Appearance
Keeper License Audit
Story: PAM-001 — Audit current Keeper license tier Owner: Rory (security) / Kobe (documentation) Status: Completed 2026-04-16 Related: PAM Scope, PAM Evaluation
Purpose
Audit Cirius Group's current Keeper Security license tier to determine whether the existing subscription covers the PAM (Privileged Access Management) session-recording capability we need for HIPAA-aligned privileged-access controls, or whether we must upgrade (or switch vendors).
This is the prerequisite for every other story in the PAM epic — if Keeper Business already includes what we need, we stop. If it doesn't, we compare the cost of Keeper's PAM add-on against alternatives in PAM-003.
Current Usage Snapshot
| Field | Value |
|---|---|
| Vendor | Keeper Security |
| Deployment | SaaS (cloud vault) |
| Tenant | Cirius Group (verified via keeper.io admin console) |
| Current tier | Keeper Business (baseline password manager) |
| Admin accounts (privileged) | ~3 — Rory, Greg, Jason R |
| Standard user accounts | ~12 staff + contractors |
| MFA enforcement | Entra SSO → Keeper SAML, MFA required at Entra |
| Session recording | Not enabled (not available on Business tier) |
Keeper Tier Comparison
Keeper's product lineup relevant to us is three tiers plus one add-on. Feature mapping below is from the Keeper Business, Enterprise, and KeeperPAM product sheets as of 2026-04.
| Feature | Business | Enterprise | Enterprise + KeeperPAM |
|---|---|---|---|
| Password vault (per-user) | Yes | Yes | Yes |
| Shared folders, team sharing | Yes | Yes | Yes |
| SSO integration (SAML) | Yes | Yes | Yes |
| Advanced reporting / BreachWatch | Add-on | Included | Included |
| SCIM provisioning | No | Yes | Yes |
| Advanced policy engine | Limited | Yes | Yes |
| Command-line / Commander CLI | Yes | Yes | Yes |
| Secrets Manager (CI/CD secrets API) | No | Add-on | Included |
| Connection Manager (RDP/SSH brokering) | No | No | Yes |
| Session recording (video + keystroke) | No | No | Yes |
| Credential rotation on targets | No | No | Yes |
| Zero-trust network access to target hosts | No | No | Yes |
Pricing (2026 public list, annual per seat):
| Tier | List price / user / year | 5 admins | 15 total users |
|---|---|---|---|
| Business | ~$45 | ~$225 | ~$675 |
| Enterprise | ~$75 | ~$375 | ~$1,125 |
| Enterprise + KeeperPAM | ~$200 (PAM add-on ~$125 on top of Enterprise) | ~$1,000 | ~$1,875 (PAM add-on typically only priced for admins) |
Note: Keeper does not publish firm PAM pricing — the $125/admin/year PAM add-on figure above is from a 2026-Q1 quote to a peer MSP and should be confirmed by Greg via a formal quote before budgeting.
Finding: What We Have vs. What PAM Requires
The session-recording, connection-brokering, and credential-rotation capabilities we need (see PAM Scope) are only on the KeeperPAM add-on, which sits on top of Enterprise. Business tier does not provide any of them.
To get PAM at Cirius on Keeper we would need to do two things: upgrade the base tier from Business to Enterprise for all users, then add the KeeperPAM module for the ~3 admins who actually perform privileged access.
Recommendation
Upgrade path: Keeper Business → Keeper Enterprise + KeeperPAM for admins only.
Reasoning:
- We already use Keeper for general password management and the team is trained on it. Switching vendors for PAM while staying with Keeper for passwords splits the admin experience across two consoles.
- Enterprise-tier features we're not using today (SCIM, advanced policy, BreachWatch) become useful as staff count grows past 15 — so the Enterprise upgrade is not pure PAM overhead.
- KeeperPAM as an add-on means we only pay PAM pricing for the ~3 admins who need it, not for every user.
- Azure PIM already covers the Entra role activation workflow (see PAM-003), so KeeperPAM's scope at Cirius is narrower than a full CyberArk deployment would be — we're using it only for DC direct access, Panorama, and firewall CLI sessions. This keeps the PAM license count small.
Estimated annual delta vs. today:
- Enterprise upgrade for 15 users: +$450/year
- KeeperPAM add-on for 3 admins: +$375/year
- Total delta: ~$825/year (confirm against formal quote)
Decision Points (for Greg)
- [ ] Approve upgrade from Business to Enterprise for all 15 seats
- [ ] Approve KeeperPAM add-on for 3 admin seats (Rory, Greg, Jason R)
- [ ] Request formal quote from Keeper sales (the $125/admin/year figure is second-hand)
- [ ] Confirm renewal date so the upgrade aligns with the existing billing cycle
References
- Keeper Business datasheet — keepersecurity.com/business.html
- Keeper Enterprise datasheet — keepersecurity.com/enterprise.html
- KeeperPAM overview — keepersecurity.com/privileged-access-management.html
- PAM Scope at Cirius
- PAM Evaluation — Keeper vs CyberArk vs Azure PIM