Self-Managed Keeper Targets Air-Gapped PAM

Quick Read

What Readers Should Know

Keeper Security announced a self-hosted deployment option for privileged access management in restricted and disconnected networks. Self-Managed Keeper runs on customer-controlled Linux infrastructure without external cloud dependencies, according to the company.

Key Takeaways

Self-Managed Keeper supports customer-hosted privileged access management.
It is designed for restricted networks, including fully air-gapped environments.
Capabilities include credential, secrets, and privileged session management.
The platform runs in Docker containers on customer-controlled Linux infrastructure.
Keeper positions it as an additional deployment option alongside its cloud offerings.

Self-Managed Keeper brings credential, secrets, and privileged session management into customer-controlled infrastructure.

Keeper Security announced Self-Managed Keeper on November 5, 2026, introducing a deployment option for organizations that must manage sensitive system access without relying on external cloud connectivity.

The platform is designed for government agencies, critical infrastructure operators, and regulated enterprises with restricted or disconnected networks. According to Keeper, organizations can deploy it on their own infrastructure, including on-premises systems, private clouds, and fully air-gapped environments.

The practical concern is continuity. Security teams may still need access to critical credentials when internet connectivity is unavailable—or when their network rules prohibit external connections altogether.

Privileged access management, or PAM, helps organizations control access to accounts and systems with elevated permissions. Self-Managed Keeper brings credential management, secrets management, and privileged session management into those restricted environments through the KeeperPAM Gateway.

The deployment also includes KeeperDB, the Keeper Admin Console, and Keeper APIs. It runs in Docker containers on customer-controlled Linux infrastructure.

Keeper said this setup gives organizations control over where the platform operates, how it connects to their networks, and where encrypted credentials and secrets reside.

Craig Lurey, Keeper Security’s chief technology officer and co-founder, said dependence on outside connectivity can create operational risks for organizations working in disconnected environments. The new option aims to address that constraint while keeping privileged access infrastructure under customer control.

The company also said the platform extends its zero-knowledge architecture, with credentials and secrets encrypted and decrypted on users’ devices.

For operational technology networks and critical infrastructure, the release addresses a specific need: managing sensitive access within the same infrastructure boundaries that support day-to-day operations.

Self-Managed Keeper complements the company’s cloud offerings, giving organizations another deployment choice when external cloud access does not fit their requirements.

For product information or a demonstration, visit Keeper Security’s Self-Managed Keeper page.

Reader Questions

Frequently Asked Questions

What is Self-Managed Keeper?

It is Keeper Security’s self-hosted deployment option for core privileged access management capabilities.

Who is it designed for?

Government agencies, critical infrastructure operators, and enterprises with restricted connectivity or infrastructure requirements.

Can it operate in air-gapped networks?

Keeper says it supports fully disconnected environments without connectivity to its cloud services.

What infrastructure does it use?

It runs in Docker containers on customer-controlled Linux infrastructure.

What capabilities does it include?

Credential management, secrets management, and privileged session management through the KeeperPAM Gateway, alongside supporting administrative tools.