KeeperPAM is Keeper Security’s privileged access management platform. It combines the Keeper vault with secrets management, credential rotation, privileged sessions, tunnelling, remote browser isolation, endpoint privilege management and discovery.[2] Keeper describes it as “part of the broader Keeper Security platform”. It is delivered through the Keeper Vault, not as a separate deployment.[3] It is “available through Sales only, with pricing tailored to your organization’s size, infrastructure and privileged access needs”.[3]
Three related products are licensed partly through KeeperPAM and partly on their own. They are Keeper Secrets Manager (KSM), Keeper Connection Manager (KCM) and Endpoint Privilege Manager (EPM). All of them are governed by the same SaaS Terms of Use, whose definition of Software names Keeper Connection Manager.[10]
Editions
| Offering | How it is licensed | Catalog row |
|---|---|---|
| KeeperPAM platform | Quote; includes enterprise password management features plus PAM, NHI and workload allowances | KeeperPAM |
| Privileged Access Manager Add-On | Per user needing PAM, on top of Business or Enterprise | Privileged Access Manager Add-On |
| Keeper Secrets Manager | Add-on to business plans, per user per year; included with KeeperPAM | Keeper Secrets Manager |
| Keeper Connection Manager (self-hosted) | KeeperPAM licence, or KCM On-Prem Add-on with Business or Enterprise, plus licence key | Keeper Connection Manager |
| Endpoint Privilege Manager | Enterprise subscription including EPM, endpoint seats in blocks of 50 | Endpoint Privilege Manager |
Sources: KeeperPAM Licensing, Secrets Manager FAQ, KCM License, EPM Licensing & Activation, Subscriptions.[1][4][5][7][8]
With the Privileged Access Manager licence, the PAM documentation lists these features: Secrets Management, Password Rotations, Privileged Sessions and Connections, Tunnels, Remote Browser Isolation, Session Recordings and Playback, Discovery, Keeper Connection Manager (Self-Hosted), and PAM Audit and Reporting.[1]
Metrics
Privileged Access Manager Add-On user. KeeperPAM Licensing gives the licence model as a two-row table. Business or Enterprise is counted as the “Number of Users using the Business or Enterprise Features”. The Privileged Access Manager Add-On is counted as the “Number of Users using the Business or Enterprise Features AND PAM Features”.[1]
Active NHI and Workload. The KeeperPAM pricing page defines an Active NHI as “Any Non-Human Identity (NHI) that is managed in the Keeper Vault and transacts through the Keeper Gateway”. A Workload is “Any AI agent or local process that is executed on an endpoint whose privileges are governed by Keeper Endpoint Privilege Manager (EPM) policies.”[2] NHIs are counted annually and workloads monthly.
Endpoint seat. EPM needs “Enough endpoint seats for the agents you plan to deploy”.[7]
Secrets Manager. Direct customers license KSM per user per year.[4] MSPs are charged for it “per API call bundle”.[9] See API call bundle (Secrets Manager, MSP).
Counting / floors
Only PAM users need the add-on. Keeper’s worked example: an organisation with 100 Enterprise users, 10 of whom need PAM, buys “100 Keeper Enterprise Licenses” and “10 Privileged Access Manager Add-Ons”.[1] The add-on is therefore a subset count. Every PAM user also holds a base licence, but not every base user needs PAM. Catalog proof: PAM add-on counted only for users needing PAM; KeeperPAM requires a PAM licence or the PAM add-on.
Included NHIs and workloads. “KeeperPAM includes protection for up to 24 annual active NHIs transacting through the Keeper Gateway and 5,000 monthly workloads transacting on endpoints at no cost.” Volume-based pricing applies above that.[2] Catalog proof: KeeperPAM includes 24 active NHIs and 5,000 monthly workloads.
| Tier | NHIs | Workloads |
|---|---|---|
| Included | up to 24 | up to 5,000 |
| Tier 1 | 25-99 | 5,001-25,000 |
| Tier 2 | 100-249 | 25,001-250,000 |
| Tier 3 | 250-749 | 250,001-1,000,000 |
| Enterprise | 750+ | 1,000,000+ |
Source: Keeper Pricing for KeeperPAM.[2] No prices are published for the tiers.
EPM blocks. Endpoint Privilege Manager is bought by endpoint count and “Sold in blocks of 50 licenses”.[8] EPM is part of Keeper Enterprise and needs “An active Keeper Enterprise subscription that includes Endpoint Privilege Manager”.[7] Catalog proof: Endpoint Privilege Manager sold in blocks of 50; Endpoint Privilege Manager requires Enterprise and endpoint seats.
Bundling and upgrades
The Secrets Manager and Connection Manager add-ons are bundled into the PAM add-on. “Both the Keeper Secrets Manager and Keeper Connection Manager Add-Ons are included as part of the Privileged Access Manager Add-On.”[1] Customers can upgrade from the KSM add-on and gain the new KeeperPAM features and “Unlimited API Calls”. Upgrading from the KCM add-on gives access to both the cloud and self-hosted KCM.[1] A customer holding both KSM and KCM add-ons alongside a PAM add-on for the same users may be paying twice. Catalog proof: PAM add-on includes the Secrets Manager and Connection Manager add-ons.
Secrets Manager is “offered as an add-on to all business password manager plans and is licensed on a per-user, per-year basis. It is included with KeeperPAM.”[4] KSM, KCM and Remote Browser Isolation cannot be added through In-Console Checkout.[8] Catalog proof: Secrets Manager licensed per user per year; KSM, KCM and RBI are not sold through In-Console Checkout.
Virtualization & partitioning
Connection Manager licence key. KCM is “a self-hosted, agentless remote desktop gateway”. It can be deployed to any on-premises, public cloud or private cloud environment, through Docker or native Linux binaries.[11] “Starting with Keeper Connection Manager version 2.19, customers are required to obtain a license key from Keeper in order to continue the use of the application.” Without a valid key, users and administrators cannot use KCM after the update.[5] The key is generated in the Admin Console under the Connection Manager tab with “On-Prem License Key”. It is supplied to the container in the KCM_LICENSE environment variable, or for RPM installs in /etc/guacamole/kcm.license.[5] The retrieved documents tie the key to the tenant, not to a host count. Catalog proof: Keeper Connection Manager 2.19 and later needs a licence key.
Gateways and NHIs. KeeperPAM uses “a lightweight gateway installation”.[1] The NHI unit counts identities that transact through the Keeper Gateway, not gateway hosts.[2]
Open source components
KCM is built on Apache Guacamole. “The packages and Docker images provided with Keeper Connection Manager contain both proprietary and open source software.” The licences of bundled software are found beneath /opt/keeper/share and in RPM package metadata.[6] Apache Guacamole and its User’s Guide are distributed under the Apache License 2.0.[6] The proprietary parts remain under Keeper’s terms. See open-source software licensing. Catalog proof: Connection Manager bundles Apache Guacamole and other open source.
Cloud / BYOL
KeeperPAM and Secrets Manager are Keeper-hosted. Secrets Manager is “a cloud-native service” that integrates with cloud and on-premises environments.[4] KCM is the self-hosted option. KeeperPAM is “a cloud-native privileged access solution that requires only a lightweight gateway installation”.[1]
Programs
- MSPs. KeeperPAM is a Secure Add-On that MSPs “can add or remove at any time” for Managed Companies.[1] MSP charges for KCM are “per KCM user (specified by MC)”.[9] See Keeper Security MSP and partner licensing.
- Trials. A free KeeperPAM trial is offered. The EPM documentation says the free trial “includes full KeeperPAM capabilities, including EPM”.[7]
Out of scope
- Prices for KeeperPAM, the PAM add-on, KSM, KCM, EPM and the NHI and workload tiers. None are published.
- KeeperDB and Remote Browser Isolation as stand-alone products. Both appear in PAM feature lists, but no separate licensing document was retrieved.
- The KCM end-user licence agreement accepted at installation (
ACCEPT_EULA), which was not retrieved.