Keeper Security Signs CISA’s Secure by Design Pledge

At a glance

• Pledge signed: Keeper Security has signed the Secure by Design pledge run by the Cybersecurity and Infrastructure Security Agency (CISA).
• What it commits to: Keeper commits to building security into every stage of software development.
• Technology focus: The company points to its zero-trust architecture and secure development practices.
• Industry impact: Each signer adds pressure on other vendors to make the same public commitments.
• Leadership comment: Keeper’s CEO described security as the base of its products.

What Keeper agreed to

Keeper Security signed CISA’s Secure by Design pledge on April 2, 2025. The pledge asks software makers to build security into products from the start of development instead of adding it later. Signers make public, measurable commitments and report on their progress.

What the pledge asks

CISA’s Secure by Design pledge covers areas such as wider use of multi-factor authentication, removing default passwords, reducing whole classes of vulnerabilities and publishing vulnerability disclosure policies. By signing, Keeper agrees to work toward those goals and show its progress. The aim is simple. Remove the weaknesses criminals exploit most.

Zero trust and secure development

Keeper says its products use a zero-trust model, in which every user and device must be authenticated and continually validated, whether inside or outside the network. It also commits to secure development practices so that code is checked throughout its lifecycle.

Pressure on other vendors

Keeper’s pledge adds to the list of vendors that have made the commitment publicly. Every signer raises the bar. Supply-chain attacks keep climbing, and buyers who once accepted default passwords and optional MFA now expect vendors to explain in writing why either still exists in a shipping product.

What Keeper’s CEO said

Darren Guccione, CEO and co-founder of Keeper Security, said security is “the foundation of every product we build” and that the pledge fits the company’s zero-trust approach.

What customers can do with the pledge

For customers, the pledge is a lever. Ask Keeper and every other software vendor you use whether they have signed, then check their progress reports against CISA’s goals. Vendors that have not signed should be asked why. Hold them to it.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.