TOOL PROFILE · IDENTITY GOVERNANCE (IGA) PLATFORM

Lumos review 2026: shadow IT analytics and offboarding reach

The short answer

Lumos ranks 7 of 8 at 6.13 out of 10. Identity Analytics surfaces shadow IT and dormant accounts, and its HRIS-driven offboarding revokes access across local accounts, custom, SaaS, cloud and on-prem systems as Lumos describes it. How it reaches apps with no API is not detailed, and it publishes no prices.

By The Credential Desk · IAM Compared · Published 2026-10-08

Desk research from public vendor pages and documentation read in September 2026, updated 2026-10-13. Editorial assessment; we did not test the products.

Rank 7 of 8 on default weights

Shadow IT analytics and HRIS-driven offboarding

Change the weights in the coverage gap calculator

What shape is Lumos's reach?

DISC: Unmanaged app discovery; 6.0
INAPP: Accounts inside the app; 6.2
NOAPI: Reach into apps without APIs or SCIM; 5.0
ORCH: Orchestrates through the existing stack; 7.0
EXEC: Executes changes itself; 8.0
NHI: Machine, service and agent accounts; 6.0
EVID: Audit evidence; 7.0
PRICE: Pricing transparency; 2.0

Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.

What does Lumos do?

Agent-driven identity governance with HRIS-triggered lifecycle, identity analytics and 300+ integrations.

Lifecycle: HRIS triggers; revokes access "across IdPs, local accounts, custom apps, SaaS, cloud, and on-prem systems"; full audit trail.; Source: Lumos Lifecycle Management · Read 27 Sep 2026
Identity Analytics: Surfaces shadow IT, dormant accounts and over-privileged access.; Source: Lumos Identity Analytics · Read 27 Sep 2026
Integrations: 300+ integrations; leavers "fully offboarded with licenses reclaimed automatically".; Source: Lumos homepage · Read 27 Sep 2026
MCP Governance: Lists the MCP servers and tool calls employees' agents use, records each call with the human identity and policy decision, and enforces policy before actions run (21 September 2026).; Source: Lumos blog: MCP Governance · Read 27 Sep 2026

What does Lumos state about itself?

We did not collect a headline figure or finding from Lumos for this page.

Which parts of the estate does Lumos document?

Unsanctioned SaaSPartial
Shadow IT surfaced in Identity Analytics
Source: Lumos Identity Analytics · Read 27 Sep 2026
On-prem and legacy appsPartial
Revocation across on-prem systems
Source: Lumos Lifecycle Management · Read 27 Sep 2026
Custom-built appsPartial
Revocation across custom apps
Source: Lumos Lifecycle Management · Read 27 Sep 2026
Local accounts in appsPartial
Revocation across local accounts; dormant accounts surfaced
Source: Lumos Lifecycle Management · Read 27 Sep 2026
Service accounts and hardcoded credentialsNot documented
Not described on the pages reviewed
AI agentsPartial
MCP Governance for agent tool calls
Source: Lumos blog: MCP Governance · Read 27 Sep 2026

How does Lumos score on each criterion?

Criterion scores for Lumos, with badges computed against all 8 tools.
Criterion	Weight	Score	Why	Source
Unmanaged app discovery	18%	6.0 / 10	Identity Analytics surfaces shadow IT alongside dormant and over-privileged accounts.	Source: Lumos Identity Analytics · Read 27 Sep 2026
Accounts inside the app	16%	6.2 / 10	Surfaces dormant accounts and revokes local accounts; app-native role mapping is not detailed.	Source: Lumos Identity Analytics · Read 27 Sep 2026 · Source: Lumos Lifecycle Management · Read 27 Sep 2026
Reach into apps without APIs or SCIM	14%	5.0 / 10	Revocation described across custom and on-prem apps; handling of apps with no API is not detailed.	Source: Lumos Lifecycle Management · Read 27 Sep 2026
Orchestrates through the existing stack	14%	7.0 / 10	Works across the IdP, HRIS, SaaS and cloud stack already in place, with 300+ integrations.	Source: Lumos homepage · Read 27 Sep 2026
Executes changes itself	12%	8.0 / 10	HRIS-triggered joiner, mover and leaver workflows; leavers offboarded with licenses reclaimed.	Source: Lumos Lifecycle Management · Read 27 Sep 2026
Machine, service and agent accounts	10%	6.0 / 10	MCP Governance records agent tool calls with the human identity and policy decision; service account coverage is not detailed.	Source: Lumos blog: MCP Governance · Read 27 Sep 2026
Audit evidence	10%	7.0 / 10	Full audit trail of every grant and revocation.	Source: Lumos Lifecycle Management · Read 27 Sep 2026
Pricing transparency	6%	2.0 / 10 Tied lowest	No published prices.	Source: Lumos pricing · Read 27 Sep 2026

Where does Lumos lead, and where does it trail?

Leads or ties the set on

It does not lead any criterion; its highest scores are Executes changes itself and Orchestrates through the existing stack.

Trails the leader on

Pricing transparency: 2.0 against Entra ID Governance at 9.5
Reach into apps without APIs or SCIM: 5.0 against Orchid at 9.0
Unmanaged app discovery: 6.0 against Orchid at 9.5
Accounts inside the app: 6.2 against Orchid at 9.0

Strengths on its public pages

Identity Analytics surfaces shadow IT and dormant accounts.
HRIS-driven offboarding that revokes access across local accounts, custom, SaaS, cloud and on-prem systems, as Lumos describes it.

Limits on its public pages

How it reaches apps with no API is not detailed.
No published prices.

What does Lumos cost, and how is it deployed?

Pricing

Not published

Deployment

SaaS.

Who is Lumos for?

SaaS-heavy companies that want shadow IT visibility and offboarding with license reclamation.

Consider instead if you need a published price before talking to sales: Microsoft Entra ID Governance.

How does Lumos compare with each other tool?

Lumos vs Orchid
Orchid Security scores higher overall, 8.24 against 6.13
Lumos vs Veza
Veza scores higher overall, 6.37 against 6.13
Lumos vs Saviynt
Saviynt scores higher overall, 6.15 against 6.13
Lumos vs SailPoint
SailPoint Identity Security Cloud scores higher overall, 6.21 against 6.13
Lumos vs Entra ID Governance
Microsoft Entra ID Governance scores higher overall, 6.15 against 6.13
Lumos vs C1
C1 (formerly ConductorOne) scores higher overall, 6.30 against 6.13
Lumos vs Apono
Lumos scores higher overall, 6.13 against 4.78

Moving off Lumos? See the alternatives Visit Lumos

Learn more

LESSON 03
Shadow authentication paths: sign-ins that bypass single sign-on
Why an app on single sign-on can still be entered another way.
LESSON 08
Assigning an owner to every application account
Why unowned accounts are the ones that stay open.

Frequently asked questions

What is Lumos?

Agent-driven identity governance with HRIS-triggered lifecycle, identity analytics and 300+ integrations. It sits in the identity governance (iga) platform layer.

How does Lumos score on reach beyond the IdP?

6.13 out of 10, rank 7 of 8 on default weights. Its highest criterion scores are Executes changes itself (8.0) and Orchestrates through the existing stack (7.0) and its lowest is Pricing transparency (2.0).

What are the alternatives to Lumos?

On our reach score the closest alternatives are Orchid Security, Veza and C1 (formerly ConductorOne). The moving-off page lists every alternative and the criteria where each scores higher.

Moving off Lumos