Lumos

Overview

Lumos combines an internal app store, self-serve access requests, and AI-driven access reviews into what it positions as autonomous identity governance (IGA) for the SaaS era. Founded in 2020, it aims to cut the IT ticket load of access management while giving security teams visibility and control over who has what. Its homepage (checked 2026-11-05) no longer markets SaaS spend management; it now leads with just-in-time access through the AppStore, lifecycle management, non-human identity governance, MCP server governance, role mining, and Albus, its AI agent layer with a marketplace of more than 30 task agents.

What it is good at

The self-service app store and automation are the differentiators. Employees request access through a familiar catalog, approvals and provisioning flow automatically with guardrails, and access reviews are largely automated, which reduces both ticket volume and rubber-stamped certifications. Just-in-time access grants expire on their own, NHI governance assigns owners to keys, tokens and service accounts, and MCP governance inventories the MCP servers that AI tools connect to. License savings now show up only as a side effect, with licenses reclaimed when leavers are offboarded, rather than as a separate spend product.

Where it falls short

Lumos is newer and SaaS-centric, so deep provisioning connectors for legacy on-premises systems and the certification depth of the established suites are still maturing. Authentication and MFA are out of scope. Estates with heavy legacy dependencies, or buyers wanting a long-established platform, should weigh that gap.

Pricing

Subscription, quote-based. Model the cost against the ticket load and review effort it removes with the TCO calculator.

Best for, and who should look elsewhere

Choose Lumos for SaaS-heavy companies wanting self-serve and just-in-time access, autonomous reviews, and governance that extends to non-human identities and AI agents. For the governance-and-JIT alternative, see ConductorOne vs Lumos; for access visibility, see Veza; for enterprise incumbents, see SailPoint vs Saviynt.

Bottom line

A compelling modern governance and access-request layer for SaaS-heavy companies, pairing self-service with autonomous reviews, less suited to legacy-heavy estates.