A spreadsheet leaves your CRM as a legitimate export. A user pastes part of it into a personal doc and shares the doc out. Cyberhaven catches that, because it tracked the data from its origin through every copy and paste. A separate move never crosses that surface: a service account on a production host pulls from a store it is allowed to read and ships the result to a destination approved months ago. Same evening, same company. Cyberhaven and Hilt both show up in the evaluation that follows. They watch from different layers and answer different questions.
Both reject static rules and content matching. Both start from the same premise: your most valuable data leaves on access you granted on purpose, and the move that hurts you is one your existing tools correctly let through. From there they split.
What Cyberhaven does well
Cyberhaven built its reputation on data lineage. Rather than classify a file by scanning its contents, it traces the data, where it came from, what it was derived from, where it went, by instrumenting the applications and endpoints where users handle data.
That beats "does this file match a regex." A spreadsheet that began as a CRM export is sensitive because of its origin, not because a pattern matcher caught a string inside it. Lineage holds that origin across copy, paste, rename, and upload. A user downloads a customer list, pastes part of it into a personal doc, shares the doc out. Cyberhaven follows the data through those application-level actions and flags the egress. For controlling what people do with files inside SaaS apps and on managed endpoints, lineage is a real advance over what it replaces.
Where the two tools diverge
Cyberhaven watches data as users handle it inside applications. Hilt watches data movement at the kernel.
Application-layer lineage is built around the object and the person touching it: this document, its ancestry, the user with their hand on it. Hilt is built around the move. It sits below the application and observes data movement as it happens on the host: which process, reading which paths, sending how much, to where, under which identity. Metadata only, by default. It does not read the contents to see the movement is wrong, and it does not wait for an application to instrument itself or a user to touch a file through a path the tool understands.
That is where a specific class of risk lives, and it is the class growing more valuable to attackers. The move permitted on purpose, run through an approved channel, where every action checks out and only the pattern does not.
The move that never becomes a file event
Walk the service-account move all the way through. It reads from a store it is allowed to read from, over a connection that exists for replication, and ships the result to a destination approved for months. Every action is permitted. No human mishandled a file. No lineage rule broke, because the data never crossed the application-handling surface where lineage is rich. The breach is the shape of the move: this identity, this volume, this hour, this destination, set against what normal looks like for this host across months.
Hilt resolves each move to a probabilistic, source-dependent identity, which process, which job behind it, which destination, and scores it against how data moves in your environment. When the deviation forms, it lands on several layers at once. The job is unusual for this identity. The read is a bulk pull of high-value paths in a tight window. The egress volume runs hot despite the approved channel. Any one signal alone is noise. Together they are a pattern, and a pattern is a case, not an alert.
So Hilt does not watch the human handle the file better. It watches every move on the host, including the automated and infrastructure-level moves that never touch the application-handling surface, and surfaces the one whose pattern does not fit.
Where Hilt does not replace Cyberhaven
Hilt is additive, not a swap.
If your problem is users mishandling documents inside SaaS apps, copy-paste into personal accounts, derivative files leaking through sharing, sensitive exports landing in the wrong place, that is Cyberhaven's surface, and Hilt does not reproduce it. Hilt does not trace a paragraph from one document into another across user copy-paste inside an app. That object-level, human-handling lineage is its own thing, distinct from what runtime kernel governance does.
Cyberhaven answers where this data came from and where the user took it. Hilt answers what this move did on the host, resolved to the identity and job behind it, and whether its pattern fits. Plenty of teams want both. The lineage layer tells the story of the file. The runtime layer catches the move that never registered as a file event.
How the runtime layer behaves next to it
Put a kernel-level collector beside an application-layer tool and a few properties decide whether it earns its place.
It stays off the path. Hilt observes the movement instead of standing in it. The collector runs at roughly 0.1% of one core and 4 to 8 MB of memory per host. It never sits inline, and it never blocks, drops, or alters traffic. When it finds a dangerous pattern, it responds with host-level network isolation, quarantine, from the control plane, not by filtering packets in line with your data.
It does not have to read your data. Metadata-only is the default vantage. The system sees the pattern is wrong without inspecting content. Content-aware inspection is there when you want it. It is not the price of admission.
It stays in your account. The path from kernel event to written case runs single-tenant inside your own cloud, AWS, GCP, Azure, or Ali Cloud. Events never leave your environment, which is the point when the job is watching sensitive data move.
The same unit covers cloud and endpoint. One collector watches a cloud workload or a user endpoint. One model, not two products bolted together, so the runtime layer reaches the production hosts and service accounts where the permitted-but-anomalous move usually lives, not just the laptops.
Cyberhaven and Hilt are not fighting for the same square inch. Cyberhaven traces lineage at the application layer and is strong where users handle files. Hilt watches data movement at the kernel and is strong where the move is permitted, the channel is approved, and only the pattern across moves is wrong.
So if your stack already covers human document handling, the open question is whether anything is watching the infrastructure-level moves, the service accounts, the production hosts, the approved automated egress, for the pattern no single permitted action would trip. If you want to see exactly where that layer fits next to what you run, the next step is a 30-minute call, engineer to engineer, walking your own data paths.