A security agent that sits on the execution path costs a trading desk money on every order. So the desk turns it off. The boxes that execute trades, the ones holding the most valuable code in the building, run with the lightest possible monitoring, or none.
That is the real state of HFT security. Not that firms ignore it. They guard proprietary models that took years and tens of millions to build, and one leaked alpha signal hands a competitor a ready-made edge. The problem is the architecture of the controls on offer. Many endpoint agents sit inline: they hook the path, copy the buffer, run a rule engine, ship telemetry to a remote collector, and only then let the operation proceed. Each step takes microseconds. Microseconds stack. On a desk where being slower than the firm across the street is its own kind of loss, the agent comes off, and the loss it was meant to catch goes unwatched.
That tradeoff was always false. The latency comes from sitting inline, not from watching. Take out the inline step and the penalty goes with it.
The exposure left behind is not malware. It is quieter. A trader copies a model to removable storage. A developer account, freshly compromised, pushes code that skews execution logic. A market data library that has shipped to one endpoint for two years starts shipping to a second. Each of those moves is permitted. Each identity is allowed to touch what it touched. No rule fires, because nothing forbidden happened. The breach is the pattern across the moves, and an inline rule engine, built to catch the forbidden thing, never sees it.
Watch the move, do not stand in its path
Runtime Data Movement Governance watches data movement at the kernel, off the path, and lets the operation complete at full speed. The kernel is the vantage because that is where the move actually happens, below the application and below application-layer encryption. A collector there sees the move without standing in it. The trading application never waits on security logic. There is no interception step on the latency-critical path, so there is nothing for the move to block on.
Hilt is built this way. One lightweight collector watches data movement at the kernel, metadata only by default, single-tenant in your own cloud. It runs on the order of 0.1% of one core and 4 to 8 MB of memory, small enough to leave running on a box that executes trades instead of being the first thing pulled when latency matters. It never sits inline. It never blocks, drops, or alters traffic. Events stay in your account.
Metadata only is the default, and that is what makes it acceptable on a desk that encrypts everything and shares nothing. Hilt does not read the content of what moves to see that a move does not fit. Content-aware inspection is there when a team asks for it. The job does not need it.
The signal is the combination
When an unexpected process runs where only a handful of known trading applications should, that is a move. When algorithm source, model parameters, or backtests are opened, copied, or sent, that is a move. When a host reaches a destination the desk has never reached before, that is a move. Hilt resolves each one to a probabilistic, source-dependent identity and the job behind it, then surfaces the ones that do not fit, as behavior rather than as a rule break.
This vantage sits below the encryption a trading firm wraps around everything: market data feeds, order management traffic, internal APIs. Network monitoring upstream sees ciphertext and little else. At the kernel the move reads as metadata, the file path, the identity, the destination, before encryption closes over it, and Hilt never touches the payload.
Speed matters for the catch, not only for the trade. An insider copying algorithm files has a window measured in seconds. Surface the move an hour later and it is gone. Find it in a forensics report or a disclosure letter and it has been gone for weeks. Predictive controls guess in advance, miss often, and still wave the permitted move through. Detection and response speaks after the fact. Runtime governance catches the anomalous move as it forms, while there is still something to keep.
When a pattern crosses into a real anomaly, Hilt writes the case and can respond with host-level network isolation from the control plane: it quarantines the host at the network. The collector does not drop or filter the move itself, so it stays off the latency path even while it acts. A lean desk gets a finished case, not one more alert to work.
The layer that runs dark
Most trading firms already run perimeter security, email filtering, and network monitoring. The obvious bases are covered. The layer where the model is read, copied, and sent is the one that runs dark, because the only tools offered to watch it were too heavy to leave on.
Hilt is additive. Perimeter security stops the external attack. Email filtering catches the phish. Network monitoring tracks lateral movement. None of them watches the permitted move: an identity allowed to touch the data, taking it somewhere it should not go. The collector at the kernel reports what actually moved and who moved it, regardless of what application logs claim, and surfaces the pattern the single-event tools cannot.
The math that once argued for running dark now argues the other way. A collector at 0.1% of one core and a few megabytes, off the path, metadata only, in your own cloud, watching the moves that cost the most: model theft, unauthorized execution, the quiet leak on access you granted on purpose. If you want to put a number on that overhead against your own desk and walk through where the collector sits relative to the path, book a 30-minute technical call.