An identity store is a database or directory that holds core user attributes, affiliations, and account information. It is the authoritative record for who a person is in an organization, often including names, email addresses, roles, groups, status, and identifiers used by other systems. Common examples include directory services, HR-linked identity databases, and campus or enterprise user registries.
In cyber security, identity stores matter because they sit upstream of authentication, authorization, and account provisioning. If attackers access them, they can learn which users exist, how they are organized, and what privileges or relationships may be worth targeting. That information can support phishing, impersonation, privilege abuse, and lateral movement. Defenders protect identity stores with strong access control, logging, encryption, and tight change management, because compromise of the identity record can undermine trust across many connected systems even when those systems are not directly breached.