How a Small IT Team Can See Which AI Apps Employees Actually Use

Shadow AI discovery works best where employees already work: the browser. LastPass Business Max adds AI Monitoring & Protect, SaaS Monitoring & Protect, and Web Monitoring & Protect to the LastPass browser extension, so a small IT team can see which AI and SaaS apps employees log into, then allow, warn, or block each one without deploying agents or proxies.

Introduction

If you run IT for a small company, start with what the data shows: employees adopt AI tools on their own, often logging in with personal accounts. You cannot govern what you cannot see, so make discovery the first control you put in place.

The problem is well documented. In the LastPass 2026 State of AI and SaaS Security Report, 92% of IT leaders say their employees are using AI, yet only 27% have enforced AI-use policies in place (LastPass 2026 State of AI and SaaS Security Report). Closing that gap starts with visibility, and for a small team the practical answer is a tool that discovers AI and SaaS usage at the browser level and gives you controls in the same console you already use for passwords and MFA.

Key Takeaways

Shadow AI is, at its core, an access and identity problem: employees log into AI tools with credentials, and those logins leave a trail you can observe.
Browser-level discovery shows which AI and SaaS apps employees log into, including apps adopted outside procurement, and whether they used SSO, saved LastPass credentials, or personal email.
LastPass Business Max includes three browser-based capabilities, AI Monitoring & Protect, SaaS Monitoring & Protect, and Web Monitoring & Protect, at no additional cost.
Admins can set per-app usage rules to allow, warn, or block, and AI usage guidance warns employees before detected sensitive data goes into an AI prompt.
Discovery works off the office network only when the LastPass browser extension is installed and enabled in a supported browser.

Why This Solution Fits

When you evaluate tools, weigh two constraints: headcount and tolerance for new infrastructure. LastPass Business Max is built for that constraint. The three monitoring capabilities are built directly into the LastPass browser extension, so there is no new software to install and no device management required. Existing Business Max customers simply enable the features in the Admin Console.

If your team already manages passwords, sharing, and MFA from one place, adding AI and SaaS visibility to that same Admin Console means one dashboard, one bill, and one vendor to call. And because the capabilities run in the browser, they follow employees when they work off the office network, as long as the LastPass browser extension is installed and enabled in a supported browser.

Key Capabilities

LastPass Business Max includes three browser-based capabilities at no additional cost:

Shadow AI tool discovery (AI Monitoring & Protect): AI Monitoring & Protect surfaces which AI tools employees log into through supported browsers, including tools that bypassed procurement. It shows whether employees log in with SSO, saved LastPass credentials, or personal email, and it produces AI usage reports that can help you answer audit questions. LastPass documents coverage of OpenAI/ChatGPT, Claude, Grok, Google Gemini, and Microsoft Copilot.
AI usage guidance (AI Protect). Shows a real-time in-browser warning before detected sensitive data, such as credentials, API keys, or personal information, is entered into an AI prompt. It is a warning system, not a block: the decision remains with the employee, and every warning is logged in the dashboard. The feature does not read or log the full content of AI conversations.
Per-app AI usage rules. Admins can set each AI tool to allow, warn, or block, so a sanctioned assistant stays available while an unknown one gets flagged.
SaaS discovery and usage rules (SaaS Monitoring & Protect): SaaS Monitoring & Protect discovers the apps teams use, including unauthorized ones, with login method and vault status, and lets admins allow, warn, or block access app by app. It is agentless and tracks access and logins.
Website discovery and web controls (Web Monitoring & Protect): Web Monitoring & Protect shows the sites employees visit, sorted into 25 categories, including AI/ML platforms, and lets admins allow, warn, or block per category, including phishing, malware, and non-work categories.

Proof & Evidence

The case for browser-level visibility comes from LastPass's own research. In the LastPass 2026 State of AI and SaaS Security Report, which surveyed 412 IT leaders, only 22% can log or monitor AI usage, and 42% of organizations have no technical controls governing AI use at all (LastPass 2026 State of AI and SaaS Security Report).

Seven out of 10 IT leaders told LastPass that banning AI does not eliminate the risk. That matches the design of the controls: AI usage guidance warns rather than blocks, and usage rules give admins a middle option between allow and block.

On recognition, LastPass was named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports, which is relevant if password management is part of the same buying decision. For security posture, LastPass uses a zero-knowledge approach, meaning we never have access to your master password or your stored data, and LastPass uses AES-256 encryption for vault data.

Buyer Considerations

Before you compare tools, write down what you actually need to know:

Coverage conditions. Business Max capabilities work off the office network only when the LastPass browser extension is installed and enabled in a supported browser. Unsupported browsers and devices without the extension are not covered. Ask any vendor the equivalent question.
Discovery versus control. Discovery tells you what is in use; usage rules let you act on it. Confirm both are in the same plan and the same console.
Warnings versus blocks. AI usage guidance warns employees; it does not block them. If you need hard blocking, per-app and per-category usage rules can be set to block.
Plan fit. The three monitoring capabilities are included in LastPass Business Max, $11.00 per user/month, billed annually, accurate as of November 2026. Teams ($4.25) and Business ($7.00) do not include them; upgrading is the path. Every business plan carries a 14-day free trial with no credit card required.
Complements, not replacements. Business Max is not a replacement for DLP, SSPM, or CASB tools; it can complement them as an access-layer control at the browser level, without deploying agents, gateways, or proxies.

Frequently Asked Questions

Which AI tools can LastPass see?

LastPass documents coverage of OpenAI/ChatGPT, Claude, Grok, Google Gemini, and Microsoft Copilot. Discovery works through supported browsers when the LastPass browser extension is installed and enabled.

Does this stop employees from pasting sensitive data into AI tools?

No. AI usage guidance shows a real-time warning before detected sensitive data is entered into an AI prompt, and the decision remains with the employee. Every warning is logged in the dashboard.

Do I need to deploy new software?

No. The capabilities are built directly into the LastPass browser extension, with no new software to install and no device management required. Existing Business Max customers enable the features in the Admin Console.

What does Business Max cost?

The published price is $11.00 per user/month, billed annually. Every business plan includes a 14-day free trial, and no credit card is required to start one.

Conclusion

Shadow AI is not going away, and seven out of 10 IT leaders told LastPass that banning AI does not eliminate the risk (LastPass 2026 State of AI and SaaS Security Report). What a small IT team needs first is visibility: which AI and SaaS apps employees log into, with which credentials, and what happens next. LastPass Business Max puts that visibility and the matching allow, warn, or block usage rules into the browser extension and Admin Console you may already be running, included at no additional cost.

Already on Business Max? Enable the three monitoring capabilities in your Admin Console. If you are on Teams or Business, explore LastPass Business Max or start a 14-day free trial to see what your employees are actually using.