The news
LastPass on September 29 expanded LastPass Business Max with AI Monitoring and AI Protect, features that show IT teams which AI tools employees use and warn staff in real time before they share sensitive data with those tools.
The features run from LastPass's existing browser extension, the company said. AI Monitoring discovers shadow AI, meaning AI tools employees use without IT's approval. AI Protect warns employees before they share data such as credentials, API keys or personal information with AI tools, and logs the detected attempts for administrators to review.
LastPass also added Web Monitoring and Web Protect. They show which websites employees visit, block known malicious sites through a single Malicious/Risky category, and let administrators set Block, Warn or Allow rules across more than 25 website categories, with AI-based classification for new domains, according to LastPass and Help Net Security. The features sit alongside Business Max's existing SaaS Monitoring and SaaS Protect tools.
The expanded Business Max is available in beta for customers who opt in through the Unified Admin Console and will be generally available in mid-October, LastPass said. The capabilities are included in Business Max, which LastPass's product page lists at $11 per user per month.
LastPass tied the launch to a survey it cited in the announcement. Ninety-two percent of organizations said AI is already in use across their company, yet nearly two-thirds either have significant ungoverned AI use or lack the visibility to identify it. Sixty-eight percent said their greatest concern is employees entering data such as credentials, API keys or personal information into AI tools.
Don MacLennan, LastPass's chief product officer, said the company is "helping companies say yes to AI while protecting their business." LastPass, based in Boston, says it is used by more than 100,000 organizations.
The numbers
- Organizations saying AI is in use across the company (LastPass survey)
- 92%
- Organizations with significant ungoverned AI use or no visibility (LastPass survey)
- Nearly two-thirds
- Organizations whose greatest concern is staff entering sensitive data into AI tools (LastPass survey)
- 68%
- Website categories for Block, Warn or Allow rules
- 25+
- Business Max list price (LastPass product page)
- $11 per user per month
- ICO fine on LastPass UK Ltd over 2022 breach (December 11, 2025)
- £1.2 million
Why CEOs should care
For CIOs and CISOs at mid-size companies, the appeal is that shadow AI discovery arrives through an extension that employees at LastPass customers already run, rather than a new agent or network appliance. Know its limits before relying on it. Ask LastPass what it cannot see: AI use in desktop apps, on phones, in browsers without the extension, or through tools that connect by API. Note that the announcement describes AI Protect as warning employees and logging attempts, not blocking the data, so ask whether admins can turn warnings into hard blocks for specific tools or data types.
For CFOs, the pitch is cost consolidation. Because the features are included in Business Max, listed at $11 per user per month, compare that with quotes for separate SaaS management or data loss prevention tools. Price the upgrade from lower LastPass tiers too, since the new features come only with Business Max.
Boards and legal teams should weigh two more points. First, monitoring which websites and AI tools employees use, and logging their attempts to share sensitive data, is employee monitoring; check notice and consent requirements, especially in Europe. Second, trust: the UK Information Commissioner's Office fined LastPass UK Ltd £1.2 million on December 11, 2025, over a 2022 breach that compromised the personal information of up to 1.6 million of its UK users. Ask LastPass where the new activity logs are stored, who at LastPass can access them and how long they are kept.
The bigger picture
Password managers already sit in the browser at the moment employees log in to apps, which makes them a natural checkpoint for watching AI use. LastPass is not alone in treating unsanctioned AI as a selling point: Omnissa said on the same day that its own research found three-quarters of AI assistant use on enterprise endpoints comes from unsanctioned tools. For buyers, that raises the risk of paying for overlapping shadow-AI dashboards from several vendors, so it is worth deciding which layer, browser, endpoint or network, should own the job.
What’s next
General availability is set for mid-October. Watch for whether AI Protect gains blocking controls, for independent tests of how well its warnings catch credentials and API keys, and for how rivals in password management and identity respond.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
