1Password hits $500M ARR with 90% YoY new-ARR growth, launches agent credential management product

Speaker 2: Our next guest is returning to the show for the third time. We're the CEO of 1Password. David, welcome to TBPN. Here it back. Thank you for your service amid Yeah. Black October. Sleeping. Hope But

Speaker 1: thank you... I've been sending... I've been just texting the one password website to people. This is... If you're scared, it's like, you know, it's warranted to be scared but here's

Speaker 2: Yeah.

Speaker 1: One simple thing you can do to start your personal security journey.

Speaker 2: I saw a tweet that was like, this is the weekend to sit down with all your family, get everyone on one password.

Speaker 1: You lined this up perfectly with with Austin F1, you guys are Red Bull sponsors, so... Driving driving quality awareness Yes. To motor sports enthusiasts.

Speaker 2: Yes.

Speaker 3: Yeah. It's funny. The the... You first of all for having me and also for sharing the sharing the word. You know, the the post that made last year about, like, the basics, you know. So, like, I've seen it on my Twitter, you know, my ex timeline a 100 times now. Yeah. And there is really... You gotta get back to basics right now because it's pretty scary out there. So anyway

Speaker 2: Yeah. So yeah. What else is going on inside of 1Password, the organization? What what can you tell us? What can you share both for consumers, obviously, like get on 1Password, but for entrepreneurs, for founders, for Fortune 500 CEOs, What are the... What's the nature of the conversation that you're having with other business leaders about security in this particular moment?

Speaker 3: Yeah. You know, it's it's interesting. Almost all of the AI oriented, you know, productive uses of AI for the last, you know, couple years have been around the developer use case, coding use case. And so, you know, trillions of dollars of value around helping people code more effectively and faster. And, you know, we've been a very big beneficiary of that as well. Our developer tools have driven our business. We put out a press release around our business momentum, about a $500,000,000 in ARR now. We're across that threshold, and we did it at Accelerate. So Accelerate That's...

Speaker 8: And thank you for that.

Speaker 1: Come on,

Speaker 3: come on. You you ring the ring the bell, which I love. What was exciting for us is we were... We accelerated through that that milestone. Yeah. That new ARR for q three was 90% growth year over year. We're adding new logos on the B2B side at 150% growth over quarter over last year, third quarter. And it's very much driven by awareness that especially in the development cycle, agents need access. Yeah. And, that access when it's left standing around is a ticking time bomb. Yeah. So that's been sort of a big catalyst for our business, but there's other things going on now too that that that are complementing that. We saw this breakthrough a couple quarters ago around personal agents.

Speaker 2: Yep.

Speaker 3: And it's the next big way that AI is being used in an agentic way to help people. We were right in the middle of that. We could talk a little bit about that as well. But that's been something that we launched this week as well. One Password for Agents

Speaker 2: Yeah.

Speaker 3: With our launch partners, which included the likes of space SpaceX SI, I'm getting the name right. Yeah. MedMuse, Anthropic, OpenAI, and sort of all the folks that are building the agents. And then at the same time, you know, the vulnerability apocalypse has descended upon us. And so there's a heightened awareness generally that agents will find access to things whether it's maliciously intended or just drift, and they will do unintended things. And so this sort of ability to say it's not gonna be me or be a little bit lazy with your credential hygiene, that's not gonna work anymore. And people are starting to realize and they're coming to 1Password to help. So that's where we are.

Speaker 2: How... What what have you what have you learned from 1Password customers about the gradations of trust between families and organizations and how passwords get shared? Like, it's very interesting that the default model is not just, you know, every password gets shared with every family member, and that feels like intentional from a clutter perspective, but also you might have two separate accounts for, you know, email, and you don't necessarily always want them guessing each other and whatnot. But it feels like some of those learnings might actually apply to the way people work with executive assistant agents in the workplace and then also personal agents in the in the family setting. And I'm wondering how you think about setting one password for agents up for success where there's a controllability layer that the user can have between, look, I'm okay with my my personal agent of choice having access to my calendar, but maybe not my email. Or maybe just my personal email but now my work email or maybe just my work email and now my personal email. So how how... What patterns have you learned and how do you see this playing out or or how do you deal with this? Are you one of the people that just gives AI access to everything or nothing or well, how have you grappled with it?

Speaker 3: Yeah. No. One password for agents, is really built around their premise of just give the agents what they need.

Speaker 2: Yeah.

Speaker 3: Just just when they need it, just enough with full visibility. It's the same primitives that apply to what we do for businesses even very large enterprises. But again, these are non deterministic actors. Right? They... You don't know exactly what they're gonna do even when they're well intended. Yeah. And there's so many ways for something malicious to be done as well. And so you have to reduce that standing access. One way... One of the ways you reduce this is you don't give it out. Yeah. And so what we've done... What... Interestingly, all of the partners, it started with with Instinct and then quickly saw with MetaMuse and with and others. These partners we've been collaborating with for months now, they see it as well. People want to have that control and they'll only really lean in and use these tools if they know that there's this trust layer. And so we set this system up. We've been working for a long time on the primitives that allow that secret to never get into the model context. It's it's never in a file where an another agent can come and find it and do something else with it. It's just delivered for the agent for the task that it wants. And so you can scope that a lot of different ways. And we're working with each of those partners on the roadmaps as to what does that scoping and that control look like for the individual to exactly your use cases or the examples that you share. How long do I want to let the agent access this particular resource on my behalf and under what conditions. And so that's really the the basis of what we're bringing here is this trust layer that sits between, you know, the agents that would do work for you and and the people that are ultimately accountable for it. And we're just all in on it and it's been it's been great for our business, it ultimately it's aligned with our mission.

Speaker 2: Do

Speaker 1: you do you think at all about, like, more proactive features and products for... On the consumer side that you could do around personal security. It feels like...

Speaker 2: Watchtower is kind of like that.

Speaker 1: Yeah. But it but it feels like now is a time where there's like a lot of activation energy from consumers of like, wanna do something, but at the same time consumers are lazy. And so it feels like you guys have gained so much trust.

Speaker 2: Like a gentic watchtower would be like, yeah, I did use the same password 25 times when I was in college setting up random websites. Like, go change those passwords for me. Like, that's a possibility, but it's kind of crazy. But I don't know. Is there to make a deal?

Speaker 3: You're you're obviously... We're right down the path on that. A lot of

Speaker 2: that is what we'll

Speaker 3: do in conjunction with our partners too.

Speaker 2: Right?

Speaker 3: And so, and then... And what you wanna make sure from our perspective that we work really hard to do is all of that activity happens and preserves the zero knowledge basis of our vault. So we do a lot with confidential computing to make sure that when those secrets get decrypted, if they needed to be decrypted for a reset or otherwise, it's never in a place where a bad actor or an agent can find it and do something with it. So very carefully constructing that, but yeah, absolutely you'll see that come. The other thing that's interesting to Jordan to your question is, what happens with preferences? You know, people's preferences, they're actually looking to have more control over that as well. And your context is a is a broad term, but there's some things that look somewhere between a secret and and context Mhmm. That people want portability and control on. And so I think you'll see more and more of what we do in connection with our partners as well as providing some of that control layer at the one password level as well. So it's really an exciting opportunity, but like first things first, making sure that those secrets stay safe because what we're seeing in all the crazy security incidents that are coming up now is vulnerabilities are not stopping. It's so easy and cheap and fast to utilize AI from an actor's perspective to get into systems, to get onto somebody's laptop.

Speaker 2: And the

Speaker 3: first thing that they do when they're there is they look around and say, well, what access is standing around here? What can I get access to immediately by just getting credentials? So you can go all the way back to where, you know, the Hugging Face incident started to make its way into the public discourse to everything that happened this week. And it's, you know, case after case, credentials being found and compromised. And that's our mission. Let's get that get that cleaned up from starter, and then let's make sure that we don't propagate that problem as we use AI internally and and make the problem worse over time.

Speaker 2: What is the one password house recommendation for personal use of hardware keys? Yeah. So... Is that something I should be onboarding my family members to after I

Speaker 8: got them on

Speaker 2: one password?

Speaker 3: Hopefully, you use multi factor authentication.

Speaker 2: Of course.

Speaker 3: You know, it's interesting. You can ask your agents to to stack rank the different forms of multi factor authentication in terms of security. The agents will tell you that, you know, a hardware key is going to be the most secure. It's also got some challenges associated with it. Sure. I use pass keys for second factor all... As much as I can, which I think is a really good way if you don't wanna go to the hardware way. SMS is probably the easiest to be compromised. Yep. SIM swapping is a real thing and it's pretty easy to implement. So the bad guys wanna get in, think you're covered through MFA. So at a minimum, I would look at TOTP or pass keys on one level. But if you're really concerned, a hardware key is helpful. And then really just the other thing that people are doing is they're just sort of like getting lazy about it. Well, you know, I'll store it in my browser you know, variety of different ways. But like having that end to end encryption and having that just in time delivery where the secret is never exposed or can't be read from a file is going to be really important because the cost to attack is going to zero. That means everybody's a target.

Speaker 2: Yeah. Right before it

Speaker 3: was just the guys that were were big enough to be worthwhile going after. Yeah. When when the cost is auto... When it's automated and the cost is almost zero, really any standing access is a potential problem. Yeah. And so you really wanna make sure that that central control point, you know, is is the is the way that your agents or you get access to the things that are most important to you.

Speaker 2: Yeah. It used to be the most secure way was just writing down a sticky note, putting it on the desk. But now the smart TVs have cameras. They're spying on you. And so they'll see from the camera the pic... The picture picture of this of the sticky note with your password on it. And so there's no there's no other solution. You have to use one password. It's it's it's gonna be bad for the sticky note industry. I I It will. Knock on effect. You're if you're really as successful as I think you're gonna be. Some money to be made shorting sticky notes. I love the industry but it's it's it's bad news. Bad news, but your building's good. But thanks so much for coming on the show. Awesome. Awesome. Have a great rest of your day.

Speaker 1: Good stuff, David.

Speaker 2: Take you to the day.

Speaker 1: Thanks for the update.

Speaker 2: Goodbye. Cheers. Let me tell you about the New York Stock Exchange. Wanna change the world, raise capital at the New York Stock Exchange. We're very excited to partner with the New York Stock Exchange.