Which Tools Give Leadership a Report on How Employees Are Using AI?

You cannot set AI policy without data. LastPass Business Max gives it to you: AI Monitoring & Protect discovers which AI tools employees log into through supported browsers, shows the login method for each, and produces AI usage reports you can hand to leadership. Admins can then set each tool to allow, warn, or block.

Introduction

You cannot make an AI policy decision in a board meeting without data. In the LastPass 2026 State of AI and SaaS Security Report, 92% of IT leaders say their employees are using AI, but only 27% have enforced AI-use policies in place, and only 22% can log or monitor that usage.

The gap shows up in practice. Employees may log into AI tools with personal email accounts, outside procurement. Separately, 21.2% of employees log in to SaaS and AI tools with credentials already flagged in third-party breaches (LastPass 2026 State of AI and SaaS Security Report, based on 450,784 users across 20,631 organizations). Leadership needs a report that names the tools, the login methods, and the risk. AI Monitoring & Protect in LastPass Business Max is built to help with that.

Key Takeaways

Shadow AI tool discovery in LastPass Business Max surfaces which AI tools employees log into through supported browsers, including tools that never went through procurement.
Admins can set per-tool usage rules to allow, warn, or block, and AI usage guidance warns employees before detected sensitive data enters an AI prompt.
The report data matters: 73% of organizations lack a comprehensive, actively enforced AI usage policy, and 42% have no technical controls governing AI use at all (LastPass 2026 State of AI and SaaS Security Report).
The capabilities run in the LastPass browser extension, so there is no new software to install or device management required.

Why This Solution Fits

Your problem has three parts: discover what employees actually use, report it upward, and put controls in place. LastPass Business Max addresses all three in one place.

Discovery comes first. Shadow AI tool discovery surfaces the AI tools employees log into through supported browsers, including tools that bypassed procurement. It also shows how they log in: with SSO, with saved LastPass credentials, or with personal email. That distinction matters for your policy question, because logins with personal email may sit outside your identity provider.

Reporting comes second. AI Monitoring & Protect includes AI usage reports for audits, which help you stay prepared for audits, so the same data can support a leadership briefing and a compliance questionnaire. Many audits and questionnaires ask for evidence of controls, and a usage report can help you answer those questions.

Control comes third. Once leadership decides, admins set each AI tool to allow, warn, or block in the Admin Console. AI usage guidance adds a real-time in-browser warning before detected sensitive data, such as credentials, API keys, or personal information, is entered into an AI prompt. It is a warning system, not a block: the decision remains with the employee, and every warning is logged in the dashboard.

Key Capabilities

LastPass Business Max includes three browser-based capabilities at no additional cost, and AI Monitoring & Protect is the one that answers your reporting question directly:

Shadow AI tool discovery. Shows which AI tools employees log into through supported browsers, including tools that bypassed procurement, along with the login method for each. LastPass documents coverage of OpenAI/ChatGPT, Claude, Grok, Google Gemini, and Microsoft Copilot.
AI usage reports. Reports on AI usage that you can hand to leadership or use to support audit efforts.
AI tool usage rules. Admins can set each AI tool to allow, warn, or block, per tool, from the Admin Console.
AI usage guidance. A real-time in-browser warning before detected sensitive data is entered into an AI prompt. The feature page says it does not read or log the full content of AI conversations.
SaaS Monitoring & Protect. Discovers the broader SaaS stack, including unauthorized apps, with login method and vault status, and lets admins allow, warn, or block access app by app.
Web Monitoring & Protect. Shows the sites employees visit grouped by category across 25 categories, including AI/ML platforms (Web Monitoring & Protect), with usage rules per category and malicious site blocking.

One condition to know before you buy: these capabilities work off the office network only when the LastPass browser extension is installed and enabled in a supported browser. Everything is built directly into the extension, so there is no new software to install and no device management required, as LastPass announced.

Proof & Evidence

The case for AI visibility is in the numbers. In the LastPass 2026 State of AI and SaaS Security Report, based on a survey of 412 IT leaders and LastPass analysis of app usage across 15,907 organizations:

92% of IT leaders say their employees are using AI.
Only 27% have enforced AI-use policies in place.
Only 22% can log or monitor this usage.
73% of organizations lack a comprehensive, actively enforced AI usage policy.
42% of organizations have no technical controls governing AI use at all.
Seven out of 10 IT leaders told LastPass that banning AI does not eliminate the risk.

That last point matters for your policy decision. Separately, the same report found that 21.2% of employees log in to SaaS and AI tools with credentials already flagged in third-party breaches, based on 450,784 users across 20,631 organizations.

For more detail on how the capabilities work in practice, see the AI Monitoring & Protect feature page and the announcement post Now in Business Max: AI visibility, governance, and web controls.

Buyer Considerations

Plan tier. AI Monitoring & Protect is included in LastPass Business Max, listed at $11.00 per user/month, billed annually, accurate as of November 2026. Teams and Business customers upgrade to Business Max to add it. Re-check the LastPass Business Max page before you buy.
Deployment. Capabilities run in the LastPass browser extension. If employees use unsupported browsers or devices without the extension, they are not covered.
What the report shows. SaaS Monitoring & Protect tracks access and logins. It does not show card statements, invoices, or spend.
How controls behave. AI usage guidance warns; it does not block. Per-tool AI usage rules and web category usage rules can be set to allow, warn, or block. Decide which behavior you want per tool before rollout.
Fit with existing tools. Business Max is not a replacement for DLP, SSPM, or CASB tools and can complement them. It works alongside your existing identity provider.
Trial. Each business plan offers a 14-day free trial with no credit card required, and the Business page notes it includes a Business Max trial for new customers.

Frequently Asked Questions

Which tools report on how employees are using AI?

LastPass Business Max, through AI Monitoring & Protect. It discovers which AI tools employees log into through supported browsers, shows the login method, and produces AI usage reports you can present to leadership.

Which AI tools does LastPass cover?

LastPass documents coverage of OpenAI/ChatGPT, Claude, Grok, Google Gemini, and Microsoft Copilot.

Can we block AI tools we do not approve?

Admins can set each AI tool to allow, warn, or block in the Admin Console. AI usage guidance, which warns before detected sensitive data enters an AI prompt, is a warning system, not a block.

Do we need to install new software?

No. The capabilities are built directly into the LastPass browser extension, and they work off the office network when the extension is installed and enabled in a supported browser.

Conclusion

A real AI policy decision needs three things: a list of the AI tools in use, the login methods behind them, and a record of what happens next. LastPass Business Max gives you all three through AI Monitoring & Protect, with usage rules that let admins allow, warn, or block each tool. With 92% of IT leaders reporting employee AI use and only 22% able to log or monitor it (LastPass 2026 State of AI and SaaS Security Report), visibility is a practical place to start.

Start with the data. Explore LastPass Business Max, review the AI Monitoring & Protect capability, and bring the usage report to your next leadership meeting. Less time on passwords. More time on what matters.