Varonis vs Lumos: Data security vs IGA

Access governance starts with knowing where sensitive data lives, yet 55% of organizations don't maintain a continuous inventory of sensitive data, according to The Netwrix 2026 Data and Identity Security Report. That gap pulls Varonis and Lumos onto the same shortlist from opposite directions: Varonis maps data and who can reach it, while Lumos governs which applications a person can open and how that access gets reviewed.

The two platforms answer different questions that regulated teams increasingly face together. Varonis works the data layer, classifying content, baselining behavior, and trimming excess permissions. Lumos works the identity and app layer, automating access requests and certification reviews across SaaS. Neither covers the other's ground.

This comparison evaluates both platforms across data-layer depth, identity governance and administration (IGA) depth, hybrid reach, and compliance evidence, then shows where Netwrix closes gaps that neither covers alone.

Why buyers compare Varonis and Lumos

These platforms reach the same shortlist by two recognizable paths, with a deadline that's speeding both along.

A Varonis evaluation runs into Lumos

A security or compliance team scoping Varonis hits Lumos when another stakeholder asks for cleaner access reviews and an app lifecycle. Both get filed under "access," so they end up side by side even though one works the data layer and the other the app layer.

A Lumos team hits the data-layer wall

Teams already running Lumos for SaaS reviews can confirm a user has Salesforce, but not what that user can reach once inside it. Lumos knows the door but not the room, so the search widens to the data-layer visibility Varonis was built for.

The Varonis deadline forces a decision

Varonis is retiring its self-hosted platform on December 31, 2026. On-premises customers facing that migration weigh their alternatives and tend to add a SaaS-native option like Lumos while they're rethinking the stack anyway.

Quick comparison: Varonis vs Lumos vs Netwrix

The table below maps each platform across the dimensions that typically drive this evaluation: data security depth, IGA depth, hybrid reach, and compliance evidence.

Varonis

Varonis is a data security platform built around the data itself. It discovers and classifies sensitive content across file servers, network-attached storage (NAS), SharePoint, OneDrive, and cloud stores.

Varonis also monitors how people interact with it through user and entity behavior analytics (UEBA) and automatically walks back excessive access toward least privilege.

Its engine resolves nested groups and inheritance to answer what app-centric tools can't at the file system: who can actually open a given file. Security teams reach for it to handle unstructured data exposure and insider risk rather than the identity lifecycle.

Key features

• Discovery and classification of PII, PHI, and PCI across on-premises and cloud file repositories, using three methods for three different jobs: pattern matching (like the Luhn check for credit card numbers) catches known formats fast and cheap, exact data match compares content against a hashed set of real known values for near-zero false positives, and AI classification handles the ambiguous or unstructured content neither rule can catch.
• Automated permission cleanup that clears stale group memberships, broad shares, and risky links without folder-by-folder work. It flags "stale" by correlating actual access activity against each entitlement rather than grant age, so an unused permission surfaces even if it was assigned last week.
• Behavioral baselining through UEBA that flags abnormal file access, mass downloads, and permission changes at the data layer. Machine learning builds a per-user, per-device activity baseline from historical behavior, then scores deviations, such as off-hours access or geo-hopping, against that baseline rather than fixed rule thresholds.
• Identity-aware detection that ties Entra ID and Active Directory signals to how data is actually being touched, so a privilege grant that's followed by an immediate spike in file access from that same account raises one correlated alert instead of two disconnected log entries.
• Framework dashboards for GDPR, HIPAA, PCI DSS, and SOX are built on data-access evidence drawn from the same classification and activity logs used for threat detection, rather than a separate compliance-only collection process.

What to consider

• Self-hosted support ends December 31, 2026, so air-gapped or data-residency-bound estates need a migration or replacement plan.
• Varonis governs access to data rather than identity lifecycle, so app-wide certifications and segregation of duties (SoD) enforcement require a separate platform.
• Value tracks data-source breadth, so wide or messy estates should plan for tuning and scoping effort.

Lumos

Lumos is a SaaS-focused identity governance and access management platform built around the request-and-review experience. Employees request access in a self-service catalog, approvals route to managers and app owners via Slack, Teams, or a ticketing tool, and reviewers certify entitlements in access reviews that an AI agent narrows to changes, anomalies, and SoD conflicts.

It replaces the spreadsheet-and-ticket grind that SaaS-heavy teams know well, and ties access to HR events so joiners, movers, and leavers flow through automatically.

source: lumos.com

Key features

• Self-service access catalog with manager and app-owner approvals, time-boxed just-in-time grants, and automatic revocation.
• Access certification campaigns for SaaS and internal apps, with an AI agent surfacing deltas, anomalies, and SoD conflicts for reviewers.
• License management that spots dormant accounts and reclaims unused SaaS seats.
• Joiner-mover-leaver automation that turns HR system changes into downstream provisioning across cloud apps.
• Connectors for common identity providers, including Okta, Entra ID, Google Workspace, and JumpCloud.

What to consider

• The platform's picture is limited to what the identity provider exposes, so confirm record- and object-level visibility within each app before treating a Lumos review as a true in-app review.
• Windows file shares are a blind spot, so check New Technology File System (NTFS) and Server Message Block (SMB) share-level permission resolution before relying on it across a hybrid infrastructure.
• Teams should measure governance and SoD depth against full enterprise IGA needs, since Lumos's governance is newer and lighter than long-established suites.

Head-to-head: Varonis vs Lumos

Each axis below sorts a capability into where Varonis leads, where Lumos leads, and where both run out of road.

Data security and least privilege at the data layer

This is squarely Varonis's domain. It classifies sensitive content, baselines behavior against it, and resolves nested groups and inheritance to show who can open a file on-premises or in the cloud, then cleans up the excess.

Lumos operates at the app and identity-provider level and doesn't read file-share or cloud content at all, so for "where does sensitive data live and who can reach it," Varonis answers, and Lumos doesn't.

Access governance, lifecycle, and SaaS reviews

This is Lumos's home turf. Its catalog, approval routing, and certification campaigns cover both human and non-human identities in a single pass, producing reviewer-friendly evidence.

Varonis can flag overprivileged identities and risky data access, but its reviews stop at data resources, and it was never meant to be a general application certification engine.

Lumos handles structured access requests and SaaS review workflows natively; Varonis addresses them from an adjacent angle.

Entitlement depth and hybrid coverage

Both hit a wall that's visible in their architecture. Lumos resolves group membership and app assignment, but not file- and data-layer permissions on on-premises shares, because cloud-only identities grant share-level access without NTFS file permissions.

Varonis reads the file layer deeply, but it's phasing out on-premises support in December 2026, leaving estates that can't move to SaaS stranded. Run either alone, and part of the hybrid identity-and-data picture stays dark.

Deployment model and operational cost

Varonis runs as SaaS, and Lumos is SaaS-only, so data-residency and on-premises mandates squeeze both models. The day-to-day effort differs in kind: Varonis grows with the number and messiness of data sources, while Lumos grows with connector setup and approval-flow design. Weigh data-source onboarding against connector configuration for the estate you actually have.

How to choose between Varonis and Lumos

The right choice depends on where the primary gap sits: the data layer or the app-and-identity layer.

Choose Varonis if:

• The pressing problem is the exposure of unstructured data and the risk of unauthorized access to sensitive files.
• You want behavioral detection and automatic permission cleanup at the data layer.
• The December 31, 2026, self-hosted end-of-life works for your timeline, or you're already cloud-bound.

Choose Lumos if:

• The pressing problem is SaaS access governance and the retirement of spreadsheet-based reviews.
• You want a self-service request catalog and joiner-mover-leaver automation across cloud apps.
• Your estate is SaaS-heavy, with little on-premises file infrastructure to govern.

If the gap is data-layer exposure, Varonis fits. If it's SaaS access sprawl, Lumos fits the bill. The size of your on-premises footprint usually breaks the tie.

When to choose Netwrix over Varonis or Lumos

Netwrix becomes the answer when one team has to solve both the data and access questions on infrastructure that outlasts 2026.

When the data layer and the SaaS layer both need governing

Netwrix Access Analyzer runs 40+ data collection modules to calculate who can actually reach a file through layered AD and Entra ID permission chains. Along the way, it flags stale accounts, orphaned groups, and over-privileged service accounts.

Netwrix Auditor runs predefined real-time alerts for privilege escalations, group membership changes, failed logons, and deleted accounts, logging the account associated with each change and its timestamp.

Netwrix Identity Manager runs certification campaigns that scope to departments, roles, or object types, route each item to the responsible manager, and revoke anything not re-attested by the close date. It also syncs joiner-mover-leaver changes from HR systems roughly every 15 minutes.

One team can see what data exists, who can actually reach it, and whether that access was granted through certification, rather than stitching two vendors together.

Credit Agricole's infrastructure division manages access for 5,000 employees across 17 French sites and needed a centralized, role-centric access framework to meet the requirements of the

French Military Programming Law. Netwrix Identity Manager gave the team a centralized identity repository, and the team's product owner reported gains "very quickly in the treatment of anomalies around not only incidents but also identities."

When privileged accounts are part of the picture

Governing privileged access natively falls outside both platforms evaluated above, so teams often bolt on a dedicated PAM tool like CyberArk or BeyondTrust. Both vault privileged credentials and rotate them on a schedule, but the credentials still exist between rotations.

Netwrix Privilege Secure takes a different approach. With Zero Standing Privilege (ZSP), an account gets created only when a specific task starts, scoped to that system and time window, and it's destroyed automatically the moment the session ends.

That means there's no standing admin credential sitting in a vault between uses, waiting for an attacker to find it. The Netwrix 2026 Data and Identity Security Report found that 76% of organizations don't automatically revoke access to sensitive data once it's no longer needed, and that's the gap ZSP and formal governance can close.

When on-premises data has to stay in scope past 2026

Netwrix maintains on-premises and hybrid coverage after the December 2026 end-of-support deadline and reaches the file-share permissions that SaaS-only models can't resolve. It tracks identity and access risk wherever the data lives.

When auditors test identity and data evidence together

HIPAA, SOX, IT general controls, and CMMC increasingly ask two things in one breath: who was certified for access, and what sensitive data they could reach. Netwrix ties the two together. Access Analyzer supplies the sensitivity and access context, and Identity Manager runs that context through certification campaigns. The result is one audit trail that shows who signed off and what they could actually touch.

Varonis answers the data question, and Lumos answers the SaaS access question. Running both still leaves the hybrid layer open: on-premises file shares, Active Directory governance, and the compliance record that ties data exposure to certified access.

Netwrix covers the full picture with 18 products under a single vendor relationship and a single licensing conversation. It's also the only one of the three that sustains on-premises coverage well past Varonis's December 31, 2026, end-of-life date.

Request a demo to see how Netwrix pairs data access governance with identity governance across hybrid Active Directory and Entra ID.

Disclaimer: The information in this article was verified as of July 2026. Please verify current capabilities directly with each provider.