PAIRING · MEASURED SIDE BY SIDE
Lumos vs SailPoint Identity Security Cloud: reach beyond the IdP and IGA
The short answer
On our default weights SailPoint Identity Security Cloud scores higher overall, 6.21 against 6.13 out of 10. Lumos scores higher on Unmanaged app discovery, Accounts inside the app and Orchestrates through the existing stack; SailPoint scores higher on Reach into apps without APIs or SCIM, Executes changes itself, Machine, service and agent accounts and Audit evidence. They tie on Pricing transparency.
By The Credential Desk · IAM Compared · Published 2026-10-08
Desk research from public vendor pages and documentation read in September 2026, updated 2026-10-13. Editorial assessment; we did not test the products.
How do they score on each criterion?
| Criterion | Weight | Lumos | SailPoint | Higher |
|---|---|---|---|---|
| Unmanaged app discovery | 18% | 6.0 Identity Analytics surfaces shadow IT alongside dormant and over-privileged accounts. | 4.0 App owners can self-register applications through the Application Management add-on; automatic discovery of unconnected apps is not described. | Lumos |
| Accounts inside the app | 16% | 6.2 Surfaces dormant accounts and revokes local accounts; app-native role mapping is not detailed. | 6.0 Keeps access in sync for connected sources; discovery of orphan and local accounts inside apps is not described. | Lumos |
| Reach into apps without APIs or SCIM | 14% | 5.0 Revocation described across custom and on-prem apps; handling of apps with no API is not detailed. | 6.0 Integration templates and a self-registration portal speed onboarding; apps with no connector are not detailed. | SailPoint |
| Orchestrates through the existing stack | 14% | 7.0 Works across the IdP, HRIS, SaaS and cloud stack already in place, with 300+ integrations. | 6.0 It is the governance platform itself; complements an IdP and partners with discovery vendors, including Orchid since August 2026. | Lumos |
| Executes changes itself | 12% | 8.0 HRIS-triggered joiner, mover and leaver workflows; leavers offboarded with licenses reclaimed. | 9.0 Joiner, mover and leaver automation that provisions, adapts and corrects access. | SailPoint |
| Machine, service and agent accounts | 10% | 6.0 MCP Governance records agent tool calls with the human identity and policy decision; service account coverage is not detailed. | 8.0 Agentic Fabric for AI and machine identities is generally available, and the Entro Security acquisition adds non-human identities, secrets and tokens. | SailPoint |
| Audit evidence | 10% | 7.0 Full audit trail of every grant and revocation. | 8.5 Collects audit evidence automatically and generates audit-ready reports mapped to SOX, PCI DSS and other frameworks. | SailPoint |
| Pricing transparency | 6% | 2.0 No published prices. | 2.0 Suites listed without prices. | Tie |
| Total | 100% | 6.13 | 6.21 | SailPoint |
What shape is each tool's reach?
- DISC
- Unmanaged app discovery
- 6.0
- INAPP
- Accounts inside the app
- 6.2
- NOAPI
- Reach into apps without APIs or SCIM
- 5.0
- ORCH
- Orchestrates through the existing stack
- 7.0
- EXEC
- Executes changes itself
- 8.0
- NHI
- Machine, service and agent accounts
- 6.0
- EVID
- Audit evidence
- 7.0
- PRICE
- Pricing transparency
- 2.0
Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.
- DISC
- Unmanaged app discovery
- 4.0
- INAPP
- Accounts inside the app
- 6.0
- NOAPI
- Reach into apps without APIs or SCIM
- 6.0
- ORCH
- Orchestrates through the existing stack
- 6.0
- EXEC
- Executes changes itself
- 9.0
- NHI
- Machine, service and agent accounts
- 8.0
- EVID
- Audit evidence
- 8.5
- PRICE
- Pricing transparency
- 2.0
Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.
Which parts of the estate does each document?
| Zone | Lumos | SailPoint |
|---|---|---|
| Unsanctioned SaaS | Partial Shadow IT surfaced in Identity Analytics | Not documented Automatic discovery of unconnected apps not described |
| On-prem and legacy apps | Partial Revocation across on-prem systems | Partial Integration templates and owner self-registration |
| Custom-built apps | Partial Revocation across custom apps | Partial Integration templates |
| Local accounts in apps | Partial Revocation across local accounts; dormant accounts surfaced | Not documented Orphan and local account discovery inside apps not described |
| Service accounts and hardcoded credentials | Not documented Not described on the pages reviewed | Partial Entro Security acquisition: non-human identities, secrets and tokens |
| AI agents | Partial MCP Governance for agent tool calls | Documented Agentic Fabric generally available for AI and machine identities |
What do they cost?
SailPoint Identity Security Cloud
Pricing
Suites are listed (Standard, Agentic Business, Agentic Business Plus) without prices.
Source: SailPoint suites · Read 27 Sep 2026
Deployment
SaaS on SailPoint Atlas.
Frequently asked questions
Which scores higher overall, Lumos or SailPoint Identity Security Cloud?
On our default weights SailPoint Identity Security Cloud scores higher overall, 6.21 against 6.13 out of 10.
Where does Lumos score higher than SailPoint Identity Security Cloud?
Lumos scores higher on Unmanaged app discovery (6.0 against 4.0), Accounts inside the app (6.2 against 6.0) and Orchestrates through the existing stack (7.0 against 6.0).
Can Lumos and SailPoint Identity Security Cloud be used together?
Usually not. Both are identity governance platforms, so most organizations pick one.