From adoption to governance: Where should your team start?
Before you can govern ChatGPT, you need to know how many employees are using it, how they’re accessing it, and what data it can reach. Start with visibility: See it first, then govern it.
Step 1: Benchmark your posture against that of the industry.
Before writing policy, establish your baseline: How many AI tools are in use, how many did IT sanction, and how large is the gap between those two numbers?
This gap is your governance starting point, and it's often larger than expected. The LastPass 2026 State of AI and SaaS Security Report highlights this by organization size and adoption maturity levels, so you can see where your organization stands relative to organizations your size.
Step 2: Map every authentication point, not just managed identities
Most AI tool access bypasses traditional controls. Consumer accounts, personal emails, and direct browser logins mean your IT team often lacks a complete picture of adoption.
Step 3: Triage by data sensitivity, not tool category
Not every AI tool carries equal risk.
A presentation tool like PowerPoint that uses AI to generate or format slides may present a lower exposure than an AI writing assistant that drafts emails to customers.
The most effective governance programs prioritize AI tools based on the type of data they can access and process.
What's possible with an accurate AI inventory?
The steps above build toward a single output: an accurate, live AI inventory. For lean teams, this unlocks what hard bans can’t:
- Tiered enforcement: With an accurate inventory, you can apply per-app rules that create less friction. This is what LastPass Business Max enables.
- Audit-ready documentation: As customers, insurers, and regulators increasingly ask organizations to demonstrate AI governance, maintaining a live inventory with applied controls provides a strong foundation for responding to those requests.
- Visibility into agentic AI: An accurate inventory puts you in a significantly better position to govern the next layer, such as agentic AI and MCP-connected integrations that bypass existing identity controls.
LastPass Business Max brings everything together in one plan, with shadow AI discovery, app usage rules, and real-time AI usage guidance, all from the browser extension your team already uses.
Where does your organization stand?
Only 22% of organizations currently have tools to monitor AI usage. The LastPass 2026 State of AI and SaaS Security Report details what the other 78% are up against.
Common viewpoints are:
-
"We already have an AI policy."
Policies only govern activity you can see. In the LastPass 2026 State of AI and SaaS Security Report, organizations consistently reported AI usage occurring outside standard approval processes.
-
"Our SSO gives us visibility."
The most commonly used AI apps, such as ChatGPT, Claude, Gemini, Copilot, are accessed with personal credentials and direct browser sign-ins that never appear in SSO logs.
-
"Employees only use approved AI tools."
Despite intent, in LastPass’s survey, 46% of organizations reported moderate to widespread shadow AI.
-
"We're not a heavy AI organization."
92% of IT leaders told LastPass employees are actively using AI, with or without permission. For most organizations, the question is no longer whether AI exists, but whether governance is keeping pace.
You can get the full picture on the biggest visibility gaps and which controls are gaining traction in the LastPass 2026 State of AI and SaaS Security Report.
Insights are based on survey responses from 412 IT leaders, login habits from 450,784 users across 20,631 organizations, and app usage at 15,907 organizations.
