Beyond that, it would have been avoided if LastPass implemented strict policies about accessing corporate systems using a personal computer. You can't control a

Beyond that, it would have been avoided if LastPass implemented strict policies about accessing corporate systems using a personal computer. You can't control a 100% what happens on a corporate system, but allowing a personal device, which introduces a larger attack surface with all these softwares present, to access that kind of sensitive data with all the potential is highly irresponsible. Sure, Plex had a security flaw, and the system owner didn't update its software in a timely manner, but ultimately the responsibility falls upon LastPass who allowed this system to access their network in the first place. For a business that focuses and sells a product based upon good security practices, the optics are quite damaging for their reputation.