Summary
- Self-Managed Keeper provides credential, secrets, and privileged-session management within customer-controlled infrastructure.
- The platform is designed for restricted networks, including operational technology, government, defence, and critical infrastructure systems.
- Local deployment removes the requirement for external cloud connectivity but places infrastructure maintenance and availability responsibilities with the customer.
Keeper Security has introduced a self-hosted privileged access management platform designed for organisations operating isolated infrastructure, allowing credentials, secrets, and administrative sessions to be managed without relying on external cloud connectivity.
Self-Managed Keeper extends the company’s existing privileged access management capabilities into customer-controlled environments, including on-premises infrastructure, private clouds, operational technology networks, and fully air-gapped systems.
The deployment option is intended for government, defence, energy, utilities, financial services, and industrial organisations whose operational or regulatory requirements limit the use of externally hosted security services.
The platform runs in Docker containers on customer-managed Linux infrastructure and includes KeeperPAM Gateway, KeeperDB, an administration console, and associated APIs.
Administrative access without cloud dependencies
Privileged access management controls how administrators and other authorised users obtain access to sensitive systems, including the credentials and elevated permissions required for maintenance and operational changes.
Conventional cloud-hosted security platforms can provide centralised administration across distributed environments, but organisations operating restricted networks may be unable to maintain the external connections those services require.
Some facilities deliberately separate operational systems from public networks to limit exposure or comply with internal security requirements. Others must ensure that administrative access remains available when external communications are interrupted.
Self-Managed Keeper is designed to operate entirely within an organisation’s own infrastructure, without requiring a connection to Keeper’s cloud services for its core privileged access functions.
The platform provides credential storage, secrets management, and privileged-session capabilities through components deployed and managed by the customer.
Keeper says its zero-knowledge architecture ensures that credentials and secrets are encrypted and decrypted on users’ devices, limiting the availability of readable secret information to the service provider.
Those are architectural claims made by Keeper. The launch information does not include independently verified deployment results or security testing establishing their performance across different customer environments.
Craig Lurey, CTO and Co-founder of Keeper Security, said: “For organisations operating in disconnected or highly restricted environments, dependence on external cloud connectivity can create unacceptable operational risks. Self-Managed Keeper brings enterprise-grade privileged access management to these environments while enabling organisations to maintain complete control over their security infrastructure.”
Removing an external management dependency may support operational continuity where the connection to a cloud service is unavailable, but the customer must still maintain the availability and integrity of the locally deployed platform.
Privileged access in operational technology
Operational technology environments often contain systems responsible for controlling physical processes, including manufacturing equipment, energy infrastructure, utilities, and other essential services.
These systems can have specialised maintenance requirements and long operational lifecycles, making changes to their security architecture more complicated than updates to conventional office applications.
Administrative access may be required during equipment faults, incident recovery, or planned maintenance. In some environments, external suppliers also require controlled access to specialist systems that they support.
That creates a security and availability challenge. Privileged access must remain available to authorised personnel without establishing unnecessarily broad connections into sensitive operational networks.
By hosting credential and session management locally, organisations can retain access-control functions inside a restricted environment rather than routing administration through an external service.
The architecture may also support data-residency requirements where sensitive credentials and operational information must remain within designated infrastructure.
Whether a particular deployment satisfies regulatory or assurance obligations will depend on the customer’s configuration and the controls surrounding it.
Shane Barney, CISO of Keeper Security, said: “Organisations operating complex OT and defence networks face a unique challenge: maintaining strict security and operational requirements while keeping pace with modern cybersecurity capabilities. Self-Managed Keeper bridges that gap, bringing advanced privileged access management to highly restricted environments where conventional cloud deployments are not an option.”
Air-gapped infrastructure can reduce dependence on external connectivity, although isolation does not eliminate the risks associated with compromised credentials, removable media, maintenance connections, or misuse by authorised personnel.
Locally hosted security platforms also require software updates, backup arrangements, access reviews, and recovery procedures. Those responsibilities become particularly important when the management service is itself necessary to restore access during an operational incident.
Self-hosted deployment consequently changes the allocation of operational responsibility rather than removing it. Organisations gain direct control over the supporting infrastructure while assuming the associated maintenance and availability requirements.
Keeper has introduced Self-Managed Keeper alongside its existing cloud-based privileged access products. The company is offering further product information and demonstrations, but has not supplied named customer deployments or independent performance measurements with the launch.
