The attack surface is identity. Ory, founded in 2019, builds open-source, enterprise-grade identity and access management infrastructure designed to be self-hosted, cloud-native, and API-first. The company decomposes IAM into distinct, composable pieces: Ory Kratos handles identity management, Ory Hydra covers OAuth 2.0 and OpenID Connect authorization, Ory Keto implements fine-grained permissions based on Google's Zanzibar model, and Ory Oathkeeper acts as a zero-trust identity and access proxy. Each component ships independently, giving security teams and developers the ability to deploy only what their threat model requires.
The scale of the problem Ory's tooling addresses is concrete: the platform supports OpenAI in serving over 800 million weekly active users. That's a credential and session management challenge measured in billions of authentications, not a theoretical exercise. The stack is designed for that volume - horizontally scalable, protocol-compliant, and built to run in environments where credential compromise or permission misconfiguration isn't an edge case but an operational certainty.
Ory operates worldwide with an open-source-first model, meaning the codebase is auditable and contributions flow from a broad developer community. The technical domains are IAM, cloud-native systems, and API-first architecture - domains where the gap between a correct implementation and a catastrophic one is measured in a single misconfigured OAuth scope or an overly permissive access policy. The company's modular philosophy reflects a stance that security tooling should adapt to the deployment, not the other way around.
