LastPass Report Finds AI Use Outpacing Security Governance

Summary

A LastPass report combining anonymized platform telemetry with a June 2026 survey and interviews finds widespread AI use with limited governance, alongside password reuse and unmanaged SaaS sprawl that raise data-exposure and compliance concerns.

Key points

In a survey of 412 admins, 92% said AI was in use in their organizations; 27% reported an enforced AI-use program, while 42% said they had no technical controls for employee AI access.
The survey found 46% of organizations reported moderate-to-high shadow AI use, while 19% were unsure of its extent. 68% named employees entering sensitive corporate data into AI tools as their top concern.
Among 450,784 users across 20,631 organizations, LastPass platform data found 52.8% reused passwords and 21.2% logged in with credentials that had appeared in known breaches.
Password reuse in the platform data was about 66% at the smallest organization segment and 42% at enterprise organizations.
Across 15,907 organizations, 65.5% of apps had no recorded login in the prior 30 days, and 64.4% were in categories where another app was already used.
The report advocates establishing visibility into AI and SaaS use before applying targeted governance controls, rather than relying on blanket bans.
The platform findings are a June 2026 snapshot based on LastPass's known-app library; the report says usage outside that library is not captured. Its research also includes 10 IT and security leader interviews.

Article Details

Publisher: LastPass
Report Period: June 2026 data snapshot and research study
Scope: Anonymized LastPass SaaS and credential telemetry, plus a survey and interviews about organizational AI and SaaS use, governance, and visibility.
Sample Size: Platform data: 450,784 users across 20,631 organizations for credential findings; 15,907 organizations for app-usage findings. Research study: 412 admins surveyed and 10 prospective-customer interviews.
Key Statistics: 92% of surveyed admins said AI was in use in their organizations; 27% reported an enforced AI governance program.
42% of surveyed organizations had no technical controls for managing employee access to AI tools.
In platform data, 52.8% of 450,784 users reused passwords across accounts, and 21.2% actively used a credential that had appeared in a known breach.
Among 15,907 organizations, 65.5% of apps went unused within 30 days, and 64.4% were in a category where the organization already used another app.
Platform data showed password reuse at approximately 66% in the smallest customer segment and 42% in the enterprise segment; company-size comparisons are directional.
Recommendations: Maintain a continuous view of the organization’s SaaS and AI app footprint, including newly adopted apps and unused or redundant subscriptions.
Assess what data employees enter into AI tools and monitor AI usage, rather than relying only on tool inventories or access controls.
Use calibrated controls such as in-flow warnings for higher-risk apps and blocking when risk outweighs benefits, instead of blanket bans.
Provide in-context guidance at the point of risk.