Lepide Turns Permission Sprawl Into a Shorter To-Do List

The least glamorous mystery in corporate computing begins with a deleted folder. Someone in finance swears it was there yesterday. The event log contains a thicket of evidence, none of it eager to introduce itself. The helpdesk needs a name; the auditor wants a timeline; the security lead would prefer to know why the person could touch the folder at all. Lepide has built a company around making that interrogation less miserable.

Founded in 2005 and headquartered in Flimwell, England, Lepide makes software that watches directories and unstructured data across Active Directory, Microsoft Entra ID, Microsoft 365, Windows file servers and a widening collection of storage systems. It records changes, maps effective permissions, identifies sensitive files, spots abnormal behavior and can revoke risky access. The company says more than 1,200 organizations use it. Its public customer list travels from the UK Home Office and NHS to Deloitte, KPMG, Moody's, Investec, Fujitsu, Edinburgh Napier University and the City of Danville, Illinois.

This is not endpoint antivirus, a firewall or a backup product. Lepide occupies the untidy space where identity meets data: the employee account, the nested group, the inherited permission and the spreadsheet nobody remembered was sitting in an open share. The buyer is usually an IT, security, compliance or identity team with too much infrastructure and too few people to narrate every alert.

The product answers three questions

Lepide's original strength was change auditing - turning cryptic native logs into the familiar who, what, where and when. Over time, the company moved outward from the event. If a user opened a sensitive file at 2 a.m., the useful story includes how the user got access, whether the file contains regulated data, whether the behavior is unusual and what response is safe. That wider context is the platform.

Six named modules divide the labor. Auditor produces interactive reports. Trust analyzes permissions and excessive privileges. Detect handles real-time alerts, anomaly spotting and response workflows. Identify discovers and classifies sensitive data. Protect applies permissions remediation. Lepide AI lets an operator ask natural-language questions of the accumulated audit and security data. The labels are almost comically literal, which is helpful in a market that can turn three verbs into a new acronym before lunch.

What failed first was the native tool

Customer stories reveal the moment a buyer's mind changes. For Danville, it was Event Viewer. The city's IT team was fielding calls about deleted and modified files, then searching a tool that could record events but was slow at reconstructing them. PCI DSS and FERPA reporting raised the stakes. Danville chose Lepide for centralized file-change history, alerts and predefined compliance reports; the city says helpdesk work and investigation time fell.

At an NHS trust, an accidental deletion exposed the deeper failure: excessive permissions inherited through nested groups. The team could see the incident, but not easily untangle why users had access or continuously watch privileged behavior. Lepide's permissions analysis made the inheritance path visible, while auditing and alerts supplied the live record. Edinburgh Napier University's trigger was different but related - students arrive and leave, accounts change constantly, and manual review does not scale politely.

“The organizations included in this research did not lack security controls. They were lacking context.”Lepide, State of Identity and Data Security 2026

A small sample with a loud warning

In 2026, Lepide published results from ten technical risk assessments in live environments across government, education, manufacturing, construction, utilities, commercial services and nonprofits. Ten is not a market census. It is, however, more interesting than a survey asking executives how secure they feel. The company found excessive permissions in 79 percent of assessed organizations, enabled inactive Active Directory accounts in 90 percent, and inherited administrative rights through nested groups in as many as 83 percent of privileged accounts. Every assessed organization was judged unready for tools such as Microsoft Copilot because of governance weaknesses.

That last finding gives the old permissions business a timely new plot. Copilot can surface information at machine speed, but it generally respects access a user already has. A forgotten group membership therefore becomes easier to exploit accidentally. Lepide added a Copilot dashboard, high-risk activity alerts, usage comparisons and conversation visibility in its February 2026 release. The pitch is not that AI creates every exposure. It is that AI makes yesterday's sloppy access decisions much more productive.

From dashboards to decisions, with caveats

The February release also introduced Lepide AI. Operators can ask direct questions instead of assembling a report by hand, receive summaries of changes and anomalies, and get configuration guidance. More than 100 fixes and enhancements arrived alongside it. That number matters: a natural-language interface is only as trustworthy as the event collection, permissions graph and product plumbing underneath.

The sharper move came in 2025, when Lepide Protect reached general availability. The module uses organizational hierarchy and risk scoring to identify and automatically revoke excessive file-server permissions. This closes a gap that afflicts many security tools: they can point at a problem for years while the operator opens a ticket in another system. Automated revocation turns observation into consequence, so a sensible buyer will test approvals, rollback and false-positive handling as closely as detection.

That model distinguishes Lepide from a loose collection of native tools and from broad platforms whose price and operating overhead can overwhelm a midsize team. Varonis is the comparison Lepide and its reviewers invoke most often; Gartner also places Concentric AI and Cyera nearby. Depending on the problem, a buyer may consider Netwrix, Quest, ManageEngine, Semperis, BigID or Microsoft itself. Lepide's advantage is the joined-up story across identity, data and behavior. Its narrower company size and modular packaging are part of the appeal, not proof of identical depth in every workload.

There are limits. One verified Gartner reviewer liked the customization but said a very small team needed considerable hands-on knowledge to extract the most value; aggregated review material also flags crashes. Organizations built mostly around unsupported cloud-native data stores may find the Microsoft and file-server center of gravity constraining. Buyers who need a transparent card price, a fully managed SOC or one-click coverage across every SaaS repository should test those assumptions before they admire the dashboard.

The part worth copying

Lepide's useful lesson is methodological rather than magical. Start with an observable event, connect it to effective access, add the sensitivity of the data, compare the behavior with a baseline, then remediate only when the evidence is coherent. Teams can borrow that sequence whether they buy Lepide or assemble the pieces elsewhere.

1. Inventory dormant accounts and privileged group membership before buying another detection feed.
2. Resolve effective permissions, including nested groups and inheritance; nominal group lists are not enough.
3. Classify the data that deserves attention so every file event does not become equally urgent.
4. Baseline behavior and tune thresholds with actual operators before automating a response.
5. Test one investigation end to end: evidence, alert, owner, remediation, rollback and audit report.

The company itself followed a version of that sequence. It began with auditing, added the access graph, layered in classification and behavior, then moved into automated remediation and natural-language analysis. In June 2024, after nearly nineteen years, it took its first institutional growth investment from Foresight Group. The amount was not disclosed. Foresight said the money would support R&D, sales and customer support; at the time, it counted more than 80 staff and said over 60 percent of Lepide's customers were in the United States. Lepide now describes a team of more than 100 across three offices in Flimwell, Austin and Noida.

Rupesh Kumar, who helped found the company, remains chief strategy officer. Sandeep Verma has led development after being there since the beginning, and product owner Vikas Kaushik joined in 2006. CEO Aidan Simister arrived in 2015 and helped drive expansion in Europe and the United States. In a sector fond of sudden rebrands and faster exits, that long tenure explains the product's accretive shape: each module answers the next annoying question raised by the previous one.

The wager now is that this patient accumulation can stay simpler than the problem it monitors. Permission sprawl never announces itself with a dramatic soundtrack. It arrives as one more group, one inherited right and one account nobody disabled. Lepide's business is to make that ordinary mess visible before a deleted folder, an auditor or an AI assistant makes it news.