Healthcare Provider – Closing Cross-Cloud Attack Paths Without Slowing Down Patient Care

A regional healthcare provider runs patient records, imaging and billing systems across AWS and Azure, with a growing footprint of contractors, third-party integrations and legacy service accounts. Every one of those connections is a potential path into systems that hold protected health information — and in a sector where downtime and data exposure carry both regulatory and clinical consequences, the security team could not afford to guess which misconfiguration mattered most.

Their existing scanner produced a steady stream of findings, but no way to tell which ones were actually reachable from the internet or from a compromised contractor account. Compliance audits for HIPAA and SOC 2 consumed weeks of manual evidence-gathering every cycle, pulling engineers away from patient-facing work.

The team brought in Arkhein to connect both cloud environments through scoped, read-only roles, build a single graph of their infrastructure, and replace the flat findings list with a prioritized view of the paths an attacker could actually take.

Challenge:

Findings were scored in isolation, so a low-severity misconfiguration sitting next to a crown-jewel database looked no different from one that was fully contained. Compliance evidence for CIS and HIPAA controls had to be assembled by hand from screenshots and spreadsheets, and no one had a single view of how AWS and Azure identities related to each other.

Solution:

Arkhein ingested both clouds into one resource graph and ran Ghost Mode to trace real attack paths from internet-facing entry points to systems holding patient data. Findings were re-ranked by what they actually exposed, choke points were surfaced where a single fix closed multiple paths, and compliance mappings were generated automatically from the same graph instead of a separate manual process.

Results:

• Closed 9 confirmed attack paths to systems holding patient data
• Cut HIPAA and SOC 2 audit preparation from three weeks to two days
• Reduced mean time to remediate critical findings from weeks to under 48 hours
• Cross-cloud IAM visibility across AWS and Azure in a single graph
• Zero care-facing downtime during onboarding or remediation

Conclusion:

By replacing an unranked findings list with a graph-based view of real attack paths, the security team could tell leadership exactly what was at risk and why — and fix the handful of choke points that mattered instead of chasing every alert. Compliance reporting became a byproduct of daily operations rather than a quarterly scramble.

Key Benefits:

• One graph covering every AWS and Azure resource, identity and relationship
• Attack paths ranked by real exposure, not isolated CVSS scores
• Audit-ready evidence exported directly from the graph
• Read-only, agentless onboarding with no impact on clinical systems
• Security and compliance working from the same source of truth