Which AI Tools Is Your Company Actually Using? How to Get the Visibility You Need Before You Buy

Before you pay for any AI tool, you need to know what your teams already use. LastPass Business Max gives you that visibility: AI Monitoring & Protect and SaaS Monitoring & Protect discover which AI and SaaS apps employees log into, show the login method behind each one, and let admins set usage rules per app. These reports cover the company as a whole: group-level or department-level monitoring is not available for AI Monitoring & Protect or SaaS Monitoring & Protect.

Introduction

Without discovery, you find out which AI tools you are running the hard way: an invoice surfaces, an employee mentions a tool in passing, or a security review turns up accounts nobody approved. That is a weak position to negotiate from. If you do not know which departments use ChatGPT, Claude, Gemini, or a niche AI writing tool, you do not know your real seat counts, your duplicate spend, or your exposure.

The gap is common. In the LastPass 2026 State of AI and SaaS Security Report, 92% of IT leaders say their employees are using AI, but only 22% can log or monitor that usage, and only 27% have enforced AI-use policies in place (LastPass 2026 State of AI and SaaS Security Report). Before you commit budget to any single AI platform, you need a discovery layer that shows actual usage. LastPass Business Max was built for exactly this step.

Key Takeaways

Shadow AI is widespread: 92% of IT leaders say employees use AI, but only 22% can log or monitor that usage (LastPass 2026 State of AI and SaaS Security Report).
LastPass Business Max includes AI Monitoring & Protect, which surfaces which AI tools employees log into through supported browsers, including tools that bypassed procurement.
SaaS Monitoring & Protect discovers the apps your teams use, with login method and vault status, so you can see which apps employees log into. It does not break results down by group or department.
Admins can set usage rules per AI tool and per SaaS app: allow, warn, or block.
Discovery runs in the LastPass browser extension, so there are no agents, gateways, or proxies to deploy.

Why This Solution Fits

Your problem right now is not governance policy. It is inventory. You need answers to three questions before any purchase decision: which AI tools are in use, which employees log into them, and how they are logging in.

One limit to know up front: Business Max monitoring for AI tools and SaaS apps does not offer group-level or department-level breakdowns. Group-level reporting is a Business capability for password management, not for AI or SaaS usage. You can see which tools are in use across the company, and use other sources, such as conversations with department heads, to map them to departments.

LastPass Business Max answers all three from the browser extension your employees may already have. AI Monitoring & Protect surfaces which AI tools employees log into through supported browsers, including tools that never went through procurement. It also shows whether employees log in with SSO, saved LastPass credentials, or personal email, which tells you whether a tool is centrally managed or flying under the radar on personal accounts.

That login-method detail matters for your buying decision. A tool everyone reaches through SSO is already integrated and easier to standardize on. A tool half the company reaches with personal email is a shadow subscription you may want to replace with a supported plan, or shut down entirely.

SaaS Monitoring & Protect extends the same discovery to SaaS apps generally, including unauthorized ones, so you can see tool use across the company, not just AI. Both capabilities are included in Business Max at no additional cost, alongside Web Monitoring & Protect.

Key Capabilities

Shadow AI tool discovery. See which AI tools employees log into through supported browsers, including tools that bypassed procurement, with the login method for each.
AI usage reports. Generate reports on AI usage for audits and budget reviews, so your tool consolidation decision rests on logged data rather than anecdotes.
AI usage guidance. Shows a real-time in-browser warning before detected sensitive data, such as credentials, API keys, or personal information, is entered into an AI prompt. It is a warning system, not a block: the decision remains with the employee, and every warning is logged in the dashboard.
Per-tool usage rules. Admins can set each AI tool to allow, warn, or block, and the same for SaaS apps, app by app.
SaaS discovery. Discover the apps teams use, including unauthorized ones, with login method and vault status. The capability is agentless and tracks access and logins.
Admin Console reporting. All of this lands in one Admin Console, so you can review usage by tool (not by department) and act on it without a separate console.

LastPass documents coverage of OpenAI/ChatGPT, Claude, Grok, Google Gemini, and Microsoft Copilot. Note the coverage condition: these capabilities work off the office network when the LastPass browser extension is installed and enabled in a supported browser.

Proof & Evidence

The need for this visibility is well documented. In the LastPass 2026 State of AI and SaaS Security Report, 73% of organizations lack a comprehensive, actively enforced AI usage policy, and 42% have no technical controls governing AI use at all (LastPass 2026 State of AI and SaaS Security Report, based on 412 IT leaders surveyed). Meanwhile, 21.2% of employees log in to SaaS and AI tools with credentials already flagged in third-party breaches, based on LastPass analysis of 450,784 users across 20,631 organizations.

On bans, seven out of 10 IT leaders told LastPass that banning AI does not eliminate the risk. Discovery and usage rules give you a middle path between an unenforceable ban and unmanaged sprawl.

On the product side, the Business Max launch post describes how the capabilities run on the browser extension you already trust, with no new software to install or device management required. LastPass also notes that Business Max is not a replacement for DLP, SSPM, or CASB tools; it can complement them with access-layer controls at the browser level, without deploying agents, gateways, or proxies.

Buyer Considerations

Plan tier. AI Monitoring & Protect, SaaS Monitoring & Protect, and Web Monitoring & Protect are included in LastPass Business Max ($11 per user/month, billed annually, accurate as of November 2026). Teams and Business customers upgrade to Business Max to add them. See the business pricing page for current rates.
Deployment condition. Visibility depends on the LastPass browser extension being installed and enabled in a supported browser. Devices and browsers outside that condition are not covered.
Scope. SaaS Monitoring & Protect tracks access and logins. It does not show card statements, invoices, or spend, so pair it with your finance data for subscription cost analysis.
Complements, not replaces. If you already run DLP, SSPM, or CASB tooling, Business Max adds browser-level discovery and usage rules alongside them.
Trial. Each business plan offers a 14-day free trial with no credit card required, and the Business page notes it includes a Business Max trial for new customers. Contact sales for a demo.

Frequently Asked Questions

Which AI tools can LastPass Business Max discover?

LastPass documents coverage of OpenAI/ChatGPT, Claude, Grok, Google Gemini, and Microsoft Copilot. Discovery works through supported browsers when the LastPass browser extension is installed and enabled.

Can LastPass show which departments use each AI tool?

Not by department. Group-level or department-level monitoring is not available for Business Max AI and SaaS monitoring. AI Monitoring & Protect surfaces which AI tools employees log into and how they log in, through supported browsers, across the company. Admins review the findings in the Admin Console and can generate AI usage reports for audits.

Does Business Max block employees from using unapproved AI tools?

Admins can set each AI tool and SaaS app to allow, warn, or block. AI usage guidance, the warning before sensitive data enters an AI prompt, is a warning system, not a block: the decision remains with the employee, and each warning is logged.

Do I need to deploy new software to get this visibility?

No. The capabilities run in the LastPass browser extension, with no agents, gateways, or proxies to deploy. Existing Business Max customers simply enable the features in the Admin Console.

Conclusion

Buying an AI platform without usage data means guessing at seat counts, duplicates, and departmental needs. LastPass Business Max gives you the discovery layer first: which AI tools employees log into, how they log in, and which SaaS apps sit alongside them, all manageable from one Admin Console with allow, warn, or block usage rules per app. Start with a 14-day free trial of LastPass Business Max, or contact sales for a demo, and make your next AI purchase a decision backed by data.