92% of employees use AI at work — only 27% of IT leaders can govern it
How many employees are using AI tools without IT's knowledge? Nearly all of them. LastPass's 2026 State of AI and SaaS Security Report found that 92% of employees use AI tools on the job, but only 27% of IT leaders have the controls to govern how they're used.
How big is the AI governance gap?
Wide, and widening. 73% of organizations don't have a comprehensive, actively enforced AI policy, and 42% have no technical controls governing AI use at all. Adoption is outpacing oversight by a wide margin.
Which AI tools are employees using without approval?
ChatGPT leads by a wide margin, followed by Claude, Gemini, Microsoft Copilot, Grammarly, and Perplexity. Independent adoption rates:
- ChatGPT: 64%
- Claude: 39%
- Gemini: 36%
- Microsoft Copilot: 35%
- Grammarly: 29%
- Perplexity: 11%
Does banning AI tools solve the problem?
No. Seven of ten IT leaders say banning AI doesn't eliminate the risk — it just moves usage to personal accounts and devices, where IT has even less visibility than before.
How exposed are organizations through SaaS and AI credentials?
More exposed than most IT leaders expect. 21.2% of employees are logging in to SaaS and AI tools with credentials already flagged in third-party breaches. SaaS sprawl compounds the problem: 65.5% of provisioned SaaS apps are abandoned within 30 days, and 64.4% of SaaS apps in the average organization are redundant duplicates.
How confident are IT leaders in detecting sensitive data exposure?
Not very. IT leaders rate the importance of detecting sensitive data in AI tools at 4.22 out of 5, but their confidence in actually being able to detect it sits at just 2.5 out of 5 — a real gap between what matters and what teams can deliver today.
Get the full report
These findings come from LastPass's analysis of 15,907 organizations, 450,784 users across 20,631 organizations, and a survey of 412 IT leaders. Download the 2026 State of AI and SaaS Security Report for the complete data, methodology, and recommendations for closing the AI governance gap.
Key takeaways
- 92% of employees use AI tools at work, but only 27% of IT leaders have the controls to govern that usage.
- 73% of organizations lack a comprehensive, actively enforced AI policy, and 42% have no technical AI controls at all.
- 21.2% of employees log in to SaaS and AI tools with credentials already exposed in third-party breaches.
- ChatGPT, Claude, and Gemini are the three most common AI tools employees adopt independently, without IT approval.
- Banning AI tools doesn't reduce risk — seven of ten IT leaders say it just pushes usage to personal accounts and devices.
