A security team somewhere is closing the quarter right now. Finance pulled ten times its usual data volume this morning, the model fired, and an analyst cleared it before lunch. That analyst has cleared the same false alarm every quarter for two years. This is what most people mean when they say anomaly detection: a dashboard that lit up a thousand times last year and was right twice. The analysts stopped reading it. The renewal went through anyway.
So when someone proposes anomaly detection on data movement, the flinch is earned. Another model. Another firehose. Another thing to tune until it goes quiet. The flinch is correct about the tools that came before. It is wrong about the cause. The idea was never broken. The definition of "anomaly" was.
Most anomaly detection scores the wrong thing
The standard approach scores statistical outliers against the population. A login from a country no one in the company has logged in from. A file larger than the others. A process with no prior history. The model learns a distribution and flags whatever lands in the tail.
Real environments fill that tail with harmless work. The finance pull at quarter close. An engineer onboarding and touching systems untouched in a year. A backup job migrating to a new region. None of these is an attack, and all of them are statistical outliers, so the model fires and the analyst clears it and the budget gets spent on attention that bought nothing.
The defect is the baseline. "Unusual for the population" describes most legitimate work, because most legitimate work is unusual for someone. The question with teeth is narrower: is this move unusual for the job behind it.
An anomaly is a move that no longer fits its job
Start from what an anomaly in data movement is not.
It is not a rule break. The moves that matter were all permitted. Access granted on purpose, an approved channel, a valid credential. Break a rule and you already have an alert. You do not need a model for that.
It is not a single outlier either. The dangerous events do not announce themselves by size, and the loud ones are usually the quarter closing.
An anomaly is a move that stops fitting the job it claims to serve. A service account that reads configuration starts reading a customer table. A reporting pipeline that ships to a warehouse begins shipping to an address it has never used. A user who drafts documents starts copying source paths at three in the morning. Nothing here is forbidden. What changed is the relationship between the move and the identity making it, and that relationship is the signal. It is invisible to any tool that only checks whether the move was allowed, because the answer is always yes.
The kernel is where the fit becomes visible
Judging fit needs three things resolved at the same moment: who is moving the data, what job that identity actually does, and where this move is headed. Watch the application layer and you see the action but not the movement under it. Watch the network and you see bytes but not the identity or the intent.
Hilt watches data movement at the kernel, the one vantage where the move, the identity, and the destination are all present together, before an app abstracts them away or the wire strips the identity off. One lightweight collector resolves each move to a probabilistic, source-dependent identity: which workload or user, which job, which destination, and whether this fits what that identity normally does.
It works metadata only by default. It does not read your data to see that a pattern is wrong, the way your bank flags a charge that does not fit without knowing what you bought. Content-aware inspection is there when you reach for it, never the price of admission.
It stays off the path. The collector observes the move instead of standing in it, on the order of 0.1% of one core and 4 to 8 MB of memory per host, single-tenant inside your own cloud. It never sits inline. It never blocks, drops, or alters traffic. A monitor that taxes the systems it watches gets switched off. This one does not, so it keeps watching.
One signal is noise; the pattern is the finding
An off-hours read, alone, is nothing. An unfamiliar destination, alone, is nothing. A large transfer, alone, is the quarter closing. Old tools fired on each of these the moment it crossed a threshold, and that is how the dashboard became something to ignore.
The fit-to-job view waits for deviations to line up on the same identity at the same time. The job is wrong for this account, and the access is a bulk read of high-value paths, and the destination is one this identity has never touched, and the timing falls outside its window. Any one alone is a shrug. Together they are a shape, and the shape does not fit the job.
That convergence is the finding, and it is rare, which is the whole value. A tool that surfaces the rare convergence instead of the common outlier is a tool an analyst will actually read. Hilt writes the convergence as a case, with the moves that compose it and the identity they resolve to. A case, not a line in a feed.
What happens when the shape does not fit
A notification leaves the work undone. When a pattern resolves to something dangerous, Hilt responds with host-level network isolation, quarantine, from the control plane. The host is cut off at the network so the movement cannot continue, and the case is already written and waiting for review.
None of that requires sitting inline. The response lives in the control plane, not the data path, which is why the same collector that adds no latency on a normal day can still contain a host when the pattern demands it. Observation and response are decoupled on purpose.
Questions that separate signal from a dashboard you will mute
Evaluating anomaly detection on data movement, skip the questions about the model. Ask about the baseline and the output.
What is the baseline measured against? "Unusual for everyone" produces noise. "Unusual for this identity's job" produces signal. Ask whether the system resolves each move to who is making it and the job behind it, or whether it only scores raw volume and frequency.
Does it correlate across layers, or fire per signal? A tool that alerts on each deviation buries you. A tool that waits for deviations to converge on one identity, then writes the convergence as a case, is a different architecture and a different shift for the analyst on call.
Does it have to read your data to do this? Metadata only by default means the system sees that a pattern is wrong without inspecting content. Content inspection should be a capability you reach for, not a tax you pay to start.
Where does it sit, and where does the data stay? Off the path means it observes without adding latency or becoming a single point of failure. Single-tenant in your own cloud, AWS, GCP, Azure, or Ali Cloud, means events never leave your account.
Does it get sharper as it learns your environment? A fit-to-job baseline improves as it sees more of how your data actually moves. Ask how the system tells a new-but-legitimate pattern from a real anomaly, and how it keeps surfacing the second without drowning you in the first.
Done right, anomaly detection is not a louder dashboard. It is a quieter one that is right when it speaks, because it stopped asking whether a move was allowed and started asking whether the move still fits the job behind it.
If you want to watch the fit-to-job baseline resolve on real movement, an engineer can walk you through it screen to screen in thirty minutes.