Signal 01 · · CCN Intelligence
AI Agents Can Act for Your Business. Who Controls Their Authority?
Toronto-based 1Password has reported more than US$500 million in annual recurring revenue as it expands into security for AI agents and automated workflows. Its new technology is designed to help AI agents access accounts without exposing passwords directly to AI models. As artificial intelligence moves from answering questions to carrying out business tasks, cybersecurity must address not only who can enter a system, but what autonomous agents are permitted to do once inside.
What happened
On October 22, 1Password reported annual recurring revenue exceeding US$500 million and a 500% year-over-year increase in monthly active nonhuman identity users of its developer and AI security tools. The company also introduced 1Password for Agents, designed to let people approve agent access without handing passwords directly to AI models. These company-reported developments reflect growing commercial demand for securing automated identities and workflows. AI agents can increasingly retrieve information, interact with applications and execute business processes, creating a new set of security and governance requirements beyond traditional password protection.
Why it matters for Canada
A Canadian-founded cybersecurity company is helping shape an emerging global market for AI identity security. Canadian organizations are exploring agents that manage customer information, support employees, process financial data and automate routine operations. These tools can improve productivity, but their access to sensitive systems creates important questions about authority and accountability. An agent authorized to review customer records should not automatically be able to export a database, alter payment details or approve transactions. Canada has an opportunity to develop trusted AI security technologies while ensuring its own businesses adopt the controls necessary for dependable automation.
What CCN sees
The next cybersecurity perimeter is the authority businesses give AI agents. For decades, cybersecurity has concentrated on protecting networks, devices, identities and information. Those protections remain essential, but autonomous AI introduces a different challenge: a system can possess legitimate credentials and still take an action the business never intended. Protecting a password does not necessarily protect a decision. As AI becomes embedded in business operations, secure identity must be connected to limited permissions, meaningful oversight and accountability for outcomes. The opportunity is not to slow automation, but to make autonomous AI dependable enough for organizations to trust.
What leaders should consider
Business leaders should understand where autonomous AI is already operating, which systems agents can access and what actions they can perform without human approval. An agent might legitimately update customer records or support supplier management, but changing payment instructions, exporting confidential information or approving significant transactions should require clearly defined controls. Organizations need task-specific permissions, approval thresholds, reliable activity records, rapid access revocation and a named person accountable for each deployed agent. These measures allow businesses to pursue productivity gains without surrendering operational control.
What to watch next
Watch how quickly enterprises adopt identity and access controls designed specifically for AI agents, how these technologies integrate with major AI platforms and whether emerging standards distinguish between permission to access a system and authority to perform consequential actions. The ability of Canadian cybersecurity companies to commercialize trusted AI infrastructure will also be important.
PEOPLE TO WATCH
David Faugno, CEO of 1Password, for the company's expansion into enterprise identity and AI agent security; Aashish Tripathi, Chief Product Officer of 1Password, for product development and integrations; Glen Coates of OpenAI and Ami Vora of Anthropic, for the evolution of agent capabilities and enterprise AI ecosystems.
ORGANIZATIONS TO WATCH
1Password, for credential protection and agent access management; OpenAI and Anthropic, for increasingly capable AI agents; Snowflake and NVIDIA, for enterprise AI infrastructure and security integration; Canadian Centre for Cyber Security, for guidance on autonomous AI risk.
Source: https://1password.com/press/2026/october/1password-surpasses-500-million-arr