Chicago – November 05, 2026 -- Keeper Security has launched Self-Managed Keeper, a self-hosted deployment of its Privileged Access Management (PAM) platform that runs without any external cloud dependency, extending the vendor into air-gapped and Operational Technology (OT) networks.
Self-Managed Keeper runs in Docker containers on customer-controlled Linux infrastructure
The platform delivers credential management, secrets management and privileged session management through the KeeperPAM Gateway. The package also includes KeeperDB, the Keeper Admin Console and Keeper APIs.
Customers can deploy on-premises, in private cloud, in fully air-gapped networks or in OT environments. They decide where the system runs, how it is networked and who can access it.
Government, defense, energy and financial buyers are the target segments
Keeper names government, defense, energy, utilities, financial services and industrial operations as sectors that maintain restricted or disconnected networks to meet security, operational and regulatory requirements. The new option complements Keeper's existing cloud-native offerings.
Keeper retains zero-knowledge encryption on user devices
Credentials and secrets are encrypted and decrypted on users' devices. Encrypted data is stored within customer-controlled infrastructure to support data residency and internal security requirements.
Access to privileged credentials and sessions does not depend on internet connectivity. Keeper says this matters for critical infrastructure operators that must restore systems during connectivity disruptions.
Craig Lurey, CTO and co-founder of Keeper Security, said dependence on external cloud connectivity can create "unacceptable operational risks" in disconnected environments. CISO Shane Barney said security teams can modernize how they protect critical systems without compromising the infrastructure requirements of those environments.