Phishing attacks are everywhere these days. People encounter them while shopping, job hunting, reading work emails, and checking personal texts. Thanks to AI-powered scammers, phishing has become both more common and harder to spot, leading to disastrous consequences. A phishing attack on a business _costs an average_ of $4.8 million, and attacks on individuals can drain bank accounts and wreck credit scores. The scary thing about phishing is that it only takes one momentary lapse in judgment for a scammer to steal a victim’s information. In one common form of the attack, the scammer will send an email or text containing a link to a fraudulent (but real-looking) website. When the victim enters their information into the site, they’re really handing it to the scammer, who can then cause chaos with the stolen information. These fake phishing sites look convincing, but they often have some tell-tale signs, such as a misspelled URL. That means a lot of phishing attacks could be prevented by a second pair of eyes to alert you if something seems…well…phishy. Today, 1Password is beginning the rollout of a phishing prevention feature to act as that second pair of eyes and stop users before they share their passwords with scammers. Here’s how it currently works: when a 1Password user clicks a link where the URL doesn’t match their saved login, 1Password won’t autofill their credentials. That’s an important first step. However, in those situations, users may not understand _why_ their credentials aren’t being autofilled and try to manually copy and paste them to the fake website. Our new phishing feature adds an extra layer of protection. When a user attempts to paste their credentials, the 1Password browser extension displays a pop-up warning, prompting them to pause and exercise caution before proceeding. In the example above, it's easy for a user to miss that extra "o" in the URL, especially if the rest of the page looks convincing. But the pop-up reminds them to slow down and look more closely before proceeding. For our individual and family plan users, this feature will be enabled by default once it is rolled out. 1Password Admins can enable this for their employees in Authentication Policies in the 1Password admin console. This feature is just one of the ways 1Password protects our users from phishing attacks. Another part of that effort is understanding _how_ people are getting phished. To get more insight about that, 1Password surveyed 2,000 American adults to learn how people are falling victim to and protecting themselves from phishing scams – both at work and in their personal lives. We learned that the problem is nearly universal; **89% of Americans have encountered a phishing scam, and 61% have actually been phished.** Clearly, people need help defending themselves. We’ll spend the rest of this blog digging deeper into the results and offering practical advice for preventing phishing attacks at home and at work. ## AI-powered scammers are flooding Americans with tough-to-spot phishing attacks Phishing has been around for decades, but AI is helping attackers run more believable scams at higher volumes. People used to spot phishing attempts by their typos and shoddy graphic design, but with AI, it takes only minutes for a scammer to create a highly polished phishing email or website. As we mentioned, the best way to spot a phishing site in the age of AI is to check the URL, but only 25% of Americans in our survey said they hover over URLs before clicking them. ### Take-home lesson #1 Don’t rely on obvious mistakes to spot a scam. Always make sure that a website URL matches the official company domain before clicking. Dave Lewis, Global Advisory CISO 1Password ## Shopping, scrolling, and job-seeking: How Americans get phished at home When we look at _where_ Americans are getting phished, it’s a mix of the usual suspects and some unexpected entries. **Where Americans have been phished** * Personal email: 45% * Text message 41% * Social media: 38% * Phone call 28% * Online ads or search results: 26% There's a surprising disconnect between where people report encountering suspected phishing attempts and where they have been successfully phished. For instance, there’s a big gap between the number of people who have _gotten_ a suspected phishing phone call (49%) and the number who have fallen for it (only 28%). That indicates that people, on the whole, are still fairly capable of spotting a scam phone call (at least until _AI voice scams_ become more widespread). On the other hand, only 37% of people report seeing a social media phishing attempt, but 38% of phishing victims have been tricked there. ### Take-home lesson #2 Any place where you can share your personal data is a place you can be phished. Even online search results can be planted by bad actors. Dave Lewis, Global Advisory CISO 1Password Next, we asked phishing victims what they were trying to do when they were phished. **Most successful phishing bait** * Get a special deal, price, or sale: 41% * Track a delivery or package: 31% * Apply for a job: 25% * Conduct personal business (banking, wire transfers, etc.): 23% * Respond to a legal issue (tax error, speeding ticket, etc.): 17% * Donate to a charity or cause: 13% The common thread between all these ruses is that they create _emotional and financial urgency_. We rush to take advantage of a good deal, to resolve a potential legal dispute, to protect our money and purchases, to support the causes we believe in, and (especially in a crowded job market) to secure a new role. ### Take-home lesson #3 If your heart rate increases, your caution should too. If a situation is urgent, contact the sender through a trusted channel, NOT the website, email, or phone number you see in the message. Dave Lewis, Global Advisory CISO 1Password ## Urgent messages from HR and the boss: How Americans get phished at work Our survey found that working Americans are 16% more likely to have fallen for a phishing scam than non-workers (67% vs 51%). The most likely explanation is that workers spend more time on their devices, which increases their exposure to phishing attempts. Indeed, **36% of workers we surveyed admitted they had clicked on a suspicious link in a work email.** Of those, 26% were responding to HR or their boss – both of which can trigger a sense of emotional and financial urgency. Here’s one story shared by a survey respondent that illustrates how this works in practice. > _About six months ago, a coworker in our office received what appeared to be an urgent email from our IT department requesting her to verify her credentials by clicking a link. The email looked legitimate with our company logo and formatting. She was busy and clicked the link without thinking, entering her username and password on what turned out to be a fake login page. Within hours, someone tried accessing company files using her credentials._ > > _Fortunately, our security system flagged the unusual activity and locked the account before any data was actually stolen. IT immediately reset all passwords and implemented additional two-factor authentication across the organization. She felt embarrassed but reported it right away, which helped prevent a more serious breach. The IT team used it as a training example for the rest of us about recognizing phishing attempts, even when they look convincing.”_ - Gen Z man in California This story has it all: an urgent email, a fake login page, and another crucial theme: **credentials**. ## Scammers are phishing for employee passwords One of the most important differences between phishing scams in private life versus at work is the importance of passwords. To be clear: scammers take advantage of weak and compromised passwords wherever they find them, but when they’re going after an individual target, the ultimate goal is usually short-term financial gain. Phishing attacks on companies are often far more sophisticated and may be the first stage of a more elaborate scheme. Indeed, _phishing attacks are the leading vector in ransomware attacks_. In this scenario, an attacker’s goal is to gain deep access to a company’s systems to steal or encrypt data. And their biggest asset is an employee password that will give them the access they want. The perfect target for a phishing attack is an employee with poor password practices, such as: * Default passwords that were never reset * Duplicate or similar passwords across multiple accounts * Weak and easily guessed passwords * No multifactor authentication (MFA) Unfortunately, poor password practices are rampant in the workplace. A single reused password can allow an attacker to move from one application to another, setting the stage for a hugely disruptive and expensive attack. ## The role of IT in preventing phishing and building a culture of security There are various methods IT teams (and companies in general) can employ to help prevent or mitigate the damage of phishing attacks. * Deploying an _enterprise credential management solution like 1Password_ helps ensure they use strong, unique credentials for every login. It also notifies admins if MFA is available but not in use, or if a credential is compromised in another breach. * Many companies require employees to complete regular phishing training and sometimes even conduct simulated attacks to ensure they respond correctly. * Requiring MFA across company-managed apps is another commonsense solution to help minimize the damage that can be caused by stolen credentials. * Likewise, larger organizations may have network monitoring and other detection software that can flag suspicious behavior that signals a bad actor trying to infiltrate a company’s systems. But even with every possible anti-phishing measure in place, at some point it still comes down to an individual employee with their mouse hovering over a link, deciding whether or not to click. In those situations, the “x factor” might be an employee’s sense of responsibility for their company’s security. **Our survey found that employees who believe it’s IT’s job to stop phishing are much more likely to fall victim to phishing.** Meanwhile, 78% of employees know they should report phishing to their IT department, but more than half (56%) delete suspicious messages instead. These numbers highlight the need for better communication between IT and end users, and for company leadership to make it clear that security is _everyone’s_ responsibility. > _Getting ahead of phishing attacks is all about communication, that’s what disrupts the scammer’s plan. The most important thing an employee can do if they receive a suspicious message is_ tell someone _. A lot of attacks could be prevented by simply knocking on the cubicle next door and saying ‘hey, does this look right to you?’ If someone believes they’ve already been phished, they should notify IT immediately. Those are the skills you learn with good training, and they need to be constantly reinforced, so people remember them when they get those urgent, scary-looking messages.”_ > > - Dave Lewis, Global Advisory CISO, 1Password The goal of 1Password’s new anti-phishing feature is to give users – whether at work or home – a subtle reminder that helps their training kick in. We’re excited to continue developing it as part of our overall mission to secure the future of work. _If you’d like to learn more about how 1Password can help protect you, your family, and your business, get in touch with our team_.__ _1Password conducted this study using an online survey prepared by_ _KW Research_ _and distributed by_ _PureSpectrum_ _, completed by n=2,000 American adults. Within employees, a range of role types, seniority, and industries are represented. Data was collected from September 29 to October 2, 2025._ __

Landing a job interview at 1Password is a big moment – for you and for us. Every time we invite a candidate to meet with us, it's because we see potential for impact. Interviews are a chance for you to both share your perspectives and learn how we work together to achieve our ambitious goal: leading the way for human-centric identity security in the AI era. At 1Password, we have a set of practices that guide how we collaborate, measure success, and create meaningful impact. We call these the **1Password Behaviors for Success.** This guide will help you think like a member of our team and frame your interview around these behaviors. It will help you both gain a deeper understanding of our company and approach your interview with confidence. ## **Behavior 1: Take full ownership** As we enter our next chapter as a high-growth company, we're collectively raising the bar on ownership. At 1Password, ownership is about taking pride in delivering quality work and high-impact outcomes, and we’re looking for teammates who think deeply about impact and responsibility. In interviews, we're listening for the moments where you: * Took responsibility end-to-end, not just your piece of a project * Balanced competing priorities in service of customers, quality, or long-term value * Proactively identified a problem and drove the solution **Tips to prepare:** * Share an example where you stepped in to help the team improve quality or clarity * Bring examples where you were accountable for the impact of your work, not just the deliverable * Be ready to talk about decisions you made and why you made them ## **Behavior 2: Proactively contribute** We move quickly through complex challenges, and we look for people who can anticipate needs, spot opportunities, and act decisively. This can show up as: * Noticing problems before they become blockers * Going above and beyond to support your team * Turning ideas into action, even amid uncertainty **Tips to prepare:** * Highlight a moment when you spotted a gap and took action * Share how AI-powered tools help you remove friction and work more efficiently * Discuss examples where your initiative created momentum for others ## **Behavior 3: Practice a growth mindset** We don’t expect perfection. Instead, we look for curiosity, openness to feedback, and willingness to grow. Our core company **values** shape how we seek continuous growth as a team: **Put people first:**_We win together by serving others first._ **Keep it simple:**_We focus on what matters most._ **Lead with honesty:**_We lead with transparency and own our impact._ In interviews, we listen for: * How you ask for and respond to feedback, especially when it's hard * How curiosity and experimentation play a role in your work * How you invest in your professional development **Tips to prepare:** * Share your approach to experimenting and iterating, and how you leverage AI to improve * Talk about your approach to delivering and receiving honest feedback * Be transparent about opportunities for growth and mentorship ## **Behavior 4: Be adaptable and resilient** As we scale our teams and evolve our products, we embrace change as a natural part of how we work. This shows up when you talk about: * Navigating ambiguity or shifting priorities * Adjusting your approach when you learn new information * Recovering from setbacks and moving forward stronger **Tips to prepare:** * Identify a time when plans changed and you adjusted quickly * Highlight an example where you navigated ambiguity by focusing on what mattered most * Share what helps you adapt to new tools or ways of working ## **Behavior 5: Collaborate effectively** Inclusion is at the heart of how we win together. We leverage diverse perspectives, share insights with one another, and build shared accountability. We're looking to understand how you: * Seek a range of perspectives to get better outcomes * Communicate clearly across teams or departments * Build trust while holding a high bar for excellence **Tips to prepare:** * Reflect on how you create space for others to contribute * Be ready to talk about how you resolve conflicts and build trust * Highlight ways you foster shared accountability and celebrate team wins > I’m proud of the culture we’ve built and the talent choosing to join us and shape what's next. We’re committed to helping every candidate feel supported as they explore whether this is the right place for them.” — Lyndsey French, Senior Director, Global Talent ## **Want to learn more before your interview?** * Read about _what high performance means to us at 1Password_ * Check out the _impact our inclusion program made in 2025_ * Explore _stories from customers_ that trust 1Password to secure their business ## **We can’t wait to meet you** As you continue your journey with us, we hope you feel supported, encouraged, and excited about the possibility of a future at 1Password. We see this as a two-way conversation, and if our Behaviors for Success resonate with you, there’s a good chance you’ll feel energized about what’s ahead. Visit our _careers page_ to see our open roles and follow us on _LinkedIn_ to stay connected with life at 1Password.

It’s easy to see how SaaS sprawl happens if you picture the moment it starts. A team is blocked, someone needs a tool ASAP, and the answer to their problems lies just behind a free trial, so they sign up for a new tool. No one is being careless. They’re being efficient. The problem is that follow-up rarely keeps pace with new sign-ups, especially when the card on file belongs to "the company" and the requester has already moved on to the next priority. Months later, you realize you are paying for services you don’t use and can’t remember how to log in to, let alone cancel. Every invitation to “try this new tool” adds another subscription, another license, and another place where company IP is stored. Over time, this SaaS sprawl creates an environment overrun with shadow IT and unmanaged apps that IT, security, and finance teams can’t fully see or control. To get ahead of this, IT teams turn to SaaS management, a process for discovering in-use apps, managing access, and optimizing software spend. At its core, SaaS management ensures the right people have access to the right tools while removing unnecessary access to reduce security risks and overspending. Without this process, unmanaged SaaS causes serious problems. Cost control suffers because companies _waste an average of $18 million annually on unused SaaS licenses_. Risk grows because _52% of employees use apps not approved by IT_, and _38% of employees retain access to data after leaving a company_. When app usage is spread across too many places, it becomes nearly impossible to show auditors who has access or what has changed over time. While SSO is an undeniably valuable tool for managing access, _70% of professionals agree it isn't a complete solution for securing identity_. Between apps that lack SCIM support and the "long tail" of unknown shadow IT, successful IT teams have to move beyond manual audits and spreadsheets. Let’s look at the five things successful IT teams do differently to manage and secure SaaS. ## Five tips to improve SaaS management ### #1: SaaS discovery does not equal SaaS management Employees and business units are signing up for new SaaS and AI apps faster than IT can keep track of them. IT teams can get a list of some new apps, but what happens next? **The common pattern:** IT discovers apps through a mix of SSO logs, audits, and expense reports, but the process stops at the spreadsheet. Knowing an app exists doesn't tell you who is using it, why they need it, or if a redundant tool already exists in your ecosystem. When teams operate in silos, you don't just get redundant apps, you get redundant bills. Conducting a SaaS audit once a year is not enough. **What successful IT teams do instead:** They treat discovery as the start of a workflow, not a final report. They leverage automation to continuously pull shadow IT and shadow AI into a unified list, then immediately add context: who is using it, when it was last used, and how access is granted. Every newly discovered app moves through a deliberate "in review" process where stakeholders are surveyed for business context before IT decides to manage, consolidate, or sunset the tool. **How**** _1Password SaaS Manager_****helps:** * **Discover SaaS usage:** Capture a list of every newly discovered app and each user to immediately understand who is using what. * **Turn discovery into management:** Use automated "new app discovered" workflows to move items off the IT backlog and into an active review process. * **Automate user surveys:** Automatically reach out to users via Slack, Microsoft Teams, or email to gather essential business context the moment an app is found. * **Continuous Shadow IT/AI monitoring:** Maintain a real-time, unified list of all unmanaged tools so nothing, including tools outside of SSO, slips through the cracks. * **Streamline license reclamation:** Use automated workflows to communicate with users about license removal or plans to consolidate redundant tools. ### #2: Offboarding is more than removing access to SSO The _easiest offboarding mistake_ is disabling SSO and relying on manual app clean-up to finish the job. **The common pattern:** IT teams know deactivating SSO access is not a complete offboarding plan, but the rest of the work is manual across dozens of apps. Removing a user in SSO or IdP blocks access to applications behind SSO, but it doesn’t necessarily delete licenses in each app, revoke OAuth tokens, or transfer ownership of files, calendars, or shared resources. That is where the long tail of unmanaged apps can leave accounts and data lingering after an employee departs. **What successful IT teams do instead:** They treat _SaaS offboarding as an end-to-end workflow_. It begins with the discovery list to identify every app a user touched, even those outside of SSO. They trigger automated deprovisioning and license reclamation for each app, keeping the process consistent so the long tail doesn’t become a hiding place for lingering access. Crucially, they build business continuity into the motion: ownership of shared resources is transferred, and managers are notified for review, ensuring work doesn't get stranded when an employee leaves. **How 1Password SaaS Manager helps:** * **Complete end-to-end workflows:** Build automated workflows that cover every critical offboarding step, from recovering licenses to transferring ownership of email inboxes, calendars, and shared files to managers. * **Automated license reclamation:** Instantly revoke access and reclaim paid seats to prevent unused licenses from impacting your budget. * **Automated manager notifications:** Trigger messages via Slack, Microsoft Teams, or email to prompt managers for any necessary manual actions regarding a departure. ### #3: Mitigate compliance and security risks with automated access reviews Once you centralize and automate access reviews, you will never do them in spreadsheets manually again. **The common pattern:** Access reviews are a manual frenzy of spreadsheets and "static" exports compiled in a frenzy before a deadline. Because the process is error-prone and slow, permissions inevitably drift as people change roles, teams reorganize, and former employees retain access, leaving the door open for security risks. **What successful IT teams do instead:** They stop treating access reviews as a one-off project and start treating them as a repeatable process. Reviews are scheduled, not improvised. Access is reviewed with context, including role, department, risk level, and external identities. And when access needs to be updated, teams can act directly from the review dashboard to revoke or adjust access immediately, producing clean documentation for faster audits. The work becomes less about chasing confirmations and more about maintaining visible control. **How 1Password SaaS Manager helps:** * **Centralize access reviews:** Bring all applications, including those that aren’t behind SSO, into a single, unified access review process. * **Replace spreadsheets with standardized workflows:** Eliminate manual data entry and "static" exports by reviewers for faster, automated review cycles. * **Enable in-line remediation:** Adjust permissions or revoke access directly from the access review dashboard the moment a discrepancy is identified. * **Gain context for every user:** View access levels alongside critical data points like role, department, and risk level to make informed security decisions. ### #4: Connect SaaS usage to license spend data If you can’t tie license entitlements to actual SaaS usage, you can’t control SaaS spend. **The common pattern:** IT grants access quickly to keep employees productive, but visibility stops at "has access." Without usage data, you end up paying for inactive licenses for people who haven't logged in for months or entire teams on premium tiers they don't actually need. This results in wasted spend hidden in plain sight, ongoing operational costs of manual audits, and removals that divert IT from higher-value work. **What successful IT teams do instead:** They connect license usage directly with spend data to make optimization a daily operation, not a pre-renewal fire drill. They set clear inactivity thresholds of 30, 60, or 90 days to identify waste. Then, they automate the "reclamation" by prompting users via Slack, Microsoft Teams, or email to confirm they still need access before a seat is downgraded or removed. They keep waste from compounding quietly, one seat at a time. **How 1Password SaaS Manager helps:** * **Correlate usage with spend:** Utilize 350+ direct API integrations with the most commonly used business apps to automatically track login data with license expenditures. * **Continuous optimization:** Move away from last-minute budget scrambles by reclaiming unused licenses and optimizing seats continuously. * **Identify tier-level waste:** Downgrade users on expensive premium tiers who only require basic functionality. ### #5 Manage contract renewals proactively with shared visibility across IT and procurement Tie usage and contract data together to give IT and procurement teams the information they need to avoid surprise true-ups and negative impacts on your budget. **The common pattern:** When a renewal looms, IT and Finance find themselves in a manual "chase." Finance asks the questions, _“Do we need this? Is it being used?”_ but the answers are isolated in fragmented systems. IT has to sift through contract details that live in procurement tools, while usage data is buried in IdP reports, app-admin consoles, and ad hoc exports. Without a unified view, decisions are made on incomplete data. This leads to a reactive cycle: auto-renewals lock in bloated seat counts, surprise true-ups occur when teams add licenses unnecessarily, and redundant tools persist because no one can see the overlap. Ultimately, IT and Finance end up looking at different numbers, which means lost negotiation leverage and preventable year-over-year spend increases. **What successful IT teams do instead:** They bring contract, spend, and usage data together into a single view of the SaaS portfolio, so everyone, including IT, procurement, and finance, plans renewals from the same source of truth. That view shows what you are paying for, who is using it, renewal dates, renewal status, license availability, and overlapping tools by category. When data is shared and up to date, renewals stop being a last-minute scramble and become a normal operational workflow: align early, negotiate with confidence, and consolidate where it makes sense. **How 1Password SaaS Manager helps:** * **Centralize contract and vendor data:** Integrate directly with finance tools or use 1Password SaaS Manager’s built-in AI tool to upload and extract key details from contracts. * **Establish a shared source of truth:** Give IT, Finance, and Procurement a unified view of the entire SaaS portfolio, including spend, usage, and renewal status. * **Surface tool overlap and redundancy:** Automatically identify overlapping tools to support informed consolidation and cost-cutting decisions. * **Trigger proactive renewal notifications:** Use automated workflows to alert the right stakeholders 30, 60, or 90 days before a contract expires, avoiding overspending. * **Negotiate with data-driven confidence:** Approach renewals with real-time utilization data to ensure you only pay for the apps and licenses the company actually needs. ## A faster way to see, manage, and optimize your SaaS environment SaaS sprawl happens because everyone is trying to get work done, using the best tools available to them. The difference with successful IT teams is that they don’t rely on one-time audits or spreadsheets to stay in control. They build repeatable SaaS management processes that maintain visibility, ensure secure onboarding/offboarding, validate access reviews continuously, optimize licenses before waste compounds, and bring contract renewals into a shared view with procurement and finance. _Customers choose 1Password SaaS Manager_ because it delivers rapid, automated visibility into their SaaS environment, cuts manual work, and centralizes spend optimization. By turning SaaS management into a repeatable, automated workflow, you can stop worrying about the "free trial" that started it all. You can let your teams move fast and stay efficient, knowing that your SaaS stack and your budget are no longer piling up in the dark. ### Watch the webinar Learn how you can automate SaaS discovery, employee lifecycle management, access reviews, and renewals with 1Password SaaS Manager. Watch the webinar ### Secure access to your company’s apps Talk to our team to empower your workforce with secure SaaS access. Talk to our team

Every 1Password account tells a story. For many of our customers, 1Password is one of the first purchases they make after starting a company. Founders store their company’s social media credentials before they’ve written their first post, their cloud provider’s root credentials before they’ve spun up their first server, the shared mobile developer account before they publish their first app, and even the access code for the door at the entrance of their office, before they’ve added furniture. As companies grow, so does the number of apps their teams rely on, and access spreads beyond what IT can easily see or control. This shift toward business-led IT breaks traditional perimeter and identity assumptions. Shared credentials become the default for anything that doesn’t live behind SSO, and critical accounts end up scattered across vaults, spreadsheets, and browsers. When someone changes roles or leaves, those credentials can quietly live on; in fact, _38% of employees_ admit to accessing a former employer’s accounts after leaving. Our customers choose 1Password to store these secrets not just because it’s secure, but because it simplifies sharing them with the right people. These are secrets that don’t belong to any one person or employee; they belong _to the company_ and deserve special consideration. Today, we’re excited to _publicly preview_ a series of capabilities that help 1Password discover these company-owned secrets and accounts, bring them under governance, and give employees the best possible experience accessing the resources those secrets protect. ## Introducing 1Password Unified Access Unified Access is a core capability within the 1Password Extended Access Management (XAM) product suite. It combines 1Password Enterprise Password Manager (EPM) and 1Password SaaS Manager (formerly Trelica) to extend Zero Trust access governance beyond SSO and ensure every login is securely governed. Admins can now discover shared and sensitive accounts stored in their organization’s EPM vaults, centralize their management, and govern access across the workforce. At the same time, employees have a simplified sign-in experience to every app, whether behind SSO or not. With Unified Access, you can see exactly which applications rely on traditional credentials, apply Zero Trust principles to those access paths, and understand who uses them and how. When an employee changes roles or leaves the organization, you can revoke access and rotate those credentials with a single action. No more searching through vaults, chasing down shared logins, or wondering whether old passwords are still active. _Product screenshot:__Team members can access every app, whether behind SSO or not._ Every access and rotation event is logged automatically, giving your compliance team defensible records for frameworks like SOC 2, ISO 27001, and HIPAA. What once required hours of manual cleanup is now fast, consistent, and fully visible. And for employees, access becomes simpler. The App Launcher brings every SSO and non-SSO app into one place, so teams can find what they need without switching portals or tracking down scattered logins. This ensures employees can move quickly with the tools they choose, while IT maintains Zero Trust control over access. The result: stronger security and a smoother experience for everyone. ## What’s included in the public preview Starting January 13, Unified Access will be available in public preview for 1Password EPM Business customers in US-hosted environments with at least 100 users. **To join, complete the public preview**** _sign-up form_****,** and our team will reach out to get you started. _Product screenshot: Discover shared and sensitive credentials in EPM vaults._ Those who participate in the public preview will get access to four new capabilities: * **App Launcher:** Simplify the sign-in experience for every app, SSO or not. * **Shadow IT Discovery from EPM** : Detect sensitive and shared accounts across your organization’s EPM vaults. * **Account Risk Discovery** : Review discovered accounts and prioritize remediation based on risk level. * **Account Governance** : Centralize management of sensitive credentials and shared logins, determining who has access and who doesn’t. _Product screenshot: Review discovered accounts and take ownership._ Unified Access requires 1Password EPM and 1Password SaaS Manager. Customers who already have both products will be able to access the new features in their accounts at no additional cost. Customers participating in the preview who only have 1Password EPM will be given access to a free 30-day SaaS Manager trial with the new features. ## The future of Unified Access As part of the XAM suite, Unified Access is a major step toward 1Password’s mission to close the Access-Trust Gap, ensuring every login, device, and identity across an organization is secure, visible, and governed. This _public preview_ is just the beginning. Over the coming months, we’ll continue refining Unified Access based on customer feedback ahead of general availability. You can be part of that journey. **_Join the public preview waitlist_** to get early access, explore what’s new, and help shape how 1Password secures every corner of the modern workforce.

Developers are moving faster than ever with AI. Cursor is redefining how software gets built, and 1Password is redefining how teams secure access to SaaS and AI. Today, we are announcing a new integration that brings these two worlds together in a way that keeps development speed high and credential risk near zero. 1Password has partnered with Cursor to build a Hooks Script that gives developers a secure, just-in-time way to ensure required secrets are made available to Cursor’s AI agents via 1Password Environments. The result is an AI-native development workflow where secrets are never hardcoded, raw credentials are never handled directly by AI agents, and secure access becomes a natural part of writing and running code. This functionality is available today as a first step and lays the foundation for a broader set of secure developer workflows we intend to build together. ## Why this matters Developers should never have to paste tokens into config files or store long-lived credentials on disk. AI agents in their editors should not have unrestricted access to secrets either. By integrating 1Password with Cursor Hooks, we are making 1Password the secure source of secrets for Cursor. When the Cursor agent needs to run a command, call an API, or perform an action that requires a credential, the required secret can be made available at runtime through 1Password, only when authorized by the user. No plaintext keys committed to disk or source code. No hard-coded environment variables. No tokens lingering in history. Everything is made available securely via 1Password and governed by the access policies your team already relies on. Furthermore, the project owner can configure 1Password secrets management, helping ensure secure practices are consistently followed across the team. This provides teams with a clear path to adopt AI-powered development while maintaining a strong security posture. ## About Cursor Cursor is an AI-powered IDE built on Visual Studio Code that adds deeply integrated AI assistance throughout the development workflow. Developers can write or modify code using natural language, search across large projects by meaning, and perform structured, multi-line edits with a simple prompt. Cursor also provides a powerful integration layer through the Model Context Protocol (MCP). This enables the editor to interact directly with APIs, databases, and external tools within the development environment. Cursor Hooks extend this further by enabling teams to run scripts automatically at specific points in an AI-assisted workflow. This new Hooks system is the cornerstone of our integration. ## What Cursor Hooks enable _Cursor Hooks_ allow teams to configure a file called hooks.json at the project, user, or system level. This file outlines what should occur at specific lifecycle stages of an AI-assisted interaction. For example, before Cursor runs code, executes a command, or interacts with a tool, Cursor invokes the Hook Script to prepare the right environment. Our new Hooks Script makes 1Password the secure source of truth for secrets, configurations, and credentials that Cursor might need. Here is how it works at a high level: 1. Before the Cursor agent runs any shell commands, the Hook Script is invoked. 2. The script verifies that all required locally mounted .env files from 1Password Environments are properly configured, ensuring commands that depend on them run without issue. 3. After the script checks your .env files, it either runs the command or returns an error message to help you fix your 1Password Environments setup. 4. When a process requests access, 1Password prompts the user to authorize and makes the secret available in memory for the runtime session. It never touches disk or Git history. This creates a secure, repeatable workflow where developers do not need to manually copy credentials, rotate tokens, or worry about accidental exposure. Explore the full 1Password Environments documentation for Cursor Hooks _._ ## What is available today With 1Password, Cursor users can: * Use 1Password as the secure credential store for AI-driven tasks in Cursor. * Configure Cursor Hooks that validate required .env files managed by 1Password at runtime, ensuring secrets are available only when needed and governed by 1Password. * Version control Hooks configuration files without exposing any sensitive values. * Enable AI-powered development in Cursor without changing existing 1Password policies, vaults, or user permissions. This initial functionality is intentionally simple: it keeps secrets out of code and provides developers with a safer way to allow Cursor to perform tasks that require credentials. ## What we are building next The work launching today is the foundation for a deeper collaboration. In the coming months, we plan to expand the integration to support: * Richer policies and permissions that allow teams to define granular, task-specific access rules for AI agents. * Broader support for MCP integrations so that Cursor can interact with external APIs and services entirely through 1Password-mediated access. * Automated secret rotation for AI-driven workflows. * Enhanced audit visibility to enable security teams to monitor how AI agents access credentials throughout the development lifecycle. Our goal is to create the first AI native development environment where secure access is not an afterthought but a built-in part of the workflow. ## Accelerate securely with 1Password and Cursor AI is transforming how software gets built, but speed only helps when teams can trust the workflows behind it. By integrating 1Password with Cursor Hooks, we are eliminating one of the biggest sources of risk in modern development: uncontrolled secrets. Developers get a faster workflow. Security teams get centralized control. And AI agents get only the access they need, exactly when they need it. This is just the beginning. We are excited to continue building with the Cursor team and help shape the future of secure AI-assisted development. You can get started with the _integration here_.

Twenty-seven episodes. Dozens of CISOs and security leaders. Hours of honest conversation about what actually keeps them up at night. When I launched the show, the goal was simple. Strip out the fluff and talk about how security really works inside organizations that ship software, handle sensitive data, and carry real operational risk—just practitioners comparing scars. This season covered three big threads that kept looping back into each other. The changing reality of the CISO role. The rise of agentic AI systems. The grind of day-to-day security work in complex environments. All of it shaped by people who actually own the outcomes. ## **The CISO job is no longer “just security”** Across episodes with sitting CISOs, former CISOs, and advisors, one theme kept repeating. The role has outgrown the narrow idea of “head of security.” Guests talked about shaping product strategy, influencing M&A decisions, and acting as a translator between engineering, legal, and the board. Security decisions now touch revenue targets, customer churn, and brand risk. That shift sounds good in theory. In practice, it means CISOs end up accountable for many things they do not fully control. Several guests described the alignment problem. They own risk, but budgets roll up through other executives. They see threats, but business incentives still reward speed over resilience. They are measured on incident outcomes, yet they do not directly manage the teams that ship code or choose vendors. We heard candid stories about burnout and turnover. One CISO walked us through the exact timeline of an incident, followed by a board meeting, followed by pressure to “simplify the story” for investors. Another unpacked why they walked away from a role that looked perfect on paper. All of them stressed the same point. Governance on slides and governance in reality are two different things. A few concrete patterns emerged: * The healthiest programs treat security as a design constraint early, not as an after-the-fact control. * CISOs who succeed long term invest in political capital, not only technical depth. * Boards that receive concise, quantified risk narratives tend to fund security in a more predictable way. None of that is theoretical. It came from leaders who already lived through breaches, regulatory investigations, and restructuring. ## **Agentic AI forced everyone to redraw the map** If the CISO role was the structural thread of the season, agentic AI was the disruptive one. I talked with researchers, builders, and defenders about AI systems that can plan, act, and adapt with far less human hand-holding. Not just models that classify or summarize, but agents that chain actions, call tools, integrate with SaaS, and touch production systems. The mood was not hype. It was curiosity mixed with concern. On the risk side, the questions got sharper: * How do you test agents that can call arbitrary APIs on your behalf. * What is the blast radius when an agent interprets a prompt in an unexpected way. * Where do you log intent, not just output, so you can reconstruct what happened. Several episodes dug into evaluation, not just capability. One guest explained their approach to “red teaming the planner” instead of only the model. Another guest from a large enterprise shared how they introduced guardrails that look a lot like familiar security patterns. Least privilege for tools. Strict boundaries between environments. Strong human review on high-impact actions. We also spent time on governance. Who owns agent risk? Is it the CISO, the CIO, or the data team? That debate is still unresolved inside many companies. The one clear signal. Wherever AI agents can pivot from data to action, security teams will get pulled in, whether they were consulted or not. ## **The grind of modern security work** Between strategy and AI, the season also stayed close to the operational reality. The stuff that never makes keynotes. We broke down identity incidents where the root cause was a single overprivileged service account that no one wanted to touch. We walked through SaaS sprawl and what happens when finance signs a contract and security hears about it six months later. We heard from teams still dealing with old VPN concentrators, fragile OT networks, brittle backups, and half-documented cloud resources. Several guests talked frankly about tooling fatigue. Too many dashboards. Too little integration. Alerts without context. One recurring message. Visibility without ownership is noise. We heard practical tactics that worked: * Building small, cross-functional “fix teams” for specific classes of risk, such as exposed secrets or misconfigured identity providers. * Tying security metrics to business metrics, for example, mapping control adoption to sales cycle friction or support ticket volume. * Using tabletop exercises as a way to expose process gaps, not as compliance theater. These were not abstract frameworks. They were things people tested on real incidents with real stakes. ## **What we learned by listening** After twenty-seven episodes, some lessons cut across every topic. First, security teams thrive when they are allowed to be specific. “Reduce risk” is meaningless. “Cut the mean time to revoke access for departing employees from three days to four hours” is actionable. The same applies to vendor review, detection tuning, or AI rollouts. Precision beats broad ambition. Second, language matters. Many guests described how small shifts in wording changed the outcome of conversations. Talking about “protecting revenue” instead of “blocking threats.” Presenting one or two sharp options, not a buffet of scenarios. Explaining uncertainty without drifting into drama. Third, community still matters more than tools. People came on the Chasing Entropy Podcast to say the quiet parts out loud. To admit where they guessed. To share how often “best practice” collided with reality. That level of honesty is worth more than another product announcement. ## **Where the Chasing Entropy Podcast goes next** Season one proved there is room for unvarnished security conversations. The numbers are useful, but the direct feedback from listeners stood out more. Messages from CISOs who replayed episodes for their leadership teams. Notes from practitioners who used an anecdote from the show to justify a change in process. Comments from people new to the field who appreciated hearing that even seasoned leaders fight the same battles. Season two will dig deeper into a few areas our guests only had time to touch on. Security for AI. Agentic AI in production, not pilots. Identity is the real control plane. The economics of security work, from budget structures to talent models. We will keep the format simple. Bring in people who do the work. Ask them pointed questions. Respect their time and yours. If you listened to one episode or all twenty-seven, thank you. Your attention is a scarce resource. If you shared the show with a colleague, argued with a guest in your head, or scribbled notes, you are part of the experiment. Entropy does not stop. Systems age. Threats adapt. Organizations change their minds. The goal of this podcast is not to deliver a final answer. It is to track how security practice evolves, one honest conversation at a time. Season one is a wrap! See you in 2026! Podcast: _https://podcasts.apple.com/ca/podcast/chasing-entropy-podcast-by-1password/id1811491680_ YouTube: _https://www.youtube.com/@ChasingEntropyPodcast_

Over the past year, we’ve been busy building for MSPs around the world, giving you more choice on where and how you buy our solutions. Starting today, **1Password Enterprise Password Manager – MSP Edition is available through QBS Software** , a leading distributor serving MSPs across more than 20 countries in Europe, the Middle East, and Africa (EMEA). Our partnership allows 1Password to meet MSPs in the channels you already use to source SaaS solutions – keeping your processes streamlined and expanding access to enterprise-grade credential security worldwide. ## 1Password closes the Access-Trust Gap We know MSPs work hard to balance operational efficiency, their clients’ security posture, and long-term strategic value as service providers. That balance becomes tougher when you’re contending with unsanctioned and invisible forms of access stemming from identity sprawl, unmanaged credentials, and shadow IT. This difference between centrally governed and controlled access and the access that occurs in practice is what we term the _Access-Trust Gap_. These challenges are the root cause of this gap. 1Password Enterprise Password Manager – MSP Edition helps close that gap, at scale. We give you the power to secure your clients’ credentials and data through a purpose-built, multi-tenant MSP console, equipped with granular controls and comprehensive client-level insights. It delivers on security, efficiency, and profitability. ## Built for MSP workflows, in partnership with MSPs **1Password Enterprise Password Manager – MSP Edition** was built in collaboration with MSPs and designed specifically for your needs. We worked hand in hand with MSPs in our community to test our product and build workflows that solve everyday pain points for admins and technicians. Our product maintains 1Password’s industry-leading security and ease of use while enabling MSPs to manage clients seamlessly. Here’s how 1Password Enterprise Password Manager – MSP Edition supports your MSP team. ### **Ensure efficiency and profitability as you grow** * Keep multi-tenant client management simple with an intuitive MSP console * Start generating profits from day 1, with no license minimums * Reduce the time your team spends on password-related support tickets ### **Effortless security for your team and clients** * Easy for clients and their users to use, from creating secure credentials to auto-saving and auto-filling * Industry-leading security model uses Two-Key Derivation and end-to-end encryption * Control technician access to specific clients with custom group permissions ### **Excel as your clients’ strategic IT partner** * Customize policies across authentication, usage, and more to keep clients secure and compliant * Stay ahead of client needs with actionable insights and custom usage reporting * Easily onboard your team and your clients’ users with MSP-tailored selling and support resources ## Our commitment to continually improving the MSP solution Over the past few months, our team has been working on feature updates to improve MSP administrator and client deployment experiences and make our solution even better for MSPs. * **Reduce managed company email notification noise** : Control which administrators get notified via email about new users and account recoveries * **More visibility and monitoring** : Connect 1Password to MSP-specific SIEM solutions, such as Huntress, LevelBlue, Todyl, and Blackpoint Cyber (in beta) * **Service accounts for MSPs** : Set up and maintain service accounts within client tenants alongside 1Password CLI to create vault and secret management automations > Growing our channel presence in EMEA is a key focus for 1Password, and QBS Software helps us accelerate that progress. Through their extensive distribution network, MSPs gain easier access to our trusted credential management platform, tailor-made for MSPs - designed to strengthen client protection and simplify everyday workflows. Together, we’re helping MSPs deliver stronger identity security and greater value to the businesses that rely on them. > > - Larissa Crandall, 1Password Global VP of Channel and Alliances > QBS is delighted to partner with 1Password, the global leader in password management. This new collaboration across the European Territory further strengthens our cybersecurity offerings, providing our channel partners with access to trusted solutions that protect digital identities and enhance productivity. Together, QBS and 1Password are making security simpler, smarter, and stronger. > > - Tom Corrigan, QBS Chief Revenue Officer ## Available starting today via QBS Software By partnering with QBS, we are extending secure, scalable password management to more MSPs and businesses across EMEA. MSPs who purchase through QBS Software unlock a streamlined billing experience that reduces administrative overhead and keeps processes simple. We’ll be working closely with QBS to support MSPs specifically in the United Kingdom and a few other EMEA regions to begin with, and we’re excited to better support more MSPs through a trusted distributor in the channel. MSPs can **contact their QBS representative at**** _1Password@qbssoftware.com_****to get started with 1Password Enterprise Password Manager – MSP Edition** and see how 1Password helps secure client credentials, reduce hidden risks, and close the Access-Trust Gap.

This year has been one of the most transformative in our collaboration with AWS. As organizations move faster toward AI-driven development and cloud-native architectures, secure access has become a foundational requirement, not an afterthought. In just a few years, we’ve gone from experimenting with GPTs to deploying action-oriented AI agents that read, write, execute, and automate workflows across production systems. These developments unlock new levels of productivity, but they also introduce new access and security challenges. That’s why AWS and 1Password have deepened their collaboration to help customers adopt AI tools safely and still capture the benefits it offers. Together, we’re making it easier for developers to authenticate, build, and operate agents securely, and using AI to streamline the login experience itself. What began as a collaboration has evolved into real momentum and a shared vision for the future of secure identity and automation in cloud-native environments. ## Delivering deeper integrations for developers and security teams This year also brought integrations that strengthen how teams manage access and secrets across AWS-native workflows. ### Amazon Nova Act launch partner Today, we’re excited to share the latest milestone in that journey: 1Password is a launch partner for Amazon Nova Act, an end-to-end service for building and managing highly reliable AI agents at scale. Amazon Nova Act represents a major step forward for secure, autonomous workflows, and 1Password is using it to simplify everyday tasks like logging in to web apps, helping users and organizations securely access the tools they rely on while reducing manual steps and potential risks. ### MCP Server for Trelica by 1Password The MCP Server for Trelica by 1Password brings secure SaaS discovery and access visibility directly into AWS workflows. It integrates with the Trelica API to give IT and security teams insight into SaaS usage, user access, and application activity without leaving their AWS-native environment. The _MCP Server for Trelica by 1Password is available on AWS Marketplace_ and helps customers discover and manage SaaS risk with zero additional cost for Trelica users. Explore the product demo. ### AWS Secrets Sync AWS Secrets Sync allows IT administrators, security teams, and developers to synchronize secrets stored in 1Password directly into AWS Secrets Manager. This provides a single, consistent source of truth for credentials while enabling applications on AWS to use secrets through native AWS mechanisms. The integration is built on 1Password’s confidential computing model. Secrets remain end-to-end encrypted within the 1Password vault and are decrypted only within the customer’s trusted execution environment. This ensures that the sync path maintains the same security guarantees customers rely on when managing sensitive information in 1Password. For customers building AI systems or cloud-native applications on AWS, this reduces operational overhead. Instead of maintaining multiple secret stores or manually handling credential updates, teams can manage secrets centrally in 1Password and rely on AWS Secrets Manager for downstream distribution, rotation, and runtime access. The result is a simpler workflow and fewer opportunities for configuration drift or inconsistent secret handling. This release also marks an important step for 1Password’s developer product strategy. It establishes a clear mechanism for connecting human-managed secrets in 1Password with machine workloads on AWS, supporting more secure development and deployment patterns across both environments. Explore the product demo. ### Confidential computing with AWS Nitro Enclaves Security is about protecting data and proving trust. 1Password uses AWS Nitro Enclaves for _confidential computing_, which enables us to bring our end-to-end encryption model to the cloud. As Jacob DePriest, CISO and CIO at 1Password, said in our collaboration with AWS Nitro Enclaves: > At 1Password, everything starts with end-to-end encryption. Your secrets are protected before they ever leave your device. With AWS Nitro Enclaves, we extend that end-to-end encryption model into the cloud, securely processing sensitive data in isolated, attested environments. These capabilities aren't just security features; they’re trust enablers, allowing us to build enterprise-grade functionality while cryptographically proving that no one can access customer data during processing.” ## Strengthening our collaboration with AWS This year also marked a major milestone: 1Password signed a _strategic collaboration agreement_ (SCA) with AWS, creating a multi-year commitment to co-innovation and global growth across both organizations. The SCA formalizes years of close collaboration with 1Password as a key partner in securing cloud-native and AI-powered applications, and represents our long-term investment in the AWS ecosystem and in every organization that is building on AWS. ### AWS Marketplace & Express Private Offers Customers want simple, fast ways to add modern identity security to their cloud environment, so we worked closely with AWS to streamline adoption. 1Password is among the first security companies to participate in AWS Marketplace Express Private Offers, transforming how customers buy software on AWS. This new capability uses automation and AI to create instant, personalized pricing for customers, turning a process that once took weeks into minutes. By simplifying procurement and expanding access, we’re helping organizations scale securely and easily with AWS. ### Recognized as a leading AWS partner That momentum has translated into measurable impact across the AWS ecosystem. 1Password has also been named the winner of the 2025 Canada Rising Star Technology Partner of the Year Award. AWS awards recognize leaders around the globe who are playing key roles in helping customers drive innovation and build solutions on AWS. As a Rising Star Partner of the Year, 1Password is being recognized for significant year-over-year growth in the technology business. Learn more in the recent press release. ## Moving forward This year showed what’s possible when AWS and 1Password innovate together. Our collaboration with AWS reflects what makes 1Password different: we don’t just secure credentials, we secure how people and AI interact with them. From Marketplace acceleration to deeper developer tooling to confidential computing, every milestone builds toward a more secure, intelligent future where IT teams and enterprises embrace AI and automation with confidence. This year set the pace, and we’re just getting started. Learn more about the _1Password Extended Access Management suite on AWS Marketplace_ and how we deliver identity security for every SaaS application and AI-driven workflow.

The 1Password browser extension is entering its eighth year of service, and quite a bit has changed over that time as we’ve built new capabilities and improvements. One crucial piece of the browser extension is its in-page notification system. With the ability to display a notification on a web page, it allows you to perform many important tasks. Over the last eight years, we’ve expanded the capabilities of this small but mighty piece of the user experience to inform you any time you: * **Save a new login credential** to 1Password that you created while browsing the web * **Used a passkey to sign into a website** that supports the _WebAuthn_ protocol * **Been offered a suggestion to sign in with a third party provider** , such as Google * **Watchtower detected a breach** with one of your vault items * **Were guided through remediation** because _Device Trust_ detected a problem with your device With this growing list of tasks, and the in-page notification system becoming a new way for us to surface information, we knew it was time to invest in some key improvements and set us up for the future. One major limitation we needed to tackle was that **the current system was only able to display one notification at any given time**. This limitation was causing friction for our users, especially because if a second notification were to appear before you addressed the first one, the first notification would simply disappear from the web page. Additionally, for some of our notifications, if you navigated to a new web page without taking action, notifications would be instantly lost. This was one key area that we knew we could improve on, so earlier this year we set out to overhaul _(and improve)_ the in-page notification system. ## Supporting multiple in-page notifications The main goal we set out to achieve was supporting **multiple in-page notifications**. If you receive a few notifications in quick succession, they should all remain visible and actionable, in a collapsed stack. When you are ready to interact with _any_ of these notifications, you can do so by clicking the “View all” button (or by pressing the down arrow on your keyboard) to expand the stack. When you would like to collapse the stack, simply click the “Collapse all” button (or press the up arrow on your keyboard): Using this new feature, we are now able to keep track of all in-page notifications, ordered by priority. Notifications are intelligently configurable to follow you as you navigate across different web pages (while others are contextual to the current web page), and they will automatically disappear when they’re no longer needed. For those interested in the technical details of how we did this, we moved responsibility to the service worker (within the browser extension) and made it the source of truth for notification states, as opposed to the user interface. For security reasons, this potentially sensitive information stays local to your device. It remains stored in memory in the browser extension using the Manifest V3 API, _chrome.storage.session_. We also have full awareness of what notifications are being shown on each tab, and we will not display a duplicate notification, unless explicitly told to do so. When you load a web page, if there are any notifications to display for the current tab, an embedded iframe is injected into the web page, inside of a closed shadow root to an internal extension page. The user interface (embedded in the iframe) will call out to the service worker to retrieve those notifications and render them using our design language, Knox. ## Supporting fullscreen in-page notifications Fullscreen Notifications is a feature that we currently use for passkey and _Device Trust_ notifications: If you need to interact with a notification before you’re allowed to interact with a web page, such as with our passkey and device trust flows, any of our in-page notifications can now be configured for fullscreen mode. For fullscreen notifications to work seamlessly with a stack of multiple notifications, we had to rebuild _“fullscreen mode”_ from the ground up. For example, if a stack of notifications is present on a web page when a fullscreen notification is shown, the remaining non-fullscreen notifications are hidden until you handle the fullscreen notification. Once you’ve taken care of the fullscreen notification, the non-fullscreen notifications are shown. ## Migrating in-page notifications Many of the types of notifications we mentioned above were built in bespoke ways over the last eight years. This approach left us with a set of notifications that were all different in slight but impactful ways. This was the final goal for our new system: to reduce that duplication and make it easier to maintain the existing notifications, and an extensible way to build new ones. When we had finished building out support for multiple notifications, we began to migrate each of our notifications over to the new in-page notification system. This has been a team effort, and over the last few months we have been busy migrating over each of the existing notifications. In addition to supporting the new system, we also continue to support the legacy system, due to the gradual rollout of this feature. Once we’ve rolled this out to all of you, we will take the final step of removing the old code and bidding it a fond farewell. ## What’s next for in-page notifications Support for multiple in-page notifications has now rolled out to our nightly and beta channels, with stable beginning to roll out this week! We will continue to make refinements to improve in-page notifications in the browser extension going forward. Thank you for reading! If you have not already, please do try out the new in-page notifications.

We’re excited to announce that today, **1Password Enterprise Password Manager – MSP Edition is now available through Renaissance** , a leading IT distributor serving MSPs across the Island of Ireland. This partnership enables even more MSPs to access 1Password through local channels, streamlining their procurement and billing processes while expanding access to enterprise-grade credential security. We know that growing MSPs around the world are constantly balancing the need to: 1. Ensure their own operational efficiency and profitability 2. Empower their clients with effortless security 3. Excel as their clients’ long-term, strategic IT partner Achieving all three is a challenge, especially as MSPs face growing complexity from identity sprawl, SaaS sprawl, and unsanctioned access that can put clients at risk. 1Password Enterprise Password Manager – MSP Edition helps solve these problems by providing MSPs with the tools to securely manage their clients’ credentials, reduce risk, and strengthen their trust with clients. ## Closing the Access-Trust Gap MSPs and their clients face what we call the Access-Trust Gap: caused by the use of unmanaged credentials and the associated shadow IT risks that their teams cannot see or control, often creating hidden vulnerabilities across tenants. 1Password Enterprise Password Manager – MSP Edition helps close that gap by giving MSPs the power to secure their clients’ credentials and company data through a purpose-built client management solution equipped with granular access controls and comprehensive client-level insights. It simplifies how MSPs protect their clients’ data while strengthening their internal operational efficiency and profitability. ## 1Password is built with MSPs, for MSPs 1Password Enterprise Password Manager – MSP Edition was designed with MSP workflows and needs in mind. We worked closely with over 1,000 MSPs to test our product with their workflows to truly understand the problems MSPs had to solve before bringing the product to market. The resulting product combines 1Password’s industry-leading security model with ease of use, ensuring the operational efficiency and profitability your MSP team needs, now available through Renaissance. Here’s a look at how 1Password helps you deliver on your goals. ### Empower your clients with effortless security they can trust * Protect client data with end-to-end encryption paired with 1Password’s unique two-key derivation. * Enable seamless onboarding and adoption with an easy-to-use user interface. * Your clients have complete ownership of their data. Any data stored in their 1Password accounts is inaccessible to 1Password. ### **Excel as your clients’ strategic IT partner** * Provide personalized security and credential management for every client, utilizing granular security policies and customer group permissions to ensure least privileged access. * Get access to MSP-tailored content from 1Password to help your team with onboarding, training, and supporting your clients’ end users. * Gain actionable insights to mitigate risks with Watchtower, including real-time notifications of breaches, weak passwords, unsecured websites, and other security anomalies with items in vaults. Proactively share insights through custom, comprehensive reports or surface security insights, account activity, or usage trends with clients. ### **Ensure operational efficiency and profitability as you grow** * Manage all your clients from one centralized MSP console to easily configure new accounts and link or unlink existing 1Password client accounts to access and manage their 1Password instance. * Grow your profits with our consumption-based billing structure, billed in arrears, with no license minimums. * Gain a clear view of client usage with a dedicated usage page, allowing your team to quickly manage seats for each managed client. > MSPs carry the important responsibility of protecting their clients from an increasingly complex landscape of identity threats, often serving as the first and last line of defence. Through our collaboration with Renaissance, we’re delivering proven credential management and local, Irish expertise that helps MSPs strengthen client protection and positions them as trusted, strategic IT partners. > > - Larissa Crandall, Global VP of Channel and Alliances at 1Password > Renaissance is delighted to bring the global leader in password management, 1Password, to MSPs. Through our partner channel, we now offer scalable enterprise password management to help MSPs secure their clients’ credentials, reducing risk while building trust. > > - Michael Conway, Managing Director at Renaissance ## Available starting today through Renaissance MSPs rely on distributors for trusted solutions across their IT infrastructure and security needs to keep processes seamless and simple. Partnering with Renaissance enables 1Password to better support the security and billing aspects of the MSP experience, allowing us to meet MSPs and their clients where they already do business. MSPs purchasing through Renaissance receive the same 1Password product experience, with access to the 1Password MSP Resource Center for enablement and onboarding materials, including pitch decks, checklists, how-to videos, and training guides to help MSPs and their clients succeed. Our partnership with Renaissance allows 1Password to bring secure, scalable password management to even more MSPs in Ireland. With consumption-based billing, an intuitive MSP console, and advanced client security management capabilities, 1Password Enterprise Password Manager – MSP Edition makes it easy to manage clients as your business grows, protect their data, and stay profitable. MSPs new to 1Password can **contact their Renaissance representative to get started with 1Password Enterprise Password Manager – MSP Edition** and see how we help secure your clients’ credentials, eliminate shadow IT risks, and support your team with closing the Access–Trust Gap.

## If you’ve built anything with AI tools lately… You’ve probably seen a file like this sitting in your project root: `{ "tools": { "github": { "endpoint": "https://api.github.com", "auth": { "token": "ghp_your-secret-token" } } } }` That’s a typical mcp.json, the file many agentic development environments (like Cursor or Claude Code) use to tell an MCP server what APIs it can call and what credentials to use. It’s handy. It works. It’s also a plaintext secret waiting to leak. Push that repo to GitHub, sync it to a teammate, or even forget to `.gitignore` it, and your API key’s gone. ## Shout-out: the developer who started a trend One of the nicest parts of working in security is seeing the community invent safe patterns before vendors even document them. A developer who goes by @codekiln wrote a great how-to showing how to secure Cursor’s mcp.json with the 1Password CLI. Their approach is simple: instead of hardcoding tokens in your config, reference them from your 1Password vault and inject them at runtime using op run. Here’s the core idea they shared: `op run --env-file=.env -- cursor mcp-server start` It’s small, but it changes everything. No plaintext credentials. No manual copy-paste. No tokens lying around in Git history. You can read their full guide here: _How to set up Cursor MCP with 1Password GitHub tokens_. > “What 1Password is doing to secure agent configurations is exactly the future we envisioned when we created _Hooks_,” said Travis McPeak, Head of Security at Cursor. “Developers shouldn’t have to choose between security and productivity.” ## Pull secrets at runtime instead of storing them This pattern works for any MCP or AI tool that uses environment variables for authentication: Cursor, Claude Code, local LangChain MCP servers, you name it. You don’t have to wait for new SDKs or integrations. You can do it today with the 1Password CLI (op). Let’s walk through implementation: ### Step 1: Store your secrets in 1Password Create a vault item for each token you need. For example: * Vault: AI * Item: GitHub Access Token * Field: token Then grab that secret via a secret reference: `op read "op://AI/GitHub Access Token/token"` Format reminder: `op://<vault>/<item>/<field>` These are pointers, not real values. Only 1Password can resolve them when you launch a process with the CLI. ### Step 2: Reference them in your .env Your .env now looks like this: `GITHUB_TOKEN=op://AI/GitHub Access Token/token` `OPENAI_API_KEY=op://AI/OpenAI Key/key` Each variable is a link to an encrypted secret, not the secret itself. ### Step 3: Start your MCP server with op run Wrap your command in op run to fetch and inject secrets at runtime: `op run --env-file=.env -- mcp-server start` Here’s what happens: 1. op run reads your .env. 2. It resolves any op:// references. 3. It decrypts those secrets in memory. 4. It sets them as environment variables for that process. 5. When the process exits, the secrets disappear. Verify it yourself: `op run --env-file=.env -- printenv | grep GITHUB_TOKEN` Outside of that shell, the token doesn’t exist. ### Step 4: Keep mcp.json clean Once your env variables are ready, your config can stay simple: `{ "tools": { "github": { "endpoint": "https://api.github.com", "auth": { "token": "${GITHUB_TOKEN}" } } } }` You can safely version-control this file. No secrets, no cleanup commits. ### Bonus: 1Password Environments (Beta) If you want something more structured than local .env files, check out 1Password Environments. It lets you define, sync, and rotate environment variables centrally across projects. It’s still in beta but already works great alongside the CLI: `1password env init my-ai-project` `op run --env-file=.env -- mcp-server start` Same security model, less config drift. ## Why this works **Common problem**| **Fixed by** ---|--- Plaintext secrets in code| Store them in 1Password vaults Shared .env files| Use secret references Secrets hanging around in memory| Decrypt only during process runtime Manual rotation| Centralized management in 1Password Audit gaps| Built-in logging and access control You’re not changing how your dev tools work. Just how they get credentials.

IT and security leaders share a common goal: to empower teams to move fast without compromising security. Over the past year, we partnered closely with customers across industries to understand what helps them scale and where they need more flexibility and control. Their feedback shaped our latest updates to 1Password Enterprise Password Manager (EPM). Each enhancement is designed to make enterprise deployment and governance faster, simpler, and more intuitive so security teams can focus on strategic priorities instead of day-to-day administration. This release builds on three core principles: * Usability that drives adoption. * Visibility that strengthens governance. * Control that scales with the business. Together, these improvements make it easier for companies to deploy confidently, manage effectively, and protect every user with 1Password. ## Security without friction New App Unlock presets give admins more flexibility in how users unlock 1Password. Teams can align unlock settings with their organization’s device policies, for example, allowing 1Password to unlock whenever the device is unlocked, while still enforcing auto-lock rules where required. Admins can define which presets are available, override settings for team members, and even let users customize their own presets. For employees, this means fewer interruptions and smoother daily workflows. For IT and security, it means consistent, enforceable policies that align with existing device standards. Your vaults remain fully protected by device-level encryption and secure access. The “Unlock 1Password when your device unlocks” option simply changes when 1Password unlocks, not how it’s secured. When a user unlocks their Mac, PC, or phone with Face ID, fingerprint, or password, 1Password unlocks alongside it using the same trusted authentication their device already relies on. The feature can be enabled as an option. ## Get teams set up in less time New admin policies and onboarding tools simplify deployment and help organizations standardize how 1Password is used. The Browser Extension policy guides users to install the 1Password browser extension during setup. It’s enabled by default, so new users begin where 1Password is most effective, saving, filling, and generating passwords right in the browser. Organizations that restrict extensions can turn it off anytime. The Guided Setup experience helps new users get started quickly by introducing them to the essentials of using 1Password in their environment. It adapts to each organization’s setup, guiding users through the steps needed to access, save, and manage credentials securely. Together, the Browser Extension policy and Guided Setup reduce confusion, minimize IT overhead, and accelerate organization-wide adoption. ## New policies provide more control As enterprises scale, admins need fine-grained control over how employees use 1Password day to day. New policy controls deliver exactly that, giving IT the ability to standardize how credentials are saved and submitted across the organization. Admins can now configure: * Autosave: Choose which elements (Logins, Credit Cards, Addresses, 2FA) are saved automatically. * Autosubmit: Disable automatic form submission. These controls allow organizations to tailor convenience and security to their unique needs, ensuring consistent policy enforcement without slowing down employees. We’re also introducing the Sign-in Attempts policy to safeguard against brute-force attacks. Admins can define how many failed attempts are allowed before an IP address is temporarily locked for that user. This applies to all login attempts, including those from previously authenticated devices. ## Set up your 1Password instance to reflect how your organization operates Large organizations need flexibility without losing control. Multi-tenancy gives admins both. It introduces a new account model designed for scale that helps security teams manage access across departments, subsidiaries, and regions from a single place, while letting teams operate independently. Linked Accounts let you connect one parent account to any number of child accounts within the same data region. You can organize them by geography, department, or business unit and adjust that structure as your organization evolves. Policy Templates make governance consistent. The parent account can: * Create and reuse policy templates. * Decide which policies child accounts can or can’t override. * Apply templates to selected accounts instantly. The result: consistent security standards, faster support for users, and greater visibility into who can access what, without slowing teams down. _See it in action_. ## Coming in 2026 ### Automated Provisioning Hosted by 1Password 1Password-hosted provisioning connects directly to Okta and Entra ID, eliminating the need for self-hosted SCIM bridges. Admins can deploy faster, reduce maintenance costs, and keep identity data in sync automatically. This feature extends the 1Password end-to-end encryption with a zero-knowledge security model to operations performed on behalf of your identity provider within the 1Password infrastructure. Learn more about how your data is protected when you use automated provisioning (hosted by 1Password) with your identity provider. Less infrastructure to manage means IT teams can focus on higher-value work, not upkeep. ### Improved Audit Logging Compliance and security teams need answers fast. This new Audit Log will provide a unified, human-readable view of all user and admin activity, making it easier to see who did what, when, and how, strengthening both compliance readiness and investigative speed. ### Join the What’s new? 1Password security spotlight & product review Webinar Dive deeper into these 1Password Enterprise Password Manager updates in our quarterly product update webinar. Register now

At 1Password, we know that a culture of belonging is essential to achieving our company’s goals. Since launching our first Employee Resource Groups (ERGs) in 2021 and expanding to Employee Community Groups (ECGs) in 2023, these communities have become so much more than spaces for connection – they’re shaping how we lead, grow, and perform together. Today, our ERGs and ECGs collectively represent more than 1,300 Slack channel members, reflecting strong engagement across communities at 1Password. Our eight ERGs and ECGs remind us that belonging and high performance aren’t competing priorities; they thrive together. They turn our values into everyday actions, helping people feel both stretched and supported as we continue evolving our high-performance culture. By keeping community at the center, our groups drive growth, learning, and impact – making belonging something we can see and feel in how we show up for each other every day. ### **Belonging in action** Earlier this year, our Chief People Officer, Katya Laviolette, shared _what high performance means at 1Password_: a culture grounded in clarity, accountability, and shared purpose. She emphasized that high performance isn’t about speed or output alone, but about moving forward together with focus and alignment. That vision has come to life across our ERGs and ECGs, which play a key role in helping socialize what high performance looks like in practice. Building on that message, our Black Caucus and Pride ERGs hosted an _Unlocking High performance_ session featuring speakers from both communities sharing how they interpret and embody high performance in their day-to-day work. The event received overwhelmingly positive feedback, because it showed how high performance can look different for everyone, and that people from all backgrounds can thrive, contribute, and do their best work within a shared vision. > **_Hearing from several folks from different areas within 1Password, and from those that experience several levels of intersectionality was super valuable for me. Just knowing of their existence feels like relief.” -_**__**_“_** _Unlocking High Performance”_ event attendee By creating space for honest conversation and diverse perspectives, our ERGs and ECGs help bridge the gap between belonging and performance. They remind us that striving for excellence doesn’t mean leaving anyone behind, it means bringing everyone along. ### **Evolving ERGs: From community to career catalyst** This year, as our culture has evolved, our ERGs have stepped into a new role: becoming true _resources_ for employees and vehicles for career growth and development. What began as spaces for connection and belonging have evolved into communities that empower members and allies to actively shape their career journeys. We’ve hosted sessions on self-advocacy, how to understand disability accommodations, how to build a personal online brand, and more. These events reflect an intentional shift: embedding more development opportunities so that belonging also means building skills, confidence, and visibility. To continue that growth, we’ve also proudly launched a formal mentorship program with our ERG community, connecting emerging leaders to structured support, guidance, and growth opportunities. We’re committed to nurturing the growth of our ERG leaders: individuals who not only champion inclusion and culture but also drive collaboration, adaptability, and business impact. Their leadership extends beyond community and is shaping the future of high performance at 1Password. ### **Community Impact: The power of connection** Even as the focus on professional growth expands, our ERGs and ECGs haven’t lost sight of their original purpose: human connection. These communities continue to be safe, energizing spaces where people can show up authentically and find belonging in a remote-first environment. Through asynchronous engagement and creative initiatives, our groups have kept connections alive across regions and time zones. They’ve organized book purchases, donated over $20,000 to global charities, and created Slack channels where members can celebrate everything from a Beyoncé tour, to a Taylor Swift album release, to _KPOP Demon Hunters_.__These small, joyful moments remind us that we’re not just colleagues behind screens, but people building community together. We’ve also proudly hosted events for each heritage month across all of our communities, spotlighting stories, experiences, and cultural learning that make our workplace richer and more inclusive. This continued focus on connection, alongside professional development, is what gives us our competitive edge. By supporting employees holistically, we create a culture where people feel seen, valued, and empowered to do their best work. _Photo caption: Members and allies of our South and West Asia and North Africa ECG at our Toronto Collaboration Space. Members gathered for a volunteer event to create and donate 100 welcome baskets for women and children arriving at_ __Nisa Homes.____ ### **Belonging is our competitive edge** At 1Password, we know that belonging isn’t separate from high performance; it’s what makes it possible. When people are truly supported and valued, they bring their best ideas forward and contribute fully to our shared goals. Our ERGs and ECGs are proof that we can turn shared values into action and spark collaboration across teams. They remind us that excellence is a collective effort, not a solo pursuit. As 1Password continues to grow, these communities will continue to lead the way, helping us build an inclusive workplace that enhances our culture and strengthens our business. Visit our careers page to learn how you can contribute and discover what makes 1Password a uniquely rewarding place to build your future.

Poorly managed credentials are among the most stubborn problems for security and IT teams, and authentication is one of the areas where the Access-Trust Gap is widest. But even as credential-based attacks remain a major threat to security, there are positive signs that companies are moving toward a passwordless future. This blog is part three in our series analyzing the _1Password Annual Report 2025: The Access-Trust Gap_. * To read part one, which addresses AI governance, click here. * To read part two, on SaaS management, click here. * If you haven’t had a chance to read the full report yet, download it here. In this blog, we’ll address the third section of the report, on credentials. We’ll walk through some of the report’s most eye-opening findings and how IT and security teams can translate them into actionable priorities. We’ll also explore how 1Password helps close these gaps via 1Password Extended Access Management, a suite of solutions that includes our Enterprise Password Manager, Trelica by 1Password, and 1Password Device Trust. ## Credential risks remain high, but companies are embracing passwordless authentication For years, weak and compromised passwords have been the most common path for bad actors to breach organizations. Yet leaders and employers alike are embracing and adopting more secure authentication methods, even as the complete elimination of passwords remains an elusive goal. ### Credential and authentication statistics from the report * 66% of employees report having poor password hygiene (e.g., using default passwords, reusing the same password for multiple accounts). * This marks a 5% increase in risky password behavior from _last year’s report_. * 44% of CISOs report that employees using weak or compromised passwords is one of their top security challenges * 89% of security and IT professionals say their company is encouraging employees to shift logins to passkeys > _In F1, data is everything, so we can't compromise on security, but we also can't afford tools that slow us down. Credential and secrets management was an area where we saw an opportunity to improve on both security and speed, by reducing the amount our team has to directly handle credentials.” - Mark Hazelton, CSO of Oracle Red Bull Racing_ ## Imperative: Passwordless As the report explains: > _'Passwordless’ authentication isn’t a binary, and passwords are unlikely to be fully deprecated anytime in the foreseeable future. With that in mind, the goal of passwordless should be to remove users as much as possible from the authentication flow, so their exposure to raw credentials is minimized.”_ With that in mind, IT’s priorities include: 1. Define your roadmap and process to replace weak passwords with unique passwords, add MFA, and transition to passwordless authentication, including passkeys. 2. Equip employees with clear guidance and ongoing support with transitioning to strong passwords, MFA, and passwordless solutions. 3. In the cases where passwords remain necessary, require the use of an enterprise password manager to facilitate secure storage and sharing of credentials. ## How 1Password helps close the Access-Trust Gap for authentication All three Extended Access Management solutions help companies accelerate their path to passwordless authentication, but we’ll focus on the capabilities of the Enterprise Password Manager (EPM). ### Define your roadmap and process to replace weak passwords with unique passwords, add MFA, and transition to passwordless authentication, including passkeys EPM provides admins with a dashboard that tracks the company’s password risk exposure, surfacing issues such as weak and reused passwords and accounts without 2FA. With this complete picture of authentication, admins can triage their most urgent risks. ### Equip employees with clear guidance and ongoing support with transitioning to strong passwords, MFA, and passwordless solutions Admins can use EPM to notify users when stronger authentication options are available and guide or require them to adopt them. ### In the cases where passwords remain necessary, require the use of an enterprise password manager to facilitate secure storage and sharing of credentials Managing passwords is the foundation of 1Password’s business. 1Password EPM encourages users to create strong, unique passwords, supports secure sharing – whether for developer secrets or social media logins – and gives admins centralized control, essential for secure onboarding and offboarding. Meanwhile, 1Password Device Trust helps enforce policies by verifying that EPM is installed and working correctly. _Explore 1Password EPM with an interactive demo_ ## Close your Access-Trust Gap with 1Password The report’s data makes clear that businesses need to reconcile security with their employees’ productivity and convenience. Make it simpler to use strong credentials than it is to recycle old passwords, and make it even easier to use passwordless methods wherever possible. Only then can companies practice their Zero Trust principles and close the Access-Trust Gap. To learn more about how 1Password can help you secure your business without slowing you down, _reach out to us today_.

We’ve all been there. You open your laptop, log in to your account, log in to your password manager, step away for a quick coffee break, and come back ready to get started on a project, only to be asked by your computer and password manager to log in to both all over again. It’s safe, sure, but it can also feel like one extra speed bump between you and getting work done. At 1Password, we’re always looking for ways to simplify your experience without compromising security. You should feel confident that your data is protected, while still being able to access what you need without disruption. That’s why we’ve made unlocking 1Password faster and simpler, without changing what makes it secure. ## Unlock 1Password when you unlock your device We’ve redesigned the 1Password unlock experience to be faster and smoother while maintaining the same trusted security. The new **unlock with device** setting lets 1Password open right alongside your Mac or PC. It unlocks as soon as you pass your device's own lock screen using a secure authentication method, whether that's Face ID, Touch ID, a PIN, or a password. No matter what, 1Password ensures you’re always in control. This feature is completely optional, giving you the freedom to decide how you want to balance convenience and security. 1Password relies on your device’s built-in secure hardware and end-to-end encryption to keep your data protected. This hasn’t changed. What’s new is how 1Password recognizes trust. When your device has already verified you through a secure method like a biometric login or system password, 1Password now accepts that verification, allowing you to access your credentials in a seamless way. ## Your security, your way To complement this new unlock experience, we’ve given you a new way to manage your security preferences with a new **security review** prompt. We know that every person has a different comfort level when it comes to convenience and security. This prompt helps you choose the balance that feels right for you, making it easier to personalize 1Password to the way you live and use it every day. _Initial app unlock presets policy prompts on Mac and PC devices_ These new security presets introduce three simple options that let you decide how 1Password unlocks so you can choose the balance of security and convenience that fits you best: * **Convenient:** 1Password locks and unlocks automatically with your device * **Balanced** : Unlock 1Password once every 8 hours, then it unlocks with your device * **Strict** : 1Password locks whenever it’s not in use, and you’ll need to unlock it each time you return You can expand the **preview changes** toggle to see the details for each option. From there, you’ll find additional ways to tailor your experience, like unlocking with your device password instead of Touch ID, unlocking automatically when your device does, or choosing to stay signed in until you decide otherwise. As presets can differ slightly depending on your device, each preset can be easily adjusted in the 1Password app. The Security settings page shows the options within each preset, making it simple to review or adjust your preferences anytime. Whether you prefer uninterrupted access across trusted devices or tighter control when stepping away, 1Password adapts to you. _Updated 1Password security settings to correspond with the new preset updates_ ## Keep your recovery options close If you choose a more flexible unlock option or turn off regular password confirmations, 1Password will prompt you to create a **recovery code**. Your recovery code ensures that if you ever forget your password or lose access to your device, you can safely recover your account without compromising security. _Setting up a recovery code is an easy way to provide yourself with peace of mind when using 1Password._ ## Finding balance in security These updates do more than make 1Password easier to use, they make it smarter. By integrating device-based unlock with flexible security presets and recovery safeguards, 1Password adapts to your digital life. You get faster access when you want it, security when you need it, and confidence that your data stays secure no matter how you choose to use 1Password. If you have feedback or want to learn more, we’d love to hear from you in the _1Password Community Forum._ In the meantime, here are a few frequently asked questions and answers to help you get started with these new settings. Does this apply to my 1Password Business plan? * Not just yet, we’re rolling out these new settings to our Individual and Family plans first. If you’re a 1Password Enterprise Password Manager administrator, be on the lookout in the coming weeks for an exciting announcement on improvements to the EPM experience. In the meantime, nothing will be turned on for Business accounts without admin consent or approval. Is this feature available on mobile? * Yes, a similar unlock experience is available on mobile, but it works differently. 1Password on mobile will only unlock automatically if you’ve accessed it within 10 minutes of your last unlock. Security presets vary across platforms and can be customized per device. You can select or adjust your security preset at any time in the Settings section of the 1Password app on Mac, PC, or mobile. Will 1Password lock while I’m using my device? * 1Password stays unlocked while you’re interacting with your trusted device, minimizing unnecessary interruptions. It will lock when your device locks, goes to sleep, or after a period of inactivity, and it now unlocks automatically when your device does. Do settings sync across devices? * Presets and security settings are specific to each device. That means you can choose different security preferences for your laptop, tablet, or phone based on how you use each one. Do I need a recovery code? * No, but if you select a more lenient preset or setting, you’ll be prompted to create one. This way, you won't have to worry about a lost or forgotten password.

When IT and security teams lack visibility and control over the SaaS apps employees use, the result is wasted spend, unsanctioned access, and compliance failures. Yet 1Password’s research shows that all too often, SaaS usage is evading the tools meant to govern it. This blog is part two in our series analyzing the 1Password Annual Report 2025: The Access-Trust Gap. * To read part one, which addresses AI governance, click here. * If you haven’t had a chance to read the full report yet, download it here. The Access-Trust Gap report lays out the issues plaguing the SaaS landscape: > _The SaaS explosion has long outpaced traditional IT oversight. Today, enterprises face an environment where hundreds of cloud- and browser-based applications are in active use, many without IT’s knowledge or control. Shadow IT is no longer a fringe behavior; it's a foundational threat to modern access governance. And even sanctioned apps pose risks when access is poorly managed, offboarding is incomplete, or they are not protected by SSO.”_ ## SaaS governance statistics from the report * 52% of employees have downloaded applications without IT’s approval * On average, 34% of a company’s apps are not protected by SSO > _Offboarding is challenging because so many apps are outside SSO, and additionally, SCIM's effectiveness varies by vendor implementation. As a result, you can disable someone's access through your SSO provider, but it's easy to miss something, and ongoing monitoring is required. " Mark Hillick, CISO, Brex_ ## Imperative: SaaS governance When it comes to managing their SaaS ecosystem, IT admins are running up against the limits of SSO solutions. The original promise of SSO was to provide secure, centralized access to all a company’s apps. But in practice, SSO is often unfeasibly expensive and plagued by integration challenges. On top of that, SSO can only protect the apps that IT is aware of, which doesn’t account for unsanctioned shadow IT. To address these limitations, IT leaders must find comprehensive solutions that complement SSO and allow for full lifecycle management of all SaaS apps. Priorities include: 1. Invest in technology that enables the continuous discovery of shadow IT. To be effective, this must include web-based apps as well as locally hosted software. 2. Mandate SSO where possible and secure authentication for apps that cannot be federated. 3. Automate SaaS access governance to ensure complete lifecycle management, including for non-SSO managed apps. ## How 1Password helps close the Access-Trust Gap for SaaS Trelica by 1Password is a SaaS management solution that enables IT teams to discover, manage, and secure every SaaS app in use at their organization. Now, let’s go through each of the priorities listed above and discuss how Trelica by 1Password helps to address them. ### Invest in technology that enables the continuous discovery of shadow IT Trelica by 1Password continuously discovers every work-related app employees use, so IT teams can either bring them under management or block access to them. ### Mandate SSO where possible and secure authentication for apps that cannot be federated Trelica by 1Password proactively notifies admins about apps where SSO is available but not in use. For apps outside SSO, it can revoke risky OAuth tokens that grant third-party apps access to company resources. ### Automate SaaS access governance to ensure complete lifecycle management, including for non-SSO managed apps Manual lifecycle and permissions management creates an environment ripe for errors and unsanctioned access. Trelica by 1Password automatically provisions apps to users by syncing with HR data during onboarding, conducts regular access reviews, and revokes access to _every_ application during offboarding, thus improving security and saving budget by reducing unused licenses. _Explore Trelica by 1Password with an interactive demo_. ## Close your Access-Trust Gap with 1Password For SaaS environments, the Access-Trust Gap encompasses both shadow IT and apps that IT is aware of, but can’t fully manage with existing tools. The SaaS explosion isn’t slowing down anytime soon, which means there will never be a better time to assess your own organization’s Access-Trust Gap and start closing it. To learn more about how 1Password can help you secure your business without slowing you down, _reach out to us today_. You can also click here to read the full Access-Trust Gap report.

## **Summary and key findings** 1Password surveyed **2,000 American adults** to learn how people are protecting themselves from phishing scams this holiday season (“phishing” refers to all those scammy emails, shady texts, and fake ads, where hackers try to trick people into clicking a link that lets them steal money or information). What we learned is that holiday scams are getting bolder and harder to spot, thanks to the help of AI. Here are some of the other most eye-opening findings: * **AI is the new gift wrap for holiday scams:****66% of Americans** say they’ve noticed more scammy messages, phone calls, and ads since AI became more prevalent. * **Taking the bait: 82% of respondents** have been phished, or come dangerously close to it. * **Younger generations are falling first:** Gen Z **(70%)** and Millennials**(67%) are more likely to be phished** compared to Gen X **(57%)** and Boomers **(46%).** * **Duplicate passwords are a gift to hackers:** A whopping **76% of Americans** who've fallen victim to a shopping scam still reuse passwords across multiple accounts. * **You [don’t] have mail: 31% of Americans** who’ve been phished were trying to track a delivery or package. * **Scroll, click, regret:** Social media scams are less common but more effective**.****45% of Americans** exposed to social media scams were successfully phished.**** If you’ve lived through enough holiday parties, you know that pretty wrapping paper can hide a real stinker of a gift. That’s how phishing attacks work; they present victims with a shiny object guaranteed to get their attention, but that bright packaging is just a trick to steal information or money. Phishing attacks also tend to increase during the holiday season, when people are hunting for deals and juggling package deliveries. As holiday shopping begins, scammers love to find the right wrapping to entice us to open a dangerous link. For instance, a victim might click on what _seems_ like a digital gift card, only to find malware inside. We all want to be savvy enough to spot phishing attempts before we click a malicious link or surrender personal information. Unfortunately, that may be more difficult than ever this holiday season, since hackers are using AI to make scams both more ubiquitous and more convincing. In this blog, we’ll go through our phishing survey results, and what they teach us about the current state of holiday scams. We’ll also be sharing key phishing prevention tips from **Dave Lewis, 1Password’s Global Advisory CISO**. We hope you’ll use this data and advice to be more aware and have a safer holiday season. Think of it as 1Password’s gift to you. ## **Keys to a phish-free holiday season** As you start gearing up for the holidays, here are the critical factors to keep in mind when guarding against phishing scams. ### **Update your red flags** Here’s the good news: **95% of our survey respondents** said they could spot common scammer red flags**.** The bad news is that this may lead to overconfidence, since **82% of respondents** have still been phished, or come dangerously close to it. Part of the issue is that the aforementioned “red flags” may need an update. The top signs that tip Americans off to a phishing scam are: * Misspelled words or poor grammar **(49%)** * Requests for sensitive information **(49%)** * Strange URLs **(49%)** * An unrecognized sender **(46%)** All of these are valid signs to be wary of online. Unfortunately, they’re less effective now that hackers are armed with AI. To _quote the FBI_, “AI-driven phishing attacks are characterized by their ability to craft convincing messages tailored to specific recipients and containing proper grammar and spelling…” In other words, the advent of AI has made it harder to spot a scam based on misspellings and other former telltale signs. Our research confirms this. **Two in three (66%) Americans** say they’ve noticed more scammy messages, phone calls, and ads since AI became more prevalent,****and**62%** have received a scammy message they suspect was AI-generated. “My grandma falls for scams all the time, especially since AI has been a thing. We’ve told her to never answer people trying to say she owes something or trying to sell her things.” – Gen Z woman in Nevada If you can’t rely on misspellings and sloppy graphic design to spot a scam, what can you look for? One age-old tactic of scammers is _pressure_. Phishing scams count on you acting impulsively, so they do their best to create a sense of urgency. For instance, they’ll fake extremely limited-time Black Friday deals, with pressure to “act now to claim this discount!” But our survey found that Americans don’t know to look out for high-pressure tactics; only **35% of respondents** consider them a red flag. People also let their desire for a bargain get in the way of their better judgment; **41% of the respondents** who clicked a phishing link were trying to access a special deal, price, or sale. > **Dave Lewis holiday phishing reminder:** > > Never be afraid to ask for a second opinion. Scammers rely on embarrassment to keep victims quiet, but spotting a scam isn’t always easy. With the help of AI, scammers can send increasingly sophisticated messages at breakneck volume; even pros can get fooled. If something doesn’t feel right, show it to a co-worker, friend, or family member before acting. A quick gut check can save you from a costly mistake. ### The newest scams are the most effective, so be on guard everywhere Phishing is one of the _oldest scams on the internet_; by now, most Americans are familiar with the most common forms of phishing. However, just as our red flags need to evolve, so do the places where we stay on guard. Our survey found the three most frequent places where people encounter suspected phishing scams: * Texts **(59%**) * Emails **(59%**) * Phone calls **(49%**) People know to be on the lookout for scams on these channels, so it’s no surprise that they are often the _least effective_ at tricking people into handing over their data, such as passwords and credit card numbers. For example,**34% of people** reported falling prey to a “smishing” attack, meaning that they clicked a suspicious link in a text message. On the other hand, less common phishing channels are more likely to deceive people. Social media isn’t as widely used for phishing as email or text, but **45% of people** exposed to social media scams were successfully phished. “One time, a scammer posing as a friend on Instagram sent me a link. I clicked the link and my account got overtaken, but I luckily got it back. The scammer [who] hacked me was sending people cryptocurrency links from my account.” - Gen Z woman in South Carolina _More and more users_ are shopping on social media every year; people are used to getting product recommendations and affiliate links from Instagram and TikTok. Social media, like phishing, also relies on impulse, with over _60% of social media users_ regretting an impulse buy they made on a platform. Essentially, people get click-happy on social media, which makes it a prime medium to deliver phishing scams. > **Dave Lewis holiday phishing reminder:** > > Be skeptical when shopping on social media. Social feeds are a prime hunting ground for scammers, who use realistic ads, fake storefronts, and sponsored posts that mimic real brands and people. Before buying or donating, verify the account, review comments for red flags, and visit the brand’s official site directly rather than purchasing through a link in a post, ad, or DM. ### Gen Z and Millennials are falling for scams – don’t assume you’re too tech-savvy to be a victim Our report data also challenges assumptions about who is getting scammed. Despite the perception of young people as tech-savvy digital natives, our survey found that younger generations are actually _more_ likely to fall prey to a phishing attack. Here’s the demographic breakdown of who has been phished: * Gen Z (**70%**) * Millennials(**67%**) * Gen X (**57%**) * Boomers(**46%**) Before we start any (more) intergenerational conflict over the holiday season, we’ll note that younger generations are also typically _exposed_ to more phishing attacks. For instance, **25% of Americans** who've received a job-related phishing scam have clicked on it, and job seekers naturally tend to skew younger. “My daughter was offered a remote job, which totally seemed legit. It wasn't until they sent her money to purchase work-related computers that we saw the red flags. She reached out to the actual company, and they verified it wasn't a real offer.” - Gen X woman in Ohio These job-related scams can be particularly dangerous over the holidays, when people begin to get worried about tight finances and start looking for new work (whether seasonal or long-term). Overall, we can’t assume that any generation is _better_ or _worse_ at clocking a phishing scam. _We should all be on guard_, particularly as scammers evolve their methods. > **Dave Lewis holiday phishing reminder:** > > If an offer seems too good to be true, it probably is. Make sure to look for telltale signs of phishing and look-a-like websites. Closely analyze the sender’s email address or phone number, hover over hyperlinks for legitimate URLs, and keep an eye out for poor grammar. Instead of automatically clicking on a link, you should always go directly to the retailer’s website to verify. ### **Secure your passwords: keep one mistake from draining your holiday funds** Here’s the most alarming finding of our survey: A whopping **76% of Americans** who've fallen victim to a shopping scam still reuse passwords across multiple accounts. If you’re not sure why this is a major problem, let us explain. One common holiday scam involves bad actors sending out _false shipping alerts_ to trick buyers into clicking malicious links or sharing personal information; we found that **31% of Americans** who’ve been phished were trying to track a delivery or package. “I got a text from (allegedly) USPS, saying that there was an issue with my package at the warehouse, and telling me to click on a link which looked legit. The website looked like a USPS website and had me pay a $0.50 shipping fee, which they then used to get access to my credit card.” - Gen Z man in Nevada Imagine you click a link to a very convincing imitation of the USPS website. You try to log in to track a package, only to then realize that the site isn’t legitimate _._ Now the bad actors who built the _fake_ site have your _real_ login information. At that point, having caught on, you close the window, find the proper USPS website, and change your password there. Unfortunately, your old USPS password was also the password to access your airline points, bank account, and credit card… which is exactly what the scammers were counting on. Reused passwords are skeleton keys for bad actors to take over multiple accounts; if you’re not paying attention to your passwords, you might not find the vulnerable accounts before the hackers do. > **Dave Lewis holiday phishing reminder:** > > Even if you’ve fallen for a scam, good password hygiene limits the damage. A single reused password can unlock multiple accounts for hackers. Use a unique password for every account, and let a _password manager_ do the remembering for you. It’s one of the simplest, most effective ways to protect yourself from waking up to a digital nightmare. ## **Security is the gift that keeps on giving** We’ll end with a final stat: **70% of Americans** have helped a family member identify a scam, but only **46%** have asked for help themselves. Remember that there’s never any shame in asking for help; a little embarrassment is far better than a compromised bank account. As we ramp up to the holidays, it’s not enough to give family and loved ones what they want; sometimes it’s better to give them what they _need_. If you’ve lived through enough holidays, you know that nobody’s ever thrilled to open up a new pair of socks. Despite that, those socks tend to be the gift we wind up using the most throughout the year. With phishing scams on the rise, people are in dire need of help to stay safe online. Whether you offer it in the form of helpful advice or perhaps through a _1Password gift card_ (we promise that link is legit), remember that security is always a good gift. _1Password conducted this study using an online survey prepared by_ __KW Research__ _and distributed by_ __PureSpectrum__ _, completed by n=2,000 American adults. The sample was balanced by age, gender, region, and employment status. Within employees, a range of role types, seniority, and industries are represented. Data was collected from September 29 to October 3, 2025._

Agentic AI is a fundamentally new paradigm. AI agents can interact with various tools and act dynamically and probabilistically as they encounter new inputs. That means they end up falling somewhere between an application and a user in terms of how they operate. Indeed, the interaction with other applications is what gives agentic AI its power; however, this also has implications for identity security and access management. Given this new paradigm, we’ve found it helpful to develop a simple taxonomy for agentic AI that guides the specific security measures that must be considered for each agent. We break this down into three distinct categories: * What type of AI agent is it, and how does it interact with the world? * Where is the agent running? * Who is the agent running on behalf of? Note: At 1Password, we have a set of AI security principles that apply across this entire taxonomy, regardless of how an agent is classified. An Identity Security taxonomy for Agentic AI ## What type of AI agent is it, and how does it interact with the world? There are two broad ways in which agentic AI can interact with other applications, tools, and services. The first is to mimic how a person would operate, most likely through a browser. Alternatively, agentic AI can use programmatic means, such as APIs, MCP, or other non-browser mechanisms to access services. While an agent may use these methods either serially or in parallel, for simplicity, we'll assume the agent falls into one camp or the other. The key point is that the method matters profoundly for the unique requirements from an identity security standpoint. For example, browser-based credentials are often very different from those used for programmatic AI. Where a browser agent might need usernames and passwords, passkeys, or even modern frameworks like WebMCP, a programmatic agent might need API keys, MCP, or other means to interact. Moreover, a browser is an execution environment that needs certain security measures, such as a credential manager, to securely fill credentials on behalf of the agentic AI. This leads to our first classification: ### What type of AI agent is it? * Browser AI agent - interacts with applications and services via a browser. * Programmatic AI agent - interacts with applications and services via APIs, MCP, agent-to-agent (A2A), etc. ## Where is the agent running? Many AI agents run on endpoints, such as a person’s laptop or smartphone. On the other hand, there's a growing number of AI agents being deployed remotely in public or private clouds. This delineation matters from an identity security standpoint. In the first case, it is running on a user's local, trusted environment. From an enterprise perspective, these devices are typically managed and protected by various tools such as MDM and EDR. By contrast, a remote deployment implies that the AI agent is coming from a source outside a user's trusted environment. Additionally, there is a strong implication (though not always true) that in the local case, a person is actively present. In contrast, in the remote case, the workload is likely running autonomously and/or asynchronously. These distinctions are critical to understand how the agent is getting authority (e.g., does it simply inherit the user's credentials?), how it accesses secrets (e.g., via accessing a secrets or privileged access management solution?), and other relevant questions around agentic identity (e.g,. how to make explicit, and distinct from the user identity?). It leads to the next classification: ### Where is the agent running? * Endpoint - running on a device or workstation. * Remote - running in a private or public cloud. ## Who is the agent running on behalf of? AI agents can be used by individuals to vibe code or to automate various tasks. A company can use them internally to automate tasks, run testing pipelines, or host internal applications. Finally, they can also be used in production, customer-facing applications. Each of these scenarios distinguishes the authority behind the AI agent running and the access and credentials the agent relies on to interact with the tools and services it needs. Thus, a third extremely important classification is: ### Who is the agent running on behalf of? * Employee - agents accomplish a task for an individual employee. * Company - Internal - agents used for an internal company use case. * Company - External - agent used in an external-facing production environment. ## Applying the taxonomy to agentic AI access management The recently announced Secure Agentic Autofill is a 1Password capability focused on securing credentials when used with a browser AI agent. We can apply the taxonomy to categorize the use cases this feature addresses: * Browser AI agent: 1Password can securely deliver credentials into a secure extension in the remote browser, which then fills the credentials on behalf of the AI agent * Remote: The credentials are end-to-end encrypted over the network, and the solution will support synchronous and asynchronous use cases. * Employee, Company, or Customer: All of these use cases are supported, with the nuance being exactly whose vault the credentials are coming from and what the appropriate human-in-the-loop authorization process is. This taxonomy, along with our security principles, provides a starting point to identify ways to balance productivity and security for our customers. ## Why Agentic AI Taxonomy matters for Identity Security The classifications above provide clear guidance on the security requirements that must be implemented to safely enable organizations to adopt agentic AI. This is crucial for understanding and thinking through how agentic AI should be secured. By mapping the agent type to where it is running and who it is running on behalf of, you can quickly and easily understand what may be required to secure agentic AI.

The new .env destination in 1Password environments makes it easy for developers to use and collaborate on .env files securely, right from the desktop app. 1Password environments provide a secure workspace to store, organize, and manage project secrets – the same credentials you would normally handle as environment variables. Each environment acts as a dedicated space for a project or app, helping teams manage and maintain consistent credentials. With the new .env file destination, you can use those secrets – stored securely and locally – in your usual workflows. We launched this functionality in beta earlier this month, and have already had some rave reviews: > _“Just wanted to drop some feedback after playing around with the new Environments Beta in 1Password. Honestly, I’m loving it so far. The local .env file mounting is just brilliant. Secrets are easy to access without having to run extra commands, but still secure – exactly what I want. Makes switching between machines seamless, too.”_ This new integration lets you keep your familiar .env workflow while solving its largest flaws: insecure storage and messy collaboration. Secure storage and access are integrated directly into the 1Password desktop app, meaning no command-line setup, infrastructure changes, or plaintext secrets stored on disk. You and your team can share and update environment variables safely without insecurely passing files or copying secrets into chat. 1Password environments also integrates with AWS Secrets Manager, allowing teams to securely sync and use secrets in production today. Local .env file mounting is now available to everyone using our desktop password manager on Mac and Linux as part of the 1Password environments public beta. ## Where .env files fall short Many developers rely on .env files in development environments to store and load app credentials like API keys, database URLs, and access tokens. The idea traces back to The Twelve-Factor App, which popularized storing configuration in environment variables instead of code or config files. This approach was a major improvement – it moved secrets out of source files – but led to the challenge of .env files storing credentials in plaintext. Plaintext storage might be manageable for a single developer, but it becomes riskier in a team setting. While developers have tried various methods to simplify this process, from shared folders to dedicated secrets-management tools, these approaches often introduce additional setup time, complexity, and overhead. Every developer knows the trade-off – .env files are simple but fragile: * Secrets are stored in plaintext on disk. * It’s easy to forget to add .env to .gitignore and expose credentials in commits. * Syncing changes across machines and teammates is laborious. * Onboarding new developers often means chasing secrets through chats or internal docs. These problems slow down teams and increase the chance of sensitive data leaks. ## Meet 1Password environments: a secure, familiar way to work with .env files without complicating your workflow 1Password environments brings the same trusted protection developers rely on for SSH keys and personal credentials to their .env files. Built directly into our desktop password manager, it lets your apps read the variables they need without secrets being written to disk. When your app requests access, 1Password retrieves the secrets securely. Once they’re read, they’re gone until you need them again. It’s a simple example of one of our core principles: making the secure thing the easy thing. Developers get the same workflow they already know – just safer, faster, and built into the tools they already use. ### Simplify your workflow 1Password environments work with your existing .env tools and libraries – no need to rewrite code or change how you load environment variables. ### Instant setup Create an environment, import your variables, mount your file, and invite your colleagues to collaborate. No admin setup or account-level configuration required. ### Zero plaintext Secrets are not written to disk so won’t appear in your Git history. You can’t accidentally commit them. ### Offline access No more getting blocked when your connection drops: you can now access cached secrets even when offline, a long-standing request from our users. ### Built for collaboration Version history, access control, and automatic updates all live in one place so everyone can stay synced without juggling files. ## What’s happening behind the scenes Here’s how this new functionality works: 1Password environments mounts a .env file at the path you choose. Once you approve access, 1Password passes the data directly to your app through a UNIX pipe. Your applications can read the file as if it were a regular .env file but the file contents are never written to disk. The mounted file remains available as long as 1Password is running and locks automatically when 1Password is locked. Because the file is mounted virtually, it won’t be tracked by Git, meaning your secrets can’t be staged, committed, or pushed. This setup allows your apps to interact with a .env file as they normally would without ever exposing or persisting secrets. Everything works as expected, just far more securely. ## Get started Setting up 1Password environments takes just a minute: 1. In the 1Password desktop app, head to the Developer section in the sidebar. (If you haven’t already, you’ll need to enable the 1Password Developer experience in Settings.) 2. Create or open an environment. 3. Import your existing .env file. 4. Under Destinations, choose Local .env file. 5. Select the file path where you want to mount it. 6. Authorize access when prompted. 7. Run your app as usual. 1Password provides your secrets securely when needed. 8. Delete your old .env file if you haven’t done so already. 1Password environments works out of the box with existing dotenv libraries. You can disable or re-enable mounted .env files anytime from the Destinations tab. ## What’s next 1Password environments already integrates with AWS Secrets Manager, making it easy for teams to use it in production. More destinations are on the way. Looking ahead, we’re focused on expanding support to more developer workflows while continuing to refine the experience based on beta feedback. We’re also exploring options to bring this experience to Windows. (Stay tuned for updates!) If you’re trying 1Password environments during beta, we’d love your feedback. Join the discussion in the 1Password Community or subscribe to our developer newsletter for updates. ## Try 1Password environments today Get started in the 1Password desktop app and experience a simpler, safer way to work with .env files. * Watch the demo video * Follow along with the documentation * Join the conversation * Sign up for updates

Professional sports franchises are high-profile, global enterprises that operate at a rapid pace and rely on instant, secure access to the tools and data that keep them competitive. In this arena, speed and trust aren’t trade-offs; they’re the keys to success. The same is true for modern businesses and the millions of people behind them; everyone needs a simple, secure way to safeguard their personal identities and technology that enables access without slowing them down. That mission takes center stage through our multi-year partnership with Smith Entertainment Group (SEG), the parent company of the Utah Jazz, Utah Mammoth, and the Delta Center. As the Official Cybersecurity Partner of both teams, 1Password is redefining how elite organizations approach access and identity security. > _“Giving teams the tools they need to move fast while keeping them digitally protected is at the heart of how organizations win, whether in business, sports, or technology,” said David Faugno, CEO of 1Password. “Just as SEG is transforming sports in Utah and beyond, 1Password is transforming how enterprises secure access in a world of distributed work, global travel, and AI-driven operations. Through the Extended Access Management suite of solutions, we ensure the right person or AI agent has access to the right app from a trusted device. As a result, the Jazz and Mammoth organizations can stay focused on winning on the court, on the ice, and in the community.”_ This partnership extends beyond the court and the ice and aims to inspire fans to take simple, practical steps to protect their digital identities. Whether you’re securing a franchise or a family tablet, everyone deserves a safer, simpler digital future. Learn more about 1Password’s partnership with SEG in the press release. ## A new era of Extended Access Management Business leaders and IT teams share responsibility for ensuring that identity and access controls keep pace with innovation, enabling every employee, partner, and system to connect safely without slowing the work that drives performance. But these risks don’t stop at the enterprise level. For every person signing into streaming accounts, shopping online, or helping your family stay safe with shared devices, a single unsecured sign-in can be the difference between security and exposure. There's a famous bit of hockey wisdom passed down by the Gretzky family: “Skate where the puck is going, not where it’s been.” That mindset captures the change taking place in identity security today. 1Password Extended Access Management represents a new approach to identity security. It’s not a single product or feature; it’s a holistic approach to securing access across people, apps, and devices that aligns with the way people work today. Traditional IAM and IGA rely on legacy technologies that can slow workflows - where the puck has been. But today’s organizations are remote, distributed, and fast-moving. In this environment, identity is the perimeter to protect. Legacy tools leave gaps in credential management, application discovery, and governance for SaaS and AI. The Extended Access Management suite of solutions ensures the right person has access to the right app from a trusted device. For business and IT leaders, this represents a shift from reactive security to proactive enablement. With Extended Access Management, identity security isn’t a bottleneck; it’s a performance advantage that helps teams share information, onboard faster, and collaborate securely without friction or compromise. The benefits extend beyond the enterprise. For fans and families, secure access becomes second nature, as simple as logging in. By reducing password fatigue and replacing complexity with confidence, 1Password helps people quickly access information and secure their household’s digital life. ## The Extended Access Management suite simplifies secure access 1. 1Password Enterprise Password Manager securely vaults credentials, provisions credentials for human and agentic workflows, and enables secure credential sharing across groups, keeping teams focused on performance instead of passwords. It provides a single source of truth for secure access, resulting in streamlined onboarding, faster workflows, and fewer password resets. 2. Trelica by 1Password is a leading SaaS Management platform that provides IT teams with a comprehensive view of all applications and AI across departments, whether managed by IT or not. With Trelica, organizations can reduce SaaS spend by identifying redundant tools, right-sizing software licenses, and automatically deprovisioning access when roles or seasons change. 3. 1Password Device Trust enables granular conditional access policies to ensure that applications and data are only accessed from trusted devices. It verifies that every laptop, tablet, or phone connecting to critical systems meets compliance standards before sign-in is granted. Device Trust guarantees that only approved, secure devices make the connection. These capabilities create a frictionless and secure ecosystem designed for real-world performance. The Extended Access Management suite enables teams to move quickly, share confidently, and innovate safely, no matter where their work takes them. ## Building the future of sports security 1Password’s partnership with SEG, the Utah Jazz, and the Utah Mammoth marks a new chapter in how cybersecurity empowers performance for teams.. Together with SEG, 1Password is helping redefine what trust means in professional sports, enabling teams to operate at full speed with confidence. This collaboration also represents a significant milestone in 1Password’s strategic expansion into the professional sports sector. The Utah market has become a national hub for innovation, where technology, sports, and AI intersect, and SEG is leading the charge. As Delta Center’s infrastructure expands and its technology ecosystem evolves, 1Password is proud to help keep SEG’s data safe. Identity security is the digital foundation that supports a safer digital future for people and businesses through trusted access, seamless collaboration, and the confidence to innovate without compromise. As professional sports venues modernize to host a range of events and activities, they are increasingly doubling as executive briefing sites, where technology and C-suite relationship-building converge. Through the Away-Game Executive Hospitality Program, we’re replicating the exceptional experience of a home game at the Delta Center and taking it on the road to engage with 1Password’s customers where they live – bringing business leaders together to explore how identity security, AI, and innovation intersect to shape the future of high-performance organizations. The program offers unique behind-the-scenes access directly tied to the NHL and NBA road schedules, connecting the excitement of professional sports with the conversations shaping the future of secure organizations. ## A new way to make a team work Whether managing a global organization or a family’s digital life, identity security starts with trust. 1Password helps people and teams everywhere protect what matters most, giving them the confidence to perform, share, and live securely. As professional teams innovate, secure access will remain their advantage. 1Password is proud to help redefine what it means to play and win. Discover how 1Password Extended Access Management helps teams and individuals move faster, collaborate securely, and foster a culture of secure performance.