1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, and takes it into territory owned by PAM vendors.
1Password has acquired Apono, an Israeli company building just-in-time access governance for humans, machines, and AI agents. Terms were not disclosed; Calcalist reported 250 to 300 million dollars. All 80 Apono employees join, around 50 of them in Israel. Apono evaluates each access request against policy, grants temporary narrowly scoped permissions, and removes them when the task finishes, so there is no standing account or persistent privilege left behind. It integrates with AWS, Azure, Google Cloud, Kubernetes, Snowflake, and Databricks plus more than 200 enterprise tools, and lets users request access from the applications they already work in. The capability lands under 1Password Unified Access.
Why it matters
1Password has spent three years walking away from being a password manager, through Passage for passkeys and its secrets line. Apono is the biggest step: just-in-time access with zero standing privileges is the core of modern PAM, not an adjacency.
That puts 1Password in front of CyberArk, Delinea, and StrongDM with a very different go-to-market: bottom-up, developer-friendly, priced per seat rather than per vaulted account. For cloud-native teams who found traditional PAM too heavy, that is a real option and worth a look in our PAM buyer guide.
What it does not yet cover is the reason PAM deals get signed: session recording, break-glass for on-premises infrastructure, and the audit artefacts a regulator expects. Judge it on those before treating it as a replacement.
Source: 1Password, price via SecurityWeek
Related on Start with Identity
- BlogPalo Alto Networks closes its 25 billion dollar CyberArk acquisition
The largest deal in security industry history closed on 11 February 2026. CyberArk shareholders took 45 dollars cash plus 2.2005 Palo Alto shares per ordinary s
- BlogSnowflake buys Natoma for about 110 million dollars to govern agent access to data
A two-year-old company with 27 people and a 7 million dollar seed round sold for roughly 110 million. What Snowflake bought is a verified MCP server library and
- BlogCisco buys Astrix Security for a reported 400 million dollars
Astrix goes into Duo, Splunk, and Cisco Identity Intelligence. The pitch is extending zero-trust principles to an agentic workforce, which in practice means gov
- CVEBeyondTrust PRA and Remote Support unauthenticated command injection
Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea
- GlossaryIAM
Identity and Access Management. Workforce identity for employees, contractors, and partners. Covers authentication, authorization, lifecycle, and audit. Distinc