top of page
Business & Enterprise
Cybersecurity
Cybersecurity Software
1Password
Built durable business adoption by making password security easy enough for individual employees to use, then expanding from consumer trust into enterprise identity, device and SaaS access management despite free and lower-cost password-manager rivals.
1
MODEL
BUSINESS MODEL
SaaS
- Began in 2006 as a Mac password manager created by developers David Teare and Roustem Karimov.
- Built consumer trust through a simple vault, strong encryption and cross-device password autofill.
- Introduced Teams and Business plans to convert individual users and small teams into organizational deployments.
- Used per-seat subscriptions, admin controls, shared vaults and integrations to expand inside companies.
- Acquired Kolide and Trelica to extend into Device Trust, SaaS governance and Extended Access Management.
1. Solve a personal productivity or security problem so well that individual users adopt it voluntarily.
2. Design the individual product so its data, workflow and trust can be reused in a team context.
3. Add team administration only after individual adoption proves retention and willingness to pay.
4. Expand into adjacent controls that address the customer’s next security problem without breaking the original simplicity.
5. Use acquisitions only when they add a distinct control point that the core product can distribute.
Avoid: treating consumer popularity as enterprise readiness; business adoption requires administration, compliance, recovery and deployment workflows.
DISTRIBUTION MODEL
1Password first proved repeatable consumer demand through paid individual and family subscriptions, then converted that trust into business adoption. By 2021 it had more than 90,000 business customers and about $120 million annualized revenue; by late 2025 it surpassed $400 million ARR, with over 75% of revenue from businesses.
HOW THEY BUILT IT
HOW TO ARCHITECT IT
Product-Led Growth, Self-Serve / Website, Direct Sales, Partnerships
HOW THEY OPERATIONALIZED
HOW TO REPLICATE WHAT WORKED
dm
- Individual users discovered 1Password through app stores, security recommendations and direct website signup.
- Employees who already used the product became internal advocates for Teams and Business deployments.
- Self-serve trials and transparent per-seat pricing reached SMB and mid-market buyers.
- Enterprise sales and partner relationships supported larger organizations, while integrations with SSO, MDM and developer tools embedded 1Password in IT workflows.
What worked: Let the end user experience the value before the organization buys; personal utility creates internal advocacy that lowers enterprise sales friction.
Trap if copied blindly: Consumer-led distribution fails when the business product lacks admin, compliance and deployment controls; the cost is high individual enthusiasm but weak organizational conversion.
| PATTERNS OF THIS MODEL
PATTERNS IN CONSUMER-TO-BUSINESS SECURITY SAAS:
1. End-user love becomes enterprise access. A product used voluntarily by employees creates a credible path into IT and security budgets.
2. Per-seat pricing scales with organizational adoption. Revenue grows as security becomes a company-wide behavior rather than a specialist tool.
3. Trust is the core product. In security, ease of use only converts when users believe the vendor will protect their most sensitive data.
THE WEAKNESS: A consumer-friendly brand can become a ceiling if enterprise buyers perceive the product as insufficiently mature for governance, audit and large-scale administration.
What companies with this model reveal
| OPPORTUNITY INTELLIGENCE
GOLDMINE 1 — ACCESS GOVERNANCE FOR SHADOW SAAS. Employees adopt unauthorized AI, productivity and SaaS tools faster than IT can govern them; pairing credential security with SaaS discovery and access control addresses an unmet operational gap.
GOLDMINE 2 — HUMAN-CENTERED ACCESS MANAGEMENT. Most IAM assumes managed devices and cooperative users; a model that secures BYOD, contractors and unmanaged sign-ins can price against the gap between identity and actual device posture.
GOLDMINE 3 — AI-AGENT CREDENTIAL SECURITY. As AI agents act on behalf of employees, secrets, tokens and delegated permissions need human-visible governance and revocation.
THE PIT — EXPANDING BEYOND THE VAULT TOO FAST. Moving from passwords into device trust and SaaS governance can create integration and implementation complexity that undermines the original ease-of-use advantage.
THE SECOND PIT — CONSUMER BRAND DISCOUNTING. A familiar consumer product may be perceived as a commodity, making enterprise buyers resist premium pricing despite stronger security capabilities.
MOVE WITH CAUTION: Do not enter access management without proving that device signals, identity data and application policies can be enforced without blocking legitimate work.
Untapped Business Model / Gaps / Goldmines / Pits
Patterns & Insights
2
MARKET
mkt mt es
1Password overcame inertia around built-in browser password managers, spreadsheets, reused passwords and lower-priced rivals such as Bitwarden. Its switching reason was a combination of stronger usability, polished cross-device experience, family/team sharing and enterprise controls that made secure behavior practical.
MARKET TYPE
Fragmented Market
ENTRY STRATEGY
Direct Entry
WHY THEY WON
Password management was fragmented across built-in browser tools, open-source options, consumer apps and enterprise password vaults. No incumbent owned the full journey from individual habit to enterprise identity governance. 1Password exploited this by making security desirable for employees while adding the administrative controls businesses required. The transferable lesson is that fragmented categories reward vendors that unify an inconsistent user experience rather than merely adding another feature.
EXECUTION
1Password entered with its own consumer password manager, its own website and app-store distribution, and later its own business products. The critical bet was that individuals would pay for a better password experience before companies mandated one. This worked because password reuse and breaches created urgent personal risk, while the product could deliver value immediately without implementation. The prerequisite was exceptional trust and usability; the approach fails where the product’s security model is hard to understand or where business buyers require enterprise controls the consumer product cannot support.
FOOTHOLD STRATEGY
Beachhead Strategy
1Password first dominated a narrow beachhead: individual Mac and later cross-platform users who wanted secure password storage and autofill. They were reachable through developer and security-conscious communities, could pay directly, and experienced immediate value. The path out was Teams and Business plans, where existing users became champions for organizational adoption.
GROWTH CAMPAIGN
CAMPAIGNS THAT WORKED
SO WHAT: The Extended Access Management campaign reframed 1Password from a password vault into a control layer for identity, applications and devices, expanding the addressable budget beyond credential storage.
KEY LEARNING: A vendor can use a familiar wedge to earn the right to sell a broader, higher-value security category.
HOW TO USE: If your product has high end-user trust, test one broader category narrative that connects current usage to an adjacent budget line before building the full platform.
KEY LEARNING
THE STANDARD: In a fragmented market, the winning vendor unifies inconsistent tools around a simpler, more trusted workflow.
RULE 1 — FIND THE DEFAULT THAT FAILS QUIETLY: Customers often tolerate spreadsheets, browser storage or manual sharing until a breach, offboarding failure or compliance issue makes the risk visible.
RULE 2 — PRICE FOR ADOPTION, NOT JUST FEATURES: Low-friction per-seat pricing encourages broad deployment, which increases switching costs.
RULE 3 — EXPAND FROM BEHAVIOR TO GOVERNANCE: Once employees use the product, the vendor can add admin, policy and audit capabilities.
RULE 4 — KNOW WHEN ENTRY FAILS: If free built-in tools are adequate and the buyer sees no organizational risk, a standalone product struggles to justify spend.
MARKET TYPE: Fragmented Market (category).
gc
Market Context
| MARKET INTELLIGENCE
PATTERNS IN PRODUCT-LED SECURITY ADOPTION:
1. Individual utility precedes organizational mandate. Employees adopt tools that make their work easier before security requires them.
2. Self-serve trials create bottom-up pipeline. IT discovers demand through employee requests rather than cold outreach.
3. Integrations turn a utility into infrastructure. SSO, MDM, browser and developer-tool connections embed the product in IT operations.
4. THE WEAKNESS: Bottom-up adoption can create ungoverned usage; without admin visibility, security teams may see the product as shadow IT rather than a solution.
| MARKET ENTRY PLAYBOOK
THE STANDARD: Direct entry is appropriate when the company can reach end users directly, deliver immediate value and build trust without an intermediary.
RULE 1 — SOLVE A PERSONAL PROBLEM FIRST: Direct entry works when the individual user receives value before the organization mandates adoption.
RULE 2 — BUILD A LOW-RISK FIRST EXPERIENCE: The product must be easy to try, easy to understand and safe to adopt without IT involvement.
RULE 3 — CREATE AN ORGANIZATIONAL UPGRADE PATH: Design team administration, billing and security controls before enterprise demand arrives.
RULE 4 — REJECT WHEN TRUST CANNOT BE ESTABLISHED: In security, privacy or financial data, direct entry fails if users cannot verify the vendor’s protection model.
How to enter
| FOOTHOLD STRATEGY PLAYBOOK
THE STANDARD: A beachhead strategy dominates one narrow, reachable segment before expanding into adjacent buyers.
RULE 1 — CHOOSE A SEGMENT WITH IMMEDIATE VALUE: The first users should experience benefit in minutes or days, not after a long implementation.
RULE 2 — BUILD REFERENCE VALUE: Early users should become credible advocates for the next segment.
RULE 3 — EXPAND WHEN RETENTION IS PROVEN: Move from individuals to teams only when the core product shows repeat usage and paid renewal.
RULE 4 — ADAPT THE BEACHHEAD TO BUYING POWER: In security, a consumer beachhead can create trust but may require a separate enterprise motion to convert into large contracts.
How to get the first strong position
MARKET PATTERNS & PLAYBOOK
3
MONEY
money rev pri
1Password expanded from individual and family plans into Teams, Business and Enterprise subscriptions, then into Extended Access Management through Device Trust and SaaS governance. ARR rose from roughly $331 million in 2024 to over $400 million in late 2025, while business revenue exceeded 75% of the total.
REVENUE MODEL
Subscription
PRICING MODEL
Tiered Pricing, Freemium, Volume-Based Pricing
WHY THEY WON
Customers pay recurring per-seat subscriptions for password and access-security capabilities. Revenue expands as companies add employees, shared vaults, advanced administration, developer secrets management and Extended Access Management; gross margin benefits from software delivery but is affected by support and enterprise service costs.
1Password charges per user per month, with a flat small-team option for up to 10 users and Business pricing around $7.99 per user monthly. The seat meter aligns with organizational adoption; higher tiers add administrative, recovery, integration and access-management capabilities.
TARGET AUDIENCE
Individuals and families (consumer; want simple secure password storage); SMBs (Teams/Starter; want low-friction credential sharing); Mid-market IT and security teams (Business; want SSO, provisioning and policy controls); Enterprises (Enterprise/EAM; want device posture, SaaS governance and access enforcement).
CUSTOMER BUYING BEHAVIOUR
An employee adopts 1Password to manage personal or work credentials, recommends it internally, and IT evaluates a team trial. Security and procurement then assess admin controls, SSO, recovery and compliance before rolling out company-wide; expansion follows new use cases such as developer secrets or device trust.
| PRICING INTELLIGENCE
What makes this model effective & make customers pay
Customers are not buying password storage; they are buying secure behavior that employees will actually follow.
RULE 1 — PRICE PER PROTECTED PERSON: The seat is the natural unit because every employee, contractor and privileged user represents credential risk.
RULE 2 — MAKE ADOPTION CHEAP, EXPANSION VALUABLE: Low entry pricing drives company-wide rollout, while governance and access controls capture higher willingness to pay.
RULE 3 — SELL THE COST OF INSECURE WORKAROUNDS: The comparison is breach remediation, credential sharing, shadow IT and offboarding failure—not merely rival password managers.
RULE 4 — WATCH THE CONSUMER-PRICE ANCHOR: If business buyers compare the product to free browser password managers, the vendor must make enterprise risk reduction visible.
The buyer is purchasing employee compliance and reduced access risk, proven by seats deployed and security policies enforced.
PRICE & REVENUE
| Revenue Risk - The biggest threat to revenue stability
Free substitutes: Browser password managers, Apple/Google built-in options and Bitwarden reduce willingness to pay for basic credential storage.
Seat-based price pressure: Companies can delay seat additions, remove inactive users or negotiate volume discounts.
Commoditization: Password management alone is increasingly undifferentiated, requiring expansion into identity, device and SaaS governance.
Platform bundling: Microsoft, Google and Apple can bundle credential and device security into broader ecosystems.
Trust concentration: A breach or cryptographic design failure would damage the core reason customers choose 1Password.
Expansion execution risk: Extended Access Management requires deeper IT integration and may slow the simple adoption motion that built the business.
1Password surpassed $400 million ARR in late 2025 and remained free cash-flow positive; it raised $100 million in 2021 at a reported $2 billion valuation.
Where the model can break
4
MOTION
motion ge cs
1Password built organic adoption through app-store presence, direct website signup, security recommendations and employee-led advocacy. Its growth from individual users to more than 90,000 business customers by 2021, and $400 million ARR by 2025, shows a compounding product- and reputation-led engine rather than dependence on paid acquisition.
GROWTH EXPANSION MODEL
Land & Expand, Product Line Expansion
HOW THEY EXPAND
1Password landed with individual password management, expanded within organizations through Teams and Business seats, then added product lines for developer secrets, device trust and SaaS governance. The Kolide and Trelica acquisitions extended it into Extended Access Management, using the existing vault relationship as a distribution base for broader security controls.
COMPETITIVE STRATEGY
Differentiation
HOW THEY COMPETE
Against Bitwarden’s lower price and built-in browser password managers, 1Password differentiated on usability, trust and cross-platform experience. Against enterprise IAM vendors, it flanked from the employee experience into access management, rather than beginning with a heavyweight identity platform.
GROWTH ENGINE
GTM
Content Flywheel
An individual adopts 1Password for personal credential security → experiences autofill, sharing and cross-device value → recommends it at work → IT starts a Teams or Business trial → the company deploys seats and policies → new security needs create demand for secrets management, device trust and SaaS governance. The compounding trigger is employee-led adoption, which reduces acquisition cost and creates internal credibility.
1Password runs a product-led, bottom-up GTM with enterprise sales and partner support. Consumers and employees self-serve into the product; internal champions create demand for Teams and Business; IT and security buyers evaluate administration, SSO and compliance; enterprise sales expands accounts into Extended Access Management. The primary motion is product-led growth, with direct sales becoming important for larger and regulated organizations. The transferable implication is that end-user adoption can create enterprise access, but only if the vendor builds governance before scaling upmarket.
SUSTAINING MOATS
High Customer Lock-In
moat
The moat is trusted consumer-grade usability combined with enterprise embeddedness. Once employees store credentials, teams share vaults and IT connects identity, device and SaaS policies, replacement disrupts daily work and security operations.
| MOAT INTELLIGENCE
THE STANDARD: Security moats last when the product becomes part of daily behavior and organizational control.
RULE 1 — HABIT CREATES RETENTION: Password autofill and vault usage become routine, making switching inconvenient even when alternatives are cheaper.
RULE 2 — ADMIN DEPTH CREATES LOCK-IN: Shared vaults, group policies, provisioning and recovery workflows make organizational migration costly.
RULE 3 — EXPANSION INCREASES DEPENDENCE: Device trust and SaaS governance add control points beyond passwords, deepening integration.
THE SIGNAL: Business revenue exceeding 75% of total and ARR growth from $331 million to $400 million indicate successful organizational expansion; the moat does not protect against a major security failure or a materially better enterprise identity platform.
Why this company remains defensible
ARR & TAKEAWAY
ARR Journey - what to do at each stage
PRE-$1M ARR — PROVE INDIVIDUAL UTILITY. From its 2006 launch, 1Password had to prove that users would pay for secure password storage and autofill.
$1–5M ARR — BUILD CONSUMER RETENTION. Cross-device sync, browser integration and trust became the basis for repeat subscription revenue.
$5–10M ARR — VALIDATE TEAM DEMAND. Employees and small teams created demand for shared vaults and administrative control.
$10–50M ARR — SYSTEMATIZE BUSINESS SELF-SERVE. Teams and Business plans converted employee advocacy into recurring organizational revenue.
$50–100M ARR — SCALE MID-MARKET ADOPTION. SSO, provisioning and integrations made 1Password deployable across larger organizations; by 2021 it had more than 90,000 business customers and roughly $120 million annualized revenue.
$100M+ ARR — EXPAND INTO ACCESS MANAGEMENT. 1Password acquired Kolide and Trelica, launched Extended Access Management, and surpassed $400 million ARR in late 2025.
Rule: Earn end-user trust first, then convert that trust into organizational security infrastructure.
COPY PLAYBOOK : What Worked → What Failed → What to Replicate → What to Avoid
THE STANDARD: Build a product individuals voluntarily adopt, then use that adoption to earn the right to sell broader organizational controls.
SEQUENCE:
1. First, solve one personal workflow so effectively that users retain and pay without organizational mandate; prerequisite: immediate, visible value.
2. Next, add team administration and shared workflows while preserving the individual experience; gate: existing users can bring the product into work without friction.
3. Then, expand into adjacent governance only when the core deployment creates data, trust and distribution; gate: the new capability solves a distinct budget-owner problem.
WORKED: 1Password converted consumer trust into business seats and then used the vault relationship to enter device and SaaS access management.
CAUTION: Do not assume consumer adoption equals enterprise readiness; governance, recovery and compliance must come first. Also avoid acquisitions that add capabilities the core product cannot naturally distribute.
bottom of page