Your design files do not get stolen. They get sent. You ship CAD geometry to a contract manufacturer so the part can be cut. You send tolerance specs to a supplier so the component fits. Line telemetry goes to an integrator so the cell can be tuned. Every transfer is one you authorized, on the day it happens and on every day after. The door was built on purpose, and it stays open because the work needs it open.
So every tool you own waves these moves through. Each one checks the same fact: was this allowed. The answer is yes. No single transfer is the breach. The shape across a hundred of them is.
What actually walks out
Skip the usual split between OT security and IT security for a second. Neither owns the thing that costs you. Your design advantage is not the line and it is not the laptops. It is a set of files: CAD geometry, bills of materials, tolerance stacks, test procedures, the process recipes that took five years to dial in, the tooling parameters that separate your yield from a competitor's. None of it is exotic. It sits in a PLM system, on a file share, on an engineering workstation, in a cloud bucket your suppliers can reach. It moves all day, because a modern factory is a supply chain wearing a building.
The OT telemetry leaks the same way. Production rates, downtime causes, scrap counts, quality histories. Pull a quarter of that together and you have described exactly how the plant runs, which becomes a competitor's playbook the moment it lands where it should not. Design files and machine data sit in different systems and leave through the same door: access you handed a partner, an integrator, a contract shop, or an engineer who has every reason to open the file. The move is permitted. The pattern is the breach.
Where your stack stops looking
The tools you run are good at their jobs. EDR catches an endpoint acting like malware. DLP blocks a file that matches a content rule. OT monitoring spots a rogue device or a protocol anomaly on the industrial network. CSPM tells you a bucket is misconfigured. Four useful answers to four narrow questions: is this endpoint infected, does this file match a rule, does this device belong here, is this bucket public.
None of them asks the question that catches a slow leak. Did the data this identity touches start moving, over the last several weeks, in a way that does not fit how that identity has always moved data.
Picture a contract shop you transfer files to over an approved channel. For a year it carries the files each job needs. Then the volume through that channel creeps up. It runs after hours. It reaches into design directories for programs that shop is not working. Every transfer is authorized. The channel is sanctioned. No content rule fires, because these are precisely the file types the channel exists to carry. DLP sees allowed traffic. The OT platform never sees it, because the leak is on the IT side. CSPM sees a bucket configured exactly to policy. The drift is obvious to a human looking at the month. Nothing in the stack is built to look at the month.
That gap is not a vendor flaw. Those tools were built to judge one event: permission, content, configuration, infection. A manufacturer's worst leak is not one event. It is a shape laid across hundreds of permitted ones, and no single-event tool can see a shape.
Governing the movement itself
Two approaches already exist here, and both miss this. Predictive tools guess in advance which moves are risky, classify everything, and bury engineering teams in false alarms, and they still wave through the move you permitted on purpose. Forensics tells you after, once the disclosure letter is in legal review and the design is in someone else's CAD seat. Hilt sits between them: it reads the movement while it happens, on the move itself. Fast like the predictive tools, accurate like forensics, live.
Hilt watches data movement at the kernel, metadata only by default, off the path. It never sits inline, never blocks or alters traffic, and never has to read your files to do its job. One lightweight collector runs single-tenant inside your own cloud, AWS, GCP, Azure, or Ali Cloud, at roughly 0.1% of one core and 4 to 8 MB of memory per host. Content-aware inspection is there when you want it. It is not the cover charge.
Each move resolves to a probabilistic, source-dependent identity: which workstation or workload, which user or service, the job behind it, the destination. Then the move gets scored against how that identity has always moved data. When the contract-shop channel starts pulling past its program, the deviation surfaces on several layers at once. The job is unusual for that identity. The access reaches paths outside the active work. The volume runs hot for a channel that is otherwise approved. One signal is noise. Stacked, they are a pattern, and a pattern is a case, not an alert.
When the pattern crosses the line, the response is host-level network isolation, quarantine, issued from the control plane. The collector never steps into the path to do it. No inline control adds latency to an engineering workstation or a workload, and nothing new sits on the factory data path waiting to fail.
Where Hilt fits
Hilt can stand in for your endpoint sensor, and many manufacturers retire their EDR once it is in place. Keep an EDR alongside only if you also want the malware and intrusion layer it runs. OT monitoring still keeps the industrial network and the safety of the line. DLP still keeps the content-rule egress it was built for. Hilt leaves all of it in place and adds the one layer none of them were designed to cover: the behavior of your data as it moves across cloud, file shares, endpoints, and the partner channels your supply chain runs on, resolved to the identity and job behind each move, scored against normal. The leak that hides inside sanctioned access lives in that blind spot and nowhere else.
If your stack cannot tell you whether the data a supplier channel carries started moving in a shape that does not fit the program it serves, in the last three weeks, that is the gap. It sits on the path your most valuable design and operational data travels every day.
If you want to see how this maps to your plant, the next step is a 30-minute call, engineer to engineer, through where your design and OT data moves and where the pattern would surface.