LastPass warns employees before they share sensitive data with AI tools

LastPass has announced an expansion of its Business Max offering to include AI Monitoring & Protect and Web Monitoring & Protect, new visibility and governance capabilities that enable organizations to identify and secure the AI tools, SaaS applications, and websites its employees use, all from its existing browser-native extension.

AI Monitoring & Protect closes the gap between the speed of AI activity and IT’s ability to see and govern its use. Ninety-two percent of organizations say AI is already in use across their company, yet nearly two-thirds either have significant ungoverned AI use or lack the visibility to identify it, posing serious security concerns. With its expanded Business Max capabilities, LastPass administrators are empowered to govern apps and sites by category, help block visits to malicious sites, and identify and warn users before sensitive data is shared with AI tools.

“AI has quickly become a fundamental part of how people work, and for good reason,” said Don MacLennan, Chief Product Officer of LastPass. “Your employees are already using AI to help them work more efficiently, but the applications they access often carry risks that IT teams can’t see or efficiently govern. Still, AI’s value is too great to ban it completely. Organizations need a way to embrace AI while managing the security risks that come with it. With our new Business Max offerings, LastPass is helping companies say yes to AI while protecting their business and empowering employees to work without unnecessary friction.”

The new capabilities are available to all Business Max customers, along with the previously available SaaS Monitoring and SaaS Protect. The expanded functions include:

LastPass AI Monitoring & Protect: Shadow AI tool discovery and AI usage guidance

Because organizations cannot protect what they cannot see, AI Monitoring, which helps admins discover Shadow AI, is a critical first step toward effective AI governance. AI Monitoring gives admins visibility into their AI ecosystem, including which tools employees are using in the browser. This essential knowledge gives IT teams a clearer understanding of how AI is being used, where potential risks are, and what governance efforts should be prioritized.

With effective visibility in place, AI Protect is the layer that turns that knowledge into action by empowering organizations to:

AI usage guidance: With its expanded capabilities, the new AI Protect solution helps organizations control how sensitive data is provided to AI tools in the browser. Sixty-eight percent of organizations say their greatest concern is employees entering data like credentials, API keys, or personal information into AI tools, yet confidence in responding to this risky behavior remains low. AI Protect logs detected attempts for admins to review while also providing employees with a real-time warning before they share sensitive data with AI tools in the first place.

LastPass Web Monitoring & Protect: Website discovery, malicious site blocking, and website rules by category

As employees navigate an ever-expanding range of websites that can expose organizations to malware, infostealer software, and other threats, businesses need greater visibility into web activity and strong access controls. Web Monitoring gives admins insight into what employees are accessing and where they may be exposed to risk, helping them establish appropriate access policies. Then, Web Protect capabilities give admins a simpler, more scalable way to enforce those policies and protect employees from high-risk sites, including:

• Website discovery: Get visibility into the websites employees visit, where they may be exposed to risk, and when they were last accessed.
• Malicious site blocking: A new Malicious/Risky category allows admins to block phishing, malware, and other high-risk sites across the organization with a single rule, helping reduce exposure from web-based threats and improve employee browsing protections without requiring admins to manage individual sites.
• Web rules by category: Admins can apply Block, Warn, or Allow rules to entire categories of sites at once, making it easier to enforce consistent web access policies without going application by application. Web rules by category automatically identify 25+ site categories and use AI-powered domain classification to help keep emerging and changing sites covered, but specific app-level rules set by admins always take precedence.