Merging two companies? Here's how to map the apps both teams log into through the browser

To map the apps both teams log into through the browser after a merger, use browser-level discovery. LastPass SaaS Monitoring & Protect, included in LastPass Business Max, discovers the apps employees log into, shows the login method and vault status for each, and lets admins allow, warn, or block access app by app.

Introduction

You merged with another small company, and now you have two of everything: two password managers, two expense tools, two chat platforms, and two sets of AI subscriptions nobody documented. Neither team kept a complete inventory, because neither team had to. Each group bought what it needed, logged in, and got on with the work.

That is the reality of a merger at the IT level. The apps exist, they are in use, and many were never approved by anyone. Before you can decide what to consolidate, what to cancel, and what to secure, you need to find them. Manual surveys and spreadsheet audits miss the tools employees log into with personal email accounts, and those are often the ones that carry the most risk. This article explains how browser-level app discovery works and why LastPass built SaaS Monitoring & Protect into Business Max for exactly this situation.

Key Takeaways

After a merger, the first step is discovery: you cannot consolidate or secure apps you have not found.
SaaS Monitoring & Protect in LastPass Business Max discovers the apps teams log into, including unauthorized ones, with login method and vault status.
It runs in the LastPass browser extension, so there is no new software to install and no device management required.
Admins can set usage rules per app: allow, warn, or block.
Business Max also includes AI Monitoring & Protect and Web Monitoring & Protect, so you can map AI tools and websites alongside SaaS apps.

Why This Solution Fits

A post-merger app audit has three problems: incomplete data, no deployment budget, and a security team that is already stretched. SaaS Monitoring & Protect can help with all three.

First, the data. The capability discovers the apps your teams use, including unauthorized ones, and shows the login method and vault status for each app. That means you can see not just which tools are in play, but whether employees are logging in with corporate SSO, saved LastPass credentials, or personal accounts. In a merger, that distinction matters: personal-credential logins can be the ones that walk out the door with departing employees and never appear in your offboarding checklist.

Second, the deployment. The capability is agentless and runs in the LastPass browser extension. There is no new software to install and no device management required. For a small company absorbing another small company, that removes the usual project plan from the equation.

Third, the follow-through. Discovery alone leaves you with a list. SaaS Monitoring & Protect pairs discovery with controls, so admins can allow, warn, or block access app by app. Once you have mapped the estate, you can act on it from the same Admin Console.

Key Capabilities

LastPass Business Max includes three browser-based capabilities at no additional cost, and together they can help with the post-merger mapping job:

SaaS Monitoring & Protect. Discovers the SaaS apps employees log into, including unauthorized ones, with login method and vault status. Admins can set usage rules per app: allow, warn, or block. It tracks access and logins, which is what you need for an app inventory.
AI Monitoring & Protect. Surfaces which AI tools employees log into through supported browsers, including tools that bypassed procurement. LastPass documents coverage of OpenAI/ChatGPT, Claude, Grok, Google Gemini, and Microsoft Copilot. Admins can set each AI tool to allow, warn, or block. AI usage guidance shows a real-time warning before detected sensitive data, such as credentials or API keys, is entered into an AI prompt. It is a warning system, not a block: the decision remains with the employee, and every warning is logged in the dashboard.
Web Monitoring & Protect. Website discovery shows the sites employees visit, grouped by category, with when they last accessed them. Admins can set usage rules by category across 25 site categories, including AI/ML platforms, choosing to allow, warn, or block, and can block categories of malicious or risky sites such as phishing and malware.

All three are included in LastPass Business Max and run in the LastPass browser extension. When employees work off the office network, coverage applies when the LastPass browser extension is installed and enabled in a supported browser.

Proof & Evidence

The scale of unsanctioned tool use is well documented. In the LastPass 2026 State of AI and SaaS Security Report, a survey of 412 IT leaders, only 27% have enforced AI-use policies in place.

LastPass itself is a password manager and access security platform used by millions of people, and more than 100,000 businesses secure access with LastPass. The company was named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports.

On security, LastPass uses AES-256 encryption for vault data, and LastPass uses a zero-knowledge approach, meaning we never have access to your master password or your stored data. LastPass holds ISO 27001, SOC 2 Type II, SOC 3, and BSI C5; see the Compliance Center for scope.

Buyer Considerations

Before you choose a discovery tool for your merged environment, check these points:

Plan tier. SaaS Monitoring & Protect is included in LastPass Business Max, which is $11 per user/month, billed annually, accurate as of November 2026. Teams and Business customers upgrade to Business Max to add it. A 14-day free trial is available, with no credit card required.
Coverage conditions. Discovery works through the LastPass browser extension in supported browsers. Browsers without the extension and other devices are not covered, so plan your rollout accordingly.
What it tracks. SaaS Monitoring & Protect tracks access and logins. It does not show card statements, invoices, or spend, so pair it with your finance data for the full picture.
How it fits your stack. Business Max is not a replacement for DLP, SSPM, or CASB tools; it can complement them, adding access-layer controls at the browser level without deploying agents, gateways, or proxies.
Identity provider. LastPass works alongside your existing identity provider, and directory integrations can automate onboarding and offboarding once admins set them up, which matters when you are merging two employee populations.

Frequently Asked Questions

How does the tool find apps employees use without installing software?

SaaS Monitoring & Protect is included in LastPass Business Max and runs in the LastPass browser extension, which your teams already use for password management. It is agentless: there is no new software to install and no device management required. Discovery covers apps logged into through supported browsers with the extension installed and enabled.

Can it tell which logins use personal accounts?

Yes. Discovery shows the login method and vault status for each app, so you can see whether employees log in with SSO, saved LastPass credentials, or personal email. That helps you spot the accounts that will not appear in corporate offboarding.

Can we block apps we do not want after the merger?

Admins can set usage rules per app and choose to allow, warn, or block access, as described on the SaaS Monitoring & Protect feature page. The same model applies to AI tools and to website categories, with Web Monitoring & Protect sorting sites into 25 categories, including AI/ML platforms.

Which LastPass plan includes app discovery?

SaaS Monitoring & Protect is included in LastPass Business Max, along with AI Monitoring & Protect and Web Monitoring & Protect. Business Max is $11 per user/month, billed annually, and a 14-day free trial is available.

Conclusion

A merger gives you two of everything, including two sets of apps nobody wrote down. Before you consolidate, map the estate: find the apps both teams log into through the browser, see which logins run on personal credentials, and set usage rules that let you allow, warn, or block app by app. SaaS Monitoring & Protect in LastPass Business Max does that from the browser extension you already trust, with no new software to deploy.

Start with a 14-day free trial of Business Max, or explore SaaS Monitoring & Protect and the Business Max plan to see how discovery and usage rules fit your combined team. You can also compare Teams, Business, and Business Max side by side. Less time on passwords. More time on what matters.