1Password Acquires Trelica to Boost SaaS Access Management

1Password bought a British SaaS access management startup to more effectively address issues like shadow IT, passwordless transitions and application security management.

See Also: Cracking the Code: Securing Machine Identities

The Toronto-based extended access management provider said its acquisition of Cambridge, U.K.-based Trelica will bolster its capabilities in device management and access visibility and help bridge the “access trust gap” in enterprise environments, according to co-CEO Jeff Shiner. The deal will boost 1Password’s roadmap by 18 months and enhance their offerings in application visibility and workflow management.

“They have built really a unique thought leadership position in the SaaS access management world,” Shiner said. “The actual technology they’ve built, we can use directly and build off of – along with the knowledge of their people – to really put us in a position where we can accelerate the entire app section of identities, devices and apps that combine together to become extended access management.”

Trelica was founded in 2018, employs 23 people, and hasn’t disclosed any outside funding. The company has been led since inception by Iain McGhee and Richard Kirby, who previously worked together at sustainability software company cr360 and serve as Trelica’s commercial director and technical director, respectively. Terms of 1Password’s acquisition of Trelica – which closed Dec. 30 – aren’t being disclosed (see: 1Password’s New Co-CEO Model to Drive Growth, Security Focus).

Shiner said Trelica stood out among the more than 30 prospective acquisition targets reviewed because of its proven track record of securing major clients and its development of tested workflows. The transaction is expected to improve 1Password’s ability to handle shadow IT, enhance visibility into unmanaged applications, and streamline app and access management workflows while controlling costs, Shiner said.

“When we connected with the team at Trelica, a couple things happened,” Shiner told Information Security Media Group. “One, we saw a very strict alignment with the way that we think the problem should be solved in terms of the approach to visibility, to workflows. They saw the problem set and their way to approach it in a very similar way that we do, which is very much oriented towards the end user.”

What Sets Trelica’s Approach to SaaS Access Management Apart

1Password’s extended access management platform addresses the disparity between the applications, devices and identities IT departments manage versus what employees actually use. Rather than cutting access, he said 1Password fosters productivity while embedding measures around identity management, device management and SaaS app access to secure workplaces where employees use personal devices.

“When I look at extended access management, the value of that comes not from having unique separate pillars,” he said. “It really comes from identities, devices, apps, access management all working together. Trelica’s area of expertise is around app access management, but it has to now be brought in and unified into the extended access management platform, so that the various pieces work together as one.”

SaaS apps are often introduced informally into organizations by individual employees or teams without the involvement of the IT department, who must identify these apps, address security risks and ensure proper workflows for onboarding, offboarding and access management. He said Trelica helps businesses track which apps employees use, assess their security posture, and integrate into broader IT workflows.

“Software comes in from the edges with SaaS,” Shiner said. “Because of that, the IT department, in a lot of cases, has no visibility into these apps, and certainly no control over them. So, how do you identify that people are using this app? Then the next challenge, from a security point of view, becomes, ‘How do we understand what’s going on there? How do we understand the security posture of that app?'”

Shiner said immediate integration priorities include ensuring that Trelica’s app visibility and workflow tools function smoothly in 1Password’s ecosystem to provide actionable insights. Over time, Trelica’s capabilities will be fully embedded into 1Password’s existing identity and device management solutions to enable a cohesive and seamless user experience across apps, devices and identities, Shiner said.

“From a technology point of view, it’s really now about, ‘How do we take their capabilities and then integrate that into the broader, extended access management platform?'” Shiner said.

How AI Has Increased the Need for Extended Access Management

The rise of AI-based threats such as sophisticated phishing schemes has boosted the need for extended access management, which Shiner said focuses on the end employee since they’re often the weakest link in the security chain. 1Password aims to reduce human error by integrating secure workflows and tools into workers’ daily routines to make it more difficult for hackers to exploit human vulnerabilities.

“Us humans get fooled very easily, and AI is going to allow us to be fooled all that much more easily,” Shiner said. “When we look at extended access management, a big part of that is, ‘How do we enable that employee to stay safe in an easy way?’ And that’s going to be an area of concern that’s going to continue to grow into 2025 as AI continues to be used in phishing and other attacks.”

Both 1Password and Trelica focus on mid-market organizations that have thousands of employees and face the same complex security challenges as large enterprises but lack extensive IT resources, according to co-CEO David Faugno. He said both companies are well-positioned to cater to the North American and European markets and excel in industries like tech, healthcare, manufacturing and government.

“The sweet spot, particularly for XAM, is those organizations that have all of the challenges of the largest organizations in the world, but they don’t have thousands of people in their IT department to meet them,” Faugno told ISMG. “They need integration, they need simplicity, they need time to value and they tend to have a more democratized IT environment.”

The Trelica deal follows 1Password’s purchase of SecretHub, Passage and Kolide in 2021, 2022 and 2024, respectively, and Shiner said the company plans to focus on acquiring both fully developed solutions as well as promising technologies. Smaller, technology-driven acquisitions may focus on specific gaps in the XAM platform, while larger acquisitions could expand core capabilities, according to Shiner (see: 1Password Acquires Kolide, Aiming to Enhance Device Security).

“We will consistently be looking for build versus buy versus partner opportunities as we build out our vision for extended access management, and then add adjacent areas to that as well,” Faugno said. “It’s critical that we align with teams that want to be part of our future and are prepared to do that.”