Keeper Security has announced the availability of Keeper Privileged Cloud, a capability within its KeeperPAM platform designed to provide just-in-time (JIT) access and zero standing privilege across cloud identity providers including AWS IAM, Azure Entra ID, Google Cloud Platform, Okta and Active Directory.

According to the company, the feature ensures privileged credentials exist only for the duration of an approved session before they are automatically revoked. By removing unused privileged credentials from cloud identity platforms after access expires, Keeper said the capability reduces the attack surface by eliminating dormant permissions that attackers could exploit.

Keeper cited its own research showing that 64% of organizations lack fully consolidated privileged access governance while 43% still allow direct application logins that bypass their identity provider, leaving privileged credentials active after they are no longer needed.

When a user requests elevated access, Keeper Privileged Cloud applies an administrator-defined role or group assignment for a limited period after approval. Users then launch the target console or application directly from the Keeper Vault through Remote Browser Isolation. Keeper said every session is recorded and analyzed in real time by KeeperAI. Once the approved access window ends, KeeperPAM automatically removes the elevated privileges without creating standing accounts, sharing privileged credentials with end users or requiring manual cleanup.

The company said many organizations currently rely on separate identity providers, PAM tools and cloud providers to implement JIT access, resulting in multiple audit trails and enforcement points. Keeper Privileged Cloud instead consolidates password management, secrets management, session management and endpoint privilege management within KeeperPAM, with access governance, credential protection and auditing operating within the same zero-knowledge architecture.

Craig Lurey, CTO and co-founder of Keeper Security, said the challenge with standing privileges is that removing them typically requires coordination across multiple systems that were not designed to work together. He added that many JIT access tools are layered on top of existing environments rather than built into them, making automatic access revocation more difficult. Because Keeper Privileged Cloud was built into KeeperPAM from the ground up instead of being added afterward, he said, "access governance, credential protection and audit all live in the same zero-knowledge architecture," adding that this approach is "the only way zero standing privilege holds up at scale, instead of becoming one more system to maintain."

Keeper said the same governance model extends to non-human identities and AI agents, limiting every identity to only the access required for a specific task while maintaining a complete audit record.

Keeper Privileged Cloud is available as part of the KeeperPAM platform and is included with existing KeeperPAM licenses. Existing customers can contact their Keeper customer success team to enable the feature while new customers can request a demonstration.