One platform replaces Workforce + Customer + PAM.
Okta's stack is three products bought separately — Okta Workforce Identity, Okta Customer Identity Cloud (formerly Auth0), and Okta Privileged Access (formerly ScaleFT). Tessarac collapses all three into one engine, one audit log, one bill, and adds the secrets vault, internal CA, and customer-visible audit that Okta doesn't ship at all.
Not available yet. This page describes the Security Platform we are building; ACOG is the product you can use today.
The Okta replacement story
Three Okta products, one Tessarac install.
Most Okta customers run Workforce Identity for employees, sign separate contracts for Auth0 (Customer Identity Cloud), and either run a third-party PAM or homemade SSH brokering. Three sales motions, three audit logs, three places where a leaked credential needs to be revoked.
- Okta Workforce Identity → Tessarac Identity (workforce SSO + MFA + lifecycle)
- Okta Customer Identity Cloud (Auth0) → Tessarac Identity (CIAM, B2B multi-tenant, branded hosted UI)
- Okta Privileged Access (ScaleFT) → Tessarac Privileged Access (SSH + RDP + DB + K8s, every protocol)
- + Tessarac Secrets, Internal CA, Customer-Visible Audit, AI-Powered SOC — none of which Okta sells
- + Open-core licensing — Community edition self-hosted free, every paid plan source-available
Side-by-side: Tessarac vs. Okta
Honest assessment as of May 2026. Where Okta ships an equivalent capability we say so; where they don't we say so. Notes carry the source.
Workforce + Customer Identity
| Feature | Tessarac | Okta |
|---|---|---|
| Workforce SSO (SAML, OIDC) | Yes | Yes |
| Customer identity (CIAM) Okta sells this as a separate product (Customer Identity Cloud / Auth0). | Yes | Yes |
| B2B multi-tenant + org switching | Yes | Yes |
| Smart-card (CAC/PIV) sign-in Planned for Tessarac paid plans. Okta supports CAC via PIV-D; full federal smart-card depth is partial. | No | Partial |
| Open source (community edition) | Yes | No |
Privileged Access
| Feature | Tessarac | Okta |
|---|---|---|
| SSH session brokering Okta has Okta Privileged Access (acquired ScaleFT). | Yes | Yes |
| RDP session brokering | Yes | Partial |
| MFA at every SSH/RDP session | Yes | Partial |
| Database protocol proxy | Yes | No |
| Kubernetes API guard | Yes | No |
| Session recording + replay | Yes | Partial |
Capabilities Okta does not sell
| Feature | Tessarac | Okta |
|---|---|---|
| Static-secret vault | Yes | No |
| Dynamic database credentials | Yes | No |
| Internal certificate authority | Yes | No |
| Encryption + key services | Yes | No |
| EDR agent (endpoint security) | Yes | No |
| CSPM across every major cloud | Yes | No |
| AI-powered SOC analysis | Yes | No |
| API-key plane for the products you ship | Yes | No |
Operator surface
| Feature | Tessarac | Okta |
|---|---|---|
| Customer-visible per-tenant audit | Yes | Partial |
| Audit export to BYO destination Tessarac is designed with object-storage / syslog / Linux-host targets built in; Okta requires an integration build-out. | Yes | Partial |
| Customer opt-out of vendor retention | Yes | No |
| Built-in customer + revenue analytics | Yes | No |
| One bill for everything above | Yes | No |
Migration
A migration you can run in parallel first.
Tessarac is designed to import SAML and OIDC config from an Okta admin export, sync users via SCIM, and run in shadow mode against your existing Okta tenant until you cut over. Customer-facing apps redirect to the new IdP via a one-line allowed-issuer change.
- Shadow-mode pilot — Tessarac receives every Okta auth event in parallel; verify user experience and audit fidelity before flipping a single user
- SCIM 2.0 sync from Okta keeps user state in lockstep until cutover
- Customer-facing app cutover via JWKS / discovery URL change — no app code touched
- Migration playbook and a reference architecture for the parallel-run period are planned
Talk to a Tessarac migration architect
The Security Platform is in beta. Talk to us about a shadow-mode pilot.