Establishing Complete Identity Governance: How K Health Built a Proactive Non-Human Identity Program
-
NHI Access Management
The Challenges
Credentials multiply, nobody retires them
Every service, pipeline, and integration creates its own credentials, and nobody runs an offboarding process when a credential's job is done.
Scanners without runtime context
Static secret scanners can flag a key in a repo, but can't confirm whether it is active, how it is used, or who owns it.
Build it, then maintain it forever
A custom scanner would have meant ongoing engineering cycles to maintain code, tune rules, and filter false positives indefinitely.
The Objectives
The Architectural Challenge: Governing Non-Human Identities at Scale
K Health runs its AI-enabled virtual primary care platform (including an AI copilot, patient portal, provider tools, and affiliated clinics) on a modern, fast-moving stack: GitLab, Kubernetes, AWS, GCP, Akeyless, 1Password, Slack, and more. As a healthcare company handling private patient data, K Health operates under rigorous compliance mandates. To maintain strict security posture as its architecture evolved, Director of Security Vincent Neiheisel set out to bring continuous, automated governance to non-human identity.
Every service, pipeline, and integration creates its own credentials, multiplying naturally as engineering velocity increases. They get created ad hoc — an API key for a quick test, a service account for a one-off job — and unlike a person, nobody runs an offboarding process when a credential’s job is done. Static secret scanners can flag a key sitting in a repo but lack runtime context to confirm whether that key is active, how it is being used, or who owns it. For Vincent, moving from static detection to continuous runtime measurement was the key to bringing complete, verifiable governance to this expanding footprint on infrastructure that carries real compliance weight.
K Health had the technical expertise to build a custom scanner in-house but evaluating that option revealed a clear trade-off. Developing a tool is only the first step; keeping it effective requires ongoing engineering cycles to maintain code, tune rules, and filter out false positives indefinitely. To avoid pulling core development focus away from platform innovation, K Health partnered with Hush Security. The Hush platform offered immediate, low-noise runtime visibility without the permanent operational drag of custom-built infrastructure, meeting their strict compliance bar right out of the box.
Setup in an hour
One engineer connected GitLab, AWS, GCP, Slack, and 1Password, plus a runtime sensor on Kubernetes, in about an hour with zero application code changes.
Total visibility in a day
Mapped ~5,000 non-human identities at runtime after an initial 24-hour scan, across multi-cloud and source control.
From noise to priorities
Separated active risk from noise, turning an open risk register item into a prioritized action plan within 24 hours.
The Solution
One Engineer, One Hour, One Report
A single engineer configured Hush connectors across GitLab, AWS, GCP, Slack, and 1Password, paired with a runtime sensor on Kubernetes in about an hour, requiring zero application code changes. Following an initial 24-hour scan, Hush provided K Health with 100% visibility into every identity across the environment. This delivered complete operational clarity across stale GCP service accounts, every credential end to end (including its owner, connected services, usage pattern, and active status), and every certificate K Health holds, delivered as an actionable the team could act on immediately.
Visibility on its own isn’t the win. The win is what it enables next: prioritization. By distinguishing what’s actively running from what simply exists in a repository, K Health could quickly focus attention on the identities and credentials that warranted action.
A few examples of what that looked like in practice:
1. A GCP service account: Hush surfaced the owner, and more importantly, confirmed it was stale. With that context, it became a one-line deletion.
2. A Postgres secret sitting in the codebase: present, but never actually invoked at runtime. Confirmed inactive, it could be quickly deprioritized as a false positive.
3. A TLS certificate nearing expiration: but this one was serving live production traffic, so it got flagged and rotated proactively. Other expiring certs tied to decommissioned services were left alone, with no active risk or action needed.
4. Thousands of authentication events a day across their environment, with only a handful tied to identities carrying actual risk. Those got surfaced and ranked first, helping the team focus attention where it mattered most.
5. Environment isolation, independently confirm: For a HIPAA-bound platform, environment isolation is an important control. Hush showed that every credential, API keys included, was used in exactly one environment, with nothing crossing between Production and Staging, providing documented runtime evidence.
6. A years-old migration, validated end-to-end: K Health moved from GCP Secret Manager to Akeyless several years ago. Hush showed what remained in the old GCP Secret Manager alongside what was already in Akeyless, giving the team a clear picture of the migration.
By the numbers
±5,000 non-human identities mapped at runtime, across multi-cloud and source control · 1 hour setup time, one engineer, zero application changes · 24 hours from setup to a full, actionable report · 0 application changes required to deploy
"As a healthcare company, the bar for us isn't just good security, it's provable security. Continuous governance of non-human identity at scale is essential to meeting this standard. In under an hour, Hush converted a complex roadmap item into complete operational clarity."
The Takeaway
K Health transformed a complex risk register item into a prioritized action plan within 24 hours. Hush provided the runtime context to separate actual risk from noise, giving the team immediate operational focus while establishing continuous, audit-ready compliance proof from day one.