Lumos Autonomous Identity

Self-service access request catalog with configurable, policy-driven approval workflows.

Discovery, modeling, and management of fine-grained entitlements and access rights across applications and systems.

Periodic and event-driven campaigns for reviewers to attest to and revoke user access.

Role mining, modeling, and administration to standardize access through roles.

Definition and enforcement of segregation-of-duties and access policies to detect and prevent toxic access combinations.

Automated fulfillment of access changes to target systems through connectors, with manual fulfillment fallback.

Analytics that score identity and access risk, surface outliers, and recommend certification or remediation.

Uses predictive and prescriptive analytics and AI assistants to recommend access decisions, certifications and policy improvements.

Manages the life cycle of machine identities such as devices, workloads, services and RPA bots and their associated accounts.

Automated joiner, mover, and leaver processes that create, change, and revoke identities and their access across connected systems.

Flags dormant and zombie accounts, weak access policies, and identity misconfigurations (such as missing MFA or risky discretionary access) so they can be cleaned up before attackers use them.

Compares granted permissions against observed usage to identify entitlements that exceed what an identity actually needs, candidates for right-sizing or revocation.

Discovers service accounts, OAuth apps, API keys, JWT tokens, and Kubernetes service accounts alongside human accounts, mapping the complete identity population.

Scores each identity by aggregated risk signals (excessive permissions, stale credentials, anomalous access patterns, MFA gaps) to prioritize remediation effort.

Detects indicators of identity compromise and attack activity (anomalous login sequences, MFA fatigue patterns, impossible travel), at the posture layer, enabling detection of active attacks alongside the static risk posture view. Distinct from EDR identity threat detection, which operates as real-time behavioral detection during an active attack.