Your most valuable data leaves on access you granted on purpose. The user was real, the job was approved, the destination was on an allowlist. Every move is permitted, so every tool you own correctly lets it through. The danger is never the single move. It is the pattern across moves. And you can only see the pattern from the place you watch from.
So where do you watch from. Stand at the application and you see what the application chose to tell you. Stand at the kernel and you see the move itself. That choice decides everything else.
Every tool watches from one floor
A SaaS audit log watches the application. A network proxy watches packets on the wire. An endpoint agent watches process activity. Each one shows a true picture of its own layer and a guess about everything underneath.
Data movement ignores those layers. One exfiltration is a user identity, a process, a file read, a socket, and a destination at once. A tool parked on a single layer sees its slice and infers the rest, or misses it cold. The slices rarely reassemble into the move that actually happened.
The kernel is the floor every move crosses to leave. Whatever the application reports, whatever the network captures, the bytes still pass through the kernel to get where they are going. That is the property that makes it the right place to watch. Not depth for its own sake. Coverage you cannot route around.
The application tells the story it wants to tell
Most data-movement monitoring lives at the application. It reads the SaaS API, the audit event, the upload log. When an application behaves, that view is excellent, and Hilt does not replace it. You want to know who shared which document with whom, and the application is the right place to learn it.
The catch is that the application view is a narration, not a recording. It goes blind two ways.
Blind by design: not every move fires an application event. Copy data through an approved transfer job, stage it to a temporary path, push it out a sanctioned channel, and every hop leaves a clean trail while the sum is theft.
Blind by attack: an actor who owns the application context shapes what it reports. Encode the payload. Tunnel it inside an allowed protocol. Rename it. Chunk it under the size that trips a log. Obfuscation works because it runs above the layer you are watching. The kernel sees the move before any of that dressing goes on, because the dressing goes on higher up. A kernel vantage matters for that reason and no other: it reads the move before the application gets to describe it convincingly.
A move you never modeled is still a move
Predictive tooling runs on a list. It enumerates the applications, users, and channels it expects to handle data, writes policy around that list, and trusts everything on it. The model is only as good as the enumeration, and the enumeration is always a few weeks stale. A new build tool. A new agent framework. A script someone wrote last Tuesday. A process that inherited a credential it should never hold. None of them are on the list, so none of them get watched the way the listed ones do.
At the kernel, the move shows up no matter which process made it. You do not have to have named the process first. A move from a binary nobody enumerated is as visible as a move from the application you wrote an entire policy around. The data is the subject. The process behind it gets resolved from what happened, not assumed from a list written before it happened.
That resolution is probabilistic and source-dependent. Hilt ties each move to a real identity and the job behind it, which user, which process, which destination, scored against how that identity normally moves data. The confidence comes from the move, not from a prior stamp that the process was fine.
Deep does not mean inline
A kernel vantage triggers one reflex: anything that deep must be heavy, and anything heavy near sensitive workloads is dead on arrival. That reflex assumes the watcher sits inline, wedged between your data and its destination. Hilt does not sit there.
The collector stays off the path. It watches data movement at the kernel, metadata only by default, and observes the move instead of standing in it. The footprint runs around 0.1% of one core and 4 to 8 MB of memory per host. It does not block, drop, or alter traffic, so there is no inline penalty to pay, even on latency-sensitive infrastructure. Metadata only is the default, which means the system sees that a pattern is wrong without reading content. Content-aware inspection is there when you want it. It is never the cost of entry.
When the kernel vantage surfaces a dangerous pattern, the response is host-level network isolation (quarantine) from the control plane. The watcher and the responder live off the data path. Kernel depth, no inline tax.
Where the pattern finally resolves
Each move in an exfiltration is individually permitted. The user was allowed, the path was sanctioned, the destination was approved. No layer above the kernel holds both halves of the picture. The application knows the user but not the raw bytes. The network knows the bytes but not the job. The audit log knows the action but not how it fits against months of history.
The kernel sees the move whole, before the higher layers rephrase it, no matter which process made it. That is what lets a pattern resolve into a case instead of scattering into separate logs that each look fine alone. Predictive tools guess before the move and wave the permitted one through. Forensics read the logs after the data is already gone. The kernel vantage is the third way: accurate, at runtime, on the movement itself.
Vantage is not an implementation footnote. It decides whether you see your data move in time to act, or read about it in a letter later.
If you want to see what the kernel vantage surfaces in an environment like yours, we will set up a 30-minute call, engineer to engineer, and walk the move resolved end to end.