A vendor tells you their tool can stop a data movement. Ask one question: where does it stand? There are only two answers. It stands in the path and refuses to pass the bytes along, or it cuts the host off the network so the move has nowhere left to go. The first is inline blocking. The second is host-level network isolation, the thing most teams call quarantine. They sound like the same job. Architecturally they are opposites, and the difference decides whether your containment can take production down with it.
The box in the middle
An inline control sits between your data and where it is going. Every request passes through it on the way out. To stop a move, it reads the traffic in flight and refuses to forward it.
That box has a property security teams learn to dread. It can fail closed. Overload it, mispatch it, or feed it one bad rule, and it does not stop only the bad traffic. It stops the traffic. A legitimate transfer hangs at the gate because the thing standing at the gate ran out of headroom or got the move wrong. You bought a way to stop a fraction of your moves and you mortgaged all of them to get it.
There is a second tax. The box adds time to every move it watches, not just the ones it stops. The whole flow pays so that a sliver of it can be blocked.
Containment by removal
Host-level isolation does not stand in the path. It takes the host off the network.
When a pattern crosses the line, the control plane issues a containment action against the one host where the move is happening. That host loses its reach. The transfer underway has nowhere to send the data, because the machine sending it is no longer connected to anything that would catch it. The move is not stopped at a chokepoint. The ground under it is gone.
Nothing read the bytes to stop them. Nothing sat in front of the flow adding latency. The action lands on the host from the side, after the pattern resolves, and it scopes to one machine instead of a shared piece of infrastructure that everyone's traffic leans on.
Hilt responds this way and only this way. The collector watches data movement at the kernel, metadata only by default, off the path. It never sits inline. It never blocks, drops, or alters traffic in flight. When a move resolves to a dangerous pattern, the control plane isolates that host at the network. There is no box in the middle to filter packets and no box in the middle to break.
Why the distinction is not pedantic
Start from what makes this hard. Your most valuable data leaves on access you granted on purpose. Every move is permitted. The breach is the pattern across moves, so the system has to watch a while, resolve the identity behind the move, and earn confidence before it acts.
An inline control turns that timing into a trap. It has to decide inside the flow, so it decides early and decides often. That is how inline tools end up blocking real transfers and getting switched to monitor-only inside a quarter. Isolation buys back the time. It does not make a snap call in the packet. It watches the pattern form, writes the case, and contains when the evidence is a case rather than a guess. Decisive, and not in your way while it makes up its mind.
Then there is the failure mode. An inline box that breaks takes traffic with it. A control plane that issues isolation holds no position in the data path, so there is nothing for it to fail closed into. If the governance layer dies, your data keeps moving exactly as it did a minute before, because the governance layer was never the thing carrying it. You lose visibility, not availability. Under failure, that is the right thing to lose.
Where quarantine fits, and where it does not
Isolation is the tool for one job. A move is underway, you have resolved it to a dangerous pattern, you want it to stop now, and you refuse to put a box in production to get there. It scopes to a single host. The case is already written with the identity and the job behind the move, so your team works the incident with the evidence in hand instead of rebuilding it later.
It is not a content filter and it will not pretend to be. If your requirement is to read and rewrite traffic in flight, redact a field at the egress, or enforce a per-request policy on a proxy, that is inline work and an inline tool should do it. Hilt does not replace your secure web gateway, your egress proxy, or your DLP enforcement point. Those controls judge a move at the moment of the request. Quarantine contains the host after the pattern across moves has crossed the line. Different point in the timeline, different question answered.
So keep the inline controls you have for the jobs they were built for. Add host-level isolation for the one they were never designed to catch: the slow, permitted, identity-resolved pattern where no single request looks wrong enough to stop.
What to ask a vendor about containment
A tool says it can stop a data movement. Press on how.
Does it sit in the path? An inline control can block, and it pays for that with latency on every move and a single point of failure. Ask whether the collector is off the path and what the response action actually does. Isolating a host at the network is a different posture from filtering packets at a box in the middle.
What happens when the control fails? Get the failure mode in plain words. A control with no position in the data path cannot fail closed onto your traffic. If the answer is "fail open versus fail closed" tuning on an appliance, you are being asked to pick which way the box breaks.
How tightly does containment scope? Ask for the blast radius of a single action. Does a false positive degrade a shared path, or quarantine one host you can release in a click?
When does it decide? A control that decides in the flow decides early. A control that isolates the host can wait until the pattern is a written case. Ask whether the response fires on one signal or on a resolved pattern, and how the system tells a new-but-legitimate move apart from an anomaly worth containing.
The posture that survives production
Both postures stop a move. That is where they stop resembling each other. One puts a box in your production path that can fail closed and taxes every flow it watches. The other never touches the path and contains by cutting the one host off the network after the pattern crosses the line.
Where every move is permitted and the pattern is the breach, only the second posture survives contact with production. Decisive response, no standing in front of the data, and a failure that costs you visibility instead of availability.
Want to watch a kernel event turn into a written case and then a host isolation in your own cloud? The fastest path is a 30-minute technical call, engineer to engineer, and we will walk the containment flow end to end.