<p>You might have seen <a href="https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024">this shocking prediction from Gartner</a>: <em>by 2027, 75% of employees will acquire, modify or create technology outside IT's visibility &ndash; up
from 41% in 2022.</em></p>
<p>Last year, LastPass launched the beginning of our evolution beyond password management to a secure access solution. Now, we've sharpened our focus to deliver
what lean teams truly need to operate securely.</p>
<p>We know that these teams only want the essentials when it comes to protecting their teams and their business. While other security tools present expensive,
cumbersome solutions built for orgs with dedicated security teams and large budgets, LastPass Secure Access Essentials is built for you.</p>
<p>It's <em>the</em> solution for resource-strapped IT organizations and businesses who don't have the budget, time, or technical resources to deploy those complex
tools.</p>
<div class="button-container"><a href="https://www.lastpass.com/solutions/secure-access"><button class="lp-button lp-button--primary">Try for free</button></a></div>
<h2>The Modern Access Challenge</h2>
<p>Your employees rely on more SaaS tools than ever, and not all of them are on your radar.<br />
From cloud apps and browser extensions to AI tools, today's workplaces move fast. And when anyone can implement a new app with little more than a credit card and
a dream, you can be sure that very few of them are thinking about secure access or credential management. Consider this:</p>
<ul>
    <li><strong>Risk is rising</strong>: <a href="https://cloudsecurityalliance.org/artifacts/state-of-saas-security-report-2025">CSA reports</a> 55% of organizations say employees adopt SaaS tools without Security's involvement, and 56% report sensitive data being
    uploaded to unauthorized apps &mdash; blind spots that lead to real security incidents.</li>
    <li><strong>Productivity is slipping</strong>: <a href="https://deepstrike.io/blog/password-statistics-2025?utm_source=chatgpt.com">Up to 50%</a> of IT help desk tickets are for password resets, and employees spend roughly 11 hours per year dealing with access
    issues instead of doing their jobs.</li>
    <li><strong>Costs are compounding</strong>: The average company now uses <a href="https://deepstrike.io/blog/password-statistics-2025">~106 SaaS applications</a>, each adding overhead &mdash; and every password reset can cost around $70 in support
    time.</li>
</ul>
<p>Single sign-on (SSO) can help with your core apps &mdash; the ones that you know about &mdash; but it doesn't cover everything, especially those smaller, hidden apps. And
for small and mid-sized businesses, controlling those can get expensive and time-consuming, fast.</p>
<p>That's where the security gaps start. Without a simple, customizable way to manage access, secure credentials, and monitor app usage, it's easy to lose
control. And that opens the door to risk from old accounts that still have access to sensitive info, to apps no one remembers signing up for.</p>
<p>It's no longer enough to secure passwords alone. Businesses need an approach to secure access management that's as flexible, efficient, and user-friendly as
the tools their employees actually use.</p>
<h2>What is Secure Access Essentials?</h2>
<p>Secure Access Essentials is the LastPass answer to the growing access management crisis, delivering core capabilities that work together to secure your
organization. These capabilities scale across the LastPass product, so you can start where you are and expand as your security needs grow.</p>
<p>With Secure Access Essentials, you can:</p>
<ul>
    <li><strong>Discover SaaS and AI tools</strong>: Gain visibility into which apps and AI tools your team is using, including unseen or unapproved apps. Spot risks early and
    maintain control across your SaaS landscape.</li>
    <li><strong>Control Access for Everyone</strong>: Ensure the right people have access to the right apps, systems, and data based on your policies. Easy to configure and adjust
    as your business evolves.</li>
    <li><strong>Simplify Secure Access</strong>: Securely manage how your team stores and uses passwords, with support for passkeys for faster and safer authentication.</li>
</ul>
<h2>Why does Secure Access Essentials matter?</h2>
<p>Enterprise solutions require dedicated IT teams, months of deployment, and ongoing maintenance that lean teams simply can't sustain. The cost and complexity
put security out of reach when you need it most.</p>
<p>And the stakes are high. <a href="https://deepstrike.io/blog/data-breach-statistics-2025">The average cost of a data breach</a> is $4.4 million, which can devastate small businesses. Unapproved tools lead to wasted spend and
duplicate or unused applications, while compliance violations can result in fines that put a serious dent in already constrained budgets.</p>
<p>LastPass brings together the essentials that cut complexity, strengthen protection, and make secure access effortless. Our capabilities are:</p>
<ul>
    <li><strong>Easy to manage, easier on your budget</strong>: Manage all access from a single place and skip the cost and chaos of multiple systems.</li>
    <li><strong>Designed for stronger protection with fewer roadblocks</strong>: Get strong, straightforward security that keeps your business safe and makes compliance
    easier.</li>
    <li><strong>Simple for your team + build stronger habits</strong>: When security fits naturally into the day, people actually follow it &mdash; reducing risk and boosting
    productivity.</li>
</ul>
<h2>Building on a Strong Foundation</h2>
<p>Password management is the foundation of LastPass, and it remains essential to secure access. But as security challenges mount, those challenges demand more.
That's why we've evolved beyond credentials to deliver the visibility and control modern businesses need.</p>
<p>Now organizations can also use LastPass to uncover risky SaaS and AI tools and enforce safe‑usage policies with SaaS Monitoring and SaaS Protect. And this is
just the beginning.</p>
<p>As secure access challenges expand, so will we, delivering the essentials you need to protect your business at every stage of your journey. Thanks for coming
along with us so far, and we're excited to build the future together.</p>
<p><a href="https://www.lastpass.com/solutions/secure-access"><button class="lp-button lp-button--primary">Try for free</button></a></p>

Beyond Password Management: Secure Access Essentials from LastPass

LastPass Secure Access Essentials gives resource-strapped IT teams the tools to discover SaaS apps, control access, and simplify security without the complexity.

Introducing Secure Access Essentials: Beyond Passwords to the New Reality of Work

Get LastPass Free

Create and store secure passwords for yourself, your team or business.

Why LastPass?

Remember fewer passwords and log in faster with our browser extension.

How LastPass works

LastPass zero-knowledge security model keeps your data private even from us.

Security Architecture

Compare LastPass competitors, plans, and features in one place

Compare LastPass

Overview

Password management

Save and autofill

Password generator

Password sharing

Passkeys

Dark web monitoring

Security dashboard

Key Features

Free LastPass Premium trial, no credit card required.

Free LastPass Business trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Sync passwords across all devices, monitor password health, data breaches and much more.

Personal

Premium password management for family or group of 6 people.

Families

Personal Plans

Password vault

Save & autofill

Mobile Smart Scanner

Automatic device sync

Emergency access

Personal password sharing

FOR INDIVIDUALS

30-day free LastPass Premium trial, no credit card required.

30-day free LastPass Families trial, no credit card required.

Limited to 1 device type and basic password management features.

Designed for businesses of all sizes, from small startups to enterprises.

Business

Simplify secure access straight from the browser with more admin control.

Business Max

For single teams just getting started with password management.

Teams

Designed to keep your clients' credentials protected and private.

Business Plans

User management

SaaS Monitoring

SaaS Protect

Secure Access Essentials

Business sharing

Multifactor Authentication

Integrations

Single Sign-on

Identity management

For admins

Marketing teams

Legal teams

HR teams

Business leaders

IT admins

Solutions by role

Case studies

Webinars

Product demos

Events

Trust Center

Compliance Center

Security architecture

LastPass University

Resource Center

Pricing

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Cloud marketplaces

Technology Alliance Partners

LastPass Partner Program

Grow new revenue streams by meeting customer's security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

System status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Submit sales inquiry

Chat with sales

Request a demo

Find a partner

Contact sales

Log in

AI App Inventory & SaaS Discovery for Professional Services

<ul class="ul1" style="color: #000000;">
    <li class="li1" style="margin: 0px;">AI adoption in&nbsp;Professional&nbsp;Services has nearly doubled in one year,&nbsp;and most of it is happening outside IT oversight&nbsp;</li>
    <li class="li1" style="margin: 0px;">Shadow AI creates client confidentiality exposure under professional ethics rules.&nbsp;</li>
    <li class="li1" style="margin: 0px;">58% of corporate logins&nbsp;occur&nbsp;outside SSO, making&nbsp;SSO-based identity&nbsp;tooling and IdP-centric authentication&nbsp;alone&nbsp;insufficient&nbsp;against identity-based attacks.&nbsp;</li>
    <li class="li1" style="margin: 0px;">A real&nbsp;AI&nbsp;app&nbsp;inventory&nbsp;requires continuous browser-based discovery, not annual&nbsp;audits&nbsp;or employee self-reporting.&nbsp;</li>
    <li class="li1" style="margin: 0px;">LastPass SaaS Monitoring surfaces AI tool usage without agents, integrations, or changes to how your team works.&nbsp;</li>
    <li class="li1" style="margin: 0px;">You can move from zero visibility to a working AI&nbsp;app&nbsp;inventory&nbsp;in&nbsp;days,&nbsp;without disrupting a single client engagement.&nbsp;</li>
</ul>

Key takeaways: AI app inventory and discovery for professional services

Get full visibility into AI tools your team uses. Build an AI app inventory, manage SaaS sprawl, and protect client data—without disrupting delivery.

AI App Inventory for Professional Services: How to Gain Visibility Without Breaking Client Delivery

<h2>A Q&amp;A with Mark Armstrong, IT Consultant, Gold Group</h2>
<p>Accounting firms sit on some of the most sensitive data in business: client financials, tax records, banking credentials, and compliance documentation. That makes them high-value targets, and it makes the consequences of poor access management especially costly. Yet for many firms, the reality is still sticky notes on monitors, passwords reused across platforms, and credentials stored wherever is most convenient rather than most secure.</p>
<p><a href="https://www.gold-group.com.au/">Gold Group</a> is a Gold Coast-based accounting firm that has been delivering specialized accounting services to clients since 1969. With a team of around 20 staff accessing a broad range of systems daily, keeping credentials organized, secure, and centrally managed is a professional obligation. We spoke with Mark Armstrong, IT Consultant for Gold Group, about the access challenges they faced, the regulatory pressure that made change urgent, and how LastPass helped them achieve something many organizations struggle to reach: 100% adoption.</p>
<p><a rel="noopener noreferrer" href="https://www.lastpass.com/trial/business?max=true" target="_blank"><button class="lp-button lp-button--primary">Try LastPass for free</button></a></p>
<h3>Q: Can you tell us about Gold Group and the work your team does?</h3>
<p><em>A: Gold Group is a Gold Coast-based accounting firm that's been around since 1969. We offer high-level and specialized accounting services and employ around 20 staff. Our team accesses a wide range of systems every day, and managing that access in a secure, organized way is critical to how we operate.</em></p>
<h3>Q: What security challenges were you facing before finding a solution?</h3>
<p><em>A: The usual suspects: users setting weak passwords and saving them in their browsers, passwords written on paper or stuck to monitors. It was ad hoc access management at its worst. We knew this wasn't sustainable, but we needed a solution that people would actually adopt and use consistently.</em></p>
<h3>Q: What made solving this a priority when it did?</h3>
<p><em>A: Two things converged. We wanted better security and centralized management, which was an ongoing concern. But new laws introduced in Australia also raised the bar on password handling requirements, making a proper password manager a baseline expectation rather than a nice-to-have. Compliance made the conversation easier to have internally, and it gave us the push to formalize something we already knew we needed.</em></p>
<h3>Q: You evaluated other options &mdash; what ultimately made LastPass the right choice?</h3>
<p><em>A: We looked at Dashlane and Bitwarden, but LastPass stood out as the well-established player in the space. Good layout, strong pricing, and a feature set that ticked all the boxes: password vault, MFA, admin policies, usage reporting. It reviewed well, and the ease of use was a deciding factor. We knew adoption would be the real test, so we needed something staff could get comfortable with quickly.</em></p>
<h3>Q: What has the impact been since rolling out LastPass?</h3>
<p><em>A: Our adoption rate is 100%, which says a lot. We ran an in-house demo for staff, configured everything in advance, and did one-on-one sessions until everyone was comfortable. The investment in onboarding paid off. Since then, we've seen a significant drop in password reset requests, faster onboarding for new staff, and generally better productivity because people aren't searching around for login information. Having everything in a secure, organized, searchable vault is exactly the workflow improvement we were after. We also do update training at regular intervals to keep good habits in place.</em></p>
<h2>Manage risk the smart way: Start with secure access</h2>
<p>Mark's account reflects a challenge that is common across professional services firms: access management starts informal and stays that way until something &mdash; a compliance requirement, a near-miss, or just the weight of accumulated risk &mdash; forces the issue. For Gold Group, it was the combination of regulatory pressure and a clear-eyed look at the habits that built over time. Passwords on sticky notes aren't a small problem. In an accounting environment, they're a liability.</p>
<p>For firms like Gold Group, password management is where secure access has to start. But as regulatory requirements evolve and the tools employees use multiply, the need for broader visibility and control grows with it. LastPass Secure Access Essentials is built to meet organizations at that starting point and scale with them, delivering the centralized management, strong authentication, and access controls that lean IT teams need without the complexity that makes enterprise solutions out of reach.</p>
<p>Ready to build the same foundation for your team? Discover how LastPass Secure Access Essentials helps organizations of all sizes secure access, simplify credential management, and drive adoption that actually sticks.</p>
<p><a href="https://blog.lastpass.com/posts/secure-access-essentials">Learn more about Secure Access Essentials</a>.</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/trial/business?max=true" target="_blank"><button class="lp-button lp-button--primary">Try LastPass for free</button></a></div>

How Gold Group achieved 100% adoption with LastPass

Learn how Gold Group replaced insecure password habits with LastPass, achieving 100% adoption, stronger security, and improved productivity across their team.

How an Australian Accounting Firm Replaced Sticky Notes with a Secure Access Foundation

“Well, We Had a Good Run”: Thinking About Cyber Threats in the Age of AI, Part 2: Threats TO AI

This article is the second part of our series examining how to frame the cyber threat environment in relation to artificial intelligence (AI). The previous blog post in this series was about threats FROM AI, while this article examines threats TO AI, specifically why companies’ usage of AI presents a unique threat model for defenders to consider and a desirable target for threat actors. 

“Well, We Had a Good Run”: Thinking About Cyber Threats in the Age of AI, Part 2: Threats TO AI 

<p>Secure access starts with a simple truth: You can't protect what you can't access securely.</p>
<p>And for most people, the first step of getting passwords into a secure vault is where momentum breaks down.</p>
<p>Before Zero Trust, autofill, or Dark Web Monitoring can keep you safe, there's one foundational step everything depends on: capturing and securing every login.</p>
<p>Getting this first step right sets the stage for secure access.</p>
<p>That's why <a href="https://blog.lastpass.com/posts/secure-access-essentials">Secure Access Essentials</a> begins with something simple: removing friction from how you enter passwords into your vault.</p>
<p>As a first in the password management space, we're introducing Mobile Smart Scanner to remove that friction.</p>
<h2>The one change that makes every login in your life easier</h2>
<p>In 2026, the work-life boundary has shifted.</p>
<p>Work follows you everywhere.</p>
<p>You're switching between devices and logging into dozens of accounts daily.</p>
<p>At the same time, your passwords are stored in too many places. And you're reusing them across sites because it's easier.</p>
<p>Unfortunately, that also makes account takeovers far more likely.</p>
<p>As the threats rise, secure access is no longer optional &mdash; it's essential. That means simplifying the way your passwords move from paper to secure vault isn't just about convenience.</p>
<p>When you can quickly get your credentials organized, security feels intuitive and less like a chore. This one simple shift keeps you safer.</p>
<p>Innovation in security matters. Instead of asking you to change how you live, we focused on making security work the way you live, so it stops being something you avoid and starts being something that just works for you.</p>
<h2>Introducing LastPass Mobile Smart Scanner: Password management that works the way you do</h2>
<p>Mobile Smart Scanner is an intelligent password scanner that's available only in LastPass.</p>
<p>Built directly into the LastPass mobile app, Smart Scanner lets you use your phone's camera to scan typed or handwritten passwords and turn them into ready-to-use password vault entries.</p>
<p style="text-align: center;">
<img src="https://www.lastpass.com/-/media/6f2c7e5075444f1cbded0bd55aacac0f.png?h=560&amp;w=500" >&nbsp;
</p>
<p>Just open your LastPass mobile app, scan the credential, review the detected site, username, and password, and save it to your vault.</p>
<p>The credentials you just saved become a fully functional, ready-to-use item you can autofill like all your other credentials.&nbsp;</p>
<p>No more delays, errors, or missed accounts.</p>
<p>Your autofill, strong passwords, and account protection start working right away, just like they should.</p>
<p>And since we know secure access requires trust, Smart Scanner works entirely on your device, so your scans stay private. Credentials and images aren't stored or sent to LastPass, and you stay fully in control at every step. The result is a seamless experience that prioritizes ease and trust.</p>
<p>Whether you're new to LastPass or finally bringing every password into one place, Mobile Smart Scanner helps you spend less time setting up and more time enjoying secure access to your digital life.</p>
<p>And here's the good news: Mobile Smart Scanner is currently available in consumer plans (Free, Premium, and Families), so you can try it while we keep refining the experience.</p>
<p>General availability for both consumer and business is expected later this year.</p>
<p>Mobile Smart Scanner is one more step in how LastPass is simplifying security without compromise.</p>
<p>So, go ahead. Scan. Save. Secure. Mobile Smart Scanner removes one of the last barriers to getting every credential into your secure vault, so protection starts immediately.</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://blog.lastpass.com/posts/secure-access-essentials" target="_blank"><button class="lp-button lp-button--primary">Learn more about Secure Access Essentials</button></a></div>

LastPass Mobile Smart Scanner: Secure Access Made Simple

Capturing passwords just got easier. LastPass Mobile Smart Scanner lets you scan credentials with your phone's camera and save them directly to your vault.

Removing the First Barrier to Secure Access: LastPass Mobile Smart Scanner

Identity-first security in the Mythos era

<ul class="ul1" style="color: #000000;">
    <li class="li1" style="margin: 0px;"><strong>If your identity tool only sees apps behind your SSO,&nbsp;it's&nbsp;missing your fastest-growing attack surface.&nbsp;</strong>The free&nbsp;SaaS and AI&nbsp;tools&nbsp;your employees&nbsp;are&nbsp;signing&nbsp;up&nbsp;for with&nbsp;corporate or&nbsp;personal emails&nbsp;are invisible&nbsp;to SSO&nbsp;and increasingly where breaches start.&nbsp;</li>
    <li class="li1" style="margin: 0px;"><strong>For lean IT teams, deployment complexity is a security risk in itself.</strong>&nbsp;An identity security tool that requires dedicated engineers to&nbsp;deploy&nbsp;and&nbsp;maintain&nbsp;means&nbsp;SaaS visibility never gets turned on.&nbsp;&nbsp;</li>
    <li class="li1" style="margin: 0px;"><strong>Your organization has days to close the gaps an AI exploit might reach.</strong>&nbsp;The right tool is the one your team&nbsp;can&nbsp;easily&nbsp;deploy&nbsp;and run&nbsp;this week, not next quarter.&nbsp;</li>
    <li class="li1" style="margin: 0px;"><strong>Shadow&nbsp;SaaS&nbsp;and&nbsp;AI visibility&nbsp;is&nbsp;now a critical part&nbsp;of identity security.</strong>&nbsp;The&nbsp;April 2026&nbsp;Vercel&nbsp;breach&nbsp;traced back&nbsp;to&nbsp;a third-party AI tool that IT&nbsp;didn't&nbsp;know existed.&nbsp;Shadow SaaS and AI are being actively exploited&nbsp;right&nbsp;now.&nbsp;</li>
    <li class="li1" style="margin: 0px;"><strong>Identity security&nbsp;without&nbsp;SaaS visibility&nbsp;leaves half the attack chain open.&nbsp;</strong>Both controls are needed to limit blast radius after an exploit succeeds.&nbsp;</li>
    <li class="li1" style="margin: 0px;"><strong>Speed matters when the attack surface is growing daily</strong>.&nbsp;LastPass SaaS Monitoring delivers immediate SaaS visibility, and SaaS Protect turns it into enforceable controls.&nbsp;</li>
</ul>

Key takeaways: Identity security in the Mythos era

FAQS: Mythos and enterprise credential security

The Mythos leak shrank the patch window to hours. See how identity-first security limits blast radius for IT teams of 50–500.

Mike Kosak

Senior Principal Intelligence Analyst

When AI Finds Every Vulnerability: Why Identity-First Security Matters in the Mythos Era (2026)

Browser‑Based Credential Attacks in 2026: What Identity Security Misses

<ul class="ul1" style="color: #000000;">
    <li class="li1" style="margin: 0px;">In 2026, the&nbsp;corporate browser is&nbsp;the new battlefield, and the prime target is workforce identities.&nbsp;</li>
    <li class="li1" style="margin: 0px;">Over 90% of incidents originate from credential reuse or incomplete identity controls.&nbsp;</li>
    <li class="li1" style="margin: 0px;">Basic&nbsp;MFA&nbsp;is no&nbsp;longer enough. Modern phishing techniques such as&nbsp;BitB&nbsp;(browser-in-the-browser),&nbsp;AiTM&nbsp;(adversary-in-the-middle),&nbsp;and&nbsp;ClickFix&nbsp;capture credentials&nbsp;and&nbsp;tokens&nbsp;inside browser sessions.&nbsp;</li>
    <li class="li1" style="margin: 0px;">Small&nbsp;and&nbsp;midmarket&nbsp;firms&nbsp;are at&nbsp;the highest&nbsp;risk&nbsp;because they often lack dedicated security&nbsp;expertise.&nbsp;So, just one&nbsp;compromised credential can lead to&nbsp;severe&nbsp;operational, financial, and reputational impact.&nbsp;</li>
    <li class="li1" style="margin: 0px;">Effective identity security now requires control at the credential layer. </li>
    <li class="li1" style="margin: 0px;">LastPass provides&nbsp;identity security&nbsp;aligned to this&nbsp;browser-first&nbsp;reality.&nbsp;&nbsp;</li>
</ul>

Key takeaways: browser based credential attacks

FAQs: Browser based credential attacks

Browser-based attacks like ClickFix and BitB now dominate initial access. See why MFA fails and what modern identity security must do in 2026.

Browser Based Credential Attacks: How Modern Identity Security Stops the Newest Variants (2026)

AI-Powered Infostealers: How Credential Theft Works in 2026

<ul class="ul1" style="color: #000000;">
    <li class="li1" style="margin: 0px;"><strong>Credential theft is&nbsp;an immediate&nbsp;business risk.</strong>&nbsp;AI‑powered&nbsp;infostealers can move from&nbsp;initial&nbsp;compromise to full credential exfiltration in as little as 72 minutes.&nbsp;</li>
    <li class="li1" style="margin: 0px;"><strong>These attacks bypass perimeter defenses by abusing trusted identities.</strong>&nbsp;Stolen credentials blend into normal activity, making breaches difficult to detect until damage is already done.&nbsp;</li>
    <li class="li1" style="margin: 0px;"><strong>The credential risk surface has expanded&nbsp;to SaaS.</strong>&nbsp;In the browser, attackers now target SaaS and AI credentials used in everyday workflows.&nbsp;</li>
    <li class="li1" style="margin: 0px;"><strong>One&nbsp;compromised account can&nbsp;lead to organization-wide exposure.</strong>&nbsp;Modern attackers routinely target endpoints and SaaS,&nbsp;leveraging&nbsp;one compromised credential to compromise an entire system.&nbsp;</li>
    <li class="li1" style="margin: 0px;"><strong>Endpoint security alone is&nbsp;not&nbsp;sufficient.</strong>&nbsp;Once credentials are stolen, prevention must happen at the identity and access layer, not after attackers authenticate as legitimate users.&nbsp;</li>
    <li class="li1" style="margin: 0px;"><strong>LastPass reduces exposure where these attacks succeed.</strong>&nbsp;By centralizing credentials, enforcing FIDO2 MFA,&nbsp;monitoring for&nbsp;compromised credentials, and&nbsp;identifying&nbsp;Shadow SaaS&nbsp;and AI usage,&nbsp;LastPass&nbsp;limits blast radius and reduces breach impact.&nbsp;</li>
</ul>

Key takeaways: AI-powered infostealers

FAQs: AI powered infostealers

AI-powered infostealers compress credential theft to 72 minutes. Learn how they work, why they're harder to detect, and how LastPass protects your business from this emerging threat.

How AI-powered Infostealers are Rewriting the Playbook on Credential Theft (2026)

Best 1Password Alternatives for Small to Midsize Businesses

Compare the top 5 1Password alternatives for small to midsize businesses. Find the best secure access tool with credential management, SaaS visibility, and admin controls. Start your free trial today.

The 5 Best 1Password Alternatives for Small to Midsize Businesses: 2026 Comparison Guide

AI Access Security for SOC 2: 2026 Audit Checklist & Controls Guide

<ul class="ul1" style="color: #000000;">
    <li class="li1" style="margin: 0px;">AI-enabled tools are increasingly&nbsp;built into browsers.&nbsp;Auditors want&nbsp;to&nbsp;see&nbsp;how access&nbsp;initiated through&nbsp;them is&nbsp;authorized, reviewed, and documented.</li>
    <li class="li1" style="margin: 0px;">SOC 2 findings related to AI-enabled tools&nbsp;frequently stem from visibility gaps,&nbsp;as&nbsp;AI&nbsp;access often&nbsp;falls&nbsp;outside the scope of legacy IAM&nbsp;coverage.</li>
    <li class="li1" style="margin: 0px;">Shadow&nbsp;AI&nbsp;can&nbsp;expand&nbsp;audit scope when it introduces access to in-scope systems.</li>
    <li class="li1" style="margin: 0px;">AI-enabled tools often have&nbsp;long-lived permissions that auditors&nbsp;may&nbsp;flag as operational&nbsp;risks.</li>
    <li class="li1" style="margin: 0px;">Logging AI activity is insufficient without attribution and tamper-resistant&nbsp;evidence, especially for SOC 2 Type 2 audits.</li>
    <li class="li1" style="margin: 0px;">To help secure AI access,&nbsp;leverage&nbsp;a solution like LastPass, which closes the Shadow AI visibility gap auditors evaluate&nbsp;under CC6.1 and CC9.1.</li>
</ul>

Key takeaways: Ensuring AI access security for your next SOC 2 audit

FAQs: SOC 2 and AI access security

Learn how to ensure AI access security for SOC 2 compliance. Discover Shadow AI risks, implement audit-ready controls, and prepare for your next SOC 2 Type 2 audit with LastPass.

How to Ensure AI Access Security for Your Next SOC 2 Audit

<p>Here's a number worth sitting with: by 2027, <a href="https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024">Gartner predicts</a> 75% of employees will acquire, modify, or create technology outside IT's visibility. For distributed teams, that number is probably already a reality. When your workforce is spread across locations, working from different environments, and leaning on a growing stack of virtual tools to stay connected, access management is beyond complicated.</p>
<h2><em>A Q&amp;A with Phillip Walters, Principal, Urban3</em></h2>
<p><a href="https://www.urbanthree.com/">Urban3</a> is a nationally distributed analysis firm that helps clients across the country make sense of complex data. Their team operates virtually, coordinating across locations with a lean structure that demands flexibility, trust, and reliable access to shared resources. We spoke with Phillip Walters, Principal at Urban3, about the access challenges that came with building a remote-first culture, and how LastPass helped them build a more secure foundation without adding overhead their team couldn't sustain.</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/trial/business?max=true" target="_blank"><button class="lp-button lp-button--primary">Try LastPass for free</button></a></div>
<h3>Q: Can you tell us about Urban3 and how your team operates?</h3>
<p><em>A: We're a geographically distributed team that provides analysis for clients all over the nation, which means we spend a lot of time in virtual meetings and rely heavily on shared digital tools. Coordination is everything for us. When your team is spread across different locations, the systems you use to stay connected and keep things running smoothly are critical.</em></p>
<h3>Q: What challenges were you running into before finding a solution?</h3>
<p><em>A: Manual sharing of credentials is slow and cumbersome. When you have multiple principals and logistical staff who need access to the same accounts, the old-fashioned approach just doesn't scale. We wanted ease of sharing and resiliency &mdash; a system that wouldn't break down if someone was unavailable, whether it was a sick day or something more serious.</em></p>
<h3>Q: What made solving this a priority when it did?</h3>
<p><em>A: Our first fully remote employee was the turning point. After that, the COVID era accelerated everything. Suddenly the need was impossible to ignore. When your entire team is working from different places, you need infrastructure that makes that possible without creating security gaps.</em></p>
<h3>Q: What made LastPass the right fit for Urban3?</h3>
<p><em>A: Honestly, it started with word of mouth &mdash; one team member had a positive personal experience, and that moved LastPass to the front of the line. What sealed it was the concept of a secure, controllable digital nerve center. We needed something that could give us functionality and confidence in our newly distributed reality. LastPass delivered that.</em></p>
<h3>Q: What has the impact been since adopting LastPass?</h3>
<p><em>A: The password vault has become our go-to tool. The most immediate impact? Meetings actually start on time. One of our logisticians can pull credentials from LastPass in minutes, which means a meeting starts three minutes late instead of being rescheduled altogether. It sounds small, but for a team of high-value thinkers, that kind of efficiency adds up. It's comparative advantage in action &mdash; our principals stay focused on high-level work while our logistical staff have everything they need to keep things running.</em></p>
<h2>A secure foundation to solve access challenges</h2>
<p>The challenges Phillip describes are ones that distributed teams everywhere will recognize. When your workforce is remote and your tools are virtual, access management becomes the connective tissue that holds everything together &mdash; and when it's handled informally &mdash; the exposure is real. Unapproved AI tools and SaaS apps, shared credentials over email, accounts tied to individuals who may not be available: these aren't edge cases. They're the norm for lean, fast-moving organizations.</p>
<p>Password management is where the Urban3 story starts &mdash; and it remains a critical foundation of secure access for any organization. But as teams grow, tools multiply, and remote work becomes permanent, the need for visibility and control across the entire access landscape grows with it. LastPass is built to meet teams where they are today and scale with them as those challenges expand.</p>
<p>Ready to give your distributed team the same foundation? Discover how LastPass Secure Access Essentials helps lean teams secure access, manage credentials, and stay productive &mdash; without the overhead.&nbsp;</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/solutions/secure-access" target="_blank"><button class="lp-button lp-button--primary">Learn more about Secure Access Essentials</button></a></div>

How Urban3's distributed team secures remote access with LastPass

Read Urban3's case study on providing secure access with LastPass, and see the impact on team efficiency.

Customer Q&A: How a Distributed Analysis Firm Secured Access for a Remote-First Team

Shadow AI & SaaS Security Risks: Close the Gaps in 2026

<ul class="ul1" style="color: #000000;">
    <li class="li1" style="margin: 0px;">Shadow AI widens security gaps by creating unmanaged access paths, with credentials, integrations, and agent connections that persist without clear ownership or centralized control.&nbsp;</li>
    <li class="li1" style="margin: 0px;">Shadow AI increases risk faster than traditional Shadow IT because it embeds access directly into everyday workflows, where credentials are created and reused outside IT visibility.&nbsp;</li>
    <li class="li1" style="margin: 0px;">Most Shadow AI risk&nbsp;doesn&rsquo;t&nbsp;come from new exploits but from identity misuse: weak authentication, missing MFA, reused credentials, and overlooked access points.&nbsp;</li>
    <li class="li1" style="margin: 0px;">Policies and periodic audits&nbsp;can&rsquo;t&nbsp;keep up with Shadow AI; effective SaaS risk management in 2026 requires continuous discovery paired with&nbsp;real‑time&nbsp;access visibility. </li>
    <li class="li1" style="margin: 0px;">LastPass&nbsp;Business Max&nbsp;surfaces Shadow AI and SaaS usage at the point of login, helping lean IT teams&nbsp;identify&nbsp;and reduce unmanaged access before it becomes an incident.&nbsp;</li>
</ul>

Key takeaways: Shadow IT revealed your gaps. Shadow AI widens them unless you do this in 2026 

FAQs: Shadow IT revealed your gaps. Shadow AI widens them unless you do this in 2026 

Shadow AI widens the gaps Shadow IT left behind. Learn how continuous SaaS discovery and access control help lean IT teams manage Shadow AI risk in 2026.     

Inside the shadows: The new SaaS security risks of Shadow AI in 2026 

<p>One chapter in the saga of infostealer malware has ended&mdash;at least for now&mdash;after a global law enforcement takedown of Lumma Stealer in mid-May. US, European, and Japanese authorities, with the help of tech companies including Microsoft and Cloudflare, took down, suspended, and blocked approximately 2,300 malicious domains that made up part of the infostealer&rsquo;s backbone. The FBI also seized domains that served as login panels allowing other criminals to access and use the infostealer. Although, this seizure is intended to effectively prevent criminals from being able to access Lumma to compromise computers and steal data, the overall stealer threat will remain prevalent for the foreseeable future. </p>
<p><em>(Interested in learning more about the infostealer threat outlook? Read the LastPass TIME team&rsquo;s threat predictions and analysis on </em><a href="https://blog.lastpass.com/posts/2025-cybersecurity-trends"><em>what direction infostealers and other threats are heading</em></a><em>.) </em></p>
<h2>What is Lumma?</h2>
<p><strong><em> </em></strong></p>
<p>Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022. Since its initial release, Lumma&rsquo;s developers have released multiple upgraded versions of the software. Before the malware-as-a-service (MaaS) platform was dismantled, the FBI linked Lumma to around <a href="https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted">10 million infections</a> globally. Lumma&rsquo;s follow-on attacks involving stealing credentials, cryptocurrency data, and credit card information have resulted in an estimated <a href="https://cyberscoop.com/lumma-infostealer-widespread-victims/">$36.5 million USD</a> in credit card theft in 2023. The malware hit individuals and a wide range of industries, including Fortune 500 companies, airlines, universities, banks, and hospitals. </p>
<p>What makes this stealer particularly effective is that it continues to evolve to bypass security layers even as defenders are responding to the threat. On top of grabbing browser-stored passwords and cookies, it&rsquo;s also capable of extracting autofill data, email credentials, File Transfer Protocol (FTP) data, and two-factor authentication tokens and backup codes. Using its MaaS platform, its creators sold access to the malware on multiple underground markets and platforms like Telegram. </p>
<h2>What comes next?</h2>
<p><strong><em> </em></strong></p>
<p>This takedown is a major win for law enforcement and will help disrupt the initial access broker ecosystem in the near term. However, this is an ecosystem that has demonstrated its resilience again and again. The number of existing infostealer families, the open access to numerous source codes of previous infostealers, and the constant demand create a lucrative environment with very low barriers to entry. Given the resiliency of this market, other infostealer will likely quickly step in and fill in the gaps left after the Lumma takedown. </p>
<p>A similar pattern previously played out with other similar takedowns. On October 28, 2024, Operation Magnus disrupted the RedLine and META infostealers. RedLine was a significant stealer last year up until the takedown, after which Lumma grew in popularity and took over a portion of the market share previously held by RedLine. Redline infected 9.9 million hosts, or 43% of all infostealer infections observed by Flashpoint in 2024. The next four most-prolific infostealers in 2024, including RisePro, SteaC, Lumma Stealer, and Meta Stealer, infected a <a href="https://cyberscoop.com/infostealers-cybercrime-surged-2024-flashpoint/">combined 7 million hosts</a>. </p>
<p>We expect to see something similar following the Lumma Stealer takedown operation. The disruption effect following takedown is real, but there are still some new infections and logs for sale that were likely stolen before the infrastructure was taken down. Additionally, just because Lumma&rsquo;s infrastructure was dismantled, a lot of the data it stole likely continues to live on the dark web&mdash;thanks to the cybercriminal ecosystem that resells this information. <span>Additionally, <a href="https://blog.checkpoint.com/security/lumma-infostealer-down-but-not-out/">CheckPoint</a> reported Lumma&rsquo;s developers are already trying to rebuild and restart their operations, which may or may not be successful.&nbsp;</span>As SpyCloud&rsquo;s <a href="https://www.linkedin.com/posts/thilligoss_lummatakedown-lummareallynowork-stealc-activity-7332888157480198146-u94p">Trevor Hilligoss shared</a>, daily new Lumma infections have trended downward following the takedown but not as much as expected. Continued monitoring will be necessary to determine the takedown&rsquo;s impact. </p>
<p>Long-standing groups such as Vidar and Stealc are good examples of this, but other newer families, such as Acreed, will also be well positioned to increase their market share. <span><a href="https://www.bleepingcomputer.com/news/security/russian-market-emerges-as-a-go-to-shop-for-stolen-credentials/">ReliaQuests</a> already reported Acreed is rapidly gaining traction following the Lumma takedown. <a href="https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/">Over 4,000 logs</a> stolen by Acreed were reportedly uploaded to the Russian Market within its first week of operations.&nbsp;</span>Nexus has also gained some traction over the last week in Lumma&rsquo;s absence. Further, former affiliates and/or administrators associated with Lumma itself may split off to create their own offerings.</p>
<p style="text-align: center;">
<img src="https://cdn.lputil.com/-/media/ffef2d4ef9d544babc2169a6d0274059.jpg?h=310&amp;w=624" >&nbsp;</p>
<p style="text-align: center;"><em>Daily new LummaC2 infections (Source: Trevor Hilligoss)</em></p>
<h2>How to protect yourself against infostealers</h2>
<p>The threat from infostealers will remain very real for the foreseeable future and continue to adapt. Oftentimes, stealers are used in indiscriminate campaigns. Additionally, the sheer volume of data that has been dumped on the internet is immense. That means anyone is fair game and should take action to protect themselves following that assumption that they could be targeted. </p>
<ul>
    <li><strong>Use strong, unique passwords for every account.</strong> This will prevent credential stuffing attacks, which is a common tactic where threat actors insert stolen usernames and passwords. That way, if one password is exposed, it won&rsquo;t give access to all your other accounts where you reuse the same password. Also, consider using a password manager to securely and conveniently store them.</li>
    <li><strong>Enable MFA on your accounts.</strong> While this measure isn&rsquo;t failproof on its own, it adds an additional layer of defense and makes you a harder target.</li>
    <li><strong>Be on guard for phishing attempts.</strong> Infostealers often spread through phishing emails and malicious downloads. </li>
    <li><strong>Check HaveIBeenPwned to monitor potential exposure </strong>if you&rsquo;re worried you may have been infected by an infostealer. </li>
</ul>

What the Lumma stealer takedown means for the infostealer market and your personal data

Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkey vs Password: Which is More Secure? | LastPass

FAQs: Passkey vs password

Explore the differences between passkeys and passwords. Learn how LastPass enhances security and simplifies access with advanced authentication methods.

Blog

Blog

Recent

News & Insights

Cybersecurity

Product Tutorials

Threat Intel

Product Updates

Tips And Tricks

Introducing Secure Access Essentials: Beyond Passwords to the New Reality of Work

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkeys Vs. Passwords: Which Login Method Is Safer in 2026?

AI App Inventory for Professional Services: How to Gain Visibility Without Breaking Client Delivery

How an Australian Accounting Firm Replaced Sticky Notes with a Secure Access Foundation

Subscribe & Save 20% off Premium or Families plans

“Well, We Had a Good Run”: Thinking About Cyber Threats in the Age of AI, Part 2: Threats TO AI

Removing the First Barrier to Secure Access: LastPass Mobile Smart Scanner

When AI Finds Every Vulnerability: Why Identity-First Security Matters in the Mythos Era (2026)

Browser Based Credential Attacks: How Modern Identity Security Stops the Newest Variants (2026)

How AI-powered Infostealers are Rewriting the Playbook on Credential Theft (2026)

The 5 Best 1Password Alternatives for Small to Midsize Businesses: 2026 Comparison Guide

How to Ensure AI Access Security for Your Next SOC 2 Audit

Customer Q&A: How a Distributed Analysis Firm Secured Access for a Remote-First Team

Inside the shadows: The new SaaS security risks of Shadow AI in 2026