Hi! We are here to help you.

Your employees’ online behaviors affect the safety of your business, and we know it’s hard to change bad habits like password reuse. Our new Security Dashboard can help. It provides an overview of the security of their accounts all in one place. Users will see weak and reused passwords so they know what needs to be updated, and the dark web monitoring feature checks if their email addresses are compromised, so they can rest assured that their accounts are protected online.  

LastPass admins can manage the "Control dark web monitoring" policy and its settings for their employees. Once enabled, their email addresses are continuously checked against Enzoic’s database of breached credentials. If their information is found to be compromised, an email notification is sent to the end user’s email address, and a dark web monitoring alert is displayed within the end user's Security Dashboard.

Notice: In addition to providing real-time monitoring of your email addresses, LastPass retroactively checks against breaches for up to one year prior to the date that dark web monitoring becomes enabled (only once, at the time of sign-up).

Yes. Using the new Admin Console (available at https://admin.lastpass.com/), you can retrieve a security report that lists users who have one or more unresolved dark web monitoring alerts. For this, make sure you have the "Control dark web monitoring" policy enabled (under Policies > General policies). Note that this policy is enabled by default.

When the "Control dark web monitoring" policy is enabled, LastPass performs a background security scan against a database of known third-party security breaches. If a username associated with a login is potentially at risk, the "Unresolved dark web monitoring alerts" security report (available under Reporting > General reports > Security) displays the email address and name of the affected user. Note that only those users appear in the report that have dark web monitoring enabled.

The report refreshes once per day.

LastPass admins of LastPass Business accounts do not have the ability to turn off the Security Dashboard feature for their end users.

However, LastPass admins can choose to restrict the "Control dark web monitoring" policy for their users.

Note: The "Control dark web monitoring" policy is enabled by default, and configured to allow end users to manage their email addresses for monitoring (i.e., value 1 when configuring the policy).

To manage this policy and its settings, please see How do I manage the dark web monitoring policy for LastPass Business users?