Provable by Default: How WRITER Closed the Book on Its Move to Infisical
-
NHI Access Management
The Challenges
Unmeasurable last “10%”
WRITER standardized secrets on Infisical, but existing security tools could not measure or prove whether lingering credentials remained active in legacy AWS and GCP stores.
Context-blind static scanners
Legacy scanning tools could detect that a key existed, but lacked runtime context to reveal whether it was actively running, what application was using it, or who owned it.
Offboarding and credential sprawl
Ad-hoc keys and service accounts far outnumbered employees, staying active indefinitely with applications still pointing at legacy secret managers.
The Objective
Most secrets migrations don't fail. They just never officially end.
WRITER - the enterprise generative-AI platform that other companies trust with their most sensitive workflows - had made a clean architectural call: standardize production secrets on Infisical, and pull everything out of the AWS Secrets Manager and GCP Secret Manager stores that had piled up over years of fast growth. The engineering was ninety percent done. The last ten percent - proving that nothing had been left behind - was the part no existing tool could measure.
Why "done" is the hardest word in secrets management
Every service, pipeline, and model gateway mints its own credentials, and they outnumber people many times over. They appear ad hoc - a key for a quick test, a service account for a one-off job - and unlike an employee, nothing offboards them when their job ends. A migration makes this worse before it makes it better: the old secret managers keep serving credentials, applications keep pointing at old references, and a static scanner can tell you a key exists but not whether it's alive, what's using it, or who owns it. For a company whose entire business is trusted AI, "we think the migration is complete" isn't a status - it's an open risk. WRITER needed the difference between believing and proving.
Setup in an hour
Connected 9 platforms across GCP, AWS, Azure, and Kubernetes in about an hour with zero application code changes.
24-hour total visibility
Mapped ~2,600 non-human identities at runtime inside a single day to establish a complete source of truth.
Believing to proving
Replaced open risk with a closed-loop checklist, surfacing 129 long-lived secrets and 103 stale identities for immediate retirement.
The Solution
The bar WRITER set
Not another alert feed. What the team wanted was a single, low-noise, source-of-truth answer they could stand behind – delivered without application code changes and without turning it into a quarter-long project.
Setup measured in coffee breaks
Hush connectors went in across GCP, AWS, Azure, GitHub, Slack, and 1Password – plus Infisical itself – with a runtime sensor on Kubernetes (GKE). One engineer, roughly an hour, zero changes to application code. Twenty-four hours later, the picture was complete: every non-human identity in the environment, every credential end to end (what it is, what’s using it, when, and whether at all), and every certificate WRITER holds.
The visibility wasn’t the prize. What it unlocked was: the team could finally separate what’s running from what’s merely sitting there, and act on the few things that actually mattered.
What the first day turned up
The migration punch-list. Hush surfaced credentials still living in AWS Secrets Manager and GCP Secret Manager that hadn’t yet moved to Infisical – turning “are we done?” into a finite, closed-loop checklist. Where a secret existed in both an old manager and Infisical, runtime told the team which copy was actually in use, so the stale duplicate could be retired without guesswork.
Cleanup that came along for the ride. The consolidation doubled as a hygiene reset: 129 credentials older than a year (rotate, don’t lift-and-shift), 103 identities confirmed inactive and safe to delete rather than migrate, and 60 cases of production secrets showing up in non-production environments.
The AI layer, held to the same bar. The identities behind WRITER’s model infrastructure were mapped, owned, and risk-ranked alongside everything else, ensuring the platform’s own AI capabilities were not a blind spot.
Isolation, confirmed not assumed. Hush checked whether each credential stayed inside a single environment, with nothing bleeding between production and staging – a documented control instead of a hopeful assumption.
The 24-hour picture
~2,600 non-human identities mapped at runtime across GCP, AWS, Azure, and Kubernetes · 115 production identities in scope · 9 connectors live in about an hour · one engineer, zero application changes · a full, actionable report inside a single day · 129 long-lived secrets, 103 stale identities, and 60 prod-in-nonprod findings surfaced and ranked.
From “we think so” to “here’s the proof”
A migration WRITER had already mostly finished became something they could actually close – and document. Every credential across AWS, GCP, and Infisical accounted for, the leftovers named, the dead weight dropped. The open question on the risk register turned into a short, ordered list of things to retire, answered before the platform rollout was even finished.
Standardizing production secrets on Infisical was the easy call. Proving nothing got left behind in the old managers was the hard part - and it's exactly the part you can't fake when you sell enterprise AI. Hush closed that gap in an afternoon: every secret across AWS, GCP, and Infisical, mapped, owned, and accounted for.
