1Password vendor risk assessment - Low Risk | Vendorisk.ai

Vendor dossier // 1password.com

1Password

Also known as AgileBits · AgileBits Inc.

Last updated: Aug 12, 2026, 05:28 AM

Low risk

Proceed

1Password demonstrates a coherent public security posture with SOC 2 and ISO certifications, regular third-party audits, and a strict zero-knowledge…

Higher score = greater risk. How we score

15/100

Low Risk

Research Coverage

Complete

Evidence Quality

High

Material incidents

Last assessed

Aug 12, 2026, 05:28 AM

Material findings

Rationale

1Password demonstrates a coherent public security posture with SOC 2 and ISO certifications, regular third-party audits, and a strict zero-knowledge architecture While a 2023 incident involving Okta's support system was quickly contained with no data compromise a 2025 DEF CON presentation highlighted a DOM-based clickjacking vulnerability in its browser extension Given the strong encryption standards, transparent audit practices, and contained nature of past incidents, the vendor presents a Low Risk profile, though continuous monitoring of extension updates is advised

Risk drivers

Material incidents: +5

01. Findings

1Password employs a strict zero-knowledge architecture, ensuring that customer data is encrypted end-to-end and only the user holds the decryption keys The vendor holds SOC 2 and ISO certifications and undergoes regular independent third-party audits and penetration tests, with most reports made public In October 2023, a security incident involving Okta’s customer support system was disclosed, but 1Password confirmed it was quickly contained with no user or employee data compromised Additionally, the company maintains a transparent privacy policy stating it does not use, share, or sell customer data

High · Security

Okta Support System Incident

OpenObserved

In October 2023, 1Password was affected by a security incident involving Okta's customer support system. The activity was quickly contained, and no user, employee, or sensitive data was compromised.

02. Events

[funding] Secondary Market Transaction
In October 2025, 1Password completed a secondary transaction reaffirming its $6.8 billion valuation.
Oct 1, 2025, 12:00 AM · Source
[other] Browser Extension Vulnerability Disclosure
At DEF CON 33 in August 2025, researcher Marek Tóth presented a DOM-based extension clickjacking vulnerability affecting 1Password's browser extension in default configurations.
Aug 9, 2025, 12:00 AM · Source
[breach] Okta Support System Incident
In October 2023, 1Password was affected by a security incident involving Okta's customer support system. The activity was quickly contained, and no user, employee, or sensitive data was compromised.
Oct 1, 2023, 12:00 AM · Source
[funding] Series C Funding Round
In December 2021, 1Password raised $620 million in a Series C round, valuing the company at $6.8 billion.
Dec 17, 2021, 12:00 AM · Source

Evidence & provenance

32 sources · Generated Aug 12, 2026, 05:28 AM

Expand →

Every verdict stores the public sources retrieved for this run. Read our methodology.

Verdict generated: Aug 12, 2026, 05:28 AM

Input sources · retrieved Aug 12, 2026, 05:28 AM

Company(8)

What is 1Password? Profile, leadership & funding — Komo
Company
Open source →
1Password’s growth story | How they went from bootstrapped to $6B company | Jeff Shiner (CEO)
Company
Open source →
1Password Nets $620 Million, Company Valued at $6.8 Billion

03. Company

1Password is a Toronto-based identity security and access management company founded in 2005 Operating as a remote-first organization, it employs roughly 2,950 people globally The company transitioned from a bootstrapped startup to a major enterprise player, raising a total of $920 million across multiple rounds, including a $620 million Series C in December 2021 that valued the firm at $6.8 billion Leadership includes CEO David Faugno and Executive Chairman Jeff Shiner, who joined in 2012 1Password is free cash-flow positive and has publicly targeted an IPO alongside a goal of reaching $1 billion in annual recurring revenue

04. Product

1Password offers a unified access management platform designed to secure credentials for humans, AI agents, and machines Its core product is an enterprise password manager that stores login credentials, credit cards, passports, and secure notes in an encrypted vault The solution integrates with major identity providers like Azure AD, Okta, and OneLogin to streamline deployment and access governance It is frequently compared to competitors such as LastPass, Keeper Security, Dashlane, and Bitwarden in the password management software category The platform emphasizes ease of integration and deployment, earning high ratings in industry reviews

05. Recent News

Recent news highlights 1Password's expansion into AI agent security and SaaS management, with the company named a Leader in the 2026 Gartner Magic Quadrant for SaaS Management Platforms In August 2025, security researcher Marek Tóth presented a DOM-based extension clickjacking vulnerability affecting 1Password's browser extension at DEF CON 33, noting that version 8.11.8.40 remained vulnerable The company continues to update its mobile and desktop applications to fix UI and autofill issues 1Password also completed a secondary market transaction in October 2025, reaffirming its $6.8 billion valuation

06. Dependencies

Fourth parties this vendor relies on - subprocessors, infrastructure, and integrations surfaced from public sources.

Okta, Inc.
okta.com
IntegrationSource →
Azure AD
IntegrationSource →

08. Vendor response

Content in this section is vendor-supplied and does not alter Vendorisk.ai's risk tier or evaluation.

09. Assessment history

8/12/2026, 5:28:33 AM · Low · 15

Risk delta is hidden until two stored snapshots can be compared.

10. Targeted questions

No unresolved controls

Targeted questions are generated only from unanswered or conflicting controls. The full SIG-lite questionnaire remains on its own route.

11. Sources

[1] 1Password demonstrates a coherent public security posture with SOC 2 and ISO certifications, regular third-party audits, and a strict zero-knowledge architecture. 1Password Review: Best Password Manager of 2026?
[2] While a 2023 incident involving Okta's support system was quickly contained with no data compromise. 1Password
[3] A 2025 DEF CON presentation highlighted a DOM-based clickjacking vulnerability in its browser extension. 1Password
[4] Given the strong encryption standards, transparent audit practices, and contained nature of past incidents, the vendor presents a Low Risk profile, though continuous monitoring of extension updates is advised. 1Password Review: Best Password Manager of 2026?
[5] 1Password is a Toronto-based identity security and access management company founded in 2005. 1Password
[6] Operating as a remote-first organization, it employs roughly 2,950 people globally. What is 1Password? Profile, leadership & funding — Komo
[7] The company transitioned from a bootstrapped startup to a major enterprise player, raising a total of $920 million across multiple rounds, including a $620 million Series C in December 2021 that valued the firm at $6.8 billion.

AI-generated assessment based on publicly available sources. Verify critical findings before contractual reliance. Analysis is advisory, not a compliance attestation, and is subject to data availability.

Investigate another vendor