1Password Chases Infrastructure Secrets Budget

This shift turns 1Password from a seat based employee app into a control point for how machines get credentials. Once secrets are injected into CI jobs, cloud services, and AI agents at runtime, the buyer changes from an individual employee or IT admin to security and platform teams that already spend with Okta for workforce identity and Vault for workload secrets.1 2 3 4 5

• 1Password now sells concrete developer workflows, not just vault storage. Teams can replace plaintext .env files with secret references, use the CLI to load secrets into scripts at runtime, or run Connect as a private API inside their own infrastructure. That is directly in Vault territory.2 3 4
• Okta overlaps from the identity side. Okta already manages who an employee is, how they sign in, and how accounts are provisioned through external identity providers like Okta and Entra ID. 1Password has to prove it is worth adding on top, by securing non SSO apps, shared credentials, developer secrets, and agent actions that IAM products do not handle cleanly.1 5 6
• The wedge is distribution. 1Password already sits in employees daily login flow, and internal research shows B2B revenue rose from about 33% of revenue in 2019 to 60% by 2024 as it expanded into access management, device security, and devsecops. That installed base makes cross sell into engineering cheaper than a cold start infrastructure sale.7 8 9

Going forward, the winners in enterprise identity will be the systems that broker access for both people and software. If 1Password keeps moving secrets out of code and into runtime delivery for pipelines and agents, it can capture infrastructure budget and become harder to replace, even inside accounts that already run Okta and Vault.1 2 4 5 9