If you're evaluating IGA tools from a compliance perspective and have been told to look at Veza and Lumos, it's worth understanding what each platform is actually optimized for before you start demos — because the IGA market has fragmented in ways that aren't obvious from vendor positioning alone.

The short version from practitioners in this thread: Veza is primarily an Identity Security Posture Management tool with strong granular entitlement visibility for complex cloud infrastructure. Lumos is a mid-market access request and governance platform. SailPoint, Saviynt, and Okta IGA are the established full-suite players. Zluri started as a SaaS management platform and has expanded into IGA. None of them covers everything, and which one fits depends heavily on your tech stack, your compliance requirements, and how much implementation overhead your team can absorb.

What Compliance Teams Actually Use IGA Platforms For

Before evaluating any specific tool, it helps to be clear about which IGA capabilities matter most for compliance work. Based on what practitioners in this thread described, the core features compliance teams depend on are:

Automated access reviews and certification campaigns. Moving away from manual spreadsheets toward automated campaigns where reviewers see context-rich dashboards — user employment status, application role, last activity, license type — and can approve or revoke with a click. The output is a timestamped, non-editable PDF or CSV evidence report that auditors can review directly. For SOC 2, ISO 27001, HIPAA, and SOX, this is the control evidence requirement that drives most IGA purchases.

Joiner-Mover-Leaver (JML) automation. Policy-driven workflows that provision birthright access on day one, adjust access when people change roles or departments, and automatically revoke access when someone leaves. Manual offboarding processes that get skipped "for convenience" are the source of the orphaned account findings that appear in audit results year after year.

Shadow IT and unauthorized app discovery. Finding and classifying applications that employees are using outside formal IT oversight — including modern AI tools. Bringing those applications under governance scope so they appear in access reviews and offboarding workflows.

Segregation of Duties enforcement. Rules that prevent one person from holding conflicting access rights — the person who requests access to a sensitive system shouldn't also be the person who approves it, and the person who initiates a financial transaction shouldn't also be the person who authorizes it.

How the Main Tools Position in This Space

Veza is primarily an Identity Security Posture Management (ISPM) tool. Where it genuinely differentiates is granular entitlement visibility for complex cloud infrastructure: it maps what a specific user can actually do inside AWS, Snowflake, or a database — create, read, update, delete at the resource level — rather than just whether they have access to the application. For organizations with complex cloud infrastructure where permission proliferation is the primary risk, Veza fills a gap that most IGA platforms don't. For compliance teams whose primary need is access review automation and JML workflows, Veza is more commonly deployed alongside an IGA platform than as a replacement for one. The OP's hypothesis in this thread — that Veza and Lumos are often used in conjunction with SailPoint or Okta IGA for the ISPM features — is accurate.

Lumos targets mid-market organizations with access request workflows, access reviews, and basic governance. It's positioned as simpler to deploy than SailPoint and more focused on the governance layer than Okta. For organizations that don't need the full complexity of SailPoint but want structured access request and certification workflows, Lumos is a reasonable fit.

SailPoint (IdentityNow, the cloud platform) is the most widely deployed full-suite IGA platform among enterprise organizations. It's mature, it's feature-rich, and it comes with the corresponding implementation complexity and cost. The practitioner in this thread who noted that SailPoint and Saviynt require "so much setup, care and feeding" is reflecting a real tradeoff: the depth of capability comes with a real implementation investment. For mid-sized organizations, the setup overhead is frequently cited as a barrier.

Saviynt is similar in scope to SailPoint — full-suite IGA with deep compliance features, particularly strong for SOX-regulated environments. Same tradeoff on complexity.

Zluri started as a SaaS Management Platform and has expanded into IGA. The differentiator that practitioners in this thread cited is discovery: the combination of HRMS integration, SSO log analysis, financial system integration, and browser agents produces an access visibility picture that covers shadow IT and non-SSO apps, not just formally provisioned applications. A practitioner who was part of a buying committee at a 2,500-person organization cited access visibility as the primary reason they chose Zluri over ConductorOne, Zilla, and Lumos. The SaaS management layer — license optimization, cost reporting, contract management — is a secondary benefit for compliance teams but a primary value driver for IT and finance stakeholders, which makes the buying case easier to close across departments.

Gaps to Evaluate Before Committing to Any Platform

Several gaps appeared consistently across the evaluation discussions in this thread and in the Cortex analysis:

Granular entitlement depth vs. broad application coverage. Most IGA platforms can tell you who has access to an application. Fewer can tell you what they can do inside it at the resource level. If your compliance requirements include demonstrating least-privilege at the permission level rather than the application level — particularly for cloud infrastructure — verify the specific entitlement depth the platform provides for your most critical systems.

Disconnected and legacy application support. Standard IGA tooling relies on SCIM and APIs. Applications without API support require workarounds: AI-powered browser automation (Zluri is developing this), on-prem agents that run custom scripts (Lumos and Zluri are both building toward this), or manual task routing to ITSM tools like Jira with tracked completion. Before selecting a platform, count how many of your applications lack API support and test the vendor's actual answer for those systems rather than accepting a general claim about coverage.

On-premises application governance. Cloud-native IGA platforms are primarily designed for SaaS. If you have significant on-prem AD, legacy databases, or mainframe systems, verify the vendor's on-prem agent capabilities specifically — not the marketing claim, but a live demo with your actual data. The practitioner in this thread who chose Access Auditor from SCC specifically because they needed to handle "identity mess" with complicated RBAC rules and on-prem systems is describing a requirement that eliminates several of the modern cloud-native platforms.

Role mining maturity. Current IGA platforms largely rely on static role definitions — you specify upfront which applications each role gets. True role mining — where AI analyzes actual usage patterns and peer behavior to suggest least-privilege role modifications — is still maturing. If your compliance program requires demonstrating that access assignments reflect actual job function rather than accumulated entitlements, verify what the platform actually does rather than what it claims to be building.

What the Evaluation Process Should Look Like

The practitioner who shared their evaluation experience in this thread offered the most practically useful advice: ignore Gartner, get your requirements in order before demos, and test every tool against your actual data. Demos make everyone look good. Bring your messiest data files and watch how each vendor handles them. Ask vendors to set up an import on the call so you can judge the actual complexity, not a pre-configured demo environment.

For compliance teams specifically: define your compliance framework requirements first (SOC 2 vs. SOX vs. ISO 27001 have different control evidence requirements), identify your highest-risk applications for access review coverage, count your non-API applications to gauge the disconnected app problem, and establish whether on-prem systems are in scope. Those four requirements alone will eliminate a significant portion of the market and make the remaining evaluation much more focused.

Frequently Asked Questions

What is the difference between Veza and a full IGA platform like SailPoint or Zluri?

Veza is primarily an Identity Security Posture Management tool that provides granular visibility into what users can do inside cloud infrastructure — specific permissions at the resource level for AWS, Snowflake, databases, and similar systems. Full IGA platforms like SailPoint and Zluri provide lifecycle management (JML automation), access request workflows, access certification campaigns, and compliance reporting in addition to visibility. Most organizations that use Veza deploy it alongside an IGA platform rather than instead of one.

Which IGA features matter most for SOC 2 compliance?

The core SOC 2 IGA controls are automated access reviews with timestamped evidence reports, JML lifecycle workflows that prevent orphaned accounts, and audit logs demonstrating that access changes are tracked and approved. Secondary controls include Segregation of Duties enforcement for sensitive systems and periodic access certification campaigns with manager review workflows. The evidence format the platform generates — whether it's non-editable and timestamped — determines whether auditors will accept it directly or require additional documentation.

Is SailPoint too complex for mid-sized organizations?

For organizations without a dedicated IAM team or significant IT bandwidth for implementation and ongoing maintenance, SailPoint's setup and care requirements are frequently cited as a barrier. Mid-market organizations in the 500–5,000 employee range often find better fit with platforms designed for faster time-to-value — Zluri, Lumos, or Access Auditor depending on specific requirements. The tradeoff is less feature depth in some areas; the benefit is deployment measured in months rather than years.

How do you evaluate IGA tools for disconnected and legacy applications?

Before demos, catalog every application in your environment that doesn't have a SCIM or REST API. Bring that list to vendor evaluations and ask specifically how each platform handles those systems. Request a live demo with a sample of your actual data files — not a pre-configured demo environment — and watch how much effort the vendor's team expends to set it up. Vendors that can set up an import quickly, with minimal custom scripting, are more viable for teams without dedicated IAM engineering resources.