Security is basically layering imperfect solutions on top of each other until the statistical probability of breaching ALL of them gets small enough to satisfy

Security is basically layering imperfect solutions on top of each other until the statistical probability of breaching ALL of them gets small enough to satisfy the requirements of the organization. In the case of LastPass, they're holding data (which they shouldn't have been to be fair) that's INCREDIBLY attractive to everyone from script kiddies to nation state actors. When it comes to keeping out nation states the threat model can get kind of wild and difficult to engineer for while building what's ultimately a consumer facing product. However, in this particular case it's fairly obvious that bad IT policies lead to an issue and LastPass got burned. I would be more forging of LastPass but letting employees do BYOD means you have to trust everyone that ever uses that computer including spouses and children. It's just really dumb.