Firstly, I am a fan of Password Managers.

However, calling them Password Managers is softening the risk of what people actual store in them. Maybe a better mouthful-of-a-name would be Personal Secret Storage or Cloud Based Personal Secret Storage. Password storage is a popular use case, but so is storing keys of all types, notes, etc.

If your company doesn’t prevent usage of a non-mandated password manager, then the LastPass breach is a much bigger deal; even bigger than shops that use LastPass Enterprise. Unless it was fully blocked, there is a very non zero chance your employees past and present used Lastpass. And likely you do not have any insight into what they stored or how strong their vault password is or was.

How do you triage that? Rotate every secret in the company? Some companies take years to rotate even the simplest service account password as they have long lost track of who created it or what it’s used for; and are too operationally risk adverse to scream test. More than likely, companies will choose to ignore it.

These are not at all new issues, but they aren’t the kinds of things that win accolades or innovative awards for solving. Where is the cavalry?