1Password vendor risk assessment - Low Risk | Vendorisk.ai

Vendor dossier // 1password.com

1Password

Also known as AgileBits · AgileBits Inc.

Last updated: Aug 12, 2026, 05:28 AM

Low risk

Proceed

1Password demonstrates a coherent public security posture with SOC 2 and ISO certifications, regular third-party audits, and a strict zero-knowledge…

Higher score = greater risk. How we score

15/100

Low Risk

Risk Score

15/100

Research Coverage

Complete

Evidence Quality

High

Last assessed

Rationale

1Password demonstrates a coherent public security posture with SOC 2 and ISO certifications, regular third-party audits, and a strict zero-knowledge architecture . While a 2023 incident involving Okta's support system was quickly contained with no data compromise , a 2025 DEF CON presentation highlighted a DOM-based clickjacking vulnerability in its browser extension . Given the strong encryption standards, transparent audit practices, and contained nature of past incidents, the vendor presents a Low Risk profile, though continuous monitoring of extension updates is advised .

Risk drivers

Material incidents: +5
Research coverage adjustment: −5

Assessment decision

No workspace decision recorded for this assessment yet.

The system recommendation is above.

01. Findings

1Password employs a strict zero-knowledge architecture, ensuring that customer data is encrypted end-to-end and only the user holds the decryption keys . The vendor holds SOC 2 and ISO certifications and undergoes regular independent third-party audits and penetration tests, with most reports made public . In October 2023, a security incident involving Okta’s customer support system was disclosed, but 1Password confirmed it was quickly contained with no user or employee data compromised . Additionally, the company maintains a transparent privacy policy stating it does not use, share, or sell customer data .

Okta Support System Incident

High severity · Security

OpenObserved

In October 2023, 1Password was affected by a security incident involving Okta's customer support system. The activity was quickly contained, and no user, employee, or sensitive data was compromised.

02. Events

[funding] Secondary Market Transaction
In October 2025, 1Password completed a secondary transaction reaffirming its $6.8 billion valuation.
Oct 1, 2025, 12:00 AM · Source
[other] Browser Extension Vulnerability Disclosure
At DEF CON 33 in August 2025, researcher Marek Tóth presented a DOM-based extension clickjacking vulnerability affecting 1Password's browser extension in default configurations.
Aug 9, 2025, 12:00 AM · Source
[breach] Okta Support System Incident
In October 2023, 1Password was affected by a security incident involving Okta's customer support system. The activity was quickly contained, and no user, employee, or sensitive data was compromised.
Oct 1, 2023, 12:00 AM · Source
[funding] Series C Funding Round
In December 2021, 1Password raised $620 million in a Series C round, valuing the company at $6.8 billion.
Dec 17, 2021, 12:00 AM · Source

03. Company

1Password is a Toronto-based identity security and access management company founded in 2005 . Operating as a remote-first organization, it employs roughly 2,950 people globally . The company transitioned from a bootstrapped startup to a major enterprise player, raising a total of $920 million across multiple rounds, including a $620 million Series C in December 2021 that valued the firm at $6.8 billion . Leadership includes CEO David Faugno and Executive Chairman Jeff Shiner, who joined in 2012 . 1Password is free cash-flow positive and has publicly targeted an IPO alongside a goal of reaching $1 billion in annual recurring revenue .

04. Product

1Password offers a unified access management platform designed to secure credentials for humans, AI agents, and machines . Its core product is an enterprise password manager that stores login credentials, credit cards, passports, and secure notes in an encrypted vault . The solution integrates with major identity providers like Azure AD, Okta, and OneLogin to streamline deployment and access governance . It is frequently compared to competitors such as LastPass, Keeper Security, Dashlane, and Bitwarden in the password management software category . The platform emphasizes ease of integration and deployment, earning high ratings in industry reviews .

05. Recent News

Recent news highlights 1Password's expansion into AI agent security and SaaS management, with the company named a Leader in the 2026 Gartner Magic Quadrant for SaaS Management Platforms . In August 2025, security researcher Marek Tóth presented a DOM-based extension clickjacking vulnerability affecting 1Password's browser extension at DEF CON 33, noting that version 8.11.8.40 remained vulnerable . The company continues to update its mobile and desktop applications to fix UI and autofill issues . 1Password also completed a secondary market transaction in October 2025, reaffirming its $6.8 billion valuation .

06. Dependencies

Fourth parties this vendor relies on - subprocessors, infrastructure, and integrations surfaced from public sources.

Okta, Inc.
okta.com
IntegrationSource →
Azure AD
IntegrationSource →

08. Vendor response

Content in this section is vendor-supplied and does not alter Vendorisk.ai's risk tier or evaluation.

09. Assessment history

8/12/2026, 5:28:33 AM · Low · 15

Risk delta is hidden until two stored snapshots can be compared.

10. Targeted questions

No unresolved controls

Targeted questions are generated only from unanswered or conflicting controls. The full SIG-lite questionnaire remains on its own route.

Evidence & provenance

32 sources · Generated Aug 12, 2026, 05:28 AM

Expand →

Every verdict stores the public sources retrieved for this run. Read our methodology.

Verdict generated: Aug 12, 2026, 05:28 AM

Input sources · retrieved Aug 12, 2026, 05:28 AM

Company(8)

What is 1Password? Profile, leadership & funding — Komo
Company
Open source →
1Password’s growth story | How they went from bootstrapped to $6B company | Jeff Shiner (CEO)
Company
Open source →
1Password Nets $620 Million, Company Valued at $6.8 Billion

11. Sources

[1] 1Password demonstrates a coherent public security posture with SOC 2 and ISO certifications, regular third-party audits, and a strict zero-knowledge architecture. 1Password Review: Best Password Manager of 2026?
[2] While a 2023 incident involving Okta's support system was quickly contained with no data compromise. 1Password
[3] A 2025 DEF CON presentation highlighted a DOM-based clickjacking vulnerability in its browser extension. 1Password
[4] Given the strong encryption standards, transparent audit practices, and contained nature of past incidents, the vendor presents a Low Risk profile, though continuous monitoring of extension updates is advised. 1Password Review: Best Password Manager of 2026?
[5] 1Password is a Toronto-based identity security and access management company founded in 2005. 1Password
[6] Operating as a remote-first organization, it employs roughly 2,950 people globally. What is 1Password? Profile, leadership & funding — Komo
[7] The company transitioned from a bootstrapped startup to a major enterprise player, raising a total of $920 million across multiple rounds, including a $620 million Series C in December 2021 that valued the firm at $6.8 billion.

AI-generated assessment based on publicly available sources. Verify critical findings before contractual reliance. Analysis is advisory, not a compliance attestation, and is subject to data availability.

Investigate another vendor