Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

You might treat a centralized vault as the authoritative source for every secret, but secrets can quietly fall out of sync as they get copied into cloud secret stores, CI/CD pipelines and running workloads. This is referred to as secrets configuration drift, and it can leave outdated or standing credentials, API keys and other secrets active for longer than intended.

GigaOm has recognized Keeper Security in the Enduring Innovators quadrant of its 2026 Radar Report for Enterprise Password Management. This marks the fifth consecutive year that Keeper has been named a Leader in GigaOm’s evaluation of the enterprise password management market. The report recognizes Keeper’s continued innovation, architectural depth and ability to help organizations secure more than just passwords.

Privileged accounts are standing invitations for attackers, with credentials to steal and permissions to misuse. When administrative rights are persistently active, whether or not they’re being used, privileged accounts significantly expand the attack surface. Zero Standing Privilege (ZSP) shrinks that risk by ensuring no user holds permanent elevated access.

Keeper Security has been named an Exemplary provider in the 2026 ISG Buyers Guide for Identity and Access Management (IAM) platforms — ISG’s highest classification. ISG Research evaluated 31 software providers across authentication, authorization, identity lifecycle management and access governance. Keeper earned an A- grade in every category ISG measures and an overall performance score of 83.0%.

MSPs are expected to understand their clients’ technology environments. They know which endpoints are managed, which applications are business-critical, which systems require patching or maintenance, where sensitive data resides and who has access to it. Increasingly, however, critical technology decisions are now being made without IT or MSP involvement. Across client environments, this can take many forms: And each instance can occur without the MSP ever knowing.

You can reduce your cloud attack surface by auditing every persistent permission across your cloud and identity platforms, stripping away unnecessary access and replacing always-on admin rights with Just-In-Time (JIT) access that’s granted on approval, time-limited and automatically revoked. Getting there starts with understanding why standing privilege makes up such a significant portion of the cloud attack surface.

One of the most exploitable parts of modern attack surfaces is standing privileges: the persistent access rights that linger on accounts long after they’re needed. With standing privilege, static credentials are easier to steal, and overprovisioned accounts give attackers far more reach than they should have. Zero Standing Privilege (ZSP) solves these issues by granting access only when necessary and revoking it as soon as the task is finished, leaving behind no lingering access.

Keeper Privileged Cloud delivers Zero Standing Privilege (ZSP) by extending KeeperPAM’s Just-In-Time (JIT) access framework to cloud identity platforms. A user gets elevated permissions only after a request is approved; those permissions last for a set time window, and Keeper removes them automatically once the window ends. No permanent privilege is left in place.

The main difference between Zero Standing Privilege (ZSP) and least privilege is that least privilege limits the amount of access an identity has, whereas ZSP limits both the amount of access and its duration. Least privilege grants every user or machine only the minimum permissions necessary to do its job, but those permissions tend to persist once a task is completed, leaving standing access behind.

Keeper Security, the leading zero-trust and zero-knowledge identity security platform, today announces the availability of a certified connector integrating Keeper Secrets Manager with Microsoft Azure Logic Apps. The connector, now published on the Microsoft Power Platform marketplace, enables enterprise teams to create and retrieve credentials at runtime directly within automated workflows without ever hardcoding sensitive values in flows.