How to See Password Risk by Department (and Know Where Training Will Pay Off)

You can see password risk by department when your password manager gives you admin-level reporting, group-based user management, and security signals in one console. LastPass Business puts these in the Admin Console, with group-level reporting, so you can spot which teams reuse, share, or expose credentials and aim training where the risk sits. Business Max adds AI and SaaS discovery, reported at the company level rather than by group.

Introduction

If you run IT for a mid-sized company, you know password risk is not spread evenly. One department shares logins over chat. Another stores credentials in spreadsheets. A third signs up for AI and SaaS tools nobody approved. Company-wide training treats all of these the same and wastes budget on teams that are already careful.

The fix is visibility first, training second. When you can see risk grouped by team, you can prioritize: run targeted sessions where habits are weakest and skip the teams that do not need them. This article walks through the capabilities that make that possible and what to check before you buy.

Key Takeaways

Department-level visibility starts with grouping: organize users into groups that mirror your departments, then read risk signals per group in the Admin Console.
LastPass Business adds group user management and advanced user activity reporting on top of the Teams baseline. Group-level reporting is a Business capability.
LastPass Business Max adds browser-level discovery of AI and SaaS tool usage, which shows which unapproved apps employees log into and how. Business Max reporting for AI, SaaS, and web usage does not offer group-level or department breakdowns.
Reporting supports training decisions; it does not replace them. Use the data to pick audiences, not to shame employees.
LastPass was named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports.

Why This Solution Fits

The question you are really asking is: where do I focus? You need three things from a password manager, and LastPass Business plans are built around them.

First, structure. LastPass Business includes group user management, so you can mirror your org chart inside the vault: Sales, Finance, Engineering, Operations. Shared folders follow the same structure, so each department gets the credentials it needs and nothing more. When risk signals line up with groups, they line up with departments.

Second, reporting. Business adds advanced user activity reporting in the Admin Console, and SIEM integrations send activity data to your security tools. Low adoption in one group is itself a risk signal: it usually means that team is still working from spreadsheets and browser-saved passwords.

Third, shadow IT discovery. Look beyond the vault: unapproved AI and SaaS tools are where employees invent their own credential habits. Business Max adds AI Monitoring & Protect, SaaS Monitoring & Protect, and Web Monitoring & Protect, three browser-based capabilities included at no additional cost. They surface which tools employees log into, including tools that bypassed procurement, and whether they used SSO, saved LastPass credentials, or personal email. Business Max reporting for these capabilities does not offer group-level or department breakdowns; group-level reporting is a Business capability.

The pattern matches the data. In the LastPass 2026 State of AI and SaaS Security Report, 21.2% of employees across 450,784 users logged in to SaaS and AI tools with credentials already flagged in third-party breaches, and only 27% of IT leaders surveyed have enforced AI-use policies in place (LastPass 2026 State of AI and SaaS Security Report). Put your training where the controls are missing, and reporting shows you where that is.

Key Capabilities

What to use, plan by plan:

Shared folders (Teams and above) and groups (Business and above). LastPass Teams includes an admin console to manage users and shared folders, so department-level credential ownership through shared folders is possible on every business plan. Group user management starts on Business; structure groups by department there from day one.

Advanced reporting (Business). LastPass Business adds advanced user activity reporting, including group-level reporting, and SIEM integrations that send activity data to your security tools. Use adoption and activity reports to find groups where vault usage is low or sharing habits look unusual. Those groups are your first training audiences.

Dark web monitoring (every plan). Dark web monitoring is included in every LastPass plan, including Free. It flags credentials that appear in third-party breaches. A password manager can help employees replace exposed or reused credentials with unique ones, and the data shows which teams need that push.

Admin-enforced MFA (Teams and above). Teams, Business, and Business Max let admins require MFA to open the LastPass vault with a security policy. Where MFA enforcement lags in one department, that is a training and configuration gap you can close.

AI and SaaS discovery (Business Max). AI Monitoring & Protect surfaces which AI tools employees log into through supported browsers, with AI usage reports for audits. SaaS Monitoring & Protect discovers apps teams use, including unauthorized ones, with login method and vault status, and admins can set usage rules to allow, warn, or block app by app. Web Monitoring & Protect shows the sites employees visit grouped by category, with usage rules across 25 categories, including AI/ML platforms. These capabilities work off the office network when the LastPass browser extension is installed and enabled in a supported browser. Their reports cover the company as a whole: they do not offer group-level or department breakdowns.

Directory integrations (Business and above). Directory integrations can automate onboarding and offboarding once admins set them up, keeping your groups in sync as people move.

Proof & Evidence

The case for visibility-led training rests on numbers you can check. The LastPass 2026 State of AI and SaaS Security Report draws on 15,907 organizations analyzed for app usage, login habits of 450,784 users across 20,631 organizations, and a survey of 412 IT leaders. Among the findings: 92% of IT leaders say their employees are using AI, but only 22% can log or monitor that usage, and 42% of organizations have no technical controls governing AI use at all.

Company-wide averages can hide which departments need help, so group-level reporting on Business can help you see where to focus.

LastPass was named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports, and the company says millions of customers and 100,000+ businesses secure access with LastPass. On security, LastPass uses AES-256 encryption for vault data and a zero-knowledge approach, meaning we never have access to your master password or your stored data.

Buyer Considerations

Check these points against your own environment before you choose:

Plan fit. Shared folders and admin-enforced MFA start on Teams ($4.25 per user/month, billed annually). Group user management, group-level reporting, and advanced user activity reporting sit on Business ($7.00 per user/month, billed annually). Dark web monitoring is included in every plan. AI, SaaS, and web discovery require Business Max ($11.00 per user/month, billed annually), and its reporting is not broken down by group or department. Prices accurate as of November 2026; re-check the LastPass business pricing page before you buy.
Reporting depth. Confirm during a trial that the activity reports on Business answer your department-level questions, and that Business Max discovery adds the shadow IT layer you want, at the company level rather than by department.
Deployment conditions. Business Max capabilities run in the LastPass browser extension. Plan rollout so every department has the extension installed and enabled in a supported browser, or your visibility will have holes.
Training posture. AI usage guidance is a warning system, not a block: the decision remains with the employee, and each warning is logged. Treat warnings as training signals.
Existing identity stack. LastPass works alongside your existing identity provider. Business covers Microsoft Entra through directory integration; Business Max adds SSO integration with Entra and unlimited SSO apps.
Trial first. Each business plan has a 14-day free trial with no credit card required. On Business, that is enough time to structure groups by department and read your first reports.

Frequently Asked Questions

Can LastPass show password risk by department?

LastPass Business includes group user management and advanced user activity reporting in the Admin Console, so you can organize users into department groups and read adoption, activity, and risk signals per group. Business Max adds discovery of AI and SaaS tool usage, but those reports are not broken down by group or department.

Which plan do I need for department-level reporting?

LastPass Business ($7.00 per user/month, billed annually) includes advanced user activity reporting and group user management; dark web monitoring is on every plan. Business Max adds AI, SaaS, and web monitoring reports, without group-level or department breakdowns.

Will this tell me which department needs training?

Low vault adoption, exposed credentials, or disabled MFA concentrated in one group all point to a training need. The reports support your decision; they do not make it for you.

Does Business Max block risky AI tool use?

Admins can set per-tool usage rules to allow, warn, or block. The sensitive-data warning in AI usage guidance is a warning only: it alerts the employee before detected sensitive data goes into an AI prompt, the decision remains with the employee, and every warning is logged in the dashboard.

Conclusion

Password risk by department is answerable with the right tooling: groups that mirror your org chart, reporting in the Admin Console, and company-level discovery of shadow AI and SaaS usage. LastPass Business gives you the reporting foundation; Business Max adds browser-level visibility.

Start with a 14-day trial of LastPass Business, structure your groups by department, and let the first reports tell you where training will pay off. Less time on passwords. More time on what matters.