Chicago – October 16, 2026 -- Keeper Security has launched native integrations with Tenable that let cloud security teams remediate findings in seconds rather than the days or weeks manual workflows typically take, and that move static scan credentials out of Tenable policies into Keeper.
The integrations are available now to Keeper customers with active KeeperPAM licenses.
Tenable findings feed directly into Keeper's remediation engine
Cloud findings from Tenable now go straight into Keeper's remediation engine. Security teams can rotate credentials, enforce Just-In-Time (JIT) access and remove standing privileges without leaving the Keeper platform. Once remediation is complete, Keeper notifies Tenable and moves the finding to resolved status, with no manual follow-up or ticket management.
Keeper says cloud security teams typically run this workflow by hand across multiple tools, spending days or weeks on approvals while risk persists in production. CEO and Co-founder Darren Guccione said AI-powered threats are shrinking the window in which defenders can act, and that the integration lets teams implement fixes in seconds instead of weeks.
Self-hosted Keeper Encrypter gateway keeps data inside the customer perimeter
Keeper Encrypter runs as a self-hosted gateway inside the customer's environment. It receives webhook traffic from Tenable and encrypts the exchange using customer-managed private keys. According to Keeper, cloud infrastructure never sees unencrypted findings or credentials.
Teams select a remediation action for each finding sent from Tenable:
- Rotate exposed credentials across databases, machines, cloud environments and directories.
- Enforce JIT access to eliminate standing privileges at scale.
- Onboard PAM User records directly for cloud identities flagged by Tenable, without separate database, machine or directory resources.
Each action is logged with a full audit trail and compliance visibility.
Keeper Commander removes passwords and SSH keys from Tenable scan policies
A second integration, between Tenable and Keeper Commander, targets the credentials Tenable uses to log into systems during vulnerability scans. Organizations typically store passwords and SSH keys directly in Tenable scan policies, which raises risk if either system is compromised. Under the new setup, credentials sit in Keeper, and Tenable requests them at scan time.
The integration supports credentialed scans of SSH, Windows (SMB) and database targets. Credentialed scans allow deeper assessments, including installed software versions, configuration settings, patch levels and compliance status. Credentials rotate automatically in Keeper, and Tenable picks up new values at the next scan without manual policy updates.
CTO and Co-founder Craig Lurey described the remediation workflow as closed-loop and operating entirely within the customer's perimeter.