Keeper launches self-hosted PAM for air-gapped and restricted networks

Keeper Security has introduced Self-Managed Keeper, a self-hosted deployment option for privileged access management in air-gapped, on-premises and other disconnected environments. The release targets government, critical infrastructure and regulated enterprises that need to keep credentials, secrets and sessions inside their own infrastructure.

Why it matters: - Government agencies, utilities, defense operators and other critical infrastructure users often cannot rely on external cloud connectivity. - Self-Managed Keeper is built to keep privileged access management running inside restricted networks, which can help maintain operations during outages or in disconnected sites. - The launch expands Keeper Security’s footprint beyond cloud-native deployments into customer-controlled environments.

What happened: - Keeper Security on November 5, 2026 announced Self-Managed Keeper, a self-hosted deployment option for its privileged access management platform. - The product is designed for environments where external cloud connectivity is restricted, unavailable or prohibited. - The deployment targets government agencies, critical infrastructure operators and highly regulated enterprises. - Keeper said the offering supports on-premises, private cloud, air-gapped networks and Operational Technology environments.

The details: - Self-Managed Keeper lets organizations manage credentials, secrets and privileged sessions entirely within their own infrastructure. - The platform works through the KeeperPAM Gateway and includes KeeperDB, the Keeper Admin Console and Keeper APIs. - Keeper said the self-managed platform runs in Docker containers on customer-controlled Linux infrastructure. - The system is designed for fully air-gapped networks and other isolated environments. - Key benefits include operational continuity without external cloud or internet access, customer-controlled data residency, air-gapped network support and self-hosted deployment control. - Keeper said credentials and secrets are encrypted and decrypted on users’ devices under its zero-knowledge architecture. - The launch adds a deployment model that complements Keeper’s existing cloud-native offerings.

Between the lines: - The launch is aimed at a persistent gap in enterprise security: many modern identity tools assume network access that restricted environments do not have. - Keeper is positioning the product as a way for security teams to modernize privileged access without changing the infrastructure rules of OT and defense networks. - The company is also signaling that regulated customers want more control over data location, access paths and system operation than cloud-only products typically allow. - Craig Lurey, CTO and co-founder of Keeper Security, said dependence on external cloud connectivity can create unacceptable operational risks in disconnected or highly restricted environments. - Shane Barney, CISO of Keeper Security, said the product bridges the gap between strict operational requirements and modern cybersecurity capabilities.

What's next: - Keeper is directing customers to learn more about Self-Managed Keeper and request a demo at the product page. - The company appears to be broadening its PAM strategy to cover both cloud-first and fully customer-managed deployment scenarios.

The bottom line: - Keeper is extending privileged access management into the hardest-to-reach environments, with a self-hosted option built for disconnected infrastructure and strict control requirements.