A researcher with read access pulls the strategy table. That is her job. She does it every week. This week the same rows leave the account from a workstation she has never used, an hour after she gave notice. Every step in that chain is permitted. The access was granted on purpose. What broke is the pattern, and most security stacks at an energy trading firm cannot see a pattern at all.
The data that loses you the firm is the data you let people touch. Strategy parameters that model grid congestion, weather correlations, transmission constraints, and nodal pricing across ISO markets. Tick history. Order flow. None of it leaves on a stolen credential or a broken rule. It leaves on the database grant the quant needs, the file read the service account is supposed to do, the export a trader runs every day. Watch for forbidden actions and you watch the wrong thing. The breach is built entirely from allowed ones.
This is the surface application-layer monitoring cannot reach. An engineer dumps strategy tables and the application sees a query it was built to answer. A compromised service account reads files and the log reads routine. Predictive tools guess the move in advance and wave the permitted one through. Detection and response names it in the forensic review, weeks after the rows are gone. Neither sits where the move actually happens.
Hilt watches data movement at the kernel, below the application logic that hides where data goes, before the move leaves the host. It reads metadata by default. It does not open your files to govern how they travel. A research workload that turns toward a destination it has never used, a trading process whose access pattern shifts overnight: Hilt sees these as movement, resolves each to the job behind it, and surfaces it while there is still time to act.
Why the latency-sensitive systems run uncovered
A renewable desk arbitrages wind forecasts against day-ahead prices and needs order placement that is fast and predictable. A gas desk modeling pipeline flows cannot eat jitter on the critical path. These are the systems that hold the IP, and they are the systems traditional security cannot touch.
Endpoint security sits inline. It intercepts the operation, inspects it, decides allow or block, and that decision costs time on every action it sees. Fine for a mail server. Disqualifying for a matching engine. So the trading environment runs thin or runs uninstrumented, the risk math picks speed, and the most valuable hosts end up the least watched. The blind spot is not an oversight. It is a deliberate trade the firm made to protect its fills.
Hilt removes the trade by never sitting inline. The collector reads data movement off the path. It does not intercept, block, drop, or alter traffic, so it cannot add a microsecond to an order. It runs at roughly 0.1% of one core and 4 to 8 MB of memory. That is what lets it sit on the exact production hosts where inline tooling was never allowed. You stop paying latency for visibility, because the collector never stands between the strategy and the market.
FERC CIP without exempting the systems that matter
FERC's Critical Infrastructure Protection standards say monitor and log access to critical systems. CIP-005 covers the electronic perimeter. CIP-007 covers system security management, ports, services, patch state. The trading firm has to answer for all of it.
The usual answer is a heavyweight agent on every host feeding a SIEM. On trading infrastructure that agent is the latency the desk refuses, so the firm carves the trading systems out of full monitoring and writes the exemption into the audit. The compliance gap lands precisely on the hosts the firm most needs to defend.
One lightweight collector closes that gap from inside the host. It runs single-tenant in your own cloud, the same unit on a cloud workload or a user endpoint. It reads movement off the path, resolves each move to a probabilistic, source-dependent identity and the job behind it, and writes the dangerous pattern as a case instead of a flood of events. The telemetry that proves coverage to a FERC auditor and the signal that catches a real exfiltration are the same telemetry. Which data moved, where it went, who moved it. The events never leave your account.
NIS2, and a CISO who is personally on the hook
NIS2 came into force across the EU in 2024. It names energy trading a critical sector and demands incident reporting inside 24 hours for significant events, where significant includes unauthorized access to a trading system even when nothing was exfiltrated. It requires "appropriate technical and organisational measures." And it puts the liability on named management. The CISO cannot tell a regulator they did not know the trading floor ran uninstrumented.
So the question an auditor asks is sharp: show me you would catch a malicious insider at runtime, not in a forensic review weeks later. "We hope the SIEM flags it" fails that question. "We see the rows move, resolve them to the identity and the job, and isolate the host at the network before they leave the account" answers it. Hilt's response is host-level network isolation from the control plane, not inline blocking, so proving the control to an auditor costs the trading systems nothing to run.
A baseline per role, not per rule
The desk is not one population. Quants run compute-heavy backtests. Traders fire strategies inside market hours. DevOps ships deploys. Each role moves data with a signature, and the breach shows up as a role wearing the wrong signature.
A compromised researcher account whose data starts moving the way a trader's does stands out against its own baseline. A trading workload that begins pulling research-shaped data and routing it outward is lateral movement caught mid-step. Hilt resolves each move against the role behind it and flags the pattern as it forms, not the isolated rule break, which is why it surfaces the breach that any single permitted move hides.
Trading systems sprawl. Research in one cloud account, backtesting in another, live trading in a third. An attacker walking across them leaves a pattern that disappears the moment each account is watched alone. One collector model, the same unit everywhere data sits, gives the firm a single view of how data crosses all of it. The wrapper a process hides behind does not change where the bytes land, and the destination is what Hilt resolves. That is the detail both the threat hunt and the audit need.
A small team against a well-funded one
A firm trading heavy daily volume might field a handful of security engineers. That team defends algorithm IP against well-resourced actors, satisfies FERC and NIS2, and adds zero latency to the desk. More budget does not solve that. The shape of the stack does.
EDR watches the process, not where the data goes. SIEM is noisy and arrives late. Network monitoring sees ciphertext. DLP guesses in advance and still passes the permitted move. Not one of them reads the pattern across permitted moves, and that pattern is what costs the firm its strategies. Data movement governance hands the small team coverage that does not stand in the way of trading and does not need a 24/7 SOC. The collector reads movement off the path, resolves each move to the job behind it, and writes a finished case instead of another queue. When the pattern is real, it isolates the host at the network from the control plane, containing the move while there is still time, never blocking inline at the cost of a fill.
One lightweight collector covers movement that used to take several tools, none of which could run on trading infrastructure anyway. You stop choosing between speed and protection. You see your data move, in time to act, without having to read your data. If that is the gap on your desk, walk a real trace through it with us on a 30-minute technical call.