SecureAuth

Overview

SecureAuth is an access management vendor built around adaptive, risk-based authentication, founded in Irvine, California in 2005 and privately held with backing from K1 Investment Management. It merged with Core Security in 2017 and has grown by acquisition since: Acceptto (behavioral, continuous authentication) in 2021, Cloudentity (fine-grained authorization and API security, FAPI-grade OAuth) in 2023, and SessionGuardian (continuous presence detection at the screen) in 2024, per its company timeline. In 2026 it repackaged everything as the Identity Authority Platform, and in May 2026 it launched an agent control layer that governs AI agent identities in real time. No change of control has been announced; see the identity consolidation report for the deals reshaping its peers.

What it is good at

Risk-scored authentication is the core. SecureAuth scores device, location, behavior and threat signals at login and through the session, then steps users up or down, including passwordless login with FIDO2 passkeys. The Assurance and Presence products extend that past the login event, which few IAM platforms attempt.

The Cloudentity code gives it unusually strong API authorization for a workforce-era vendor. The Customer Authority page lists FAPI 2.0, PAR, DPoP and mTLS, and SecureAuth states it is a certified FAPI 2.0 provider, which matters for open banking. B2B Authority federates partner IdPs over SAML and OIDC and provisions over SCIM 2.0, with delegated administration per tenant.

Deployment range is the other draw. SecureAuth lists multi-tenant SaaS, private SaaS, on-premises, hybrid and air-gapped options. For a regulated buyer that cannot put its IdP in a shared cloud, that list narrows the field quickly.

Where it falls short

The product line has been renamed and reassembled from several acquisitions in five years, and the seams show in documentation and positioning: the site now leads with AI agents while most buyers still come for authentication. Integration catalog and community reach are well behind Okta and Microsoft Entra, so expect more custom SAML or OIDC setup for long-tail apps. Lifecycle provisioning and governance are thin; pair it with an IGA tool. The agent product is months old, so treat its agentic identity claims as roadmap until you have run a proof of concept.

Pricing

Quote-based on an annualized MAU commitment, per the pricing page, which shows bands and add-ons (self-hosted, air-gapped, FIPS, extra SCIM connectors, continuous session assurance) but no dollar figures. A 30-day free trial is available. The Identity Pricing Transparency Index classes it as quote-only.

Best for, and who should look elsewhere

SecureAuth fits enterprises, banks and public-sector buyers who need risk-based and passwordless authentication on infrastructure they control. Deployment effort is moderate for SaaS and closer to a classic on-premises IdP project when self-hosted, so budget engineering time for the risk policy tuning, not just the federation. Teams that want the widest pre-built app catalog should look at Okta or Ping Identity; consumer-fraud-heavy CIAM buyers should also compare Transmit Security.

Bottom line

A deployment-flexible adaptive authentication specialist with real FAPI-grade API authorization inside. Pick it when where the IdP runs matters as much as how it scores risk.