Keeper Security and Tenable Integrate to Streamline Cloud Risk Detection, Remediation and Vulnerability Assessment

Keeper Security, the leading zero-trust and zero-knowledge identity security platform, today announces native integrations with Tenable that eliminate the costly delay between identifying cloud security risks and remediating them while centralizing credential management for comprehensive vulnerability assessment. These integrations allow cloud security teams to move from detection to remediation in a single workflow, without managing manual tickets or switching between tools. Teams can now instantly act on Tenable’s findings to rotate compromised credentials, enforce Just-In-Time access and remove standing privileges, all without leaving the Keeper platform. Organizations can also eliminate static credentials from scan policies by storing privileged credentials centrally in Keeper, enabling Tenable to retrieve them automatically at scan time for credentialed scanning of SSH, Windows and database targets.

Tenable provides comprehensive visibility into exposed identities, risky access paths and misconfigurations across cloud environments. However, the gap between discovering these findings and executing remediation remains a persistent challenge for cloud security teams that typically manage this workflow manually across multiple tools. Teams can spend days or weeks chasing approvals and context-switching while risk persists in production, leaving the vulnerability window open for exploitation.

Keeper’s integration with Tenable closes this gap by sending cloud findings directly into Keeper’s remediation engine. Once a finding arrives in Keeper’s platform, security teams can immediately execute targeted fixes – including credential rotation, Just-In-Time (JIT) access enforcement and standing privilege removal – without leaving their existing workflow. When remediation is complete, Keeper automatically notifies Tenable and moves the finding to resolved status with zero manual follow-up. The entire cycle from detection to closure happens without teams switching platforms or managing tickets.

“Organizations can’t remediate findings if they aren’t properly equipped to take action immediately,” said Darren Guccione, CEO and Co-founder of Keeper Security. “As AI-powered threats increase the onslaught of cyber attacks and decrease the window of time in which cyber defenders can take action, this integration enables cloud security teams to implement fixes in seconds instead of weeks.”

Closed-loop remediation without exposure

The integration preserves Keeper’s zero-knowledge architecture at every step. Keeper Encrypter operates as a self-hosted gateway deployed inside the customer’s environment, receiving webhook traffic from Tenable and encrypting the data exchange using customer-managed private keys. All synchronization between platforms happens through encrypted channels that remain fully contained within the organization’s perimeter. Cloud infrastructure never sees unencrypted findings or credentials, and security teams achieve automated remediation without exposure. 

The remediation workflow is straightforward and comprehensive. Teams send relevant Tenable findings directly to Keeper, then select the appropriate remediation action for each finding. For infrastructure compromises, teams can rotate exposed credentials across databases, machines, cloud environments and directories. For access control issues, they can enforce JIT access to eliminate standing privileges at scale. For cloud identities flagged by Tenable, teams can onboard PAM User records directly without requiring separate database, machine or directory resources. Each remediation action is logged with a full audit trail and compliance visibility.

“By connecting Tenable’s cloud detection directly to Keeper’s zero-trust remediation engine, we’ve built a closed-loop workflow that operates entirely within the customer’s perimeter,” said Craig Lurey, CTO and Co-founder of Keeper Security. “Security teams can immediately execute targeted fixes – from automated credential rotation to JIT access enforcement – without leaving their workflow or exposing unencrypted data.”

Centralized credential management for credentialed scans

Tenable’s integration with Keeper Commander solves another critical challenge: securing the credentials Tenable needs to log into systems during vulnerability scans. Today, organizations typically store passwords and SSH keys directly in Tenable scan policies, a practice that increases risk if either system is compromised. With this integration, organizations store those credentials securely in Keeper instead. When Tenable runs a scan and needs to log into a system, it requests the credential from Keeper, which delivers it securely, never allowing it to sit in Tenable’s configuration.

Credentialed scans allow the Tenable scanner to log in to target systems directly and perform deeper assessments than is possible without credentials, including checking installed software versions, configuration settings, patch levels and compliance status. This approach supports SSH, Windows (SMB) and database credentialed scans while keeping secrets out of scan policies. Credentials rotate in Keeper automatically, and Tenable picks up the new values at the next scan with zero manual policy updates.

For teams managing cloud risk at scale

Both integrations are purpose-built for security operations teams managing cloud infrastructure at scale. Organizations can now detect cloud risks with Tenable, remediate them instantly through Keeper and run deeper vulnerability scans using centrally managed credentials without exposing secrets or switching between tools. 

The Keeper Commander and Tenable integrations are available now to Keeper customers with active KeeperPAM licenses. To learn more about connecting Tenable findings to Keeper’s zero-trust remediation controls and securing credentials for authenticated scans, visit keepersecurity.com or schedule a demo with Keeper Security today.