Keeper Enterprise

Short Summary

Password management remains a necessary IT discipline despite growing interest in passwordless authentication and identity federation for single sign-on. Passwords are still ubiquitous: they act as fallbacks for many “passwordless” approaches, remain common in legacy applications and network devices, and are frequently required for partner and consumer websites. Because passwords are widely viewed as a major security risk and cannot be replaced quickly in many environments, organizations need solutions that protect, govern, and operationalize password use.

Enterprise Password Managers and Enterprise Single Sign-On (E-SSO) solutions address this need, with an increasingly blurred boundary between them. Password managers typically focus on web-based credential capture and fill, while E-SSO more often supports password-based login to legacy, non-web applications. Any centralized password capability raises security stakes, so key attack surfaces include the vault, the admin console, secret transmission to endpoints, and client components. Strong security—often including HSM support—remains a primary market differentiator.

Keeper Enterprise is presented as an enterprise-grade password manager with a “zero trust/zero knowledge” security model and extensive integrations. Keeper Security focuses on Enterprise Password Management, also offering consumer password management and additional password security and privileged access capabilities. Keeper Enterprise manages passwords and other secrets (e.g., API keys), supports dark web leakage checks, provides broad device and browser coverage, and includes a desktop “Native App filler” for credential and data injection into legacy Windows applications. It integrates with SAML-based identity providers for SSO and SCIM for provisioning, offers optional directory sync via AD Bridge, and provides native MFA options when an IdP is absent, including FIDO2/WebAuthn on mobile. Additional capabilities include layered encryption per record, automated password rotation via an SDK, policy-driven administration with dashboards and compliance reporting, and BreachWatch monitoring for leaked credentials.

Interesting Facts

• Passwords remain prevalent across legacy applications, network devices, partner applications, and frequently used websites.
• Password managers are available in single-user editions and enterprise solutions with centralized management and enterprise features.
• Key attack surfaces for password manager solutions include the vault, the admin console, secret transmission to endpoints, and client components.
• HSM support is identified as a key requirement for protecting centrally stored secrets.
• Keeper Security’s core focus is Enterprise Password Management, alongside a consumer password manager and additional password security and PAM offerings.
• Keeper Enterprise supports managing passwords and other secrets such as API keys in an integrated solution.
• Keeper supports dark web checks for password leakage and includes BreachWatch for monitoring leaked passwords for sale.
• Keeper Enterprise integrates with identity providers via SAML for SSO and supports provisioning/deprovisioning via SCIM.
• Keeper provides native MFA options including email, text, KeeperPush, OTP, and biometrics, and supports FIDO2/WebAuthn on mobile.
• Keeper uses AES 256-bit and elliptic curve cryptography with multiple encryption layers, with each record having its own key.

Notable Quotes

• “Password Management is an established discipline in IT.”
• “Passwords are ubiquitous.”
• “With passwords rightly being perceived as a major security risk, there is a need for protecting and managing passwords and adding security to all the use cases where passwords can't easily be replaced and will not disappear in foreseeable time.”
• “The core requirement for any Password Manager solution is security.”
• “Storing passwords centrally increases the risk, if not done right.”
• “The line between enterprise-grade Password Managers and E-SSO is blurring, these solutions are often complementary.”
• “The main distinction is the client-side support of E-SSO for password-based login into legacy, non-web applications…”
• “Zero Knowledge is about securely storing and transmitting the passwords and other secrets, while not providing insight into passwords for administrators or others.”
• “Zero Trust refers to the fact that the internal control environment of the customer remains isolated and protected…”
• “The administration interface is powerful and delivers real-time insights into password-related threats.”