Keeper links Tenable findings to instant remediation

Keeper Security has launched integrations with Tenable, linking Tenable's cloud risk findings with remediation actions in Keeper.

The integrations let security teams send findings from Tenable into Keeper, where they can rotate credentials, enforce Just-In-Time access and remove standing privileges without switching between tools.

The setup also allows Tenable to retrieve privileged credentials for authenticated vulnerability scans from Keeper when needed, rather than storing passwords or SSH keys in scan configurations.

Remediation workflow

The integrations address a common cloud security challenge: the delay between identifying a risk and fixing it. Tenable identifies exposed identities, risky access paths and misconfigurations in cloud environments, while Keeper positions its platform as the place for security teams to take corrective action.

Under the integration, findings identified by Tenable are sent to Keeper's remediation engine. Security teams can then choose a response based on the issue, including rotating exposed credentials across databases, machines, cloud environments and directories, or enforcing Just-In-Time access where access control issues have been identified.

Once remediation is complete, Tenable is automatically notified and the finding is moved to resolved status. The process is intended to remove the manual ticketing and approval steps that often leave risks unresolved for days or weeks.

"Organisations can't remediate findings if they aren't properly equipped to take action immediately," said Darren Guccione, Chief Executive Officer and Co-founder of Keeper Security. "As AI-powered threats increase the onslaught of cyber attacks and decrease the window of time in which cyber defenders can take action, this integration enables cloud security teams to implement fixes in seconds instead of weeks."

According to Keeper, the remediation workflow keeps unencrypted findings and credentials out of cloud infrastructure. It uses Keeper Encrypter, a self-hosted gateway deployed inside a customer's environment, to receive webhook traffic from Tenable and encrypt the data exchange using customer-managed private keys.

All synchronisation between the two platforms takes place through encrypted channels within the customer's perimeter, the company said. Each remediation action is also logged, creating an audit trail for security and compliance teams.

"By connecting Tenable's cloud detection directly to Keeper's zero-trust remediation engine, we've built a closed-loop workflow that operates entirely within the customer's perimeter," said Craig Lurey, Chief Technology Officer and Co-founder of Keeper Security. "Security teams can immediately execute targeted fixes - from automated credential rotation to JIT access enforcement - without leaving their workflow or exposing unencrypted data."

Scan credentials

A second part of the integration focuses on vulnerability scanning. Organisations often use credentialed scans so a scanner can log in to systems directly and inspect software versions, configuration settings, patch levels and compliance status more deeply than is possible without credentials.

In many cases, those credentials are stored directly in scan policies. The integration with Tenable Commander changes that model by keeping privileged credentials in Keeper and allowing Tenable to request them only at scan time.

The arrangement applies to SSH, Windows and database targets. This means credentials do not remain stored inside Tenable's scan configuration, reducing the exposure associated with static secrets held across multiple systems.

The companies also said rotated credentials can be updated centrally in Keeper, with Tenable using the new values at the next scan without manual policy changes.

Operational focus

The integration is aimed at security operations teams managing cloud infrastructure at scale, particularly those trying to shorten the time between detection and response while retaining stronger control over privileged access.

Customers with active KeeperPAM licences can use the new Keeper Commander and Tenable integrations now. Keeper's broader pitch is that teams can combine cloud risk detection, remediation and authenticated vulnerability assessment in a more connected workflow while maintaining a full audit trail for every remediation action.

Credentialed scans give Tenable the ability to examine installed software versions, configuration settings, patch levels and compliance status on target systems while keeping those secrets out of scan policies, the companies said.