What our analysis found

Imprivata Enterprise Access Management, used by 20,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages and can observe network requests. It was last updated in February 2026.

Imprivata Enterprise Access Management is a well-known enterprise SSO product from Imprivata Inc., a legitimate US-based healthcare IT security vendor. All code reviewed implements a clean, comment-rich native-messaging bridge between the Chrome extension and a locally-installed Imprivata Agent desktop application (com.imprivata.isxnmhost). Credentials captured from web login forms are immediately encrypted client-side using libsodium's crypto_box_easy (NaCl public-key encryption with a per-session key exchange) before being relayed over native messaging — they are never transmitted to any remote server, and no network calls to external domains appear anywhere in the source. The ML model flagged broad permissions (scripting, webRequest, nativeMessaging, all-host content scripts) and common SSO implementation patterns (form-field listeners, document.createElement('script') for injecting from the extension's own origin) that are inherent and necessary for an enterprise SSO product of this kind, not indicators of malice.