1Password is a company many Canadian partners know, but the Toronto-based firm has evolved well beyond the password vault it’s historically been associated with. Now positioning itself as an identity security company, 1Password recently expanded its global partner program, won the 2025 AWS Canada Rising Star Technology Partner of the Year award, and was named to CRN’s 2026 Security 100 list. The company counts more than 180,000 business customers, with over 75 per cent of its revenue now coming from the enterprise side.

Larissa Crandall, 1Password’s global vice president of channel and alliances, joins us to talk about what that evolution means for MSPs looking to build identity security practices. Crandall talks openly about the need to “myth bust” how partners think about 1Password, pointing to strategic integrations with CrowdStrike and Zscaler and the company’s growing presence in AI labs and enterprise security stacks as evidence of the shift.

The numbers that emerge are striking. Non-human identities – AI agents, service accounts, API keys – now outnumber human identities 82 to 1, according to Crandall, and SMBs remain largely unprepared for the challenge. That’s the gap MSPs can step into. She shares the story of an MSP that made 1Password mandatory across its entire customer base – not as an add-on, but as a baseline requirement – because you can’t credibly sell identity security if you haven’t secured the front door yourself.

On building a profitable practice, Crandall identifies three keys: proper discovery, understanding scope and complexity, and having the right skill sets on your own team before delivering it to clients.

Partners interested in learning more can visit the 1Password partner program page.

Robert Dutt: Hello and welcome to In the Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca, and as always, your host for the show.

If you’ve been following the cybersecurity conversation this year, you’ve probably noticed that identity keeps coming up – not as one item on the security checklist, but increasingly as the item.

The attack surface is shifting. SaaS sprawl, shadow AI, and a growing universe of non-human identities – things like AI agents, service accounts, and API keys – are creating access governance challenges that traditional security tools were never designed to handle. And for MSPs, that shift represents both a risk and an opportunity to build a real practice around identity security.

1Password is a company that a lot of us know, but the Toronto-based company has evolved beyond the password vault that many partners may remember. It’s now positioning itself as an Extended Access Management platform, recently expanded its global partner program, and counts more than 180,000 businesses among its customers.

Joining me today to talk about what that evolution means for the channel is Larissa Crandall, global vice president of channel and alliances at 1Password. We’re going to dig into why identity has become the front door to the security conversation, what MSPs need to understand about non-human identities before their customers start asking, and what building a profitable identity security practice actually looks like.

Larissa, thanks for taking the time. I appreciate it.

Larissa Crandall: Thank you so much for having me. Excited for a conversation.

Robert Dutt: We keep hearing that identity is the new security perimeter. For a lot of MSPs, the bread and butter is still firewall, endpoint, some MFA. Can you help me with what’s changing in the threat landscape that makes identity security an urgent, a “build a practice around it right now” kind of opportunity?

Larissa Crandall: Yeah, absolutely. AI is here to stay. I think the opportunity for MSPs is now. It’s prevalent. We’re seeing a lot of MSPs build practices around identity security, and those are the ones that are getting ahead of it, are leading the charge. I think for us personally, spending a lot of time with MSPs, the attack surface has changed. It’s no longer about human, it’s about non-human identities, and it spans across SaaS applications, endpoints, APIs, service accounts, and AI agents. All of the MSPs that are getting ahead of it are helping our customers and growing.

Robert Dutt: You guys have been around for 20 years now or so. I think for a lot of folks, the on-ramp, the familiar place is the personal password vault, of course. Some partners certainly are selling you alongside other tools, are working you into the mix. What would surprise a partner who hasn’t looked closely at 1Password in the last couple of years about where you guys are at right now?

Larissa Crandall: Love this question, because I’ve been talking to a lot of partners. As we’ve built out the partner program that we just launched and going to truly partner first, we have to – what I call – myth bust. A lot of how people perceived us is just traditional EPM, the Enterprise Password Manager business, into this true solution that’s attached to everything that they’re already selling. For instance, we have large integrations with CrowdStrike and Zscaler, and that’s getting the attention of some of the partners out there not realizing that we fit into that full conversation and that tech stack as a platform play, versus thinking of us traditionally just on that human-centric credential management play. We’ve definitely flipped the script, I would say, on having sellers think of us different. MSPs – we also have a lot that we’re doing with AWS, and that has changed some of the landscape for us here, is positioning that full technology solution.

Robert Dutt: You touch on partner first on the program launch. Can you walk me through what partner first means from a 1Password point of view at this point and the highlights there in terms of what it means to your partner base or your prospective partner base?

Larissa Crandall: Sure, absolutely. We built what I call a customer-centric partner strategy. What that means to us internally – and as I’ve shared this with our partner ecosystem – is however a customer wants to transact with us. Via AWS Marketplace, whether they want to work with us with a partner through Marketplace, if they want to work with their traditional reseller and VAR partners out there. We have obviously SMB customers, a lot around working with their MSPs. We have that all taken care of, where we have prescriptive partners across the globe as well as working with our distribution partners. What that means for us internally is we have worked through an entire strategy top-down. It goes from our executives all the way through our sellers that they’re to engage partners. Now it could be an existing account that we have that we’re wanting to bring a partner into. We’re also spending a lot of time with partners, both new and existing, teaching them the 1Password story and teaching them how we fit in what they’re selling today and what the opportunity is. Increased enablement, certifications, all of that. Again, it goes back to what I would say is that myth bust of how you think of us and what we’re doing, versus how we’re getting a lot of attention from partners that have talked with us previous but are seeing us different, talking about putting us in their AI labs and their security practices and a full wrapper into platform.

Robert Dutt: That’s two fronts of myth busting, or developing the stories to partners. Where would you say you’re at in getting that out there, broadly disseminated and well understood on both of those fronts?

Larissa Crandall: It’s a daily, right? I think it’s a daily spend. I spent this morning talking to two partners and they were both new. They were in a region that we have not spoken to before, and it was newer partners wanting to learn more because they’re hearing the market demand and they’re having customers call about 1Password and identity security. That has flipped as well, where identity security is no longer a “it’s a nice” – it’s needed. Same thing across MSPs. They’re building foundational practices as well around identity security and we’re having them come to us and say, “Teach us more. How do we build this? How do we do the discovery and how do we get in front of it?” Especially around AI.

Robert Dutt: You’ve talked about something you call the Access-Trust Gap – the space between what IT can see and control versus what employees are actually using to get their work done. Can you walk us through what that looks like in a real organization and the why as to why traditional IAM tools aren’t closing that gap?

Larissa Crandall: I have an example for you that I love to use, and it’s related to an MSP that we have that shared with us how they personally worked with 1Password. It’s a mature MSP that made a deliberate decision as a company to bring in 1Password and make it mandatory for all of their customers. Not an add-on – make it mandatory for all. They did that because they wanted to ensure that security was embedded into everything they did from the start and how they interacted with customers. The reason that they did that is they wanted to make sure – if they weren’t ahead of it and they weren’t giving customers a secure way to manage their credentials, they would find their own way. That’s the problem still. There’s spreadsheets, there’s shared sticky notes. You put it in your phone. That’s never good.

This MSP shared that and said, “If we’re going to go preach this and sell 1Password, we’re going to basically do it ourselves.” If you leave it up to your own devices, employees will do it on their own and that’s the big risk. For us, that’s the big opportunity that we’re sharing with our partners to make sure that they know that – that is not the way to go. You need to make sure that you’re protecting it. You can’t begin to address that identity sprawl if you haven’t first secured the front door. When we say that to partners, we let that sink in. If you haven’t done it personally as an organization and you’re working with customers, you have to secure that front door. MSPs that are building the basics and getting ahead of it are going to nail this and be far ahead of their competition. I love that example because it’s a real life, “If I’m going to go sell it, I’m going to make sure that we’re using it ourselves.”

Robert Dutt: The new front, I think, that’s maybe catching MSPs a little bit off guard, that’s certainly building awareness, is the non-human identities side of things. You touched on AI agents a little earlier, the service accounts, the API keys – the things that need credentials but aren’t employees. How big of a governance problem is this becoming and what does it mean for an MSP who’s trying to help clients figure this out and navigate this problem?

Larissa Crandall: It’s a big problem. Non-human machines are growing every day, and a stat that we’ve been using and explaining this – just on the severity of it – with our partners, is non-human identities now outnumber human 82 to 1. Think about that. If that is the number of how much you would have to protect non-human, you can’t just think about it from that human perspective. “I log in, I do the right thing.” It’s everything that they don’t know. That gap, again, is helping customers get that visibility and control around that across human and non-human, is generally hard to replicate because you have to teach it.

That’s where, again, the partners come in and they bring that up and explain that. They’re ahead of it. What I will say, though, is SMBs are not ahead of that just yet. They’re not thinking about non-human every day, and that’s where partners can come in and being their true trusted advisor and explain that and explain the risk to their businesses. Because that’s their job – to keep businesses running – and that’s why customers go to them.

Robert Dutt: For an MSP who’s at the point of saying, “OK, I see your point. I see the opportunity around identity security. I need to build around this,” but they aren’t there yet necessarily – what does a profitable identity security practice look like? What are they selling? What services are they wrapping around it? Where do you fit into that stack?

Larissa Crandall: MSPs are all different. Obviously, they’re great about doing that first initial assessment and analyzing the infrastructure and set of tools and governance that they have. I think the first piece that we’re explaining, and we’re talking to MSPs, is just how to get started and how to build a practice around this. You first have to do that discovery. Most customers are not getting an accurate inventory of what they have. That piece, and explaining “if you do this, here’s the risk mitigation around it, this is how it could help your business.” The second piece I think that some don’t really truly understand is the scope complexity, meaning identifying the infrastructure, the dev, the security, the operations team, everybody else that’s all-encompassing around this.

I think the third is staffing. Some MSPs don’t realize, “OK, if we have this, how do we build a profitable practice?” – you need to ensure that you have the right skill set from your own teams to do that assessment up front. It’s a step-by-step, but you can’t do only one of those. Proper discovery, scope, and staffing are really key.

Robert Dutt: You guys are a Toronto-based company. For Canadian MSPs or resellers in the audience, is there anything specific about how you’re building the partner ecosystem up here in the market that they should know about, and what’s the first step that a partner should take who’s intrigued by this conversation and wants to find out more?

Larissa Crandall: Join a partner program. Obviously, I will say that. I think one of the proud moments for us right now is we launched a new partner program in February. Simplified, it did increase profitability and economics for them, and also did a complete overhaul of all the training, enablement, everything that they were asking for. It sounds simple, hard to do. We did this outside in. We spent a lot of time surveying Canadian resellers, MSPs across the world and really asking them what was needed around that. When we launched it, we had a record number of logins immediately on our partner portal in the first eight days of the program that we had seen in a while. That just goes to show that there’s just this strong pent-up demand for “Teach me and tell me more” because they’re hearing customers with some of these issues. We want to be there first and foremost and be proactive with them. Join the program. That’s what I would say. It’s very simple to start. I promise you, it’s a very profitable program. We’ll help you through and do all the onboarding and spend some time with us.

Robert Dutt: From a Canadian point of view, anything particular that you’re looking at in the market up here, as far as building the ecosystem or as far as how you view where the Canadian channel’s at with you guys?

Larissa Crandall: I’ve spent quite a bit of time there, talking to partners up there and spending some time with AWS. We spent a lot of time – we just won the Rising Star Award for Canada for the work that we’ve done in partnership with AWS. That has got a lot of press for us personally and what we’re doing and how we’re building solutions together. I would also say we have quite a bit of employees there, obviously. That’s been where we started. I would say a lot of loyal partners that have been with us through the entire journey. I would say that I’m hoping they’re pleased with all the changes and the added incentives there, and happy to talk to them.

Robert Dutt: All right, a few quick-answer lightning round type questions before we wrap up.

You touched upon this a little bit, but can you maybe elaborate? When you talk to MSPs who are doing identity security really well, what’s one thing that’s common amongst them? What’s the common thread amongst those who are doing well in this space?

Larissa Crandall: Great. I would say exactly how we started this conversation – that they have recognized that AI is here and here to stay, and the ones that have built in the forefront and done really well with enablement out to their customers around that human and non-human identity security space and explained it are crushing it. Those are the ones that we’re seeing seat count increase, seeing some of their large customers come on and do true – what I would say, we call it – wall to wall. Bring in customers that have done exactly what that mature MSP did and said, “If we’re going to go do this and preach it ourselves and sell it, we better make sure that we are doing it as a company.” We’re continually seeing that. The ones that really get that from the very beginning are the ones that are on the forefront and being proactive about it versus reactive. You have to be trusted advisors out there, especially to even the SMB community.

Robert Dutt: Finally, without naming any names if you don’t want to, what’s the worst password hygiene you have personally witnessed?

Larissa Crandall: I would say sticky notes. I would say everything that your grandparents have done, your parents have done. I think it’s one of those where we’re all guilty of – where do we put that password? Did you share it with someone? That’s the worst thing that you can do. Of course, I work here, I’m going to say it, but being a 1Password customer even before – and that’s the fun about being here. I could be in an airport, I’d have a 1Password sweatshirt on walking through and we’re this beloved brand out there because they started with us on that B2C journey and have moved and brought us through into their businesses today. It’s a great place to be.

Robert Dutt: Quite the evolution, and thanks for walking us through it, and good luck with the program rollout. Thank you so much for taking the time.

Larissa Crandall: Thank you so much, Robert. I appreciate it.

[MUSIC]

Robert Dutt: My thanks to Larissa Crandall from 1Password for that conversation.

A couple of things I want you to take away from it. First, that stat: non-human identities now outnumber human identities 82 to 1. If that number doesn’t make you rethink the scope of the identity conversation you’re having with customers, I’m not sure what will. Second, the MSP who made 1Password mandatory across their entire customer base – not as an add-on, not as an option, but as a baseline requirement for doing business. That’s the kind of conviction that turns a product into a practice. Whether 1Password is the right fit for your stack or not, the broader point stands: identity security is no longer a nice to have, and the MSPs who treat it that way are the ones building real recurring revenue around it.

Thanks for listening today. If you haven’t already, please do consider subscribing to or following the podcast in your podcast app of choice. We’re up on Apple Podcasts, Spotify, YouTube Music, iHeartRadio, and more. And if you’re old school and you like your RSS feed to be, well, an RSS feed, we got you covered too. Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.