The pace of technological change is accelerating crime. For example, cybercrime has undergone a fundamental transformation over the past two decades, evolving from isolated hackers operating in basements to sophisticated criminal enterprises that mirror legitimate business models 1, 2. What was once the domain of technically skilled individuals driven by prestige and ideology has become a $1.5 trillion in cybercriminal revenue/earnings that operates with the professionalism and structure of Fortune 500 companies 3, 2. In this article, we will examine how cybercrime has evolved into a modern business model that is profitable and built to attack you, your family, and business.

The first phase of cybercrime, roughly spanning from 1990 to 2006, was characterized by hackers motivated primarily by personal prestige and technical challenge rather than financial gain 4. These early cybercriminals operated as lone wolves, requiring extensive technical knowledge and specialized skills to execute attacks 4. The underground economy was fragmented, with limited collaboration between different criminal actors5.

The dotcom boom fundamentally shifted the cybercrime paradigm by demonstrating the immense financial potential of internet-based activities 4. Criminals began to recognize that the same digital infrastructure powering legitimate e-commerce could be exploited for illicit profit 4. This realization marked the beginning of cybercrime’s transformation into a business-driven enterprise 4.

Crime-as-a-Service (CaaS) represents a business model where cybercriminals provide various hacking and cybercrime services to other individuals or groups, typically for financial gain 6. This model essentially commodifies and commercializes cybercriminal activities, allowing even those with little technical expertise to engage in sophisticated cyberattacks 6. The CaaS framework mirrors legitimate Software-as-a-Service (SaaS) business models, transforming hacking into a subscription service available to individuals, groups, and even nation-states 1.

The emergence of CaaS has fundamentally democratized cybercrime by lowering the barriers to entry 7, 5. Previously, successful cyberattacks required exceptional technical abilities that were limited to a small group of highly skilled individuals 5. Today, budding cybercriminals need only a rudimentary understanding of cybersecurity, internet access, and a few dollars in cryptocurrency to initiate sophisticated attacks 6, 7.

This democratization is exemplified by cases like the infamous Lapsus$ hacking group, where several members were renegade teenagers who managed to breach tech giants like Microsoft and Nvidia, with the group’s former leader being a 16-year-old living at his mother’s home in the English countryside1.

The CaaS ecosystem employs various pricing models that mirror legitimate business practices 8, 9. The most common revenue structures include:

Monthly Subscriptions: Many cybercrime services operate on recurring monthly fees, similar to legitimate SaaS platforms 8. These subscriptions often range from tens to thousands of dollars, depending on the sophistication of the service 10.

Commission-Based Models: In ransomware-as-a-service operations, developers typically receive a 20-30% cut while affiliates retain 70-80% of ransom payments 9. This revenue-sharing model incentivizes both development and deployment of criminal tools 9.

One-Time Purchases: Some services offer single-payment options for specific tools or access credentials 8. For example, corporate login credentials can sell for several thousand dollars 11.

Hybrid Models: Many providers combine subscription fees with performance-based commissions, maximizing revenue from multiple streams 8, 9.

The cybercrime marketplace has demonstrated remarkable price evolution as competition has intensified 4. The Zeus malware, which originally cost $8,000, saw its price drop to around $500 due to competition from SpyEye 4. By 2011, when the Zeus source code was leaked, it effectively became free, demonstrating how market forces operate even in illegal sectors 4.

The cybercrime economy has reached staggering proportions, with research estimating total annual revenues at $1.5 trillion 3. This massive figure breaks down across various criminal activities:

Cybersecurity Ventures projects that the total economic damage to victims will reach $10.5 trillion annually by 2025, representing a 15% annual growth rate 12. If cybercrime were measured as a country, it would rank as the world’s third-largest economy, behind only the United States and China 13, 12.

The CaaS ecosystem now encompasses nearly every aspect of cybercrime 14, 15. Beyond traditional malware and phishing kits, the marketplace now offers:

Modern cybercrime organizations have adopted sophisticated business structures that mirror legitimate enterprises 14, 15. These criminal enterprises now feature:

Hierarchical Management: Clear organizational charts with specialized roles including developers, distributors, and end-users 17. Developers create malicious software, distributors act as intermediaries assembling attack teams, and end-users execute attacks with minimal knowledge of the larger operation 17.

Human Resources Functions: Cybercrime marketplaces now feature dedicated help-wanted pages and recruiting staff 14, 15. Criminal job seekers post summaries of their skills and qualifications, while employers advertise positions with competitive salaries, performance bonuses, and even paid time off 10.

Research and Development: Criminal organizations invest heavily in innovation, constantly developing new attack methods and improving existing tools to evade detection 5, 11.

The professionalization of cybercrime extends to customer service and user experience 11. Criminal service providers now offer:

Ransomware-as-a-Service (RaaS) represents perhaps the most sophisticated evolution of the CaaS model 8. RaaS providers lease out compiled ransomware, source code, and complete infrastructure packages to affiliates 8. These services include:

Prominent RaaS groups like Conti, REvil (Sodinokibi), DarkSide, and LockBit have established themselves as major players in the criminal marketplace 8. LockBit 3.0, for instance, operates as a full-service RaaS platform where affiliates share a percentage of profits with operators as commission 18.

These organizations have demonstrated remarkable resilience and adaptability 18. When law enforcement disrupts one operation, others quickly emerge to fill the market gap, suggesting a mature and self-sustaining ecosystem 11.

The CaaS economy operates primarily through dark web marketplaces that provide anonymity and security for both buyers and sellers 19. These platforms have evolved sophisticated features including:

Payment Systems: Bitcoin and Monero are the primary cryptocurrencies used, with many marketplaces implementing mixing services for additional anonymity 19.

Escrow Services: Sophisticated escrow mechanisms protect both buyers and sellers, with funds held until services are delivered satisfactorily 19.

Multi-signature Security: Advanced marketplaces use multi-signature wallets requiring authorization from two of three parties (buyer, seller, marketplace) to complete transactions 19.

Auto-finalize Features: Automatic fund release mechanisms ensure vendors receive payment even if buyers don’t confirm receipt 19.

Criminal marketplaces have developed comprehensive trust and reputation systems that parallel legitimate e-commerce platforms 10. Vendors with proven track records of delivering working malware and maintaining operational security can command premium prices 10. Some ransomware groups have built such strong reputations for reliability that they leverage their “brand recognition” to charge higher fees 10.

The CaaS ecosystem continues to evolve rapidly, driven by the same market forces that shape legitimate business 11. As cybersecurity defenses improve, criminal services adapt by offering more sophisticated tools and techniques 14, 15. The commoditization of nearly every component of cybercrime has created opportunities for attackers of any skill level to participate in this underground economy 14, 15.

The massive financial incentives driving the CaaS ecosystem show no signs of diminishing3. With annual revenues exceeding $1.5 trillion and growth rates of 15% per year, the criminal economy has established itself as a self-sustaining and continuously expanding sector 1, 2 3.

The transformation of cybercrime from individual hacking activities to a subscription-based service economy represents one of the most significant developments in modern criminal enterprise 1 7. By adopting legitimate business models, implementing professional operational structures, and creating user-friendly service offerings, cybercriminals have successfully democratized access to sophisticated attack capabilities 6, 14.

This evolution has fundamentally altered the threat landscape, making advanced cyberattacks accessible to anyone with modest financial resources and basic internet access 7 16. The CaaS model’s success demonstrates how criminal organizations can adapt and thrive by mimicking the very business innovations they seek to exploit 4, 11.

As the cybercrime economy continues to mature and expand, reaching projected revenues of $10.5 trillion by 2025, it presents an unprecedented challenge to cybersecurity professionals and law enforcement agencies worldwide 12. The subscription-based nature of modern cybercrime has created a resilient, scalable, and increasingly sophisticated threat that mirrors the digital transformation occurring in legitimate business sectors 1, 15.

Despite facing significant cybersecurity threats, many family offices continue to operate with inadequate defenses, creating a dangerous disconnect between risk exposure and preparedness. Understanding the underlying causes of this vulnerability reveals systemic challenges that go beyond simple oversight.

The cybersecurity preparedness gap among family offices is striking. While 43% of family offices globally have experienced a cyberattack over the last 12-24 months, nearly one-third (31%) lack a comprehensive cybersecurity strategy, leaving them woefully unprepared 1 6. In North America, the situation is even more concerning, with 57% of family offices reporting cyber incidents during recent periods 9. Despite these alarming statistics, only 31% of family offices say their cyber risk management processes are well-developed 1.

Many family offices fundamentally underestimate their attractiveness as targets and the sophistication of modern cyber threats 19. A significant factor contributing to this vulnerability is the belief that “privacy equals security” – the misguided notion that operating “under the radar” provides adequate protection 19. This mindset leads to a dangerous miscalculation where family offices assume they’re too small or obscure to warrant sophisticated attacks 20.

Research reveals that 47% of family offices acknowledge that underestimating the threat level obstructs the implementation of risk management measures 3. Additionally, smaller and newer family offices are particularly vulnerable, with only 15% accurately assessing the likelihood of cyberattacks compared to 25% at larger family offices 3.

A pervasive culture of complacency significantly hampers cybersecurity preparedness among family offices 1 3. Studies show that 41% of family offices cite complacency as an obstacle to implementing risk management measures 3. This reactive mindset is further evidenced by the fact that 33% of family offices have adopted a “reactionary rather than preventative approach” to cybersecurity, an increase from around 25% in previous studies 21.

As one US-based single family office CEO noted, “Many people do not react to cyber threats until they have been attacked” 2. This wait-and-see approach leaves offices vulnerable to increasingly sophisticated attacks that target the “low-hanging fruit” 2.

Unlike large enterprises, family offices often lack the financial resources for comprehensive cybersecurity infrastructure 21. Only 33% of family offices report having a dedicated cybersecurity budget, forcing many to rely on inadequate solutions 5. The typical family office operates with a small staff ranging from 2 to 25+ members, making it challenging to allocate personnel specifically for cybersecurity functions 7.

The resource limitation extends beyond budgets to human capital. Just 8% of family offices have in-house cybersecurity personnel, and 67% have not hired third-party defense providers 1. This staffing gap means that cybersecurity often becomes an afterthought rather than a strategic priority.

Family offices face unique structural challenges that impede effective cybersecurity implementation. Many operate more like small businesses when it comes to cybersecurity infrastructure while managing wealth comparable to mid-sized enterprises 20 23. This creates a dangerous mismatch between resources and risk exposure.

The fragmented nature of family office operations compounds these challenges. Many use disparate systems that don’t communicate effectively, creating security vulnerabilities and making comprehensive protection difficult to implement 29. Without proper integration, family offices struggle to maintain consistent security protocols across all their technological touchpoints.

Family offices increasingly rely on external vendors and service providers, creating additional vulnerabilities they may not fully understand or manage effectively 28 30. There has been “a huge uptick in third-party vendors having cybersecurity incidents and then reporting them back to the data owner,” creating cascading security risks 28.

Family offices without proper processes to vet third-party vendors significantly increase their risk exposure through insecure connections and compromised vendor relationships 30. This is particularly problematic given that many family offices outsource critical functions without implementing adequate vendor security oversight.

A critical gap exists in cybersecurity awareness and training across family office organizations. Fewer than 25% of family offices have implemented basic protections such as phishing simulation tests, security awareness training, external penetration testing, or defined incident response plans 5.

The challenge is compounded by the diverse technology adoption patterns within wealthy families, ranging from tech-savvy younger members to “tech-averse octogenarians” 13. This spectrum of cyber hygiene habits makes it difficult to implement consistent security protocols across all family members and staff.

Cybersecurity experts emphasize that most cyberattacks don’t happen through technology failures but because of people and process weaknesses 16. Family offices are particularly vulnerable to social engineering attacks because cybercriminals can often gather extensive information about wealthy families through social media and public records 18.

The younger generation’s increased online visibility has inadvertently exposed families that previously maintained tight privacy controls 18. As one expert noted, “The younger members of the family are outing families that have kept a really tight lid on their wealth for a long period of time” 18.

The consequences of inadequate cybersecurity preparedness extend far beyond immediate financial losses. Among family offices that have experienced cyberattacks, a significant one-third have suffered some form of loss or damage, with operational damage and financial loss being the most common consequences 9.

The average cost of a data breach globally approaches $4 million, with individual family offices at risk of losing up to $500,000 in ransom payments alone 10. Beyond direct financial impacts, successful attacks can severely damage reputation, erode trust, and lead to regulatory inquiries and litigation 14.

The persistent unpreparedness of family offices despite high cyberattack risks reflects a complex interplay of psychological, organizational, and resource-related factors. Addressing these challenges requires a fundamental shift from reactive to proactive cybersecurity approaches, supported by dedicated budgets, specialized expertise, and comprehensive risk management frameworks.

As cybersecurity threats continue to evolve and become more sophisticated, family offices can no longer afford to operate under the assumption that their size or privacy provides adequate protection 1 6. The time for reactive measures has passed; proactive cybersecurity investment has become an operational necessity rather than an optional consideration.

Supreme Court Allows DOGE Access to Social Security Database: Privacy Implications for the Future

On June 6, 2025, the U.S. Supreme Court ruled 6-3 to allow the Department of Government Efficiency (DOGE) unfettered access to Social Security Administration (SSA) databases containing sensitive personal information on millions of Americans 1, 2, 3. The Court granted the Trump administration’s emergency request to lift a lower court injunction that had previously restricted DOGE’s access to these systems due to privacy concerns 4, 5.

In an unsigned three-paragraph order, the majority concluded that “under the present circumstances, SSA may proceed to afford members of the SSA DOGE Team access to the agency records in question in order for those members to do their work”6, 7. The decision overturned a ruling by U.S. District Judge Ellen Hollander in Maryland, who had found that DOGE’s broad access likely violated federal privacy law 8.

This SCOTUS decision concerns Netlok and other cybersecurity companies because we are required to protect Personal Private Information (PPI). However, if DOGE’s collection and storage of PPI is hacked into by nation-states and bad actors, PPI becomes public information, which begs the question, “Is Privacy Dead?”

The Social Security Administration’s databases contain some of the most sensitive personal information held by the federal government 9, 13. This includes:

As privacy expert Kathleen Romig, a former SSA employee, noted, the agency possesses personal data about most Americans that spans “from cradle to grave”13.

The legal battle centers on the Privacy Act of 1974, a Watergate-era law designed to protect Americans’ personal information from federal government misuse 12, 17. This landmark legislation establishes strict limitations on how federal agencies can collect, use, and disclose personal information, requiring consent for most data sharing and imposing penalties for unauthorized access 17, 18.

Legal experts argue that DOGE’s access represents “an egregious violation of the Act” and potentially “the worst violation of the Privacy Act since its enactment in 1974” 18, 19. More than a dozen lawsuits have been filed invoking the Privacy Act to challenge DOGE’s data access across multiple federal agencies 20, 23.

Justice Ketanji Brown Jackson, joined by Justice Sonia Sotomayor, issued a blistering dissent warning that the decision “creates grave privacy risks for millions of Americans” 2 4. Jackson criticized the majority for allowing DOGE “unfettered access to this personal, non-anonymized information right now — before the courts have time to assess whether DOGE’s access is lawful” 4 7.

The dissenting justices emphasized that the government had failed to demonstrate any necessity for bypassing existing privacy protections 24.

Privacy advocates warn that this ruling sets a dangerous precedent by prioritizing administrative efficiency over individual privacy rights 2 9. As American Oversight Executive Director Chioma Chukwu stated, “The Court’s shielding of those in power while stripping protections from the American people sets a dangerous precedent and is exactly backwards in a functioning democracy” 2.

The decision effectively undermines the foundational principle that has governed SSA for nearly 90 years: an expectation of privacy concerning its records 24. Legal experts worry this could “turn privacy law into an empty promise” 9.

The ruling may embolden similar data-sharing initiatives across the federal government 27. DOGE has already sought access to sensitive databases at the Treasury Department, Education Department, and Office of Personnel Management 10, 14. The Supreme Court’s backing of DOGE’s Social Security access could facilitate broader government data consolidation efforts 11, 15.

Security experts have raised alarm about the risks associated with DOGE’s data access practices 25, 28. Recent investigations have revealed over 150 government database servers exposed to the internet, creating unprecedented vulnerabilities to cyberattacks 25, 28. The combination of expanded data access and weakened security protocols creates “grave privacy risks” for millions of Americans 4.

The ruling is likely to accelerate legislative efforts to strengthen data protection laws 27. Congress is already considering bills like the Social Security Data Protection Act, which would impose strict audit requirements on agencies handling sensitive information 27. State-level privacy legislation may also be strengthened in response to federal privacy rollbacks 27.

Privacy law experts have described DOGE’s data practices as representing a fundamental shift away from established privacy protections 18, 20. Professor Danielle Citron noted that the Privacy Act was created specifically to address concerns about government agencies accessing sensitive databases without proper safeguards 12.

The American Civil Liberties Union has demanded transparency about DOGE’s data practices, filing Freedom of Information Act requests to uncover the full extent of the agency’s access to Americans’ personal information 11. The organization warned that DOGE has already started “removing some protections around personal data” 11.

Democracy Forward, representing the plaintiffs in the Social Security case, stated that the ruling would “jeopardize the data of millions of Americans” and vowed to continue using “every legal avenue available to prevent unelected officials from misusing the public’s most sensitive information” 24.

The Supreme Court’s decision to allow DOGE access to Social Security databases marks a significant erosion of privacy protections that have safeguarded Americans’ personal information for decades 2, 18. While the administration argues this access is necessary to combat fraud and modernize government systems 6, 10, privacy advocates warn of unprecedented risks to data security and individual privacy rights 2, 19.

The ruling’s long-term implications extend beyond Social Security data, potentially opening the door for expanded government surveillance and data collection without adequate oversight15, 27. As legal challenges continue in lower courts, the ultimate impact on American privacy rights will depend on how aggressively the government pursues data access and whether Congress acts to strengthen privacy protections 20, 23.

Executive Summary

The cybersecurity landscape has undergone a fundamental transformation as artificial intelligence democratizes steganography attacks while simultaneously creating new defensive opportunities. Steganography bots—AI-powered automated systems that hide malicious code within seemingly innocent files—have emerged as a critical threat vector that bypasses traditional security measures with unprecedented sophistication.

Key Findings:

Threat Escalation:

AI-driven bot traffic surpassed human-generated traffic for the first time in a decade, constituting 51% of all web traffic in 2024
AI-powered steganography attacks saw an alarming resurgence in 2025, with cybercriminals using AI to refine their methods, embedding malicious payloads with greater precision and creating image files that are nearly indistinguishable from legitimate ones
Nation-states have incorporated steganography in their cyber operations, with up to 50% of steganography attacks targeting industrial organizations

Market Impact:

FBI’s 2024 Internet Crime Report reveals $16.6bn lost to cybercrime in 2024, representing a 33% rise compared to recorded losses in 2023
Global Multi-Factor Authentication market size is expected to reach $41.59 billion by 2029 at 20% growth rate, driven by rapid surge in cybersecurity threats

Defensive Innovation:

Photolok offers meaningful advantages over traditional authentication methods through its unique combination of enhanced security, improved user experience, and operational cost savings. Its steganographic approach and AI-resilient design particularly differentiate it in today’s threat landscape.

Current Threat Landscape: The Offensive Evolution

AI-Powered Steganography Bots

Technical Sophistication: AI systems are more interconnected and data-driven than ever, making them ripe targets for steganographic attacks. Attackers can corrupt training datasets with malicious or poisoned data, causing AI models to make incorrect or dangerous decisions

Attack Vectors Include:

ASCII Smuggling: AI-based steganography using invisible characters that AI models like GPT-4 or Claude can read but are imperceptible to human users, used to exfiltrate sensitive information covertly from platforms like Microsoft Copilot
Native Virtual Cameras: Native virtual camera attacks evolved from experimental phase in 2023 to become a major threat in 2024, peaking at 785 weekly attacks in Q2, without requiring rooted or jailbroken devices
Face Swap Proliferation: Attack volumes surged by 300% compared to 2023, with the number of tools increasing by 15.5%, rising from 110 to 127 tracked tools

Automation and Scale

Bot-as-a-Service Evolution: ByteSpider Bot was responsible for 54% of all AI-enabled attacks, with other significant contributors including AppleBot at 26%, ClaudeBot at 13%, and ChatGPT User Bot at 6%

Market Commercialization: 31 additional online threat actor groups were identified in 2024, with the largest having 6,400 users. Tool-selling groups serve 68% (23,698) of users, indicating their effectiveness and credibility

Nation-State Operations

Industrial Targeting: According to Kaspersky, up to 50% of steganography attacks targeted industrial organizations, with attacks being particularly difficult to detect because the files appear legitimate to traditional security tools

Supply Chain Infiltration: Some attacks take advantage of network interconnectivity between organizations and their smaller vendors/suppliers with weaker protections. By harvesting vendors’ credentials, attackers can remotely affect larger organizations’ networks

Defensive Applications & Market Opportunities

Steganography-Based Authentication Solutions

Photolok’s Market Position: Netlok’s Photolok appears to be the only mainstream commercial IAM solution that specifically uses steganography technology to prevent AI attacks. Photolok is “the first passwordless login that uses patented steganography photos as a standalone MFA IdP login method”

Competitive Advantages:

AI Attack Prevention: With “trillions of possible photo combinations, Photolok prevents pattern recognition by AI tools and hackers,” making it particularly effective against automated attacks from AI systems
Human-Centered Design: Photolok leverages the “Picture-Superiority Effect” and reduces demands on short-term memory, potentially offering significant usability advantages over traditional passwords and passphrases
Cost Benefits: Lower operational costs vs AI-based security that are energy intensive, reduces password management/reset expenses, minimizes support costs from forgotten credentials

Detection and Mitigation Technologies

Advanced Defense Systems: Owl Cyber Defense’s advanced cross domain solutions (CDS) are purpose-built to detect and mitigate data threats transferred between sensitive systems, including steganographic content embedded within data

Deep Learning Steganalysis: Deep learning-based steganalysis approaches exhibit rapid detection of steganographic payloads and demonstrate remarkable accuracy and efficiency across a spectrum of modern steganographic algorithms

Market Analysis & Business Implications

Financial Impact Assessment

Cybercrime Economics:

California reports $2.54 billion in cybercrime losses
Cyber-enabled fraud made up 38% of complaints to IC3 and 83% of recorded losses, at $13.7bn, in 2024
FBI data indicates identity-related criminal activities generated losses of $8.8 billion in 2023 alone

Password Management Costs: The average cost to reset passwords for employees ranges from $15 to $70 per password reset incident, with organizations typically reporting that password resets consume 20-30% of IT help desk resources

Recovery Statistics: In 68% of ransomware incidents, backups aided in the recovery process, demonstrating the critical importance of robust backup strategies

Market Growth Projections

Authentication Market Expansion:

MFA Adoption: Large enterprises (1,000+ employees): 75-85% have implemented MFA, with mid-sized businesses (100-999 employees): 50-65% adoption
Passwordless Transition: Only 5-10% of organizations have fully implemented passwordless MFA across their systems, indicating significant growth potential

Industry-Specific Vulnerabilities: Manufacturing industry accounts for the largest share of ransomware IR cases at 18.6%, followed by healthcare at 13.1%, and construction at 12%

Competitive Landscape Analysis

Market Positioning: Based on comprehensive search, there don’t appear to be any direct commercial competitors to Netlok’s Photolok that specifically use steganography for IAM authentication to combat AI attacks

Technology Differentiation:

Traditional IAM Solutions: Many IAM systems are “AI-enabled and capable of detecting and stopping attacks,” but they don’t specifically use steganography to hide authentication credentials
Biometric Limitations: Biometric data, once stolen, cannot be changed unlike Photolok photos, and provides similar ease-of-use benefits while avoiding permanent biometric data storage risks

Strategic Recommendations

For Organizations

Immediate Actions:

Implement Layered Defense: Organizations must focus on fundamentals, including an adaptable security posture, detection and response spanning the full attack surface, and an IR process that enables fast and effective recovery
Strengthen Identity Controls: Implement and require strong, phishing-resistant MFA, employ a zero trust security strategy that limits access unless identity and security posture can be verified
Enhanced Monitoring: Monitor logs from intrusion detection systems, endpoint detection and response solutions, firewalls, identity and access management systems, and email services

Strategic Investments:

AI-Resistant Authentication: Consider steganography-based solutions like Photolok for high-value applications
Advanced Threat Detection: Deploy deep learning-based steganalysis capabilities
Continuous Security Evolution: Move from periodic to real-time security monitoring

For Security Vendors

Product Development Priorities:

Steganography Detection: Organizations should take an activist approach to cybersecurity hygiene measures including ongoing end-user education and timely endpoint update and policy enforcement to defend against steganographic attacks
AI-Powered Defense: Develop solutions that can adapt to evolving steganographic techniques
Integration Capabilities: Ensure compatibility with existing security infrastructure

Market Positioning:

Target high-security industries (finance, healthcare, government)
Emphasize AI-resilience and zero-day protection capabilities
Develop partnerships with identity providers

For Investors

Investment Themes:

Defensive Steganography: Companies developing authentication solutions using steganography
AI-Powered Detection: Advanced steganalysis and threat detection technologies
Zero Trust Infrastructure: Solutions enabling comprehensive identity verification

Risk Considerations:

Regulatory compliance requirements
Technology adoption curves
Competitive response from established players

Quick Links & Resources

Industry Reports & Research

Arctic Wolf 2025 Threat Report – Comprehensive analysis of ransomware, BEC, and intrusion trends
FBI 2024 Internet Crime Report – Official cybercrime statistics and loss data
iProov Threat Intelligence Report 2025 – Deepfake and synthetic identity fraud analysis
Imperva Bad Bot Report 2025 – AI-driven bot traffic analysis

Technical Documentation

NIST AI Risk Management Framework – Guidelines for AI security implementation
MITRE ATLAS Framework – AI attack pattern documentation
SANS Applied Data Science & Machine Learning for Cybersecurity – Training resources

Solution Providers

Defensive Steganography: Photolok by Netlok – Steganography-based authentication
Threat Detection: Owl Cyber Defense – Cross-domain steganographic mitigation
Steganalysis Tools: Fortinet Security Fabric – Counter-steganographic solutions

Market Intelligence

Global MFA Market Report – Authentication market forecasts
Cybersecurity Investment Trends – Industry funding analysis
Identity Security Market Analysis – Enterprise identity management trends

Regulatory & Compliance

Executive Order on AI (2023) – Federal AI security requirements
GDPR AI Compliance Guidelines – European data protection regulations
SOC 2 AI Controls – Audit framework for AI systems

Report compiled from proprietary research, industry documentation, and current threat intelligence. All financial projections and market data current as of Q1 2025.

In the daily operations of a business, it’s normal for employees to need to access multiple accounts or collaborate across accounts to get their work done. In some cases, though, it may be impractical to have multiple accounts for the same service. When this happens, it’s common for employees to share passwords.

Password sharing in a business setting can be dangerous, exposing sensitive company information to outsiders who may use it for ill intent. There are a few ways you can mitigate this danger, but first, it’s best to understand why password sharing happens and what exactly those dangers are.

Why do people share passwords?

According to research conducted by popular survey company Survey Monkey, an estimated 32 million employees in the United States share passwords. But why? Per the respondents to this survey, most people who share their passwords (about one-third of participants), at least in a work setting, do so to collaborate with their teammates. Other reasons found in the survey included following company procedures and reducing costs.

This makes sense; a company may not have the resources to pay for separate subscriptions to certain services for all of their employees or may not use the service enough to justify the extra cost. Having some employees share a single paid account might be more practical in these scenarios. Additionally, having everyone work from the same account can make collaboration easier by allowing employees to save their work to the same location and access others’ work as needed without the intermediary steps of sharing documentation through messaging or emails.

The dangers of sharing passwords

The first and most obvious risk of sharing passwords is that of the person with whom the password is shared being a bad actor. Phishing schemes are incredibly common, accounting for 3.4 billion spam emails sent every day and being the most common cause of data breaches. These scams rely on a person voluntarily sharing their password with a party pretending to be some kind of authority.

Even if the person with whom you are sharing your password is not a bad actor themselves, however, password sharing can still lead to accessing sensitive information through unsecured networks. It is incredibly difficult to regulate server access if employees share information and access it via external networks such as remote office setups or public computers.

Additionally, if any changes are made to the sensitive data via an external network, tracking who made the changes and why is much more difficult. This may mean that your internal data is susceptible to abuse by jaded former employees or dishonest employees looking to profit from your work in some way. This may mean anything from unauthorized social media posts that may greatly damage the company image to the misuse of customer information to potential serious loss of revenue.

How to share passwords safely

All of this being said, there will still be scenarios in which you may need to share an account across multiple employees or access points. Here are some tips from Forbes on how to share passwords safely.

It’s also a good idea to implement multi-factor authentication into all of your accounts. MFA adds layers of security to accounts and limits access to those with the appropriate information and identifying factors. Consider adding a more advanced MFA solution such as Photolok to your data. Photolok, a new technology from Netlok, allows users to upload and label photos to be used as identifiers; they simply select their photo from a grid to access their account. There is also an option to create a Duress photo, which will allow access for the user in the event of a forced authentication but will also alert the appropriate authorities so that the breach can be addressed quickly and safely.

Why MFA Is Important to Keeping Your Business Safe

If you are a business looking to implement MFA, consider using a more advanced authentication method such as Photolok IdP. Photolok is a passwordless IdP that is simple, effective, and offers a range of benefits including AI and ML defense, device authorization, and one-time-use authenticators. With Photolok, users select images and label them for security use. When accessing a network, application, and/or API, users simply choose their account photos in several photo panels, and they are given access. Users can also label a photo as Duress, which acts as a silent alarm. The Duress option allows the user access but notifies IT administrators that the user’s account is compromised and they need to execute the company’s security procedure quickly to protect the company and the user’s safety.

With the Biden Administration announcing new guidelines for AI safety – including requiring innovators to share critical information with the federal government – it is clear that cybersecurity stakeholders must also defend against the serious threat AI poses to online security, privacy, and data protection.

Fortunately, Photolok IdP is available today and has been tested and found to protect against AI attacks. Photolok, a passwordless IdP, employs photos in place of passwords and uses OAuth for authentication and Open ID Connect for integration. To understand Photolok and how it protects against AI attacks, it is important to understand how AI/ML tools and techniques have made it easier for hackers to get around current password security methods.

AI/ML tools are enabling hackers to scrape the internet for personal data and find passwords. When combined with social engineering, AI technics can decipher passwords far more quickly than earlier systems. The reality is that AI password crackers can breach most passwords in seconds and more difficult ones in minutes. For example, hackers can attempt millions of possible passwords each minute using AI-driven brute-force attacks that enable hackers to take advantage of password complexity flaws. While longer passwords and phrases make it more challenging, as computational capabilities of AL and ML continue to evolve, those solutions will experience a significant reduction in efficacy.

AI technologies are also negating the cybersecurity value of two-factor authentication. For example, the common use of CAPTCHAs, known as Completely Automated Public Turing test to tell Computers and Humans Apart, are becoming obsolete. AI bots have become so adept at mimicking the human brain and vision that CAPTCHAs are no longer a barrier.

Making CAPTCHAs more complex is not the answer. Cengiz Acartürk, a cognition and computer scientist at Jagiellonian University in Kraków, Poland, says that there’s a problem with designing better CAPTCHAs because they have a built-in ceiling. “If it’s too difficult, people give up,” Acartürk says. Whether CAPTCHA puzzles are worth adding to a website may ultimately depend on whether the next step is so important to a user’s experience that a tough puzzle won’t turn away visitors while providing an appropriate level of security. AI bots are better than humans at solving CAPTCHA puzzles (qz.com)

Another way AI undermines passwords is via the use of keylogging. The use of AI can enable keyloggers to keep track of your keystrokes in order to retrieve your passwords. According to a University of Surrey study, artificial intelligence can be trained to recognize the key that is being pressed more than 90% of the time simply by listening to it. Using an Apple MAC Pro, the group recorded the sound of 25 distinct finger and pressure combinations being used to press each key on the laptop. The noises were captured during a conversation on a smartphone and during a Zoom meeting. A machine learning system was then trained to recognize the sound of each key using some of the data that had been provided to it. The algorithm was able to accurately identify which keys were being pressed 95% of the time for the call recording and 93% of the time for the Zoom recording when it was evaluated using the remaining data. What secrets can AI pick up on by eavesdropping on your typing? (govtech.com)

To combat these attack vectors, Photolok randomizes photos to mediate AI/ML attacks so that AL/ML tools cannot identify and/or learn any patterns, which prevents AI/ML breaches. Photolok uses steganographic photos (random codes hidden in the photo) to hide the attack points from nefarious hackers, while randomly placing the user’s photo on each photo panels to prevent keylogging and other security attack methods. Photolok also blocks horizontal penetrations and defends against external threats, such as ransomware, phishing, shoulder surfing, and man-in-the-middle assaults.