LastPass has released findings from its inaugural 2026 State of AI and SaaS Security Report, finding that AI adoption is outpacing organizations’ visibility and control over its use.

The research is based on anonymized LastPass platform data and a survey of more than 400 business administrators. The report examines AI adoption alongside ongoing SaaS sprawl and shadow IT challenges, including the growing use of autonomous AI agents.

“AI tools are now being adopted faster than previous categories of traditional software, and the growing popularity of autonomous agents is creating a new security reality that organizations cannot afford to ignore,” said Don MacLennan, chief product officer at LastPass. “AI is silently embedding itself into tools that organizations have already approved, and even ‘approved’ agents are fanning out to multiple ungoverned interactions, creating risks companies may not even know they have. You can’t control what you can’t see, and this research proves the growing gap between AI adoption and organizational visibility is impossible to overlook.”

According to the report, 92% of business administrators said AI is already in use across their organizations, while only 27% reported having an enforced AI governance program. Additionally, 42% said they have no technical controls for managing employee access to AI tools, including allow lists, block lists or data loss prevention rules covering AI traffic.

Employee use of sensitive information with AI was identified as the biggest concern by 68% of business administrators surveyed. However, respondents’ confidence in identifying and addressing that risk averaged 2.5 out of 5.

More than 40% of organizations said they plan to implement technical controls within the next 12 months.

The report also examines credential-related risks that predate AI adoption. More than half of users surveyed by LastPass, or 52.8%, reuse passwords across accounts, while at least 21% are actively logging in with credentials that have appeared in a known data breach.

LastPass said employees are also using consumer-grade tools with personal accounts or accounts that IT has not connected to the company’s single sign-on system. The report links these unmanaged accounts to visibility gaps and additional opportunities for credential theft and sensitive data exposure.

The report also identifies financial risks associated with unmanaged AI and SaaS usage beyond the potential costs of a security breach.

More than 65% of applications organizations sign up for go unused within 30 days, according to LastPass. More than 64% of applications fall into categories where organizations already use at least one other application, creating potentially redundant use cases.

LastPass also said unmanaged AI adoption is increasing compliance exposure gaps, which could contribute to regulatory fines, legal action, loss of government contracts and exclusion from future bids.

The report argues that AI governance should begin with visibility into which AI and SaaS tools employees use, where corporate data and credentials are flowing and which applications create unnecessary risk or redundancy. LastPass said this visibility can allow organizations to establish controls around AI use without limiting the productivity gains associated with the technology.

The research analyzed anonymized aggregated platform data, including credential data from 450,784 users across 20,631 organizations and app-usage data from 15,907 organizations. It also included a survey of 412 LastPass Business and Business Max administrators and interviews with 10 prospective customers at organizations with roughly 100 to 2,500 employees in data-sensitive industries including professional services, healthcare, education, finance and technology.