- "What used to take weeks to craft can now be auto generated in a matter of seconds." ~ Guillermo Triana, CEO, PEO-Marketplace.com.
- "The danger is rolling out AI without having protections built around it." ~ Rafay Baloch, CEO, REDSECLABS
- "The attack surface isn’t just your laptop but also the tokens and permissions you're handing your agents. A single over-scoped key can do more damage than a phishing email." ~ Hayat Amin, fractional CFO with 20 years in high-tech growth & 3 FT100 listings
- "API keys and service account passwords stored in workflow configs are an underappreciated vulnerability." ~ Roland Jakob, founder of Praxica.io.
- "Most small business owners don't need the most expensive enterprise tools. What they need is a password manager, MFA enabled everywhere, and regular backups. These three things stop 90% of the attacks we see." ~ Peter Nguyen, founder of Protect My Data.
- "The companies that will be most successful are the ones that treat access management as part of the rollout from day one." ~ Cache Merrill, founder of Zibtek.
- LastPass surfaces your SaaS & AI usage without requiring a manual audit or more staff. Once you see what's in use, you can vault credentials, enforce MFA, and apply the same access controls you already have for approved tools. Discovery is where governance starts.
AI app security is the practice of governing the credentials, access permissions, and data flows connected to AI tools your employees use. The risk isn’t the AI itself, but the unmanaged access layer underneath: weak passwords, risky logins, and sensitive data moving through apps your access control policy doesn’t yet cover.
Once in a while, attackers get a rare gift: World events that function as distractions. The 2026 FIFA World Cup has fans everywhere glued to screens. Meanwhile, news coverage draws attention to the wars in Ukraine and the Middle East, Anthropic’s new Fable 5 & Claude Mythos 5 models, and the Remus infostealer’s evolution to a full-blown malware-as-a-service platform.
Not to mention the UNC6508 threat group using the INFINITERED malware for persistent remote access and credential theft.
None of the above is under my or your control. But distraction is a threat vector.
Attackers have always timed campaigns to world events, i.e. high noise equals lower vigilance and more clicks on phishing links.
This playbook brings together security experts and business leaders on the access gaps that leave an AI-augmented workforce exposed and what to do about them.
What has actually changed about the threat landscape in 2026?
The cost of launching a sophisticated attack has collapsed.
Attacks that used to require skill and a sizable investment can now be deployed with just a subscription.
And with the use of AI to generate and deploy exploits to infiltrate networks and steal data, the window you have to catch something before it lands has gotten shorter.
I recently spoke to fractional CFO, Matt Twiford, whose passwords were weak or recycled before he started using LastPass in and around 2017.
Matt Twiford is the founder of Pegacorn Group, a fractional CFO firm working with venture-backed Series A and B startups. Here’s what he’s seen across his client portfolio:
“My clients use generic accounting email addresses to receive invoices, which makes them constant targets.
I once received the exact same phishing email simultaneously for two completely different clients.
The fact that the same email arrived for both at the same minute told me the attackers were using marketing automation tools to send phishing campaigns at scale.
The most dangerous attacks now involve real conversation hijacking, not just spoofed emails
“I recently watched an attack play out at one of our clients where a hacker had been monitoring an email thread between a small vendor and the client's COO.
Four people were in the original conversation, discussing billing. At some point the attacker started a new email thread, asking for invoices to be sent to them directly.
Shortly after, I received an email from the vendor that looked nearly identical to their normal communication except the URL had the last letter of their domain dropped. Subtle enough that you wouldn't catch it unless you were looking.
The attacker requested payment by wire transfer, which is the preferred method for these attacks because wires are almost irreversible once sent.”
What saved us was habit, of all things
“When we processed the invoice, we just issued a paper check rather than setting up a new electronic payment relationship.
We do send wires and ACH payments regularly, but this felt like a one-off invoice, and we didn't want to take the extra steps to onboard a new vendor for electronic payment.
The fraud only came to light six months later when there was a dispute, and I had emailed the vendor several times without a response. Later I had a call with the actual vendor and we discovered this.
The lesson I took from this: Most security advice tells you to verify banking information over the phone before sending money to a new vendor.
That advice would have surely failed in this specific case because the attackers were sophisticated enough to provide their own phone confirmation if asked. The actual safeguard was that we didn't move to electronic payment for an unknown vendor on the first invoice.”
Friction in financial processes can be a feature, not a bug
“What I tell my clients now:
A few things have become non-negotiable in how I advise growing companies:
- Password managers like LastPass must be a default for the whole company.
- MFA is enforced everywhere it's available. No exceptions, no "I'll set it up later."
- Vendor onboarding for electronic payments should have a deliberate verification step that goes beyond "they sent us their banking details by email."
- Every employee who has access to financial systems gets ongoing training on social engineering.
- Incident response plans should exist in writing before they're needed. Most companies don't have one. They figure it out during the actual incident, which makes the damage worse.”
To hear more from Matt Twiford and the Pegacorp group, head to https://www.pegacorngroup.com/insights
The attack surface Twiford describes is expanding due to increasing SaaS use.
Based on current research, the global SaaS market is projected to grow from $375 billion to $1,482 billion by 2034 (that’s almost $1.5 trillion).
And SaaS growth is being driven heavily by AI: More than 80% of companies will be deploying AI apps by the end of 2026.
The problem with AI apps is, employees are adopting them outside of corporate policy.
If you aren’t sure what AI-enabled SaaS apps are living in your system right now, you have a visibility problem, and you aren’t alone in this.
In short: Most risk comes from access, not models. Visibility is the first step to control.
LastPass surfaces your SaaS & AI usage without requiring a manual audit or more staff. Once you see what's in use, you can vault credentials, enforce MFA, and apply the same access controls you already have for approved tools. Discovery is where governance starts.
Is employee AI use making AI app security harder?
The answer is yes. According to the 2025 Verizon DBIR, among employees accessing GenAI on corporate devices, 72% routinely used their personal emails, and 17% used corporate emails without integrated authentication.
This means most SaaS and AI logins inside businesses aren’t tied to corporate identity systems.
I spoke to Rafay Baloch, CEO and founder of REDSECLABS, about this.
Rafay is a world-class cybersecurity expert and white-hat hacker with a proven track record of identifying zero-day vulnerabilities in web apps, products, and browsers.
He’s presented his research at Black Hat, Hack in Paris, and HEXCON, and he’s also been featured by media outlets like Forbes, WSJ, and BBC. Here’s what he has to say about ensuring employee AI use is safe and secure.
Rafay’s firm REDSECLABS is a London-based CREST consultancy that specializes in penetration testing, red team assessments, and compliance. You can connect with Rafay Baloch on LinkedIn.
“I have spent the last few years doing my best to break into systems that companies swore were unbreachable. The danger isn’t the AI itself but rolling it out without having protections built around it.
The advice that I have for businesses this year is based on one principle: Trust absolutely nothing by default.
I have seen more breaches in my career because attackers used existing, forgotten accounts rather than an exploit.
Before introducing any AI tools, your teams need to ask important questions about data provenance, storage, privacy and the possibility of your proprietary data being used to develop or advance a publicly accessible model you don’t have any governance over.
Humans are the priority here; no tool supersedes this.
AI tools can offer detection capability early, but they can’t guarantee optimal performance when implemented without baseline protections, such as strong passwords, multifactor authentication, and up-to-date software."
Baloch’s advice is spot on and bears considering.
According to a joint report by IBM and Ponemon (2025), the average cost of a data breach involving shadow AI or shadow SaaS is $4.63 million.
That’s $670,000 more than for a normal breach.
- Despite this, 87% of organizations say they have no governance policies to handle AI risk.
- Nearly two-thirds of breached organizations didn’t perform regular audits on AI use.
- And over three-quarters didn’t perform adversarial testing on their AI models.
What should an AI-augmented workforce security checklist actually include?
The short answer: It should cover the tools your employees are actually using, not what your policy assumes they're using.
I spoke to Hayat Amin, founder of Beyond Elevation about this, and here’s what he had to say.
Hayat Amin is a fractional CFO with 20 years across high-growth tech, with three high-profile exits (including to American Express and TripAdvisor) and three FT100 listings. You can connect with him at meethayat.com
“As businesses hand more work to AI agents, those agents are quietly gaining access to the most sensitive data in the company: bank logins, payroll, customer records, contracts.
The attack surface isn’t just your laptops, but also the tokens and permissions you’re handing your agents.
A single over scoped key can do more damage than a phishing email.
My one piece of advice for small businesses is to treat every AI agent like a new employee.
Give it the least access it needs, write down what it can reach, and review that list often.
A couple of things keep our AI playbook current:
- Let the system write the list, not a person. You want to track the scope of your API keys and their permissions. Point one agent at those settings and have it print the whole thing back in plain English every Monday.
- Hand out keys with an expiry date, never permanent ones. Every key an agent gets dies in 30 days. If it still needs the access, it asks again."
Next, I spoke to Roland Jakob, founder of Praxica.io, an AI workflow and automation platform for B2B teams, to identify where the actual risk lives in agentic deployments and what an AI security playbook should include.
Roland Jakob is the founder of Praxica.io, a platform he designed and built himself. He has 15 years of experience building AI agents, automation systems, web apps, and custom platforms for B2B clients. You can connect with him on LinkedIn.
“The greatest fear isn’t sophisticated nation-state attacks. Rather, it’s automation.
Things like large-scale credential stuffing attacks; business email compromise attacks utilizing AI-created look-a-like messages; trust abuses in supply chains where one compromised supplier becomes a conduit to multiple downstream clients.
From my experience building and implementing agentic AI systems, the three (3) main areas many SMBs miss are:
- The scope of permissions. To allow an AI to perform a task, teams will generally give the AI full access quickly, then never go back and review those permissions.
All agents should have the minimum number of permissions necessary to complete their tasks, and those permissions should be regularly reviewed.
- Audit logging in multi-step agentic workflows. If the initial tool in the workflow is compromised, all subsequent tools in that chain are also exposed. The checklist item here is audit logging at each step in a workflow. You need to understand what the agent did, in what order, and where the data was sent.
- Human escalation paths: Most SMBs don’t define an escalation path when an agentic process encounters something outside its expected input. Without one, the agent may either fail silently or continue processing without notification. Every agentic deployment needs a human-in-the-loop protocol for handling edge cases.
On credential management: The most common exposure in agentic AI deployments isn’t the agent itself, but the credentials the agent uses to authenticate.
API keys and service account passwords stored in workflow configs are a frequent and underappreciated vulnerability.
A credential management layer that handles SaaS logins and keeps credentials vaulted and reviewed directly addresses that surface."
Every item on Roland and Hayat’s checklists share one thing in common: You must know where your credentials are being used before you can govern them.
That sounds obvious until you try to do it manually for 200 people with 50 or more SaaS tools and a growing list of AI apps.
If you can’t automate updates to your checklist, containing your risks becomes that much more difficult. Here's a quick rundown of how it would work if you had to do it manually.
AI App Security Checklist (2026)
- Discover all AI and SaaS apps employees are using
- Enforce MFA across every tool (even outside your IdP)
- Vault and rotate all credentials (human + machine)
- Restrict permissions to least privilege
- Monitor and audit access continuously
In practice, a credential management system and continuous SaaS discovery are what’s going to help you make Roland and Hayat’s advice executable. And that’s what we’ll talk about next.
How does a credential management system and SaaS discovery fit into an AI security posture?
Both a credential management system and SaaS discovery are the foundation of a positive AI security posture.
To secure an AI-augmented workforce, you need two things:
- Continuous SaaS discovery (visibility)
- A credential management system (control)
Secure access providers like LastPass combine both by tracking SaaS logins and enforcing credential policies in one place.
This means you can:
- Identify Shadow AI and high-risk logins
- Apply consistent access controls across both approved and shadow tools
Instead of relying on manual audits or assumptions, you get a continuously updated view of your access layer and the ability to act on it. *
*The controls above focus on the access layer: credentials & logins tied to SaaS and AI tools.
They don’t replace specialized systems that govern what AI agents are allowed to do once authenticated (for example, fine-grained authorization frameworks like Permit.io).
In practice, these layers work together:
- Credential management + SaaS discovery for human access
- Authorization frameworks for agents
Most SMBs should start with visibility and credential control first. Without that foundation, more advanced authorization layers won’t have the context they need to be effective.
Read our blog on this: Your Small Business Guide to Agentic AI Identity & Access Management (2026) *
Next, I talked with Kriszta Grenyo (COO of Suff Digital and a LastPass customer) and Cache Merrill (founder of Zibtek) about access controls, and each shared their practical playbook for an AI augmented workforce.
Kriszta Grenyo is the Chief Operating Officer (COO) at Suff Digital, a performance-driven digital marketing agency that helps businesses grow through custom web design, development, optimization, and marketing. You can connect with Kriszta on LinkedIn.
“I think one common misconception many clients have is that they think they’re too small to be targeted, when in fact it’s the opposite.
Which is why being a customer of LastPass has been so critical for us when sharing credentials within our team. It helps give that extra layer of defense.
One of the biggest benefits of LastPass SaaS Monitoring + Protect is the extra security it provides by flagging passwords that are weak, reused, or even compromised.
It gives us an extra set of eyes that are so crucial to the security of a larger company.
From an operational standpoint, SaaS Monitoring + Protect allows us to centralize access without having to rely purely on memory. For an agency managing multiple client accounts, this level of security and attention to detail is invaluable.
If you ask me, what’s most effective for AI security are three things:
- Treat AI like a new employee. Move from "Can the AI do this?" to "Should the AI be allowed to do this?" There should be members on the team that track its every move and the access it's given.
- Inventory every tool it uses. Having an honest conversation on how your employees are already using AI, can help set parameters on how you deploy agentic AI and what tools you give it access to.
- Create Approval Tiers. Not every AI action is going to be a security breach. Having a meeting that goes over the difference between low-risk actions like scheduling or task creation, versus high-risk actions like financial transactions and legal approvals, can help give your employees clarity...”
And below, Cache Merrill, founder of Zibtek, a software development firm, names what separates the companies handling this well from the ones that aren’t.
Cache Merrill is the founder of Zibtek,a leading software development company in Utah. You can connect with Cache on LinkedIn.
“What concerns a lot of SMB leaders is the growing difficulty of knowing what deserves attention.
There are more alerts, more vendors, more risks being discussed, and more pressure to make the right decision with limited time and resources.
One thing we're paying close attention to at Zibtek is this: Once an agent has access to email, internal systems, customer records, or business apps, the question becomes less about what it knows and more about what it's allowed to do.
A gap I see is that many SMBs are excited about connecting agents to multiple tools but haven't fully thought through permissions and access controls.
In practice, agentic AI can amplify the impact of a compromised account or an overly permissive workflow just as quickly as it can improve productivity.
That's where solutions like LastPass make a difference.
As businesses connect more systems to AI agents, having stronger visibility into credentials, authentication, and SaaS access becomes increasingly important.
In my view, the companies that will be most successful with agentic AI are the ones that treat access management and security as part of the rollout from day one, not something they address after deployment.”
What are security experts and business leaders saying is the #1 AI access mistake in 2026?
The pattern across every expert interviewed for this playbook is the same: The #1 AI access mistake in 2026 is deploying tools before you can see them.
Guillermo Triana, CEO of PEO-Marketplace.com, works with businesses across dozens of software platforms and integrations. His observation is blunt.
Guillermo Triana is the Founder & CEO for PEO-Marketplace.com, an online marketplace that helps employers find the right PEO provider for outsourcing HR, group health insurance, and workers compensation. You can connect with Guillermo on LinkedIn.
“A business may have 75 employees but operate on 20+ different software platforms, dozens of integrations and hundreds of user permissions. It comes down to visibility.
Yes, AI will scan for abnormal login locations, flag permission anomalies, and alert on suspicious behavior far quicker than any human can process.
However, cybersecurity isn’t solved by technology but by attention to detail. Most breaches aren’t caused by human error. Employees are busy. Owners are busy.
Sometimes they click on a malicious link because they’re being rushed or too much trust is given to a colleague. The future of cybersecurity will be a balanced combination of smart automation and careful human analysis."
Peter Nguyen, founder of Protect My Data, works daily with SMBs on foundational security and is direct about where organizations stand.
Peter Nguyen is the founder of Protect My Data, a digital privacy and data removal service.
Where do you think SMBs struggle most?
“Most businesses think cybersecurity is just an IT problem. They stick some antivirus on their computers and feel safe.
In the meantime, employees are clicking on bad emails, using weak passwords, and nobody’s actually teaching them what to watch for.”
In your opinion, what should small business owners invest in for cybersecurity?
“Most small business owners overthink this. The truth is, they don't need the most expensive enterprise tools. What they need is a password manager, MFA enabled everywhere, and regular backups.
I tell clients to start there because these three things stop 90% of the attacks we see. Too many owners want to buy expensive firewalls when their employees are still using "123456" as a password.”
In your experience with clients, what do you think are tools that provide the best value proposition right now?
“Password management.
And then a backup solution like Backblaze or IDrive.
These cost less than $50/month and have saved countless small businesses when ransomware hit.
Where people overspend is on endpoint protection and security software that claims to do everything. Most of that is bloatware. I recommend Malwarebytes for the occasional cleanup, and that's it.
The biggest bang for your buck is actually training your staff."
How do you know if your current security setup is ready for an AI-augmented workforce?
If you can answer yes to all four of these, your security posture is in reasonable shape. The one that fails most often for SMBs is #1, and it’s the gap that makes the others harder to close.
- Are credentials for AI tools unique, not reused from other accounts?
- Do you know which AI apps your employees are logging into right now?
- Do those apps fall under your access control policy?
- Is MFA enforced, including for tools outside your core identity provider (IdP)?
Nick Santora, founder of aijobs.com and a LastPass user, whose prior company Curricula, a cybersecurity awareness training platform, was acquired by Huntress in 2022, describes where this is heading:
"As agents scale and become part of the workforce, we’ll have an entire new ecosystem built around securing those agents. Security controls will be designed to focus on the agent's goal, what it was designed to complete, where it goes to complete work...”
Ultimately, the companies building that foundation now with credential visibility, governed access policies, and SaaS security won’t be scrambling when the above becomes reality.
See which AI apps your team is logging into, identify ungoverned access, and build an access control policy that holds up under audit. Get started free or request a demo now.
Sources
IBM and Ponemon: 2025 Cost of a data breach report (The AI oversight gap)
Bleeping Computer: Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution
Google. Beyond the Battlefield: Threats to the Defense Industrial Base
