Akeyless is an identity security platform that secures the credentials, keys and access used by machines, AI agents and people. The company is headquartered in New York and Tel Aviv and is led by co-founder and CEO Oded Hareven. Its platform brings secrets management, certificate lifecycle management, key management, privileged access and AI agent security into a single SaaS service with one policy engine and one audit trail. Its architecture is built on Distributed Fragments Cryptography (DFC), which is designed so that complete encryption keys are never stored or assembled in one place. This overview explains how the platform works and what it covers, based on Akeyless’s public product documentation and announcements.
At A Glance
| Vendor | Akeyless, headquartered in New York and Tel Aviv |
|---|---|
| Category | Secrets management, machine identity security, AI agent identity security, modern PAM |
| Identities covered | Applications, workloads, service accounts, AI agents and human users |
| Deployment | SaaS control plane with an optional customer-deployed Gateway on Kubernetes, Docker or virtual machines |
| Cryptography | Distributed Fragments Cryptography with an optional customer-held fragment; FIPS 140-3 validated |
| Agentic AI | SecretlessAI credential brokering, Agentic Runtime Authority (generally available September 2026), Agentic Identity Intelligence |
| Analyst recognition | Overall Leader, KuppingerCole Leadership Compass: Enterprise Secrets Management (2025) |
What The Platform Does
Akeyless groups its capabilities into machine identity security, AI agent identity security and human identity security, all running on the same platform.
Secrets Management
Akeyless stores, issues and rotates the credentials that applications and pipelines depend on. It supports three types of secret:
| Static | Passwords, API keys and tokens, stored centrally instead of hard-coded in applications. |
|---|---|
| Rotated | Akeyless changes the password or key on the target system on a schedule. Documented targets include AWS, Azure, GCP, databases, LDAP, SSH and Windows, with custom rotation for other systems. |
| Dynamic | Created on request and expire automatically. Documented producers include AWS, Azure, GCP, databases, Kubernetes, GitHub, GitLab, Snowflake, RabbitMQ, LDAP, RDP and custom producers. |
Multi-Vault Governance
The Universal Secrets Connector lets organisations manage secrets held in other vaults from the Akeyless console, including AWS Secrets Manager, Azure Key Vault, Google Secret Manager, Kubernetes secrets and HashiCorp Vault. Rotated secrets can be synchronised to these external stores automatically, so applications that read from a cloud-native vault receive the latest value after each rotation.
Certificate Lifecycle Management And Key Management
Akeyless issues and renews TLS and SSH certificates through its own PKI and integrates with Kubernetes cert-manager. Its multi-cloud key management service manages encryption keys across cloud providers, including bring-your-own-key scenarios, and Akeyless describes its encryption as hybrid post-quantum.
Modern PAM
Akeyless Secure Remote Access provides just-in-time privileged access to servers over SSH and RDP, databases, Kubernetes clusters and cloud consoles in AWS, Azure and GCP. Sessions are brokered with short-lived credentials tied to a verified identity, and access ends automatically when the task is complete. The service records sessions and commands, integrates with identity providers such as Okta, Microsoft Entra ID and Ping, and can discover and enrol new servers, databases and clusters as they appear in the cloud. A workforce password manager is also available on the same platform.
How The Architecture Works
Akeyless is delivered as SaaS, with two optional components that customers can run in their own environment.
| Component | What it does |
|---|---|
| Akeyless Platform | The SaaS control plane handles authentication, access policy, secret and key operations, and audit. It runs in US and EU regions. |
| Distributed Fragments Cryptography | Instead of storing a master key, Akeyless represents each key as several mathematical fragments held by independent fragment managers. Each fragment manager computes a partial value, and these are combined into a one-time derived key for each operation. Fragments are refreshed continuously, and the complete key never exists on any server. |
| Akeyless Gateway | The Gateway is a lightweight component deployed inside the customer’s network on Kubernetes, Docker or a virtual machine. It gives the SaaS platform access to private systems for rotation, dynamic secrets and remote access, and provides local caching for continuity and latency. The Gateway does not store secrets or private keys. All communication with the SaaS platform is outbound over HTTPS. |
| Customer Fragment | Organisations that need full key custody can generate a Customer Fragment that is held only on their Gateway and never sent to Akeyless. Keys created with a Customer Fragment cannot be used without it, which means Akeyless itself cannot decrypt that data. Separate Gateways with separate fragments can be deployed in different jurisdictions to meet data residency requirements. |
Authentication And Access Control
Every workload, pipeline or person authenticates to Akeyless through an authentication method, and access roles define which secrets and actions each identity can use. Documented authentication methods include:
| Cloud identity | AWS IAM, Azure AD and GCP |
|---|---|
| Kubernetes | Service account tokens |
| Federated identity | OAuth 2.0 / JWT, OIDC and SAML with Okta, Ping Identity and Microsoft Entra ID |
| Certificate | Certificate-based authentication |
| Universal Identity | A rotating token for workloads that cannot use a cloud or platform identity |
| API key and email | For cases where no identity federation is available |
Using cloud, Kubernetes or JWT identities allows workloads to authenticate without a stored credential, which Akeyless describes as secretless authentication.
Integrations
| Area | How it works | Documented integrations |
|---|---|---|
| Kubernetes | Secrets are injected into pods at start-up, mounted as files, or synced into Kubernetes Secrets. | Akeyless Secrets Injector, External Secrets Operator, Secrets Store CSI driver, cert-manager; also supported on Red Hat OpenShift |
| CI/CD | Pipelines authenticate with their platform identity and fetch secrets at run time. | GitHub Actions, GitLab, Jenkins and other CI/CD tools |
| Infrastructure automation | Configuration and provisioning tools read secrets from Akeyless. | Terraform, Ansible, Chef and others |
| Identity providers | Single sign-on and federated access for administrators and remote access users. | Okta, Ping Identity, Microsoft Entra ID |
| Other vaults | Secrets in other stores are managed and synced through the Universal Secrets Connector. | AWS Secrets Manager, Azure Key Vault, Google Secret Manager, HashiCorp Vault |
| Security operations | Audit logs and security events are forwarded for monitoring. | Splunk, Datadog, Microsoft Sentinel |
Akeyless also provides SDKs, a CLI and a browser extension.
Agentic AI Capabilities
Akeyless treats AI agents as a distinct identity class and addresses them in three layers.
SecretlessAI
SecretlessAI keeps credentials out of AI agents entirely. The agent authenticates with its workload identity, and Akeyless brokers the connection through the Gateway, which provisions a short-lived identity directly on the target system. Passwords, keys and tokens never enter the agent’s code, prompts, context or environment, so a compromised or prompt-injected agent has no credential to leak. This works with legacy and on-premises systems as well as cloud services.
Agentic Runtime Authority
Runtime Authority controls what an agent does after it has access. It evaluates each action against the agent’s stated objective, combining AI-based intent classification with deterministic policy on top of role- and attribute-based controls, and blocks actions that exceed the assigned task before they run. For example, an agent asked to summarise sales data would be stopped from deleting a database, even if its underlying permissions allowed it. An Agentic Access Dashboard shows live agent sessions and lets security teams end a session immediately, and investigation views explain why an action was blocked. Runtime Authority became generally available to all Akeyless customers in September 2026.
Agentic Identity Intelligence
Agentic Identity Intelligence discovers AI agents across the environment and builds a record of each agent’s identity, access and data interactions. Every agent action is logged and traced back to the human, application or agent that triggered it.
Supported AI Platforms
Akeyless documents support for Claude Enterprise, Claude Desktop, OpenAI Codex, Amazon Bedrock AgentCore, Google Gemini, xAI Grok, Cursor, GitHub Copilot, JetBrains IDEs and n8n.
Use Cases And Industries
Akeyless publishes solutions for replacing hard-coded and static secrets, consolidating multiple vaults, automating certificate renewal, multi-cloud key management, just-in-time privileged access, and securing AI agents and coding assistants. Its industry pages cover finance, technology, retail and manufacturing. Akeyless holds ISO 27001, SOC 2, PCI DSS and CSA STAR Level 1 attestations, and publishes material on supporting DORA requirements. Customers shown on its website include Progress, Constant Contact, Cimpress, Wix, Deutsche Bank, Amdocs, Hugo Boss and Thales.