Shadow IT is changing. Are you ready? - LastPass

GUIDE

The new reality of shadow IT in the age of AI

Nearly 2 in 3 organizations use ChatGPT. But only 22% of organizations have the tools to track AI tool usage. Get the LastPass 2026 State of AI and SaaS Security Report to find out where shadow IT is growing fastest and how to take control.

Download the report

Trusted by 100,000+ businesses worldwide · SOC 2 Type II, ISO 27001, ISO 27701 Certified · 4.5/5 on G2

illustration_seo-hero_2026-ai-security-report-svg

Key stats: What the data shows

Source: The LastPass 2026 State of AI and SaaS Security Report. Insights based on survey responses from 412 IT leaders, login habits from 450,784 users across 20,631 organizations, and app usage at 15,907 organizations.

64% ChatGPT is the most commonly cited unsanctioned AI tool in our survey of IT leaders, named by 64% of respondents.

Why it matters: Shadow AI is widely regarded as one of the fastest growing categories of shadow IT. When a tool is free and useful, employees don’t wait for permission. Now, you must decide how to gain sufficient visibility to assess risk and protect your business.

65.5% LastPass platform data shows 65.5% of SaaS apps go unused within 30 days of sign-up.

Why it matters: Tools adopted quickly and abandoned still have active credentials. If you never revoked access, the accounts they’re tied to can still be compromised.

2.6/5 IT leaders rated their confidence in detecting unapproved AI tools at 2.6 out of 5.

Why it matters: Many IT teams suspect shadow AI is happening. But they lack the visibility to understand its full scope, making informed risk management impossible.

Shadow IT management: Why it’s harder than it used to be

Prior to AI’s explosive growth, software procurement had enough friction built in to slow down the rate of adoption. If someone had their eye on a tool, they needed IT approval to charge the purchase.

Today, an employee can sign up for an AI writing assistant, vibe coding tool, or chatbot in the browser for free. The process takes just a few minutes.

And none of those tools will appear in your next quarterly software audit.

What makes this generation of shadow IT different:

  • When an employee pastes a client contract or sales forecast into an AI tool, that data now resides inside a platform whose data processing policies may not align with your organization’s risk tolerance.
  • Many AI tools are being granted access to calendars, inboxes, and code repositories. There, they can take action on behalf of your employees, with no guardrails imposed.
  • Offboarding gaps compound over time. When employees leave, the apps they accessed with personal emails don’t appear on your offboarding checklist. But they leave behind a trail of active credentials that can be weaponized.

In many cases, you have no visibility into any of the above.

68% of IT leaders cite sensitive data flowing into AI tools as their number one AI-related concern.

Source: The LastPass 2026 State of AI and SaaS Security Report

Shadow IT detection: How to get visibility without blocking everything

You shouldn't have to choose between blocking the tools your employees need or accepting the risks of unmanaged SaaS use.

You have better options.

The LastPass 2026 State of AI and SaaS Security Report examines how organizations are improving visibility into shadow IT and reducing risk without disrupting productivity.

Download the report today to discover the practical, simpler path to visibility, governance, and cost control.

Get the complete insights

Download the report
illustration_77medium-card_2026-ai-security-report-svg

What changes when shadow IT is visible

The first thing that changes is the quality of your offboarding process.

When an employee leaves, logs in LastPass Business Max show which SaaS and AI tools were accessed, which means you see a complete list of logins you can close in one pass.

The second thing that changes is the quality of your compliance conversations.

When a senior partner or auditor asks about SaaS and AI usage, the one who can say, “Here’s a live inventory and how each one is governed” presents differently from the one who says, “I think I have it under control.”

And finally, with visibility, you’re no longer just managing risk but also addressing budget shortfalls originating from duplicate SaaS spend.

Try LastPass Business Max free Get a demo

What the data reveals about shadow IT

The LastPass 2026 State of AI and SaaS Security Report is based on:

  • App usage at 15,907 organizations
  • The login habits of 450,784 users across 20,631 organizations
  • Insights from 412 IT leaders
  • The latest AI adoption, credential security, and SaaS governance trends

Explore the latest data on shadow IT and SaaS security and see how lean teams with limited time and resources are responding.

Get the complete insights

Download the report
illustration_77medium-card_2026-ai-security-report-svg

Explore more in the AI & SaaS Security series

View all AI & SaaS security guides

FAQ: Managing shadow IT

Not every unsanctioned tool represents an immediate risk.

But if you lack visibility into what apps are active across your organization, you can’t assess data handling practices and enforce usage policies.

The risk is proportional to the sensitivity of the data shared. Sharing proprietary code fragments with a vibe-coding platform like Base44 is far riskier than sharing nonconfidential design elements with a content creation platform like Canva.

LastPass Business Max helps you tell the difference. It identifies every SaaS app and AI tool your team uses, sanctioned or not, so you can set block, warn, or allow rules based on risk. Everything runs through the LastPass browser extension, with no agents or proxies to deploy.

LastPass Business Max's AI usage guidance feature provides visibility into potentially risky AI interactions without capturing the content of employee prompts.

It surfaces an in-browser warning when an employee appears to be about to share login credentials, API keys, or PII with an AI tool.

Warning events are logged, giving you the visibility you need to educate users on safe AI usage.

Many organizations detect shadow IT in three ways: quarterly reviews, employee surveys, or alerts from endpoint agents.

But there are downsides to all three. Reviews miss the times between cycles, surveys depend on employee memory, and browser-based logins are invisible to endpoint agents.

The LastPass 2026 State of AI and SaaS Security Report examines why visibility remains challenging and explores the simple, but effective approach organizations are using to address the problem.

Full-featured CASB (Cloud Access Security Broker) solutions are often better suited for enterprise teams with the staff, budget, and operational maturity to deploy and manage.

For many small to mid-sized IT teams, a CASB can be more than is needed to gain visibility into shadow IT.

A simpler approach is a shadow IT detection tool like LastPass that governs risk without added complexity.

LastPass works through a browser extension, with no need for agents or infrastructure changes. Your team can begin discovering shadow IT usage shortly after deployment.

Don't see your questions here? Visit Support Center.

Get started with LastPass for Business

Try LastPass free Contact sales
No credit card required for the 14-day trial.