‘Unpleasant surprise’ taught 1Password CFO important lessons on AI usage

A surprise AI bill is a seemingly common experience for finance leaders, including Greg Henry, CFO of password management company 1Password. Henry described an “unpleasant surprise” in a recent blog post: an AI bill five times higher than the original contract.

Henry told CFO Brew the contract was for a few hundred thousand dollars, but as employees were let loose to use the tool, “consumption took off” and the company blew through the initial contract amount “pretty quickly.” He was soon handed “another procurement request for a million dollars.” Per his blog post, the incident “revealed a structural gap between IT, Finance, and end users.”

“We weren’t probably set up the way we should have been to capture consumption vendors,” Henry told us.

The experience offered an important, albeit expensive, lesson that can apply to any CFO navigating AI vendor contracts. 1Password now has procurement triggers and greater visibility into consumption.

Henry said companies faced a similar learning experience with cloud technology, since some cloud vendors use consumption pricing. Back then, a company may have ended up with a surprise $10,000 bill if an employee left “an instance running over the weekend.” But Henry also made an important distinction between cloud and AI spending.

The AI learning curve is “going to happen a lot faster,” he said. “It’s not going to take years and years, because this is going faster than the cloud did. And so there’s no way we can wait…we have to get this under control quickly.”

Taking control. One problem in the blog example, Henry said, was that the initial AI contract “didn’t trip the trigger where it had to get to me, and so it went through.” By the time the problem reached his desk, the company had opened Pandora’s box—the tool was “so far embedded that it’s really tough to turn it off or stop it.”

With 1Password’s new procurement triggers, “anything that is a consumption contract comes to me and the CISO/CIO,” Henry said. Unlike a traditional SaaS contract that charges for seats, “the [usage-based] contract you’re signing up for isn’t really your ultimate commitment,” he explained. “And quite honestly, even when we forecast usage in a consumption model, we never commit to 100% because you don’t want to overcommit and then have waste.”

On the back end, 1Password is using its own SaaS and AI spend management tool, which shows Henry “what’s being used by who, which models, all the details.” This allows him better visibility “to make sure you’re trending the way you expect [consumption] to go, not something different,” he said.

The dashboard also allows 1Password to identify who’s using AI for agentic work—which is something that 1Password wants to see, Henry said.. “You can start seeing trends of who’s really building agents that are actually doing work”—driving business outcomes—“versus generating personal productivity,” he said.

No cap. Henry said educating employees on appropriate AI model use is the next stage in the company’s AI evolution. He added he believes “90% to 95% of the models being used are the wrong models,” because “they’re too high powered, too expensive.”

AI vendors default to their latest (and most expensive) model on their landing pages, Henry said. Those models should be reserved “for engineering” and “hardcore development,” while other functions can get by with an older model. Henry estimated the model his finance team should be using is “probably one-eighth or one-tenth the cost” of the latest model.

“People are putting caps in place because they have no visualization of [usage] and they have no way to educate, and monitor, and manage,” Henry said. “So the only thing they can do is put [in] these hard caps, which I believe stifles what we’re trying to drive, versus optimizing the usage itself.”

Changing relationships. As CFO Brew recently detailed, AI technology requires tighter bonds between the CFO and a company’s executive tech leadership. Henry said he’s working “way more closely” with his CISO/CIO, Jacob DePriest, because of the variability that comes with usage-based AI contracts.

“Before, you could be like, ‘I’m going to buy this many seats. It’s a fixed price. IT, go deploy your seats. I don’t need to manage that,’” he said. “But now we both have to manage it,” because they have to determine which employees need access to the AI tool.

“We need to make that decision because once you give it to them, it’s not just, ‘I’m giving you a seat at $200 a year. I’m giving you the access to go use whatever you want,’” he said. The company’s CISO/CIO has a better view of who needs access to certain AI tools and for what purposes, Henry said. With that information, the finance team can better model expected costs and monitor usage.