You might have seen <a href="https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024">this shocking prediction from Gartner</a>: by 2027, 75% of employees will acquire, modify or create technology outside IT's visibility &ndash; up
from 41% in 2022.
Last year, LastPass launched the beginning of our evolution beyond password management to a secure access solution. Now, we've sharpened our focus to deliver
what lean teams truly need to operate securely.
We know that these teams only want the essentials when it comes to protecting their teams and their business. While other security tools present expensive,
cumbersome solutions built for orgs with dedicated security teams and large budgets, LastPass Secure Access Essentials is built for you.
It's the solution for resource-strapped IT organizations and businesses who don't have the budget, time, or technical resources to deploy those complex
tools.
<div class="button-container"><a href="https://www.lastpass.com/solutions/secure-access"><button class="lp-button lp-button--primary">Try for free</button></a></div>
<h2>The Modern Access Challenge</h2>
Your employees rely on more SaaS tools than ever, and not all of them are on your radar. 
From cloud apps and browser extensions to AI tools, today's workplaces move fast. And when anyone can implement a new app with little more than a credit card and
a dream, you can be sure that very few of them are thinking about secure access or credential management. Consider this:
<ul>
 <li>Risk is rising: <a href="https://cloudsecurityalliance.org/artifacts/state-of-saas-security-report-2025">CSA reports</a> 55% of organizations say employees adopt SaaS tools without Security's involvement, and 56% report sensitive data being
 uploaded to unauthorized apps &mdash; blind spots that lead to real security incidents.</li>
 <li>Productivity is slipping: <a href="https://deepstrike.io/blog/password-statistics-2025?utm_source=chatgpt.com">Up to 50%</a> of IT help desk tickets are for password resets, and employees spend roughly 11 hours per year dealing with access
 issues instead of doing their jobs.</li>
 <li>Costs are compounding: The average company now uses <a href="https://deepstrike.io/blog/password-statistics-2025">~106 SaaS applications</a>, each adding overhead &mdash; and every password reset can cost around $70 in support
 time.</li>
</ul>
Single sign-on (SSO) can help with your core apps &mdash; the ones that you know about &mdash; but it doesn't cover everything, especially those smaller, hidden apps. And
for small and mid-sized businesses, controlling those can get expensive and time-consuming, fast.
That's where the security gaps start. Without a simple, customizable way to manage access, secure credentials, and monitor app usage, it's easy to lose
control. And that opens the door to risk from old accounts that still have access to sensitive info, to apps no one remembers signing up for.
It's no longer enough to secure passwords alone. Businesses need an approach to secure access management that's as flexible, efficient, and user-friendly as
the tools their employees actually use.
<h2>What is Secure Access Essentials?</h2>
Secure Access Essentials is the LastPass answer to the growing access management crisis, delivering core capabilities that work together to secure your
organization. These capabilities scale across the LastPass product, so you can start where you are and expand as your security needs grow.
With Secure Access Essentials, you can:
<ul>
 <li>Discover SaaS and AI tools: Gain visibility into which apps and AI tools your team is using, including unseen or unapproved apps. Spot risks early and
 maintain control across your SaaS landscape.</li>
 <li>Control Access for Everyone: Ensure the right people have access to the right apps, systems, and data based on your policies. Easy to configure and adjust
 as your business evolves.</li>
 <li>Simplify Secure Access: Securely manage how your team stores and uses passwords, with support for passkeys for faster and safer authentication.</li>
</ul>
<h2>Why does Secure Access Essentials matter?</h2>
Enterprise solutions require dedicated IT teams, months of deployment, and ongoing maintenance that lean teams simply can't sustain. The cost and complexity
put security out of reach when you need it most.
And the stakes are high. <a href="https://deepstrike.io/blog/data-breach-statistics-2025">The average cost of a data breach</a> is $4.4 million, which can devastate small businesses. Unapproved tools lead to wasted spend and
duplicate or unused applications, while compliance violations can result in fines that put a serious dent in already constrained budgets.
LastPass brings together the essentials that cut complexity, strengthen protection, and make secure access effortless. Our capabilities are:
<ul>
 <li>Easy to manage, easier on your budget: Manage all access from a single place and skip the cost and chaos of multiple systems.</li>
 <li>Designed for stronger protection with fewer roadblocks: Get strong, straightforward security that keeps your business safe and makes compliance
 easier.</li>
 <li>Simple for your team + build stronger habits: When security fits naturally into the day, people actually follow it &mdash; reducing risk and boosting
 productivity.</li>
</ul>
<h2>Building on a Strong Foundation</h2>
Password management is the foundation of LastPass, and it remains essential to secure access. But as security challenges mount, those challenges demand more.
That's why we've evolved beyond credentials to deliver the visibility and control modern businesses need.
Now organizations can also use LastPass to uncover risky SaaS and AI tools and enforce safe‑usage policies with SaaS Monitoring and SaaS Protect. And this is
just the beginning.
As secure access challenges expand, so will we, delivering the essentials you need to protect your business at every stage of your journey. Thanks for coming
along with us so far, and we're excited to build the future together.
<a href="https://www.lastpass.com/solutions/secure-access"><button class="lp-button lp-button--primary">Try for free</button></a>

Beyond Password Management: Secure Access Essentials from LastPass

LastPass Secure Access Essentials gives resource-strapped IT teams the tools to discover SaaS apps, control access, and simplify security without the complexity.

Introducing Secure Access Essentials: Beyond Passwords to the New Reality of Work

Get LastPass Free

Create and store secure passwords for yourself, your team or business.

Why LastPass?

Remember fewer passwords and log in faster with our browser extension.

How LastPass works

LastPass zero-knowledge security model keeps your data private even from us.

Security Architecture

Compare LastPass competitors, plans, and features in one place

Compare LastPass

Overview

Password management

Save and autofill

Password generator

Password sharing

Passkeys

Dark web monitoring

Security dashboard

Key Features

Free LastPass Premium trial, no credit card required.

Free LastPass Business trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Sync passwords across all devices, monitor password health, data breaches and much more.

Personal

Premium password management for family or group of 6 people.

Families

Personal Plans

Password vault

Save & autofill

Mobile Smart Scanner

Automatic device sync

Emergency access

Personal password sharing

FOR INDIVIDUALS

30-day free LastPass Premium trial, no credit card required.

30-day free LastPass Families trial, no credit card required.

Limited to 1 device type and basic password management features.

Designed for businesses of all sizes, from small startups to enterprises.

Business

Simplify secure access straight from the browser with more admin control.

Business Max

For single teams just getting started with password management.

Teams

Designed to keep your clients' credentials protected and private.

Business Plans

User management

SaaS Monitoring

SaaS Protect

Secure Access Essentials

Business sharing

Multifactor Authentication

Integrations

Single Sign-on

Identity management

For admins

Marketing teams

Legal teams

HR teams

Business leaders

IT admins

Solutions by role

Case studies

Webinars

Product demos

Events

Trust Center

Compliance Center

Security architecture

LastPass University

Resource Center

Pricing

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Cloud marketplaces

Technology Alliance Partners

LastPass Partner Program

Grow new revenue streams by meeting customer's security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

System status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Submit sales inquiry

Chat with sales

Request a demo

Find a partner

Contact sales

Log in

Allow, warn, block: AI governance for lean teams | LastPass

<ul>
 <li data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1">The 2026&nbsp;leaks from vibe code platforms like&nbsp;Lovable, Base44,&nbsp;and&nbsp;Replit&nbsp;weren't&nbsp;breaches but access control failures.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1">An "AI acceptable use policy" in your employee handbook is a good start.&nbsp;But without enforcement at the point of access,&nbsp;the policy&nbsp;carries no real authority.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1">The&nbsp;LastPass&nbsp;Allow/ Warn/ Block model gives&nbsp;your team&nbsp;a way to apply&nbsp;different levels&nbsp;of&nbsp;access&nbsp;control,&nbsp;without blanket restrictions that kill productivity or drive behavior underground.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="4" data-aria-level="1">Most AI risk starts at the credential&nbsp;rather than&nbsp;network layer.&nbsp;That's&nbsp;why governing access in the browser catches what&nbsp;enterprise&nbsp;CASB&nbsp;or SSPM tools&nbsp;miss.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="5" data-aria-level="1">LastPass Business Max surfaces&nbsp;every&nbsp;SaaS or&nbsp;AI tool&nbsp;your&nbsp;employees log into,&nbsp;while&nbsp;SaaS Protect&nbsp;enforces controls&nbsp;at the moment&nbsp;of access.</li>
</ul>

What to Know Before You Read 

Blanket AI bans don't reduce risk — they relocate it. See how allow, warn, block gives lean IT teams practical AI governance without enterprise overhead. 

Mike Kosak

Senior Principal Intelligence Analyst

Allow, Warn, Block: A Practical AI Governance Model for Lean Teams 

AI credential sprawl: Your guide to identity-first security

<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px;">
 To act autonomously, every AI agent your team onboards is issued credentials (API keys, OAuth tokens, SSH keys). And most teams struggle to maintain a complete inventory of agents and credentials.<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335559738':0,'335559739':0,'335559740':300}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>
<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px;">
 AI-assisted commits (saved snapshots of code changes) leak secrets at more than twice the rate of human-only commits.&nbsp;<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335559738':0,'335559739':0,'335559740':300}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>
<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px;">
 Don&rsquo;t hold that FIDO2 MFA rollout: While exploitation of vulnerabilities is now the #1 initial access vector (Verizon 2026 DBIR), credential abuse still sits in many attack paths.&nbsp;<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335551550':1,'335551620':1,'335559685':720,'335559737':0,'335559738':0,'335559739':0,'335559740':300,'335559991':360}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>
<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="4" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px; ">
 Frameworks like SOX, the UK Corporate Governance Code, and the EU AI Act require strong identity and access controls, which implicitly include non-human (machine) identities.&nbsp;<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335559738':0,'335559739':0,'335559740':300}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>
<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="5" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px; ">
 The fastest-growing identity threat is in the browser, where logins to AI-integrated apps live.<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335559738':0,'335559739':0,'335559740':300}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>
<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="6" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px;">
 LastPass gives lean IT teams: Real-time visibility into every SaaS and AI tool in use + centralized credential management + browser-level access controls.<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335559738':0,'335559739':0,'335559740':300}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>

FAQ: solving AI credential sprawl in real environments

AI tools create credentials faster than most teams can track. Learn what AI credential sprawl costs your business and how identity-first security helps.

Identity-first security for Financial Services: Your best defense against AI credential sprawl 

6 Shadow IT Solutions for Companies in 2026

A guide to finding the best shadow IT solution for your organization. Including solutions for small to midsize businesses, as well as enterprise level companies

6 Shadow IT Solutions for Companies in 2026 

<span data-ccp-parastyle="intro" data-ccp-parastyle-defn="{&quot;ObjectId&quot;:&quot;d592eb23-fd16-52a5-a403-2217e79092b5|1&quot;,&quot;ClassId&quot;:1073872969,&quot;Properties&quot;:[201342448,&quot;3&quot;,469777843,&quot;&quot;,201341986,&quot;3&quot;,268442635,&quot;27&quot;,469777841,&quot;Times New Roman&quot;,469777842,&quot;Times New Roman&quot;,469777844,&quot;Times New Roman&quot;,469769226,&quot;Times New Roman&quot;,469775450,&quot;intro&quot;,201340122,&quot;2&quot;,134233614,&quot;true&quot;,469778129,&quot;intro&quot;,335572020,&quot;1&quot;,335559739,&quot;375&quot;,134233117,&quot;true&quot;,469778324,&quot;Normal&quot;]}">If&nbsp;you&rsquo;re&nbsp;using LastPass, you already know&nbsp;you&rsquo;re&nbsp;in good company. Trusted by millions of users worldwide, LastPass delivers Secure Access Essentials that help you manage and protect access to AI, applications, and credentials right from the browser. Today,&nbsp;we&rsquo;re&nbsp;happy to&nbsp;announce that&nbsp;we&rsquo;re&nbsp;making that experience even better.<span data-ccp-props="{&quot;134233117&quot;:true,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559739&quot;:375,&quot;335559740&quot;:259}">&nbsp;
Welcome to the new&nbsp;<a href="https://community.lastpass.com/">LastPass Community</a>,&nbsp;built to help you learn more about LastPass, get answers faster, and feel supported every step of the way.&nbsp;We're&nbsp;excited to bring you a better experience with new features designed to make finding answers easier, connecting with others more rewarding, and exploring LastPass more intuitive.&nbsp;&nbsp;
<h2>What will you get in the new LastPass Community?&nbsp;</h2>
<h3>Enhanced&nbsp;navigation &amp; LastPass&nbsp;topical&nbsp;hubs&nbsp;</h3>
The new Community features cleaner navigation.&nbsp;LastPass topical hubs are organized content areas within the Community that group related discussions, articles, and resources by subject, such as account management, security best practices, and troubleshooting.&nbsp;
<h3>Powerful&nbsp;search &amp;&nbsp;personalization&nbsp;</h3>
Our improved search functionality helps you find relevant answers in seconds. The new platform learns from your activity to deliver a personalized experience, surfacing the content and discussions most relevant to your needs&nbsp;so you can get to the&nbsp;information&nbsp;you want&nbsp;faster than ever before.<span data-ccp-props="{&quot;134233117&quot;:true,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559739&quot;:225,&quot;335559740&quot;:259}">&nbsp;
<h3>Gamification &amp;&nbsp;community&nbsp;engagement&nbsp;</h3>
Engage with the Community in new and exciting ways. Earn points and badges as you contribute&nbsp;and share your&nbsp;expertise. The new engagement tools make it easy to recognize helpful members and build connections with others who face the same challenges you do.&nbsp;
<h2>Getting&nbsp;started&nbsp;</h2>
Ready to explore? Existing members can sign in now with their LastPass credentials.&nbsp;As an existing Community member, your account and all your content, including posts, replies, and member points, have already&nbsp;transferred&nbsp;to the new platform.&nbsp;New members can register in just a few clicks. Once&nbsp;you're&nbsp;in,&nbsp;you'll&nbsp;find&nbsp;helpful&nbsp;resources to&nbsp;guide you,&nbsp;like "How to get started in the Community," "Rules of the Road," and information about how gamification works.&nbsp;
Head to&nbsp;<a href="https://community.lastpass.com/">community.lastpass.com</a>&nbsp;to&nbsp;explore the new Community &mdash;&nbsp;we're&nbsp;excited to see you there!&nbsp;Your feedback helps shape the Community, so&nbsp;we'd&nbsp;love to hear what you think as you explore the new experience.&nbsp;&nbsp;
If&nbsp;you&rsquo;d&nbsp;like some help learning the ropes&nbsp;before you get started, register for our&nbsp;webinar,&nbsp;New LastPass Community: Open Office Hours&nbsp;on&nbsp;Wednesday, May 27,&nbsp;2026&nbsp;from 1:00 PM - 3:00 PM PDT.&nbsp;<a href="https://register.gotowebinar.com/register/8783556845180756060">Register here</a>.&nbsp;&nbsp;

New LastPass Community: Faster Answers & Better Support

FAQs

Discover the new LastPass Community — faster answers, personalized resources, and engaging tools to help you connect, learn, and stay secure.

The New LastPass Community is Live: Faster Answers, Better Resources, More Connection

6 Best KeePass Alternatives for Businesses: 2026 Comparison Guide

6 of the best KeePass alternatives available, including a password managers for small businesses, open-source teams, and more.

Model Context Protocol (MCP) Risk: Govern AI Agent Credentials in SaaS Apps

Via a connection protocol called Model Context Protocol (MCP), AI agents can connect to SaaS tools and perform actions on your behalf. While LastPass doesn&rsquo;t manage MCP‑powered AI agents, it can govern human‑owned credentials such as static API keys and SSH keys that AI agents commonly rely on. These long-lived credentials remain a primary source of AI access risk.&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Every time an employee authorizes an AI tool with MCP integrations, it creates a machine identity that doesn't expire or show up in standard usage reports. And most SaaS security frameworks aren't built to see it.&nbsp;</li>
 <li class="li1" style="margin: 0px;">MCP launched in November 2024 with no authentication framework at all. In 2026, OAuth 2.1 and authentication are a strong spec recommendation for MCP, but no enforcement mechanism exists.&nbsp;</li>
 <li class="li1" style="margin: 0px;">58% of SaaS logins occur outside SSO-managed environments. AI tools widen that gap, because employees can authorize them independently without informing IT.&nbsp;</li>
 <li class="li1" style="margin: 0px;">The access trail your auditors will ask for (which AI tools are active, what data they can touch, and how access is controlled) must be documented before the question gets asked, not after.&nbsp;</li>
 <li class="li1" style="margin: 0px;">LastPass helps lean IT teams at Professional Services firms close gaps at the credential layer, where both human and AI-connected logins occur, without needing a separate IAM platform.&nbsp;</li>
</ul>

What to know before you read

FAQs about MCP Risk and AI credential governance

MCP-powered AI agents use employee credentials to access SaaS apps, creating hidden security risks. Learn how to govern AI-driven access, reduce credential sprawl, and stay audit-ready.

Model Context Protocol (MCP) Risk: How to Govern Credentials AI Agents Rely On

SSO limitations and Shadow AI: A new HIPAA compliance risk

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">SSO protects only the apps your IdP (identity provider) knows about. The AI tools your staff accesses through direct browser logins are completely invisible to your IdP.&nbsp;</li>
 <li class="li1" style="margin: 0px;">The HSCC AI Third-Party Risk Guide (April 2026) now formally requires healthcare organizations to maintain an active, continuously updated inventory of all AI tools employees use &mdash; including those IT never approved.&nbsp;</li>
 <li class="li1" style="margin: 0px;">97% of organizations that experienced AI-related security breaches lacked proper access controls.&nbsp;&nbsp;</li>
 <li class="li1" style="margin: 0px;">Shadow AI incidents carry an average of $670,000 in additional breach costs.&nbsp;</li>
 <li class="li1" style="margin: 0px;">Policies against unapproved AI tools don't work on their own: 52% of workers say they'll break their company's AI policy if it makes their job easier, and 25% already have.&nbsp;</li>
 <li class="li1" style="margin: 0px;">LastPass closes the SSO coverage gap by surfacing every app your staff logs into through the browser, giving you the AI tool inventory HIPAA auditors and cyber insurers require.&nbsp;</li>
</ul>

Key takeaways

FAQs: HIPAA compliance and the limitations of SSO and MFA when it comes to AI tools

31.4% of vendor logins now happen outside SSO. See how to surface every AI tool your staff uses and meet new HIPAA requirements — in hours. 

Justin Sparks

Director, Governance, Risk and Compliance

How Do You Stay HIPAA Compliant When AI Tools Bypass SSO and MFA?

Looking for a recap of our recent AI Access &amp; Governance webinar, or weren&rsquo;t able to join? This guide brings together the key findings, peer data, and practical guidance from our sessions, drawn from 348 IT leaders, security managers, and executives who participated across three global sessions.
<div class="button-container"><a rel="noopener noreferrer" href="https://info.lastpass.com/od-ai-access-risk-thought-leadership" target="_blank"><button class="lp-button lp-button--primary">Watch webinar on demand</button></a></div>
<h2>The data exposure risks your team needs to understand</h2>
AI tools have changed the security equation. With SaaS, the risk was visibility into which applications employees were using. With AI, the risk has shifted: employees are actively feeding data into systems outside your control. Once that data leaves your environment, it cannot be recalled.
In early 2023, Samsung engineers used ChatGPT for everyday productivity tasks and in the process shared source code, meeting notes, and internal documentation with an external system they didn't control. There was no breach in the traditional sense, no malicious intent, only a deadline and a tool that made the work faster.
<h3>The numbers behind the problem</h3>
<ul>
 <li><a href="https://www.cyberark.com/resources/blog/secure-identities-with-these-five-intelligent-privilege-controls">63%</a><a href="https://www.cyberark.com/resources/blog/secure-identities-with-these-five-intelligent-privilege-controls"> of IT decision-makers</a> say high-sensitivity access in their environment is not adequately secured today.</li>
 <li><a href="https://4d9506f4.isolation.zscaler.com/profile/eaf1666f-e51b-46fd-a487-2fd708708d6a/zia-session/?controls_id=ba1bb6b0-60db-4d24-875c-71f94414daf2&amp;region=was&amp;tenant=364674db8b67&amp;user=e7ed3a4d479496c706487f710d860e431325bf60955f0e8e425669115cb437fa&amp;original_url=https%3A%2F%2Fgo.writer.com%2Fai-adoption-enterprise-2026%3F_gl%3D1*1ngopea*_gcl_au*MTUwODc5MDg5OS4xNzc4MTc1NjM1&amp;key=sh-1&amp;hmac=b9a2a472e5ea844dfc1440d59cbb4dc01c592b4c5705367ae4c13684c67c9e7a">67%</a><a href="https://4d9506f4.isolation.zscaler.com/profile/eaf1666f-e51b-46fd-a487-2fd708708d6a/zia-session/?controls_id=ba1bb6b0-60db-4d24-875c-71f94414daf2&amp;region=was&amp;tenant=364674db8b67&amp;user=e7ed3a4d479496c706487f710d860e431325bf60955f0e8e425669115cb437fa&amp;original_url=https%3A%2F%2Fgo.writer.com%2Fai-adoption-enterprise-2026%3F_gl%3D1*1ngopea*_gcl_au*MTUwODc5MDg5OS4xNzc4MTc1NjM1&amp;key=sh-1&amp;hmac=b9a2a472e5ea844dfc1440d59cbb4dc01c592b4c5705367ae4c13684c67c9e7a"> of executives report</a> their organization has already experienced a data breach caused by an unapproved AI tool.</li>
</ul>
<h3>The path forward: discover, distinguish, direct</h3>
Organizations getting security right start with visibility. You cannot govern what you cannot see, and most organizations don't yet have a complete picture of how employees are using AI, with what credentials, and with what data.
<ul>
 <li>Discover:&nbsp;Understand what AI tools are in use across every form factor, including browsers, extensions, desktop apps, IDE tools, and AI features inside existing SaaS platforms.</li>
 <li>Distinguish:&nbsp;Identify which tools carry enterprise-grade data protections versus consumer or free tiers where those protections don't apply.</li>
 <li>Direct:&nbsp;Guide employees toward sanctioned environments, not by making unsanctioned tools harder to use, but by making the secure path easier.</li>
</ul>
<div style="border-left: 4px solid #003366; background-color: #f5f5f5; padding: 20px; margin: 20px 0;">
The goal is not to block AI. The goal is to ensure that when your employees use it, they're doing so in an environment you can see, govern, and protect. That's the difference between AI as a risk and AI as a competitive advantage.
</div>
<h2>AI Access Governance at LastPass: What we found in our own environment</h2>
Before building any governance policy, we audited our own environment. What we found changed almost every assumption we had going in.
<h3>Finding 1: AI is everywhere, not somewhere</h3>
AI use wasn't concentrated in engineering. It was in HR, finance, sales, marketing, and operations. Individual contributors far from the technical core had found ways to remove the mundane parts of their jobs with AI. A governance policy focused on controlling developer tools would have missed most of the actual usage.
<h3>Finding 2: The personal-vs-corporate split was significant</h3>
Employees were accessing AI tools using personal accounts on corporate devices. This matters because the data protections that come with enterprise agreements don't apply to personal accounts. An employee using Claude with their work email under an enterprise agreement has their prompts protected. An employee using Claude with their personal Gmail on the same device may have that data in scope for model training.
That distinction isn't visible at the network level. You need user-level identity data to see it.
<h3>Finding 3: AI was already on inside tools we thought we controlled</h3>
Several existing SaaS platforms had AI features available; some already enabled by default in recent updates. Databricks, Gainsight, and others had modules that employees could activate, or that vendors had turned on without a formal change of management process. Your existing stack is probably already AI-enabled in ways you haven't fully inventoried.
<h2>What your peers told us: live poll results</h2>
These results come from live polls across three global webinar sessions with 348 respondents, including IT leaders, security managers, operations directors, and executives of every organization size.
<h3>Where is your organization today with AI use?</h3>
136 responses across NA, APAC, and EMEA.
<table style="width: 100%; border-collapse: collapse;">
 <thead>
 <tr style="background-color: #f0f0f0;">
 <th style="border: 1px solid #ccc; padding: 8px;">Response</th>
 <th style="border: 1px solid #ccc; padding: 8px;">Count</th>
 <th style="border: 1px solid #ccc; padding: 8px;">%</th>
 </tr>
 </thead>
 <tbody>
 <tr>
 <td style="border: 1px solid #ccc; padding: 8px;">Light experimentation</td>
 <td style="border: 1px solid #ccc; padding: 8px;">47</td>
 <td style="border: 1px solid #ccc; padding: 8px;">35%</td>
 </tr>
 <tr>
 <td style="border: 1px solid #ccc; padding: 8px;">Used by select teams</td>
 <td style="border: 1px solid #ccc; padding: 8px;">40</td>
 <td style="border: 1px solid #ccc; padding: 8px;">29%</td>
 </tr>
 <tr>
 <td style="border: 1px solid #ccc; padding: 8px;">Broad use, but limited guardrails</td>
 <td style="border: 1px solid #ccc; padding: 8px;">25</td>
 <td style="border: 1px solid #ccc; padding: 8px;">18%</td>
 </tr>
 <tr>
 <td style="border: 1px solid #ccc; padding: 8px;">AI is used with clear policies and controls</td>
 <td style="border: 1px solid #ccc; padding: 8px;">14</td>
 <td style="border: 1px solid #ccc; padding: 8px;">10%</td>
 </tr>
 <tr>
 <td style="border: 1px solid #ccc; padding: 8px;">Not actively using AI</td>
 <td style="border: 1px solid #ccc; padding: 8px;">10</td>
 <td style="border: 1px solid #ccc; padding: 8px;">7%</td>
 </tr>
 </tbody>
</table>
Only 1 in 8 respondents reported using AI with clear policies and controls in place.
<h3>Where do your employees use AI today?</h3>
189 responses across NA, APAC, and EMEA.
LLM websites like ChatGPT and Claude were the most common entry point (39%), but nearly a third of respondents said all of the above, meaning desktop apps, extensions, browser, and development tools simultaneously.
That multi-form-factor reality means a single-channel governance policy will miss most of what your employees are actually using.
<h3>How do you handle AI and SaaS risk today?</h3>
174 responses across NA, APAC, and EMEA.
<table style="width: 100%; border-collapse: collapse;">
 <thead>
 <tr style="background-color: #f0f0f0;">
 <th style="border: 1px solid #ccc; padding: 8px;">Response</th>
 <th style="border: 1px solid #ccc; padding: 8px;">Count</th>
 <th style="border: 1px solid #ccc; padding: 8px;">%</th>
 </tr>
 </thead>
 <tbody>
 <tr>
 <td style="border: 1px solid #ccc; padding: 8px;">We have no AI usage visibility</td>
 <td style="border: 1px solid #ccc; padding: 8px;">67</td>
 <td style="border: 1px solid #ccc; padding: 8px;">39%</td>
 </tr>
 <tr>
 <td style="border: 1px solid #ccc; padding: 8px;">We have AI visibility but no access controls</td>
 <td style="border: 1px solid #ccc; padding: 8px;">41</td>
 <td style="border: 1px solid #ccc; padding: 8px;">24%</td>
 </tr>
 <tr>
 <td style="border: 1px solid #ccc; padding: 8px;">We block access to unapproved AI tools</td>
 <td style="border: 1px solid #ccc; padding: 8px;">22</td>
 <td style="border: 1px solid #ccc; padding: 8px;">13%</td>
 </tr>
 <tr>
 <td style="border: 1px solid #ccc; padding: 8px;">We block unapproved access AND control how approved tools are used</td>
 <td style="border: 1px solid #ccc; padding: 8px;">20</td>
 <td style="border: 1px solid #ccc; padding: 8px;">11%</td>
 </tr>
 <tr>
 <td style="border: 1px solid #ccc; padding: 8px;">I'm not sure</td>
 <td style="border: 1px solid #ccc; padding: 8px;">24</td>
 <td style="border: 1px solid #ccc; padding: 8px;">14%</td>
 </tr>
 </tbody>
</table>
Nearly 40% of respondents have no visibility into AI usage at all. Another 24% have visibility but no controls. That's nearly two-thirds of attendees operating without the ability to act on what their employees are doing with AI tools.
<h2>Questions your peers asked</h2>
These are the three most widely relevant questions from IT leaders, CTOs, and security professionals across our global sessions.
<h3>How do you mitigate exposing proprietary information and code to Claude?</h3>
Buy at the enterprise tier and validate that with your security team before rollout. Enterprise agreements from Anthropic mean your prompts and data are not used to train the model and won't surface in other users' responses.
Beyond that, build controls around data uploads, particularly in tools where employees can upload documents. If an employee is accessing Claude with a personal email on a corporate device, that's a gap. Personal accounts don't carry the same data protections as enterprise ones. Visibility into how employees are logging in matters as much as which plan you're on.
<h3>How does LastPass complement firewall and ZTNA tools?</h3>
Firewall and zero-trust network access tools show you which AI sites employees are accessing. What they don't reveal is who is accessing something and how.
LastPass adds the layer of: which specific user is logging in, and are they using a credential stored in your vault, a personal credential, or something else? That method-of-access detail is critical for understanding your actual risk exposure, and it's the layer that network-level tools consistently miss.
<h3>What LastPass tools are available to existing customers right now?</h3>
If you're on the Business or Teams plan, the capability you're looking for is LastPass Business Max. It includes the ability to discover SaaS and AI site usage across your organization and set access control policies, not just password management.
The fastest path: ask your customer success team to activate a 30-to-60-day trial. Most customers start seeing meaningful usage data within the first week, often the first time they've had visibility into what their employees are actually accessing. If you already have Business Max, log into the Admin Console and look at the SaaS discovery reports.
<h3>What about preventing tampering with training data for businesses that train their own models? Does LastPass offer anything in this regard?</h3>
LastPass addresses the access layer of this problem, ensuring that the people and systems with access to your training data and ML infrastructure are authenticated securely and that credential risk is surfaced and acted on. Training data integrity and model tampering protection require additional tooling at the data and infrastructure layer, which is outside our current scope. We'd recommend pairing LastPass with a data governance and MLOps security solution for comprehensive coverage.
<h3>Without removing local admin from Devs, how can we provide governance for tools like Claude that advise about other tools, plugins, APIs in which we don't have enterprise licenses, so they are not tested, approved? We are trying to avoid Shadow AI.</h3>
SaaS Monitoring gives IT visibility into AI tools your developers are accessing through the browser, including free-tier and unapproved tools, without requiring you to lock down their machines or remove local admin. You can see what's in use, how they're logging in, and what credential risk exists. SaaS Protect then lets you set graduated policies: warn developers accessing unverified AI tools, block high-risk ones, and point them toward approved enterprise alternatives. That said, AI tools accessed via CLI, IDE plugins, or direct API calls outside the browser aren't captured by SaaS Monitoring today, so for a developer-heavy environment you'd want to pair this with endpoint or network-layer visibility for complete coverage.
<h3>'Block use of non-enterprise versions of AI tools.' But SaaS Protect cannot do this yet. Can you add detection of free LLM accounts so we can block access?</h3>
SaaS Protect can currently block access to AI tools by domain entirely, or flag users accessing them with non-enterprise credentials. Distinguishing between free-tier and enterprise accounts for the same tool (same domain, different account type) isn't something SaaS Protect does today. This requires network-layer inspection or header analysis that sits outside the browser extension architecture. This is valuable product feedback and something we want to take back to our product team. If free-tier vs. enterprise account detection is a critical requirement for you, we'd want to have a more detailed conversation about your environment and what complementary tooling might bridge that gap in the near term.
<h3>What impact is the use of passkeys (and recommendations from bodies such as NCSC to use passkeys rather than passwords) have for LastPass's roadmap?</h3>
LastPass already supports passkey storage and management, and passkey support is a core part of our roadmap. The practical reality is that passkey adoption is uneven. Many enterprise systems, legacy applications, and third-party tools won't support passkeys for years, which means most organizations will be managing a hybrid environment of passwords, passkeys, SSO, and MFA for the foreseeable future. LastPass's role in that world is helping manage how your workforce authenticates to everything, regardless of what authentication method an individual app or system supports. Rather than making passwords obsolete, passkey adoption actually increases the complexity that a credential management platform needs to handle. We see this as an expansion of the problem we solve, not a threat to it.
<h2>See what's running in your environment</h2>
Automatically discover every SaaS app across your org with LastPass. 
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/trial/business?max=true" target="_blank"><button class="lp-button lp-button--primary">Try LastPass for free</button></a></div>

Securing AI in the Workplace: Webinar Recap & Insights

Explore real-world AI security risks, peer data, and practical steps to govern AI usage without slowing innovation.

AI Access & Governance: Webinar Recap & Resource Guide 

AI App Inventory & SaaS Discovery for Professional Services

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">AI adoption in&nbsp;Professional&nbsp;Services has nearly doubled in one year,&nbsp;and most of it is happening outside IT oversight&nbsp;</li>
 <li class="li1" style="margin: 0px;">Shadow AI creates client confidentiality exposure under professional ethics rules.&nbsp;</li>
 <li class="li1" style="margin: 0px;">58% of corporate logins&nbsp;occur&nbsp;outside SSO, making&nbsp;SSO-based identity&nbsp;tooling and IdP-centric authentication&nbsp;alone&nbsp;insufficient&nbsp;against identity-based attacks.&nbsp;</li>
 <li class="li1" style="margin: 0px;">A real&nbsp;AI&nbsp;app&nbsp;inventory&nbsp;requires continuous browser-based discovery, not annual&nbsp;audits&nbsp;or employee self-reporting.&nbsp;</li>
 <li class="li1" style="margin: 0px;">LastPass SaaS Monitoring surfaces AI tool usage without agents, integrations, or changes to how your team works.&nbsp;</li>
 <li class="li1" style="margin: 0px;">You can move from zero visibility to a working AI&nbsp;app&nbsp;inventory&nbsp;in&nbsp;days,&nbsp;without disrupting a single client engagement.&nbsp;</li>
</ul>

Key takeaways: AI app inventory and discovery for professional services

Get full visibility into AI tools your team uses. Build an AI app inventory, manage SaaS sprawl, and protect client data—without disrupting delivery.

AI App Inventory for Professional Services: How to Gain Visibility Without Breaking Client Delivery

<h2>A Q&amp;A with Mark Armstrong, IT Consultant, Gold Group</h2>
Accounting firms sit on some of the most sensitive data in business: client financials, tax records, banking credentials, and compliance documentation. That makes them high-value targets, and it makes the consequences of poor access management especially costly. Yet for many firms, the reality is still sticky notes on monitors, passwords reused across platforms, and credentials stored wherever is most convenient rather than most secure.
<a href="https://www.gold-group.com.au/">Gold Group</a> is a Gold Coast-based accounting firm that has been delivering specialized accounting services to clients since 1969. With a team of around 20 staff accessing a broad range of systems daily, keeping credentials organized, secure, and centrally managed is a professional obligation. We spoke with Mark Armstrong, IT Consultant for Gold Group, about the access challenges they faced, the regulatory pressure that made change urgent, and how LastPass helped them achieve something many organizations struggle to reach: 100% adoption.
<a rel="noopener noreferrer" href="https://www.lastpass.com/trial/business?max=true" target="_blank"><button class="lp-button lp-button--primary">Try LastPass for free</button></a>
<h3>Q: Can you tell us about Gold Group and the work your team does?</h3>
A: Gold Group is a Gold Coast-based accounting firm that's been around since 1969. We offer high-level and specialized accounting services and employ around 20 staff. Our team accesses a wide range of systems every day, and managing that access in a secure, organized way is critical to how we operate.
<h3>Q: What security challenges were you facing before finding a solution?</h3>
A: The usual suspects: users setting weak passwords and saving them in their browsers, passwords written on paper or stuck to monitors. It was ad hoc access management at its worst. We knew this wasn't sustainable, but we needed a solution that people would actually adopt and use consistently.
<h3>Q: What made solving this a priority when it did?</h3>
A: Two things converged. We wanted better security and centralized management, which was an ongoing concern. But new laws introduced in Australia also raised the bar on password handling requirements, making a proper password manager a baseline expectation rather than a nice-to-have. Compliance made the conversation easier to have internally, and it gave us the push to formalize something we already knew we needed.
<h3>Q: You evaluated other options &mdash; what ultimately made LastPass the right choice?</h3>
A: We looked at Dashlane and Bitwarden, but LastPass stood out as the well-established player in the space. Good layout, strong pricing, and a feature set that ticked all the boxes: password vault, MFA, admin policies, usage reporting. It reviewed well, and the ease of use was a deciding factor. We knew adoption would be the real test, so we needed something staff could get comfortable with quickly.
<h3>Q: What has the impact been since rolling out LastPass?</h3>
A: Our adoption rate is 100%, which says a lot. We ran an in-house demo for staff, configured everything in advance, and did one-on-one sessions until everyone was comfortable. The investment in onboarding paid off. Since then, we've seen a significant drop in password reset requests, faster onboarding for new staff, and generally better productivity because people aren't searching around for login information. Having everything in a secure, organized, searchable vault is exactly the workflow improvement we were after. We also do update training at regular intervals to keep good habits in place.
<h2>Manage risk the smart way: Start with secure access</h2>
Mark's account reflects a challenge that is common across professional services firms: access management starts informal and stays that way until something &mdash; a compliance requirement, a near-miss, or just the weight of accumulated risk &mdash; forces the issue. For Gold Group, it was the combination of regulatory pressure and a clear-eyed look at the habits that built over time. Passwords on sticky notes aren't a small problem. In an accounting environment, they're a liability.
For firms like Gold Group, password management is where secure access has to start. But as regulatory requirements evolve and the tools employees use multiply, the need for broader visibility and control grows with it. LastPass Secure Access Essentials is built to meet organizations at that starting point and scale with them, delivering the centralized management, strong authentication, and access controls that lean IT teams need without the complexity that makes enterprise solutions out of reach.
Ready to build the same foundation for your team? Discover how LastPass Secure Access Essentials helps organizations of all sizes secure access, simplify credential management, and drive adoption that actually sticks.
<a href="https://blog.lastpass.com/posts/secure-access-essentials">Learn more about Secure Access Essentials</a>.
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/trial/business?max=true" target="_blank"><button class="lp-button lp-button--primary">Try LastPass for free</button></a></div>

How Gold Group achieved 100% adoption with LastPass

Learn how Gold Group replaced insecure password habits with LastPass, achieving 100% adoption, stronger security, and improved productivity across their team.

How an Australian Accounting Firm Replaced Sticky Notes with a Secure Access Foundation

“Well, We Had a Good Run”: Thinking About Cyber Threats in the Age of AI, Part 2: Threats TO AI

This article is the second part of our series examining how to frame the cyber threat environment in relation to artificial intelligence (AI). The previous blog post in this series was about threats FROM AI, while this article examines threats TO AI, specifically why companies’ usage of AI presents a unique threat model for defenders to consider and a desirable target for threat actors. 

“Well, We Had a Good Run”: Thinking About Cyber Threats in the Age of AI, Part 2: Threats TO AI 

One chapter in the saga of infostealer malware has ended&mdash;at least for now&mdash;after a global law enforcement takedown of Lumma Stealer in mid-May. US, European, and Japanese authorities, with the help of tech companies including Microsoft and Cloudflare, took down, suspended, and blocked approximately 2,300 malicious domains that made up part of the infostealer&rsquo;s backbone. The FBI also seized domains that served as login panels allowing other criminals to access and use the infostealer. Although, this seizure is intended to effectively prevent criminals from being able to access Lumma to compromise computers and steal data, the overall stealer threat will remain prevalent for the foreseeable future. 
(Interested in learning more about the infostealer threat outlook? Read the LastPass TIME team&rsquo;s threat predictions and analysis on <a href="https://blog.lastpass.com/posts/2025-cybersecurity-trends">what direction infostealers and other threats are heading</a>.) 
<h2>What is Lumma?</h2>
 
Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022. Since its initial release, Lumma&rsquo;s developers have released multiple upgraded versions of the software. Before the malware-as-a-service (MaaS) platform was dismantled, the FBI linked Lumma to around <a href="https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted">10 million infections</a> globally. Lumma&rsquo;s follow-on attacks involving stealing credentials, cryptocurrency data, and credit card information have resulted in an estimated <a href="https://cyberscoop.com/lumma-infostealer-widespread-victims/">$36.5 million USD</a> in credit card theft in 2023. The malware hit individuals and a wide range of industries, including Fortune 500 companies, airlines, universities, banks, and hospitals. 
What makes this stealer particularly effective is that it continues to evolve to bypass security layers even as defenders are responding to the threat. On top of grabbing browser-stored passwords and cookies, it&rsquo;s also capable of extracting autofill data, email credentials, File Transfer Protocol (FTP) data, and two-factor authentication tokens and backup codes. Using its MaaS platform, its creators sold access to the malware on multiple underground markets and platforms like Telegram. 
<h2>What comes next?</h2>
 
This takedown is a major win for law enforcement and will help disrupt the initial access broker ecosystem in the near term. However, this is an ecosystem that has demonstrated its resilience again and again. The number of existing infostealer families, the open access to numerous source codes of previous infostealers, and the constant demand create a lucrative environment with very low barriers to entry. Given the resiliency of this market, other infostealer will likely quickly step in and fill in the gaps left after the Lumma takedown. 
A similar pattern previously played out with other similar takedowns. On October 28, 2024, Operation Magnus disrupted the RedLine and META infostealers. RedLine was a significant stealer last year up until the takedown, after which Lumma grew in popularity and took over a portion of the market share previously held by RedLine. Redline infected 9.9 million hosts, or 43% of all infostealer infections observed by Flashpoint in 2024. The next four most-prolific infostealers in 2024, including RisePro, SteaC, Lumma Stealer, and Meta Stealer, infected a <a href="https://cyberscoop.com/infostealers-cybercrime-surged-2024-flashpoint/">combined 7 million hosts</a>. 
We expect to see something similar following the Lumma Stealer takedown operation. The disruption effect following takedown is real, but there are still some new infections and logs for sale that were likely stolen before the infrastructure was taken down. Additionally, just because Lumma&rsquo;s infrastructure was dismantled, a lot of the data it stole likely continues to live on the dark web&mdash;thanks to the cybercriminal ecosystem that resells this information. Additionally, <a href="https://blog.checkpoint.com/security/lumma-infostealer-down-but-not-out/">CheckPoint</a> reported Lumma&rsquo;s developers are already trying to rebuild and restart their operations, which may or may not be successful.&nbsp;As SpyCloud&rsquo;s <a href="https://www.linkedin.com/posts/thilligoss_lummatakedown-lummareallynowork-stealc-activity-7332888157480198146-u94p">Trevor Hilligoss shared</a>, daily new Lumma infections have trended downward following the takedown but not as much as expected. Continued monitoring will be necessary to determine the takedown&rsquo;s impact. 
Long-standing groups such as Vidar and Stealc are good examples of this, but other newer families, such as Acreed, will also be well positioned to increase their market share. <a href="https://www.bleepingcomputer.com/news/security/russian-market-emerges-as-a-go-to-shop-for-stolen-credentials/">ReliaQuests</a> already reported Acreed is rapidly gaining traction following the Lumma takedown. <a href="https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/">Over 4,000 logs</a> stolen by Acreed were reportedly uploaded to the Russian Market within its first week of operations.&nbsp;Nexus has also gained some traction over the last week in Lumma&rsquo;s absence. Further, former affiliates and/or administrators associated with Lumma itself may split off to create their own offerings.

<img src="https://static.lputil.com/-/media/ffef2d4ef9d544babc2169a6d0274059.jpg?h=310&amp;w=624" >&nbsp;
Daily new LummaC2 infections (Source: Trevor Hilligoss)
<h2>How to protect yourself against infostealers</h2>
The threat from infostealers will remain very real for the foreseeable future and continue to adapt. Oftentimes, stealers are used in indiscriminate campaigns. Additionally, the sheer volume of data that has been dumped on the internet is immense. That means anyone is fair game and should take action to protect themselves following that assumption that they could be targeted. 
<ul>
 <li>Use strong, unique passwords for every account. This will prevent credential stuffing attacks, which is a common tactic where threat actors insert stolen usernames and passwords. That way, if one password is exposed, it won&rsquo;t give access to all your other accounts where you reuse the same password. Also, consider using a password manager to securely and conveniently store them.</li>
 <li>Enable MFA on your accounts. While this measure isn&rsquo;t failproof on its own, it adds an additional layer of defense and makes you a harder target.</li>
 <li>Be on guard for phishing attempts. Infostealers often spread through phishing emails and malicious downloads. </li>
 <li>Check HaveIBeenPwned to monitor potential exposure if you&rsquo;re worried you may have been infected by an infostealer. </li>
</ul>

What the Lumma stealer takedown means for the infostealer market and your personal data

Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkey vs Password: Which is More Secure? | LastPass

FAQs: Passkey vs password

Explore the differences between passkeys and passwords. Learn how LastPass enhances security and simplifies access with advanced authentication methods.

Blog

Blog

Recent

News & Insights

Cybersecurity

Product Tutorials

Threat Intel

Product Updates

Tips And Tricks

Introducing Secure Access Essentials: Beyond Passwords to the New Reality of Work

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkeys Vs. Passwords: Which Login Method Is Safer in 2026?

Allow, Warn, Block: A Practical AI Governance Model for Lean Teams

Identity-first security for Financial Services: Your best defense against AI credential sprawl

Subscribe & Save 20% off Premium or Families plans

6 Shadow IT Solutions for Companies in 2026

The New LastPass Community is Live: Faster Answers, Better Resources, More Connection

6 Best KeePass Alternatives for Businesses: 2026 Comparison Guide

Model Context Protocol (MCP) Risk: How to Govern Credentials AI Agents Rely On

How Do You Stay HIPAA Compliant When AI Tools Bypass SSO and MFA?

AI Access & Governance: Webinar Recap & Resource Guide

AI App Inventory for Professional Services: How to Gain Visibility Without Breaking Client Delivery

How an Australian Accounting Firm Replaced Sticky Notes with a Secure Access Foundation

“Well, We Had a Good Run”: Thinking About Cyber Threats in the Age of AI, Part 2: Threats TO AI