Is Lumos right for mid-market IGA? Autonomous identity, pricing and alternatives

For IT and security leads at companies of 50 to 500 employees, often in Europe, who have Lumos on an identity governance shortlist.

Lumos (also known as Lumos Identity) is an identity governance and administration (IGA) platform that sells "autonomous identity": AI agents that run access reviews, access requests and role design for employees, service accounts and AI agents. It suits mid-market teams with a SaaS-first stack and an enterprise-grade budget, since buyer data puts the median Lumos contract at $35,644 per year. It is a weaker fit if you need published pricing, deep AWS, Azure or GCP entitlement coverage, or EU-hosted identity data, which is where alternatives such as C1, Zluri, Torii, Microsoft Entra ID Governance and Corma differ.

Key takeaways

Lumos shows no prices on lumos.com, but its AWS Marketplace listing prices the Lumos Core Platform at $27,000 for 12 months, plus $180 per additional user per year.
Vendr buyer data puts the median Lumos contract at $35,644 per year, across 50 purchases ranging from $12,997 to $129,360.
Lumos does govern AI agents: Identity Agent Force (June 2026) covers humans, machines and AI agents, and MCP Governance (September 2026) controls agent tool calls at runtime.
Lumos is rated 4.7 out of 5 on G2 across 69 reviews, and integration gaps and setup effort are the drawbacks its reviewers cite most often.
EU mid-market buyers should request Lumos's hosting region and data processing terms early, because its privacy policy relies on Commission-approved contractual safeguards for transfers outside the EEA.

Last updated: 30 September 2026. Prices and ratings were checked on that date at the sources linked below.

What is Lumos, and what does "autonomous identity" mean?

Lumos is a US identity governance vendor whose platform decides and records who gets access to which application, for how long, and who signs off on it. The company calls its approach autonomous identity, which it defines as using "AI to power complete visibility, actionable insights, full-cycle automation, and adaptive systems within identity governance".

In plain terms, identity governance and administration (IGA) is the layer that sits above your identity provider. Your IdP (Okta, Microsoft Entra ID or Google Workspace) authenticates people. IGA decides whether they should still have that access, and keeps the evidence an auditor will ask for.

Lumos covers that layer with four building blocks:

AppStore: a self-service catalog where employees request access, with approval rules and time-bound grants.
Lifecycle management: joiner, mover and leaver automation, including provisioning and deprovisioning.
Access reviews: user access review campaigns, now run first by an AI agent.
Albus: Lumos's AI agent, which Lumos says builds its recommendations on "entitlement-level data across your IdP, HRIS, SaaS, cloud, and on-premises systems".

Lumos did not start as an autonomous platform. Its $35 million Series B, announced in May 2024, was framed around unifying SaaS management and identity management. GitLab, one of its public references, still describes Lumos in its company handbook as a tool for access requests, just-in-time access, access reviews, license tracking and shadow IT discovery.

If you searched for "Lumos" alone, you probably met an internet provider, a crypto token and a pharmaceutical company. The identity vendor is the one below, and its product history explains most of what follows.

Lumos product timeline, from Lumos's own announcements

Date	Launch	What it changes for a buyer
May 2024	$35M Series B	Positioning as one platform for SaaS and identity management
23 Apr 2025	Autonomous Identity Platform	AI-driven policy management and lifecycle automation
2 Jun 2025	Albus AI agent	Policy and role recommendations from access patterns
8 Dec 2025	Agentic User Access Reviews	An agent runs the first pass of each review campaign
24 Mar 2026	Identity Security Agents	Agents that surface and act on identity risk
15 Jun 2026	Identity Agent Force	Governance extended to machine identities and AI agents
22 Sep 2026	MCP Governance	Runtime control over AI agent tool calls

How does Lumos rate on identity governance?

Lumos rates well with its own customers: 4.7 out of 5 on G2 across 69 reviews, and a Strong Performer placement in the 2026 Gartner Peer Insights Voice of the Customer for IGA. The recurring criticism is not the product's intelligence but its reach: integrations and setup effort.

According to Lumos's announcement of 9 April 2026, the Gartner recognition rests on verified reviews submitted over the 18 months ending 31 January 2026. In that report Lumos scored 4.7 out of 5 across more than 50 reviews, and 96% of reviewers said they would recommend it.

The weaknesses show up in the dislike tags G2 builds from Lumos reviews (as displayed on 30 September 2026):

Integration issues: 7 mentions
Limited integrations: 6 mentions
Integration difficulties: 5 mentions
Complex setup, lack of features and important tracking features missing: 3 mentions each

Three of those six tags concern integrations, for 18 mentions in total. The individual reviews point in the same direction. In December 2025, several reviewers from mid-market companies (51 to 1,000 employees) wrote that setting up integrations and workflows takes time, and a cloud security engineer asked Lumos to add AWS, GCP and Azure integrations.

For a 50 to 500 employee company, the reading is simple. The governance logic is well rated; the risk is time-to-value when your application list includes long-tail, custom or infrastructure apps that Lumos does not connect to out of the box.

Does Lumos govern AI agents?

Yes. Since June 2026, Lumos has governed AI agents as identities in their own right, and since September 2026 it also controls what agents do at runtime through MCP Governance. Lumos also uses AI agents to do the governance work itself, which is a different capability and worth separating in a demo.

The two layers look like this:

Agents that do the governance. Albus (June 2025) recommends policies and roles, Agentic User Access Reviews (December 2025) run the first pass of each campaign, and Identity Security Agents (March 2026) surface identity risk.
Agents that are governed. Identity Agent Force, announced on 15 June 2026, is described by Lumos as "a team of AI agents that continuously govern access across every human, machine, and AI agent in the enterprise". MCP Governance, launched on 22 September 2026, promises "visibility and runtime control over every MCP server and tool call in Claude Code and Codex".

Some comparison pages still say otherwise. A comparison published on 30 April 2026 by Linx Security, a competing vendor, rates Lumos's non-human and agentic identity support as "Limited" and states that Lumos "operates on IdP-level signals only". The first claim predates both the June and September launches, so it no longer describes the product Lumos sells today.

The second claim deserves a test rather than a verdict. Lumos says Albus reads entitlement-level data across IdP, HRIS, SaaS, cloud and on-premises systems, while a December 2025 G2 reviewer still asked for AWS, GCP and Azure integrations. Our reading: Lumos governs AI agents at product level; how deep it sees into your cloud infrastructure entitlements is the point to prove in a pilot. For the controls any AI agent program needs regardless of vendor, see our AI agent governance framework.

How much does Lumos cost?

Lumos does not publish prices on its website, but two public sources give a usable range: a $27,000 list price for a 12-month Core Platform contract on AWS Marketplace, and a median of $35,644 per year across 50 purchases tracked by Vendr.

What each public source says about Lumos pricing (checked 30 September 2026)

Source	What it shows	Figure
lumos.com/pricing	An assessment form with a mandatory company size field	No price shown
AWS Marketplace listing	Lumos Core Platform, 12, 24 or 36 month contracts	$27,000 per 12 months, plus $180 per additional user per year
Vendr buyer data	Annual contract value across 50 purchases	Median $35,644, from $12,997 to $129,360

Reviews that call Lumos pricing "quote-based" are right about lumos.com and wrong about the market. Start with Identity (June 2026) lists the model as "Subscription, quote-based", yet the AWS listing is a public list price anyone can read. It gives you a negotiation anchor before the first sales call.

Two calculations help turn those figures into a budget. They are illustrations, not quotes:

At $180 per additional user, the $27,000 platform fee equals the price of 150 users. The listing does not say how many users the platform fee includes, so ask.
A 200-employee company paying the Vendr median would spend about $178 per employee per year, roughly $15 per month.

The low end of the Vendr range ($12,997) is less than half the AWS list price, which suggests real room to negotiate on smaller scopes. The high end reflects much larger deployments.

For comparison, Corma's pricing tiers show an entry price: the Essential plan starts at €3 per user per month on annual billing and covers visibility, shadow IT detection and spend data. Governance automation (automated access reviews, provisioning, 200+ integrations) sits in the Pro plan, which is quoted after a demo, so compare like for like.

Is Lumos right for a 50 to 500 employee company?

Lumos is right for a 50 to 500 employee company when the stack is SaaS-first, one identity provider is the source of truth, and the budget matches enterprise pricing. It is a weaker fit when the IT team is small, critical access lives in cloud infrastructure, or EU data processing terms drive the decision.

Lumos's messaging speaks to large organizations. Across 14 Lumos pages we checked on 30 September 2026 (product, solution, customer and announcement pages), the word "mid-market" does not appear once, and its agent products promise to govern access "in the enterprise". Its reviewers are more mixed: several of the G2 reviewers quoted above work at mid-market companies.

Lumos fit check for a 50 to 500 employee company

Lumos is a reasonable fit if	Look at alternatives if
Your apps are mostly SaaS and sit behind one IdP (Okta, Entra ID or Google Workspace)	Critical entitlements live in AWS, Azure or GCP and must be reviewed at resource level
Your budget is in the range buyers report (median $35,644 per year)	You need a published price to budget before talking to sales
You want agent-run access reviews and role mining now	Your IT team is one or two people and cannot absorb a long integration setup
You need runtime control of AI agent tool calls (MCP)	You need EU hosting or an EU-based processor to satisfy your DPO

What should EU mid-market buyers check before choosing Lumos?

Lumos's product pages do not name an EU hosting region. Its privacy policy says personal data may be transferred to countries outside the European Economic Area, with "contractual commitments approved by the European Commission" as safeguards. Those are the standard contractual clauses of Article 46 GDPR: a legal transfer mechanism, but one your DPO will want to review with the data processing agreement, the sub-processor list and the hosting region.

Access governance is also a compliance requirement in Europe. Article 21(2)(i) of the NIS2 Directive lists "human resources security, access control policies and asset management" among the cybersecurity risk-management measures in-scope entities must take. None of the five third-party comparison and review pages that rank for "Lumos IGA" mentions GDPR, NIS2 or DORA (count made on 30 September 2026), so this part of the evaluation is on you.

If this fit check points away from Lumos, especially on EU hosting or on combining spend and access control in one tool, book a Corma demo and run the same checklist against it.

What are the best Lumos alternatives for mid-market IGA?

Six Lumos alternatives cover mid-market identity governance: C1 (formerly ConductorOne), Zluri, Torii, Okta Identity Governance, Microsoft Entra ID Governance and Corma. They fall into three groups: IGA-first platforms, SaaS management tools that added governance, and governance add-ons from your identity provider.

Lumos alternatives for mid-market IGA (pricing pages checked 30 September 2026)

Vendor	Built around	Price on vendor site	Worth a look if
C1 (formerly ConductorOne)	IGA-first: access requests, just-in-time access, access reviews, AI gateway	No figure: "exact pricing scoped with you", platform or consumption models	You want a governance specialist with commercial, regional and federal hosting paths
Zluri	SaaS management with access reviews	No figure: the pricing page leads to a demo request	Your first problem is SaaS discovery and spend, with reviews as a second step
Torii	SaaS management with an IGA module	No figure: "get a tailored quote"	You run a SaaS-heavy stack and want governance on top of app discovery
Okta Identity Governance	Governance for Okta Workforce Identity customers	No per-user governance figure on okta.com/pricing	Okta is already your IdP and you want one vendor
Microsoft Entra ID Governance	Governance add-on for Entra ID P1 and P2	$7 per user per month, annual commitment	You are a Microsoft 365 shop with Entra ID as source of truth
Corma	SaaS management and IGA in one EU-native platform	Essential from €3 per user per month (annual); governance tier quoted after demo	You are an EU mid-market company that wants spend and access governance in one tool

C1 is the closest like-for-like: an IGA-first platform that also leans into AI agents. Zluri and Torii come from SaaS management and treat access governance as an extension of app discovery; we compare both in Corma vs Zluri and Corma vs Torii.

Okta Identity Governance and Microsoft Entra ID Governance make sense when one identity provider already runs everything. Entra's add-on is the only option in this table with a per-user governance price published on the vendor's own site. For a wider shortlist that includes enterprise suites, see our guide to the best IGA solutions for mid-market companies.

How does Corma compare as a European alternative to Lumos?

Corma is a European SaaS management and identity governance platform that puts license and spend control, access requests, provisioning and access reviews in one tool for companies of 50 to 500 employees. Where Lumos grew from an app store into autonomous identity, Corma was built on the idea that a mid-market company should not run two separate governance tools.

"We believe that [for] midsize market companies, it doesn't make sense to have two different tools to provide governance of your software."
Héloïse Rozès, CEO and co-founder of Corma, in Revenue Brew, 8 December 2025

What that means in practice for a team comparing it with Lumos:

EU-native by design. Corma's identity governance platform is built and hosted in the EU, aligned with GDPR and NIS2 requirements, and Corma is ISO/IEC 27001:2022 certified.
Spend and access in one inventory. The same app inventory drives license reclaim and automated access reviews, connected to Google Workspace, Microsoft Entra ID, Okta or JumpCloud.
Non-human identities and AI agents. Corma's pricing page lists NHI discovery (service accounts, API tokens, OAuth), NHI lifecycle governance and AI agent identity visibility, and its AI agent automation provisions apps that have no API.

The same Revenue Brew interview sets the direction for 2026: using the seed round "to help us develop the multiagency vision of Corma to provide, at all stages possible, automated zero-touch workflows and use cases for license governance".

Satelia, a monitoring company specialized in cardiac disease, shows what that looks like during an audit. Its manual reports had identified 30 applications; Corma surfaced 160 apps and agents, which gave auditors the access evidence Satelia needed for ISO 27001 and SOC 2. As Eriel Cruz, Technical Project Manager at Satelia, put it: "Without having those details, we couldn't move forward with the ISO 27001 and SOC2 certifications." (Satelia customer story, July 2026)

Where Lumos is ahead: if runtime control of MCP tool calls is a hard requirement today, Lumos has a dedicated product for it, launched on 22 September 2026. Check the equivalent on every tool you shortlist, Corma included. For a feature-by-feature view, read the Corma vs Lumos comparison.

How to evaluate Lumos in 30 days

Run a 30-day evaluation on your own data: test integration depth on your most sensitive apps, one cloud account, one real access review, your AI agents and service accounts, the EU paperwork, and the price against public benchmarks.

Map integration depth on your top apps. List the 20 applications where access matters most and ask, app by app, whether the connector reads accounts only or also provisions and revokes. Integrations are the most common complaint in Lumos reviews.
Connect one cloud account. Plug in one AWS, Azure or GCP account and check whether entitlements appear at resource level or only as group membership from the IdP.
Run one real access review. Launch a campaign on a sensitive app with the agentic first pass switched on, then measure reviewer time and the number of revocations actually executed.
Inventory non-human identities. Count service accounts, API tokens and AI agents in your environment, then compare with what Identity Agent Force and MCP Governance detect.
Collect the EU paperwork. Ask for the data processing agreement, the hosting region and the sub-processor list, and map the audit exports to your NIS2 and ISO 27001 evidence needs.
Benchmark the quote. Compare the offer with the $27,000 AWS list price and the $35,644 Vendr median, and ask how many users the platform fee includes before the $180 per-user rate applies.

Run the same six steps on each alternative. A shortlist that survives your own data is worth more than any ranking, including this one.

FAQ

What does the company Lumos do?

Lumos is a US software company that sells an identity governance and administration platform. It automates access requests, onboarding and offboarding, access reviews and role design, and since 2026 it also governs non-human identities and AI agents. Lumos markets this approach as autonomous identity.

What does IGA stand for, and how is it different from IAM?

IGA stands for identity governance and administration: the policies, reviews and audit trails that decide who should have access to what. IAM, identity and access management, covers authentication and enforcement, such as SSO and MFA. In short, IAM lets people in and IGA proves they should still be there.

Does Lumos publish its pricing?

No price appears on lumos.com, where the pricing page is a demo form that asks for company size. Lumos's AWS Marketplace listing shows $27,000 for a 12-month Core Platform contract plus $180 per additional user per year, and Vendr reports a median Lumos contract of $35,644 per year (checked 30 September 2026).

What are Lumos's top competitors?

Lumos's main competitors in mid-market identity governance include C1 (formerly ConductorOne), Zluri, Torii, Okta Identity Governance, Microsoft Entra ID Governance and Corma. Enterprise suites such as SailPoint and Saviynt compete for larger organizations with complex hybrid estates.

Is Lumos a SaaS management tool or an IGA platform?

Lumos is both, with the weight now on IGA. Lumos started with an app store and license tracking, raised its 2024 Series B to unify SaaS and identity management, and since 2025 positions itself as an autonomous identity platform. Gartner Peer Insights lists Lumos in both the SaaS management and IGA markets.

What is the best IGA solution for a mid-sized company?

The best IGA solution for a mid-sized company is the one that covers its real access estate at a budget it can sustain. SaaS-first teams on one identity provider can compare Lumos, C1, Zluri, Torii and Corma, while Microsoft 365 or Okta shops can start with their provider's governance add-on. EU companies should add hosting region and NIS2 evidence to the criteria.