Identify the access requirement.
If the client names 1Password Device Trust, first confirm that this is the requirement being discussed. Storing credentials, controlling access according to device health and detecting malicious activity are different jobs. A team may need all three.
Ask which applications are in scope, which devices can reach them and what should happen when a device fails a requirement. Then ask who fixes the device and how the client will see evidence of the control. Give each decision an owner.
A device check can change who gets in.
Device Trust evaluates device posture and can restrict access based on configured requirements. It also helps users resolve failing checks. This is more than a passive inventory. Read the Device Trust product description.
The current documentation distinguishes Core, using the browser extension for protected web apps, from Connect, which also integrates with identity providers during sign in. Confirm which path the organisation uses. Read the Core and Connect explanation.
A successful check describes that access decision. It does not promise that malicious activity is impossible afterwards or that every application follows the same policy. State the enforcement path and scope.
Access, protection and evidence fit together.
Swipe across to see both products
| The job | cybee | 1Password Device Trust |
|---|---|---|
| Access policy | Not a replacement for an identity provider or a device based access gate. | Checks device conditions as part of access to protected applications. |
| Device protection | Behaviour, signatures and local inspection on supported Macs. | Evaluate the required access controls separately from the organisation’s threat protection. |
| Fixing settings | Free CIS score. Paid hardening applies and maintains supported changes. | Checks surface issues and guide people through remediation. |
| Evidence | Dated and sealed device observations, with assessed coverage visible. | Device checks, issues and device details support the access workflow. |
May this device enter?
Check the access policy and the application it protects.
What protects it?
Read the protection and configuration actually operating.
What can we show?
Share dated observations with their scope and gaps.
This describes separate responsibilities, not a product integration.
A failed check needs a route to resolution.
The check documentation explains how device tests produce results and issues, with checks targeted to particular groups or platforms. Review which checks are enabled and how the team resolves a failure. Read how Device Trust checks work.
For example, a client asks about screen locks. Check the required setting, its actual value, any resulting access restriction and the fix. Each may come from a different system; keep the device and date with each answer.
cybee checks security settings for free. Paid hardening applies and maintains supported changes. For a managed Mac, agree who owns each setting and how changes can be reversed.
Preserve the scope of each observation.
The device documentation describes enrolled devices, their properties and related checks and issues. Use those facts to support the access controls they actually describe. Read the documented device model.
The cybee device Trust Passport adds a dated, sealed record of assessed Mac controls. The reader checks for changes against cybee’s sealed copy. It is not independent certification and it does not answer for every policy, supplier, person or account. Missing devices stay part of the coverage question.
Connected Google Workspace has a separate account record with observations limited to that organisation. Visibility is free, with sealed account and offboarding evidence in the paid plan. Personal Gmail, Apple ID and unrelated services remain outside that scope. Neither a passing access check nor a healthy Mac establishes that MFA is enforced everywhere.
Keep access controls. Evaluate the additional job.
If the requirement is to prevent an unsuitable device from entering an application, assess the access policy and its supported enforcement path. cybee does not replace that access policy. If the gap is Mac protection, maintained hardening or a dated device record, examine that narrower requirement on its own.
Before adding software, review agent compatibility, permissions and policy ownership. Plan for separate workflows unless a supported connection is confirmed. Keep the existing controls while checking the proposed arrangement. Keep reporting and authority to change settings distinct.
cybee protection and scoring are free. The paid plan includes hardening, the sealed device Passport, security training and sealed Workspace account and offboarding evidence. The price is 9 per Mac monthly or 90 yearly in CHF, EUR or USD, excluding tax. Compare that against the actual access product scope being purchased, not a password manager’s price.
Alerts through Slack, Teams or SMS bring findings into the team’s day. Ask the assistant about the affected device and the recorded result. Keep alerts, access decisions and resolved issues distinct in the client’s answer.
Common questions.
Is this a comparison with the 1Password password manager?
No. This page concerns Device Trust: device health checks and access decisions. A password vault has a different role and is not replaced by cybee.
Does cybee replace device based access enforcement?
No. cybee protection, hardening and evidence address a different job from the policy that grants or denies access to an application.
Can the records be used together in a client review?
They may answer different parts of the request. Match each record to its control, devices and dates. Confirm the sharing workflow and agent compatibility, and let the client decide whether the evidence meets the request.
Read the sources.
Official product and documentation pages used for this comparison. Editions and availability can change; review the relevant package before choosing.