Feature: KeeperAI in Privileged Sessions

Revolutionise privileged access monitoring with KeeperAI

KeeperAI enables real-time, agentic AI threat detection and response, ensuring that high-risk sessions are automatically terminated and all user activity is analyzed and categorised.

Start Free Trial

Revolutionise privileged access monitoring with KeeperAI

What can KeeperAI do?

Real-time AI threat analysis

Automatically analyzes live session activity and categorises behaviors into Critical, High, Medium and Low risk levels. Each threat is explained with detailed command-by-command context, so security teams understand why an action is risky, not just that it occurred.

Automated session termination

KeeperAI can instantly terminate sessions when critical or high-risk behavior is detected, drastically reducing time to response and exposure windows.

Pattern matching and custom rules

Define your own risk indicators using custom string or regex pattern matching. Prevent activity with “Terminate Session” actions, or allow activity through “Monitor Only” actions, based on your environment’s needs.

Flexible LLM integrations

Bring any Large Language Model (LLM). KeeperAI integrates with all LLM Providers that support OpenAI compatible endpoints, including AWS Bedrock, Azure, Google Vertex AI, Grok and self-hosted runtimes.

Structured risk summaries

Generate encrypted summaries of activity with video playback of the session. These AI-based summaries offer precise forensic detail for audit and incident response.

AI-powered privileged session monitoring

KeeperAI analyses privileged sessions in real time to classify risk, automate response and generate encrypted forensic summaries across text-based and visual environments.

How does KeeperAI help my organisation?

Automate insider threat detection

Automatically detect malicious or suspicious behavior by privileged users, including data exfiltration attempts, unauthorised access and privilege escalation.

Eliminate manual log reviews

Security teams no longer need to manually review hundreds of session recordings each day.

Significantly reduce false positive rates

False alarms that overwhelm security teams are no longer an issue.

KeeperAI is built on a zero-knowledge architecture

All AI processing happens within the customer environment. Data is never exposed to Keeper and is built on zero-trust principles with end-to-end encryption. All data is encrypted with the customer’s private key.

Start Free Trial

Frequently asked questions

What does KeeperAI currently support?

KeeperAI provides real-time threat detection, automated session termination and encrypted session summaries across all major privileged access protocols, including:

SSH — Command-line session monitoring and analysis
Database protocols (MySQL and PostgreSQL) — Query and command monitoring
RDP — Remote Desktop Protocol session analysis with visual monitoring
VNC — Virtual Network Computing session analysis with visual monitoring
Kubernetes — Command and activity monitoring
Remote Browser Isolation (RBI) — Browser session analysis with visual monitoring

Where does AI analysis happen?

All AI processing takes place at your local PAM gateway within your environment, with LLM calls routed to your chosen provider (cloud-based or on-premises). All data is encrypted locally at your gateway before being sent to Keeper. KeeperAI adheres to a zero-knowledge security architecture and ensures Keeper never has access to your unencrypted session data.

Can I customise what KeeperAI detects?

Yes, organisations can define custom string or regex patterns to trigger automated responses, such as terminating a session or applying heightened monitoring.

Is KeeperAI a separate product?

No, KeeperAI is a core capability included with KeeperPAM^®. It requires no additional licensing beyond PAM deployment. LLM provider costs may apply depending on your chosen deployment option.

How does KeeperAI analyse visual sessions like RDP and VNC?

KeeperAI uses vision-enabled Large Language Models (LLMs) to analyse both text-based commands and visual session data. This allows KeeperAI to detect risky behavior within graphical and browser-based sessions by analysing screen content alongside user actions.

Vision-enabled models must support:

Text input for command and query analysis
Image input for visual session monitoring and screen capture analysis

Examples of supported vision-enabled models include OpenAI GPT with Vision, Anthropic Claude, Google Gemini and AWS Bedrock models with vision support.