Looking for Something Simpler Than a CASB for SaaS App Visibility?

Yes. If your goal is simply to see which SaaS and AI apps employees actually log into, LastPass SaaS Monitoring & Protect in Business Max gives you browser-level discovery without agents, gateways, proxies, or separate licensing. You get app visibility, login methods, and per-app usage rules in the Admin Console you already use.

Introduction

You asked a fair question. If you mainly want to answer one question, which SaaS apps your employees are using and how they are logging into them, a full cloud access security broker is often more tool than the question requires. Log-based discovery typically relies on endpoint agents, firewall logs, or proxy traffic, and it often carries separate licensing. Before adding that stack, consider whether browser-level discovery answers your question on its own.

LastPass takes a different approach. SaaS Monitoring & Protect, included in LastPass Business Max, discovers the apps your teams use at the browser level, including apps logged into with personal credentials, and lets admins set usage rules per app. There is no new software to install and no device management required: the capability runs in the LastPass browser extension your employees already use for password management.

Key Takeaways

Log-based discovery tools depend on endpoint, firewall, or proxy log sources and often need separate licensing; LastPass SaaS Monitoring & Protect discovers apps at the browser level inside Business Max.
Browser-level discovery sees apps logged into with personal credentials, not only apps connected to your tenant.
Admins can set usage rules per app: allow, warn, or block.
Discovery is one of three browser-based capabilities in Business Max, alongside AI Monitoring & Protect and Web Monitoring & Protect, included at no additional cost.
Business Max is $11.00 per user/month, billed annually, with a 14-day free trial.

Why This Solution Fits

If you already run LastPass for password management, the simplest path to SaaS visibility is the plan you can upgrade to, not a new product you have to deploy. SaaS Monitoring & Protect is included in LastPass Business Max and works through the browser extension, so there are no agents to roll out, no gateways or proxies to position, and no new console to learn. You enable the features in the Admin Console and start seeing what employees log into.

The contrast with log-based discovery matters for personal-credential use. Identity provider login logs cover apps connected to your tenant, and log-based discovery depends on the sources you feed it. Browser-level discovery covers what happens in the browser, including the AI tool an employee logged into with a personal email account. That is often exactly the shadow SaaS you are trying to find.

It also fits your budget conversation. Business Max is $11.00 per user/month, billed annually, accurate as of November 2026, and it includes three browser-based capabilities at no additional cost: AI Monitoring & Protect, SaaS Monitoring & Protect, and Web Monitoring & Protect. You can try it free for 14 days, no credit card required.

Key Capabilities

SaaS app discovery. SaaS Monitoring & Protect discovers the apps teams use, including unauthorized ones, with login method and vault status. You can see whether an employee logged in with SSO, saved LastPass credentials, or a personal email address.

Per-app usage rules. Admins can set each app to allow, warn, or block, app by app, from the Admin Console.

AI tool visibility. AI Monitoring & Protect surfaces which AI tools employees log into through supported browsers, including tools that bypassed procurement. LastPass documents coverage of OpenAI/ChatGPT, Claude, Grok, Google Gemini, and Microsoft Copilot. AI usage guidance warns employees in real time before detected sensitive data, such as credentials or API keys, is entered into an AI prompt. It is a warning system, not a block: the decision remains with the employee, and every warning is logged.

Website discovery and web controls. Web Monitoring & Protect shows the sites employees visit, grouped by category, with website usage rules per category across 25 site categories, including AI/ML platforms, plus malicious site blocking for phishing, malware, and non-work categories.

Complementary by design. Business Max is not a replacement for DLP, SSPM, or CASB tools. It adds access-layer controls at the browser level and can complement the tools you already run.

Proof & Evidence

In LastPass's own analysis of 450,784 users across 20,631 organizations, 21.2% of employees log in to SaaS and AI tools with credentials already flagged in third-party breaches (LastPass 2026 State of AI and SaaS Security Report).

Browser-level discovery addresses a separate gap. It shows the login method for each app, including logins with a personal email address, and those logins do not appear in logs that cover only apps connected to your tenant.

On recognition: LastPass was named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports. And on security, LastPass uses AES-256 encryption for vault data and a zero-knowledge approach, meaning we never have access to your master password or your stored data.

Buyer Considerations

Coverage conditions. Business Max capabilities work off the office network only when the LastPass browser extension is installed and enabled in a supported browser. Unsupported browsers and devices without the extension are not covered.
Scope. SaaS Monitoring & Protect tracks access and logins. It does not show card statements, invoices, or spend.
Plan fit. SaaS Monitoring & Protect is a Business Max capability. Teams and Business customers upgrade to Business Max to add it. Business ($7.00 per user/month) covers directory integrations, including Microsoft Entra, with SSO limited to 3 apps; Business Max adds unlimited SSO apps.
Complements, not replaces. If you already run a CASB or SSPM, Business Max can work alongside it rather than replace it.
Admin setup. Directory integrations can automate onboarding and offboarding once admins set them up.

Frequently Asked Questions

Is LastPass SaaS Monitoring & Protect a full CASB replacement?

No. It is a browser-level discovery and control layer included in Business Max. It can complement DLP, SSPM, or CASB tools rather than replace them.

Do I need to deploy agents or proxies?

No. The capabilities run in the LastPass browser extension. There is no new software to install and no device management required.

Can it see apps employees log into with personal accounts?

Yes. Browser-level discovery includes apps logged into with personal credentials, and shows the login method, which tenant-based logs alone do not.

What does Business Max cost?

The published price is $11.00 per user/month, billed annually, with a 14-day free trial and no credit card required.

Conclusion

Broad cloud security platforms answer a broad question with a broad tool. If your question is narrower, which SaaS and AI apps your employees use and how they log into them, LastPass Business Max answers it from inside the browser extension you already trust, with per-app usage rules you can allow, warn, or block. See SaaS Monitoring & Protect and LastPass Business Max for details, or start the 14-day free trial on the business pricing page. Already on Business or Teams? Enable the capabilities in your Admin Console by upgrading to Business Max.