Wiz tells you how your cloud is configured. Hilt tells you what your data is doing inside it. Those are different axes, and the question buyers actually ask, does one replace the other, has a short answer: no.
Most cloud breaches do not start with a misconfiguration Wiz missed. They start with access someone granted on purpose, used in a way nobody modeled. Your most valuable data leaves through a path that was always permitted. Every move checks out. The pattern across the moves is the breach. Posture lives on one side of that line. Runtime movement governance lives on the other.
What Wiz does well
Wiz is a cloud security posture management platform, and it is very good at the job. It connects to your AWS, GCP, and Azure accounts, builds a graph of your estate, and shows you where you are exposed. A public S3 bucket. An over-permissive IAM role. A workload carrying a critical CVE that also has a path to sensitive data and a route to the internet. The Wiz Security Graph correlates those facts into a ranked list of what an attacker could reach.
Doing this well is hard. Before tools like Wiz, mapping toxic combinations across a sprawling multi-cloud estate was manual archaeology. Wiz turned attack-path analysis into a dashboard. Agentless scanning gives you coverage across thousands of workloads without deploying into each one. For finding exposure that should not exist, and for ranking which of ten thousand findings actually matters, Wiz earned the category lead.
Posture answers one question: could this be exploited? Wiz answers it across your whole cloud, continuously.
Where posture stops
Posture describes a state. It is a snapshot of what is reachable, what is misconfigured, what is theoretically exploitable. That snapshot is the boundary, built into the definition.
Posture does not watch data move.
Take a workload Wiz rates as healthy. IAM scope correct, no public exposure, no critical CVE, patched, well-segmented. By every posture measure it is fine. Then a service account on that host, using access it is supposed to have, starts reading from a sensitive datastore at a volume and cadence it has never hit before, and shipping the result to a destination that is permitted but new for this identity. No misconfiguration occurred. No policy was violated. The posture of that host did not change. The configuration was right the whole time. Only the behavior changed.
That is not a gap in Wiz. It is the edge of what posture, as a category, is built to see. CSPM evaluates the shape of your estate. It was never meant to evaluate live data moving through a correctly configured one. And the dangerous case keeps landing in exactly that space: legitimate access, legitimate channel, anomalous pattern.
Where Hilt adds a layer
Hilt is runtime Data Movement Governance. It does not score your configuration. It watches the data move.
One lightweight collector runs in your own cloud and watches data movement at the kernel, metadata only by default, off the path. It does not sit inline. It does not block, drop, or alter traffic. The footprint stays small enough for latency-sensitive infrastructure: roughly 0.1% of one core and 4 to 8 MB of memory per host. Content-aware inspection is there when you want it, but it is not the price of admission. Hilt does not have to read your data to see that a pattern is wrong.
Each move resolves to a probabilistic, source-dependent identity: which workload, which job, which destination, and whether this fits what that identity normally does. The healthy-but-anomalous workload above is the exact case it catches. The job is unusual for that service account. The read is a bulk pull of high-value paths in a short window. The destination volume is off, even on a permitted route. Any one signal alone is noise. Together they form a pattern, and a pattern is a case, not an alert.
When the pattern is dangerous, Hilt isolates the host at the network from the control plane: quarantine, not inline filtering. The collector observes the move instead of standing in its way, so the response is decisive without the latency or single-point-of-failure cost of a packet-level control. Events never leave your account.
The layers stack. Wiz tells you the bucket was reachable. Hilt tells you data left it, resolved to the job behind the move, scored against how that data normally moves. One is the map of what could happen. The other is the live read on what is happening.
Where Hilt does NOT replace Wiz
Hilt is not a CSPM and does not pretend to be one.
Hilt does not enumerate your misconfigurations. It will not tell you an S3 bucket is public, an IAM role is over-permissive, or a workload is running a vulnerable package. It does not build an attack-path graph of theoretical exposure. It does not do agentless inventory of every cloud resource you own. Those are posture functions, and they are Wiz functions. Turn off Wiz expecting Hilt to surface your exposed buckets, and you go blind to the exact thing CSPM exists to find.
The honest division: Wiz shrinks the surface an attacker can reach. Hilt watches what moves across the surface that remains. You close the exposure and you govern the movement, because you cannot close every theoretical path, and the access you keep open on purpose is precisely where the permitted-but-anomalous move hides.
How to weigh the two
Frame it the way a security leader weighing both would.
Wiz answers "what could go wrong?" It maps reachability, misconfiguration, and toxic combinations across your cloud, and ranks the exposure worth fixing first. That is hardening at the configuration layer.
Hilt answers "what is going wrong right now?" It watches data movement at runtime, resolves each move to an identity and the job behind it, and writes the anomalous pattern into a case while it forms, not into a disclosure letter after the data is gone.
The misconfiguration Wiz flags and the anomalous movement Hilt catches are different failure modes. Owning one and skipping the other leaves a real hole. Posture without movement governance means a perfectly configured estate can still bleed data through a permitted path while you find out later. Movement governance without posture means you are governing data flow across an estate full of exposure you never closed.
Run Wiz already and the posture layer is handled. Hilt is additive on top of it: it sees the runtime movement posture cannot, by design. Run neither, and you have two questions you will eventually need answered, with no "either/or" that covers both.
The line to hold onto: a healthy posture score is not the same as safe data movement. Wiz keeps the first one honest. Hilt keeps the second.
If you want to see how the runtime layer fits next to a CSPM you already trust, the fastest path is a 30-minute technical call, engineer to engineer. We will walk through where the collector sits, what it resolves, and where the posture boundary ends and movement governance begins.