By Hamza Faisal

1Password has crossed a milestone that puts it firmly in the top tier of cybersecurity startups: the Canadian company announced on Thursday that it has surpassed $500 million in annual recurring revenue, up from $400 million in November 2025 — growth it credits directly to the explosive spread of AI agents inside enterprise IT.

The numbers show the acceleration is recent and sharp. Net new ARR grew roughly 60% through the first three quarters of its fiscal 2026, with third-quarter growth of about 90% year over year, according to the company. Monthly active usage of its developer and AI security tools has climbed 200% over the past year, and customers using those tools grow their spending at roughly five times the rate of others. The free cash flow margin, the company said, sits in the double digits.

Chief executive David Faugno framed the moment as a turning point for identity security. In an interview with the Wall Street Journal, he said the explosion of coding assistants and AI agents in enterprise settings has created a new class of security problem: software that can touch company secrets and systems in unpredictable ways.

"The agents can actually take those secrets and do things that are unpredictable," Faugno said. "You have to be very, very clear about what access you give it, and how you monitor and maybe even revoke that access, and humans have to stay in control."

From password vault to agent gatekeeper

Founded in 2005 in Toronto, 1Password built its name on the humble password vault. It now serves more than 200,000 businesses, including 85% of the Forbes AI 50 list of promising AI startups, and says roughly 75% of its revenue comes from business customers. New customer logos added in the third quarter rose 150% year over year.

The company's pitch has evolved well beyond storing logins. It is investing in 1Password Unified Access, a platform that discovers and secures identities and credentials and audits activity across humans, AI agents and machines. A companion product, 1Password for Agents, lets people approve task-specific access for an agent without exposing the underlying credentials to the agent or its model context.

The strategy mirrors a broader industry shift: as agents gain the ability to browse, spend and deploy code, every login becomes a potential attack surface. Faugno pointed to recent incidents of agents going rogue or breaking containment — including the reported hack of Hugging Face by OpenAI internal agents — as evidence the industry needs purpose-built controls.

A late-stage startup with cash flow

Reaching $500 million in ARR with double-digit free cash flow margins is rare air for a private cybersecurity company, and it strengthens 1Password's hand against identity giants like Okta and CyberArk. The company, last valued around $6.8 billion, has long been seen as a candidate for an eventual IPO.

For now, Faugno is betting the agent era plays to 1Password's strengths. "At the end of the day, an agent found standing credentials to have access to something, and did something that was unintended," he said. "That is the ticking time bomb, if you will, that sits everywhere in our society."

By Hamza Faisal