Keeper Security Recognized in PAM Magic Quadrant™ and as Second Fastest Growing Security Company Globally
Learn MoreThreatLocker controls which applications can execute on endpoints. KeeperPAM® governs every identity that can access your environment – identifying, monitoring and enforcing policy across humans, machines and AI agents.
Analysis is based on publicly available documentation and information as of August 12, 2026.
Keeper combines password management, secrets management, privileged session management, endpoint privilege management and Remote Browser Isolation (RBI) in a single zero-knowledge vault. Endpoint privilege management is one pillar of the platform, which means elevation requests, credential access and session activity are all governed by the same policy engine and visible in the same audit trail. The solution supports Windows, Linux and macOS endpoints, with consistent policy concepts, centralized governance and audit visibility across supported platforms.
MSPs can start by providing password management and endpoint privilege control, then expand their offering to include secrets management and full session management as their clients' requirements grow.
ThreatLocker is a zero-trust endpoint security platform built around application allowlisting, Ringfencing, Storage Control and Network Control. Elevation Control is one module within that platform. It enables application elevation without assigning local administrator rights to users.
The platform supports Windows, Linux and macOS, but there are meaningful differences in feature depth among the three, with the deepest feature support on Windows and narrower support on Linux.
ThreatLocker does not include a privileged credential vault, secrets management or privileged session management.
MSPs using ThreatLocker for endpoint control need separate tools to cover those areas of privileged access.
Keeper's Endpoint Privilege Manager (Keeper EPM) is a purpose-built Privileged Elevation and Delegation Management (PEDM) solution. It removes standing local admin rights and replaces them with scoped, temporary elevation granted at the process or machine level, without requiring an application allowlisting baseline first. Policies are scoped to user and group identity across device collections, and Just-In-Time (JIT) grants expire automatically.
Elevation supports Multi-Factor Authentication (MFA) requirements, justification capture, time-bound windows and multi-step approval workflows integrated with Slack, Jira and ServiceNow. It provides full coverage across Windows, macOS and Linux with consistent privilege governance across all three operating systems.
ThreatLocker Elevation Control grants elevated permissions to specific applications or processes without giving users local admin rights. Elevation depends on ThreatLocker's application allowlisting, so applications must be approved before elevation can be granted. As a result, new deployments require a baselining period.
Time-limited elevation is supported. The model is based on applications rather than identities, meaning policies govern what can be executed, not who can access what. ThreatLocker's Elevation Control is documented for managing local administrators on Windows and macOS. Linux is supported at the platform level for allowlisting and Ringfencing, so MSPs should verify whether ThreatLocker's Linux privilege handling meets their governance requirements.
Keeper EPM extends privilege enforcement beyond humans, applying the same policy and audit model to AI agents running on endpoints.
Keeper EPM detects agents and assigns them identities to monitor their behavior and provide action-based risk scoring, enabling organizations to actively govern them through three different policy types.
Organizations can control who can run AI agents, what agents can do and how they request administrative elevation.
ThreatLocker approaches AI agents differently than Keeper EPM does. Under its deny-by-default allowlisting, it treats an AI agent like any other executable or script and controls whether it can run. It does not assign AI agents their own identities or apply the agent-specific behavior monitoring and action-based risk scoring that Keeper EPM provides.
Keeper stores all privileged credentials in a zero-knowledge encrypted vault; passwords are never exposed during a session launch. Every privileged session is recorded in full: Keystrokes and video are stored as immutable audit evidence across all tenants. KeeperAI® monitors sessions in real time and can automatically terminate activity that exceeds defined risk thresholds.
Clients can be granted direct access to session recordings and audit logs, which support compliance reviews and incident response without relying on the MSP.
ThreatLocker does not include a privileged credential vault. Elevation Control manages application-level privilege without storing or managing the underlying credentials used to access systems. There is no privileged session recording. The platform logs elevation and execution events within its endpoint policy framework, not what happens inside a session.
For MSPs supporting clients with strict auditing requirements, ThreatLocker does not provide visibility into technician activity performed during privileged sessions.
Keeper's access governance model is built around identity. Policies are scoped to users and groups, access is granted just-in-time with automatic expiration and credentials are never exposed during a session. Approval workflows support MFA, justification capture, multi-party sign-off and time-bounded access, which is configurable per tenant, per role or per record type.
Role-Based Access Control (RBAC) applies to both MSP technicians and client-side administrators, with delegated admin roles and co-managed IT support enabling client governance without full MSP dependency.
ThreatLocker provides an Approval Center where end users can request elevation for specific applications, attaching files and notes to support their requests. Administrators, or the ThreatLocker Cyber Hero support team, can approve and apply elevation simultaneously.
The governance model is application-centric. Time-limited elevation is available, but identity-based policy controls, such as MFA requirements tied to elevation, multi-party approvals or justification workflows scoped to user roles, are not the platform's primary control construct.
Keeper's multi-tenant architecture is built around isolated Managed Companies (MCs), fully separated tenants with their own RBAC, policy configurations and audit trails. Privilege governance is a core control plane, not a secondary feature of endpoint management. MSP technicians, client admins and auditors can be connected to specific tenants with least-privilege access.
Standardized policy templates allow new clients to be onboarded against a consistent security baseline. PSA integrations, a REST API and CLI tooling support automation at scale.
ThreatLocker explicitly markets MSP multi-tenant support with centralized policy management and reporting across client organizations. MSPs can deploy and adjust policies across diverse environments from a unified cloud portal, leveraging RMM integrations to support at-scale operations.
Role controls are available but primarily focus on endpoint management permissions rather than identity-scoped privilege governance across the full access lifecycle. The platform's governance model centers on application execution policy rather than cross-tenant identity controls.
Keeper is FedRAMP High Certified and GovRAMP High Authorized and holds SOC 2 Type II, ISO 27001/27017/27018 certifications and is HIPAA and PCI DSS compliant, backed by FIPS 140-3 validated cryptography.
ThreatLocker holds SOC 2 Type II certification (with ISO 27001 reported in progress) and, in August 2025, achieved FedRAMP Ready status for a government-cloud deployment of its suite, now listed on the FedRAMP Marketplace. FedRAMP Ready is a designation on the path to authorization that confirms a readiness review has been completed; it is not the same as a full FedRAMP Certification, which most federal agency procurement requires.
Through its Defense Against Configurations (DAC) module, ThreatLocker also maps its controls to frameworks including NIST 800-53, CMMC, HIPAA, PCI DSS and ISO 27001. That mapping is a compliance-visibility capability, separate from the certifications ThreatLocker holds.
iOS App Store
Microsoft Store
Chrome Extension
Android
See how KeeperPAM gives MSPs full visibility and control across credentials, sessions, secrets and endpoints, in a single zero-trust platform.
ThreatLocker is primarily a zero-trust endpoint security platform built around application allowlisting, with Elevation Control as one of its modules. It controls which applications can execute with elevated privileges without giving users local admin rights. It does not include credential vaulting, secrets management, privileged session recording or database access management.
ThreatLocker Elevation Control manages which applications can run with elevated permissions, tied to its application allowlisting policies. The model is application-centric, meaning it governs what executes, not who accesses what. KeeperPAM is identity-centric; it governs access by user, role and policy across credentials, sessions, secrets, endpoints and databases. ThreatLocker is one layer of endpoint security; Keeper is the full privileged access lifecycle.
ThreatLocker can help contain AI agent activity when that agent is running as an application or process on an endpoint. Its application allowlisting controls what software, scripts, executables and libraries are allowed to run, while Ringfencing limits what approved applications can interact with, access, launch or connect to. In that sense, ThreatLocker treats an AI agent like other endpoint application behavior and constrains it by default.
That is different from managing the identity, credentials and privileged access an AI agent uses to authenticate into systems. Keeper approaches AI agent security from the identity and access side. AI agents can use managed secrets and credentials from Keeper's zero-knowledge vault, with just-in-time and least-privilege access, automated rotation, no hardcoded secrets and full auditability across sessions, commands and secret usage.
ThreatLocker achieved FedRAMP Ready status in August 2025 for a government-cloud deployment and is listed on the FedRAMP Marketplace. FedRAMP Ready is an early step on the path to authorization: it confirms a readiness review has been completed, but it is not a full FedRAMP Certification, which most federal agency procurement requires. Keeper is FedRAMP High Certified and GovRAMP High Authorized.
No, ThreatLocker does not include a privileged credential vault or privileged session recording. Its Elevation Control module manages application-level privilege elevation within its endpoint security platform. MSPs using ThreatLocker for endpoint control still need a separate solution for credential management, session recording and secrets management.
You must accept cookies to use Live Chat.