Apono

Overview

Apono automates just-in-time, least-privilege access to cloud infrastructure and data. Founded in 2022, it grants and revokes permissions on demand through chat and workflow integrations, so engineers request the access they need, get it for a bounded window, and have it removed automatically. The aim is to eliminate the standing cloud privileges that traditional PAM and manual IAM processes tend to accumulate.

1Password acquired Apono on 15 June 2026, reportedly for 250 to 300 million dollars, with all 80 staff joining. Apono is now the just-in-time access layer of 1Password Unified Access, which takes 1Password from credential storage into PAM proper. Expect packaging and pricing to move toward 1Password's per-seat model: see the news item.

What it is good at

Fast, self-service access with automatic expiry is the core strength, and the developer experience is a standout: requests and approvals flow through tools teams already use, with guardrails and policy applied automatically. Coverage across AWS, Azure, GCP, and common data stores is good, and the just-in-time model directly reduces standing-privilege risk, which is one of the most common cloud security gaps. Audit trails of who accessed what, when, and why support compliance.

Where it falls short

As a young, cloud-focused vendor, Apono concentrates on just-in-time access rather than the full traditional PAM feature set: session proxies, credential vaulting for legacy systems, and on-premises Windows admin scenarios are not the focus. Its enterprise track record and ecosystem are still building. It is best seen as complementary to classic PAM, covering the cloud JIT gap, rather than a wholesale replacement for a vault-based suite.

Pricing

Subscription, quote-based, with a free trial. Compare against broader PAM and CIEM tooling with the TCO calculator.

Best for, and who should look elsewhere

Choose Apono for cloud-native just-in-time access where self-service and automatic expiry matter. For AD-tied JIT, see Netwrix Privilege Secure; for certificate-native infrastructure access, see Teleport and StrongDM; for cloud entitlement governance, see the CIEM category.

Bottom line

A strong cloud-native just-in-time access tool for DevOps teams, complementary to classic PAM rather than a full vault-based replacement.