Lumos alternatives expose the gap between SaaS management and IGA

At a glance

What this is: This guide explains why Lumos alternatives split into SaaS management and true identity governance, and why that distinction changes the shortlist.

Why it matters: It matters because IAM, IGA, and PAM teams need different control depth for compliance, hybrid estates, and privileged access than a SaaS-first access layer can provide.

By the numbers:

• 75% begin with compromised identities or misconfigured permissions, according to The Netwrix 2026 Data and Identity Security Report.
• Only 5.7% of organisations have full visibility into their service accounts.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.

👉 Read Netwrix's guide to Lumos alternatives for identity governance and access management

Context

Lumos alternatives are being compared across two adjacent but distinct control problems: SaaS management and identity governance. That distinction matters because SaaS discovery, license optimisation, and lightweight app workflows do not deliver the same control depth as IGA when the requirement is enforced lifecycle governance, separation of duties, and audit evidence.

The primary issue is scoping, not feature count. Regulated environments still depend on Active Directory, Entra ID, on-premises databases, and file servers, so a SaaS-first access layer leaves critical identity risk outside the governance boundary. That is why the Lumos alternatives conversation often becomes a proxy for whether the programme is trying to manage applications or govern identities.

Key questions

Q: What should teams do when a SaaS-first access tool does not cover regulated systems?

A: They should split the evaluation into two tracks: SaaS operations and governed identity controls. If regulated data or access decisions live in Active Directory, Entra ID, file servers, databases, or privileged accounts, the platform must prove it can govern those systems natively. Otherwise, the organisation still needs a separate IGA or PAM control plane.

Q: Why do Lumos alternatives look so different from one another?

A: Because they are not all solving the same problem. Some platforms focus on SaaS discovery, licence optimisation, and access workflows, while others are built for lifecycle governance, SoD, and audit evidence across hybrid estates. The right comparison starts with the control objective, not the brand category.

Q: What do security teams get wrong about access reviews in hybrid environments?

A: They often assume a review workflow is enough if it produces approvals. In hybrid estates, the harder question is whether the platform sees the full entitlement path across cloud, on-premises, and admin access. If it cannot, the review may be documented but still incomplete from a control standpoint.

Q: How do organisations know whether they need IGA or SaaS management?

A: Use the compliance and control requirement as the test. If the need is app discovery, licence recovery, and lightweight request handling, SaaS management may be enough. If the need includes SoD, recertification, lifecycle governance, and audit evidence, the programme needs true IGA and possibly PAM alongside it.

Technical breakdown

SaaS management versus identity governance

SaaS management tools focus on discovering applications, reclaiming licences, and automating basic access workflows. Identity governance platforms go further by controlling joiner-mover-leaver events, certification campaigns, separation-of-duties checks, and evidence generation. The architectural difference is that SaaS management usually operates from what the identity provider already knows, while IGA must reconcile entitlements across directories, business systems, and legacy platforms. In regulated estates, that difference determines whether access review output is operationally useful or audit-ready.

Practical implication: define whether the programme needs application administration or governed identity decisions before shortlisting any platform.

Why hybrid coverage changes the evaluation

Hybrid identity estates expose the limitation of SaaS-first models because regulated data and entitlements often sit outside the cloud application layer. Active Directory, Entra ID, databases, and file servers still contain critical access paths, and these systems do not collapse neatly into a gallery-based connector model. Effective governance therefore depends on whether the platform can correlate identities and permissions across both modern SaaS and older on-premises systems without manual post-processing.

Practical implication: validate native hybrid coverage against the systems auditors actually test, not just the systems the vendor demo uses.

Why privileged access is a separate control plane

Privileged access management governs elevated, high-risk accounts that ordinary access review workflows often do not cover well. If a platform does not natively govern admin accounts, then certification and lifecycle automation stop at standard user entitlements while the most dangerous access remains outside the control boundary. That creates a split governance model in which ordinary users are reviewed but privileged identities are handled somewhere else, often inconsistently.

Practical implication: inventory where admin access is controlled today and confirm whether the shortlisted platform closes or only exposes that gap.

Threat narrative

Attacker objective: The objective is to retain ungoverned access paths that remain invisible to the access review process and cannot be proven compliant.

1. Entry occurs when a buyer scopes the problem as SaaS access management even though the compliance requirement demands governed identity controls across hybrid systems.
2. Escalation follows when review workflows expose only group membership and app assignments, leaving effective entitlements and privileged access outside the control boundary.
3. Impact is governed evidence failure, because auditors cannot test SoD or lifecycle controls that the platform never captured in the first place.

Breaches seen in the wild

• Coupang Signing Key Breach — Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

The Lumos comparison problem is a governance problem, not a product problem. Buyers are not choosing between a dozen equivalent tools, they are choosing between application administration and identity control. Once the programme has SOX, HIPAA, PCI DSS, or CMMC obligations, the shortlist must be judged by certification evidence, SoD enforcement, and hybrid coverage rather than app-discovery convenience.

Hybrid identity coverage is the real dividing line in regulated environments. SaaS-first control models work only when the relevant entitlements already live in the identity provider and cloud app layer. That assumption fails when critical access sits in Active Directory, Entra ID, file servers, or databases, because the governance model can no longer see the full entitlement chain. The implication is that scoping rules, not connector count, determine whether the platform can satisfy audit expectations.

Privileged access remains the control that lightweight governance leaves behind. A platform can automate lifecycle tasks for standard users and still leave admin accounts untouched, which is why access review maturity and PAM maturity often diverge. That gap is visible in many buyer evaluations, where the governance story is complete until the highest-risk accounts enter the picture. Practitioners should treat privilege as a separate control plane, not an add-on.

Audit-ready evidence is the differentiator that separates adoption from compliance. Many access tools can show that a request was approved, but that is not the same as showing separation of duties, recertification, and remediation evidence across a hybrid estate. The issue is not whether the workflow exists, but whether the record survives scrutiny from auditors and control owners. Teams should choose based on evidence quality, not workflow polish.

Identity governance is converging with adjacent control domains, but the boundaries still matter. The market is moving toward combined views of governance, PAM, and evidence, yet the operational reality remains that each discipline answers a different question. That means buyers need to resist category blur and map the actual control objective first. The practical conclusion is to buy for the control gap you need to close, not the broader story the platform tells.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• 79% of organisations have experienced secrets leaks, and 77% of those incidents resulted in tangible damage.
• For lifecycle governance, see NHI Lifecycle Management Guide and the Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs for the control model behind joiner-mover-leaver and offboarding discipline.

What this signals

Identity programme scoping is tightening around evidence, not just access. Teams that can only show approvals will keep running into audit friction because regulators and control owners care about what was governed, not only what was requested. The practical shift is toward proof across lifecycle, certification, and privileged access boundaries, with NIST Cybersecurity Framework 2.0 useful as the broader governance lens.

The governance gap is increasingly a hybrid visibility gap. The more access spans cloud, on-premises, and directory systems, the more likely a SaaS-first model is to miss the entitlement chain that matters most. That is why access visibility, revocation, and evidence generation need to be evaluated as one programme rather than separate tools, especially when service-account sprawl and privilege are in scope.

Audit pressure will continue to expose the difference between workflow and control. If the platform cannot produce testable evidence for SoD, recertification, and revocation, the organisation will need compensating controls somewhere else. The next buying cycle will reward teams that can link access governance to operational evidence, not just to convenience.

For practitioners

• Separate SaaS management from IGA in the requirements doc Write one control section for app discovery and license optimisation, and a separate section for lifecycle governance, SoD, and certification evidence. If the tool cannot satisfy both, do not let marketing language blur the evaluation. Use the Ultimate Guide to NHIs for the governance side and the NHI Lifecycle Management Guide for lifecycle scoping.
• Test hybrid coverage against audited systems Build a validation list that includes Active Directory, Entra ID, file servers, databases, and any regulated application used in control testing. Ask for evidence that the platform can govern those systems natively rather than through post-processing or a partial connector.
• Treat privileged access as a separate workstream Document where admin access is governed today and determine whether the shortlisted platform actually covers those identities or only standard entitlements. If privileged access sits elsewhere, map the handoff so certification, remediation, and revocation do not diverge.
• Demand audit-ready evidence before rollout Require sample certification reports, SoD violation records, and revocation evidence that match the control objectives of SOX, HIPAA, PCI DSS, or CMMC. If the evidence cannot be tested, the deployment is still a workflow demo, not a governance programme.

Key takeaways

• The Lumos alternatives market is really a choice between SaaS management and true identity governance.
• Hybrid coverage, privileged access, and audit evidence are the three controls that most often separate a useful tool from a compliant one.
• Teams should compare platforms against the actual control objective first, then verify whether the evidence will survive audit scrutiny.

Key terms

• Identity Governance And Administration: Identity Governance and Administration is the discipline for controlling who has access, why that access exists, and whether it should continue. In practice it spans joiner-mover-leaver processes, access reviews, separation of duties, and audit evidence across human, machine, and service identities.
• Separation Of Duties: Separation of duties is the control that prevents one identity from holding conflicting permissions that could enable fraud, error, or uncontrolled change. In identity programmes it is enforced through rules, review campaigns, and remediation workflows that detect risky entitlement combinations before they become an audit issue.
• Hybrid Identity Estate: A hybrid identity estate is an environment where access and identity data span cloud directories, SaaS applications, and on-premises systems such as Active Directory, databases, and file servers. Governance tools must correlate all of those control points or they will only describe part of the access picture.
• Privileged Access Management: Privileged Access Management is the control layer for accounts and sessions with elevated power over systems, data, or identity infrastructure. It focuses on reducing standing privilege, tightly scoping elevation, and preserving evidence for high-risk access that general access reviews often do not capture well.

What's in the full article

Netwrix's full blog covers the operational detail this post intentionally leaves for the source:

• Platform-by-platform feature comparisons for Lumos alternatives across governance depth, hybrid coverage, and implementation complexity
• Decision criteria for regulated environments that need SoD enforcement, certification evidence, and privileged access coverage
• Vendor-specific notes on connector depth, rollout effort, and where each alternative fits in Microsoft-centric or SaaS-heavy estates
• Current verification notes for capabilities that may change as products evolve or integrate into broader platforms

👉 Netwrix's full guide compares governance depth, hybrid coverage, and audit-readiness across eight alternatives.

Deepen your knowledge

NHI governance, identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.