accepted Answer

No. NewCore does not publish pricing, named customers or a deployment model on the pages reviewed, which is why it scores low on the buying-clarity criteria.

Question 14

How can I estimate cost for my organization?

Accepted Answer

Use the calculator. For workforce IAM it multiplies each vendor's published per-user price by your user count and applies published minimums. It does not include discounts, taxes or add-ons.

Question 15

Which product scores highest in each topic?

Accepted Answer

AI agent security and identity: Okta (7.8 / 10); ITDR: Silverfort (7.6 / 10); Non-human identities: Oasis Security (7.5 / 10); MCP security: Docker MCP Enterprise Gateway (8.4 / 10); Workforce IAM: Okta (8.5 / 10); Identity visibility and hygiene: Veza (7.6 / 10).

Question 16

Does NewCore replace Okta or Microsoft Entra ID?

Accepted Answer

NewCore describes an agent-driven coexistence model that preserves existing federations and policies, so it is positioned to run alongside Okta or Entra ID. This site scores the products side by side and does not assume one replaces another.

Question 17

Where does NewCore score highest?

Accepted Answer

In AI agent security and identity, on no standing credentials for agents; per-call authorization; and human accountability and approval. In ITDR, on token and session attacks. In non-human identities, on AI agents as non-human identities. In MCP security, on credentials kept from the agent and policy per tool call. In workforce IAM, on phishing-resistant sign-in, protection of token signing and AI agent identities. In identity visibility and hygiene, on people, machines and agents in one view; and acting on findings.

Question 18

Where does NewCore score lower than other products?

Accepted Answer

In AI agent security and identity, on finding agents you did not register; standards and ecosystem; and maturity and buying clarity. In ITDR, on detection breadth; stopping attacks at sign-in; response and recovery; posture and attack paths; and maturity and buying clarity. In non-human identities, on discovery breadth; owner for every identity; removing long-lived secrets; runtime enforcement; and maturity and buying clarity. In MCP security, on user and agent bound together; audit trail; server isolation and approval; and deployment choice and buying clarity. In workforce IAM, on app integration breadth, provisioning to apps and pricing transparency. In identity visibility and hygiene, on breadth of sources; hygiene findings; effort to start; and maturity and buying clarity. Every topic page shows these rows.

Question 19

How does Okta score across topics?

Accepted Answer

Okta is scored in 3 topics: AI agent security and identity (7.8 / 10, ranked 1 of 5); ITDR (7.0 / 10, ranked 2= of 5); workforce IAM (8.5 / 10, ranked 1 of 6).

Question 20

How does Silverfort score across topics?

Accepted Answer

Silverfort is scored in 5 topics: AI agent security and identity (7.2 / 10, ranked 3 of 5); ITDR (7.6 / 10, ranked 1 of 5); non-human identities (7.0 / 10, ranked 3= of 6); MCP security (6.1 / 10, ranked 4 of 5); identity visibility and hygiene (7.3 / 10, ranked 2 of 5).

Question 21

How does Microsoft Entra score across topics?

Accepted Answer

Microsoft Entra is scored in 2 topics: AI agent security and identity (7.0 / 10, ranked 5 of 5); workforce IAM (8.3 / 10, ranked 2 of 6).

Question 22

Why is Astrix Security not scored?

Accepted Answer

Astrix Security is now part of Cisco and ended standalone sales of new licenses on 30 June 2026, so it is not scored. It states that existing customers keep the service in their current agreements.

Question 23

Which MCP gateway isolates MCP servers?

Accepted Answer

Docker MCP Enterprise Gateway runs each server in its own container and lets you approve servers before agents can reach them. The other gateways scored on this site do not describe server isolation on the pages reviewed.

Question 24

How are the scores calculated?

Accepted Answer

Each topic scores its products on six criteria out of 10, with a one-line reason and a source for every score. The total is the weighted average, computed in code from the weights on the page. Equal totals share a rank.

Question 25

What does the Gap in public material tag mean?

Accepted Answer

It marks a score where the vendor's public pages do not describe the capability. It does not mean the capability is missing from the product; it means a buyer will need to ask.

Question 26

Do you test the products?

Accepted Answer

No. Scores come from desk research on public vendor material and standards, read between 27 and 29 September 2026. There is no hands-on testing and there are no vendor interviews.

Question 27

Can I use my own weights?

Accepted Answer

Yes. The calculator re-ranks any topic with weights you choose, using the same criterion scores, and the side-by-side page compares up to five products at once.

Identity security questions and answers

Category basics