Authority Isn't Demand

Customer identity is one of the most instructive categories in B2B software right now. It sits at the crossroads of two audiences that rarely overlap: developers who integrate authentication in an afternoon, and security and IT leaders who sign the enterprise contract. It has decades-old incumbents and venture-backed challengers fighting in the same search results, and it is being reshaped, in real time, by the shift from Google to AI answers.

We pulled organic, paid and backlink data for eight players on 9 July 2026, the incumbents Okta, Auth0 (now owned by Okta) and Ping Identity; the developer-first challengers Stytch, WorkOS, Frontegg and Descope; and the platform-embedded outlier, AWS Cognito, then ran a 40-question AI visibility scan across ChatGPT, Google AI, Claude and Gemini. The picture that emerges is not big versus small. It is about who has built a demand engine, who is renting traffic, and who is about to be caught out by the next platform shift.

01Who wins the identity search war?

Three things jump out. The gap between incumbents and everyone else is enormous, Okta alone pulls more free traffic than the other seven combined, several times over. Trust score does not decide the race among challengers: Descope (75) outscores Stytch (74) and Frontegg (71), yet earns the least buyer traffic of the three. And ad spend does not track with size.

02What does each company do well, and not?

Okta and Ping: the incumbents who own the shelf

Okta is the category's gravity well, 1.5 million-plus free visits a month and over 15,000 top-three terms, built over a decade across every identity topic a buyer could search. It owns the enterprise vocabulary: single sign-on, lifecycle management, zero trust. Ping plays a similar game one tier down on compliance-heavy terms. The weakness is inertia: incumbent content is broad but dated, and it ranks on accumulated authority, not because it is the clearest answer, which matters more now that AI answer engines reward the plainest answer, not the oldest, most-linked page. Okta's acquisition of Auth0 is a tell, it bought the developer demand engine it could not build organically.

Auth0: the content engine everyone should study

If you study one company here, make it Auth0: 11,000-plus ranking terms, nearly 5,000 in the top three, 430,000-plus free visits a month, all on developer education that compounds. It did not win by writing about Auth0, it won by owning the language of the category, what a JWT is, how OAuth works, what a magic link does, and built tools developers link to reflexively (nearly 34,000 referring domains from the real developer web). The move that built the moat is almost embarrassingly simple: take the concept every developer has to learn, and publish the clearest explanation on the internet.

// A JSON Web Token is three base64 parts joined by dots:
header.payload.signature

// Decoded payload of a login token:
{
  "sub": "user_8f3a9c",       // who the user is
  "iss": "https://auth.acme.com",  // who issued it
  "iat": 1752000000,           // issued-at
  "exp": 1752003600            // expires in one hour
}

Every developer who learns the concept on Auth0's page arrives at the buying decision already inside Auth0's frame. Educational content is not a cost center, it is a moat, the definitional library that wins citations. The risk now is the same one facing all the incumbents: much of that library was built for Google's ten blue links, not for an AI box that summarizes the concept without ever sending the click.

Stytch and WorkOS: the efficient challengers

Stytch and WorkOS are the clearest proof that focus beats volume. Stytch ranks for barely 1,000 terms yet earns 37,000 free visits a month on $0 of ads. WorkOS is sharper on commercial intent: of its ~2,000 ranking terms, more than half sit in the top three, a hit rate the incumbents cannot match, and it owns buyer phrases like "sso provider" at position one.

The tradeoff is ceiling: a tightly focused footprint captures buyers who already know what they want but does less to create demand among developers still learning. The strongest position would combine WorkOS-style commercial discipline with an Auth0-style education layer. Right now, no challenger has both.

Frontegg and Descope: strong products, unfinished demand engines

Both have genuinely good products and healthy authority, yet neither has converted it into buyer-facing search presence. Descope is the sharpest example of the trap, the authority paradox: a trust score of 75, higher than Stytch and Frontegg, but the least buyer traffic in the group. The reason is instructive, its single largest source of free traffic is a blog post about Claude versus ChatGPT, a topic with nothing to do with buying identity software.

The authority is real; the buyer pages that would turn it into pipeline have not been built. This is the most common failure mode in B2B: mistaking traffic for demand, a visit from someone comparing chatbots is not a lead. Descope's paid strategy shows the same half-built pattern: it spends ~$2,100/month bidding on rival brand names with a clean "try Descope instead" message, but points those ads at a thin destination while the same terms sit wide open on free search where it ranks near zero. Conquest advertising only pays off when a strong comparison page and organic presence sit behind it.

AWS Cognito: distribution without a demand engine

Cognito ranks for ~125 terms and publishes almost no marketing content, yet still pulls 17,000 visits a month because it rides one of the highest-authority domains on the internet and shows up wherever a developer already lives inside AWS. Distribution, not marketing, does the work, until the AI scan exposes the ceiling. When buyers ask an AI tool which platform to choose, Cognito is largely absent, because it has published nothing to be cited. A distribution moat wins acquisition; it does not win preference.

03How does AI search reshuffle the cohort?

The pattern within a single brand makes the point concrete. Descope showed up in AI answers only where it had published direct, comparison-style content, and vanished everywhere else.

How an AI engine decides who to cite

What answer-shaped content actually looks like

Pages should be built to be quoted, the anatomy of a high-citation page. Two moves do most of the work. First, lead each key page with the question as a heading and a tight, 40-to-60 word direct answer the model can lift verbatim.

<h2>What is an authentication service?</h2>
<p class="answer">
  An authentication service verifies that users are who they
  claim to be, then issues a secure token their apps can trust.
  It handles login, multi-factor, sessions, and social or SSO
  sign-in, so teams do not build and maintain that themselves.
</p>

Second, wrap the page in structured data so machines can parse the question-and-answer pairs without guessing. A small block of FAQ schema turns an ordinary page into a clean, citable source.

{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [{
    "@type": "Question",
    "name": "How much does a passwordless auth platform cost?",
    "acceptedAnswer": {
      "@type": "Answer",
      "text": "Priced per monthly active user, with a free tier to ~7,500 MAUs and paid plans from ~$0.02 to $0.05 per MAU beyond that."
    }
  }]
}

04What does the B2B demand engine look like?

If you are the challenger reading this, the sequence matters as much as the parts. Fix the foundation first, then buyer pages, then trust, and you turn authority into demand inside a single quarter.

05What are the seven lessons for any B2B company?