Lumu

Lumu Technologies is a cybersecurity vendor that builds a threat detection and response platform designed to confirm instances of compromise across corporate networks, endpoints, identities and cloud environments. The company pioneered what it calls Continuous Compromise Assessment, an approach that continuously analyzes telemetry to identify malicious activity rather than waiting for other security controls to raise alerts. Its flagship product, Lumu Defender, collects data through virtual and physical appliances, integrations with AWS, Azure, GCP and Kubernetes, native agents for Windows, macOS, Linux and ChromeOS, and API collectors for SIEM, EDR, firewall, VPN and ZTNA tools.

The platform detects hacker activity using artificial intelligence, spots threats across cloud and on-premises infrastructure, employee workstations and connected devices, and can identify malicious emails. Beyond detection, Lumu can automatically contain threats through integrations with third-party security tools — for example instructing a firewall to block a suspicious connection — or through response capabilities built into the Lumu Agent. It retains two years of network metadata to support retrospective threat hunting against newly published indicators of compromise, and presents compromised assets, malware propagation paths, adversary tactics and possible threat-group attribution in a consolidated incident view. More recent additions include Lumu AI for incident intelligence, an Autopilot capability that can manage incidents autonomously, Lumu Discover, and the Lumu Threat Observatory, which supplies sector- and region-specific threat intelligence.

Founding story

Lumu was founded by Ricardo Villadiego, a second-time founder who previously created Easy Solutions, an electronic fraud prevention and detection company, and led the cybersecurity business unit at Cyxtera Technologies. Earlier in his career he held leadership roles at IBM — including regional director for internet security systems in Latin America — as well as Internet Security Systems and Unisys. After studying corporate data breach patterns, he observed that attackers must always use a network, and developed technology to continuously look for and respond to signs of network compromise, which became Lumu. The company's name means "light" in Esperanto, reflecting its emphasis on visibility.

Business model

Lumu sells a software platform to enterprises and to managed service providers, positioning the product as a layer that works alongside and improves the effectiveness of a customer's existing security stack rather than replacing it. Delivery is through cloud-based software with collectors, appliances and endpoint agents deployed in customer environments.

Sources indicate recurring software revenue, with the company reporting annual recurring revenue growth of 133% year over year as of September 2023; specific pricing terms are not disclosed.

Traction

As of September 2023 the company reported 881 live deployments worldwide and 133% year-over-year annual recurring revenue growth. Publicly named customers include North Ridgeville Schools, Harding Academy, Marysville Schools, Uinta County School District, Meta Solutions, Sublette County School District, Beavercreek City Schools, Ozinga, Horizon Bank, Davivienda, Valid, Provident, Lehigh County, Mostellar Medical, Ophthalmic Consultants of Boston, Alachua County, and MSPs such as Lehigh Valley Technology, Touchstone Security and Kemper Technology Consulting.

Latest developments

Lumu announced the Lumu Threat Observatory at Black Hat USA 2026, offering personalized threat intelligence with a live view of threats targeting a customer's sector and region. The company also published a 2026 Compromise Report and a 2026 report on cybersecurity for education, promoted Lumu Discover product training, and highlighted recognition as a Leader in a GigaOm Radar report on network detection and response. The platform has added AI-powered security operations features including Lumu AI for incident intelligence and Autopilot for autonomous incident handling.