An approver clicks yes. The developer wanted production database access, the request landed in the queue, and the PAM tool did exactly what it is for: it rotated the credential, opened the session, and logged who asked, who approved, and when. The keys changed hands cleanly.
Then the session reads a quarter of a million customer records and writes them to an outside storage bucket. PAM logged the start time and the credential. It saw none of that.
That is the seam. PAM governs who gets in. It does not govern what the data does after. The permission here was real, the approval was real, the credential was real. The only thing wrong was the movement, and the movement is the part nobody was watching.
What PAM watches, and where it stops
A PAM platform records authentication and session metadata. Who requested access, who approved it, which credential was issued, when the session opened. Some products add session recording on top, capturing keystrokes or screen output.
Recording is forensic. You replay it after an incident and read the commands back. That is useful for the autopsy and useless for the save, because by the time you are watching the replay the records are already in the bucket. The terminal text shows what was typed. It does not show what left.
So PAM lands at the access layer. It confirms a user authenticated into the tools they were cleared for. The volume those tools then read, the destination they wrote to, whether that flow matches the work the access was approved for: invisible. Approved tools carry data on the user's behalf, and PAM does not follow the data.
The kernel, where the move becomes a number
Privileged users matter for one reason. They can move valuable data, at scale, with permission. The monitoring question is not who logged in. It is what moved, where it went, and whether that shape fits the job the access was granted for.
The kernel is where that question has an answer while the data is still in flight. It sits below the application, below the approved tool, below the encryption the application wraps around traffic before it leaves. A move that reads as routine permitted activity up at the application layer resolves down here into something you can check: a volume, a source, a destination, an identity, and the job behind it.
The tools above this vantage cannot do that. PAM logged the grant. SIEM ingests application logs after the fact. EDR hunts known-bad files and processes. None of them turn a permitted move into the pattern that makes it dangerous, because none of them sit where the move happens.
Picture a privileged operator with valid access running an off-hours job. It reads far more records than the task needs and writes them somewhere outside. The access was valid. The credential was real. The application logs show an approved session doing approved-looking work. What they never show is the contour of the data movement: how much left, where it went, and that none of it matches how this operator usually works.
Three baselines, one confluence
Watching movement gives you a stream of moves. Detection needs two more things on top: a baseline for what normal looks like, and a resolution of each move to the person and job behind it.
Here is the keystone. Every individual move is permitted. The access was granted on purpose, so every control you own correctly waves the data through. No single move is the breach. The pattern across moves is the breach, and runtime, while the data is moving, is the only place that pattern is visible.
Hilt profiles how data moves along three axes: the individual user, the role, the infrastructure. One deviation on one axis is probably nothing. A deviation that lights up all three at once is signal. Each move resolves to a probabilistic, source-dependent identity, the real person and the work behind the movement, so a baseline is a portrait of how that identity normally moves data, not a blacklist of forbidden commands.
Take a database administrator. They read from production in business hours, in volumes that track query work, to internal destinations. The user baseline expects that. The role baseline expects database administration, not bulk export. The infrastructure baseline expects this on database hosts and nowhere else.
Now the same account, off-hours, ships a large volume of records to an external destination it has never touched. Wrong time, wrong volume against the user. Wrong kind of work against the role. Wrong source against the infrastructure. Three baselines break together. PAM still sees a valid session from a credentialed user. Hilt sees the confluence, the fingerprint of stolen credentials or an insider, while there is still room to act.
When you find out, and what lands on the desk
Behavioral monitoring stands on two numbers: how early it tells you, and how much noise it makes.
On timing: predictive controls guess ahead and miss a lot, flooding the queue while the permitted move walks past them. Detection and response speaks up after the fact, once the data is gone. Hilt is the third path. It reads the movement itself, so the anomalous flow surfaces as it forms, early enough to respond instead of early enough to draft the disclosure letter.
On noise: because each move resolves to an identity and a job, and because the trigger is a pattern across three axes rather than one tripped rule, the security team receives a case, not a heap of context-free alerts. The handoff is a written narrative. Who moved what, where it went, why it does not fit. Not a raw event to chase down.
The cost of watching at the kernel stays small on purpose. The collector runs off the path, metadata only by default, on the order of 0.1% of a single core and 4 to 8 MB of memory. It never sits inline and never touches the data path, so it adds no meaningful weight to the hosts it watches. Content-aware inspection is there when an investigation calls for it. Seeing the pattern does not require it, which is why the watching runs continuously without reading your data.
How it lands in your stack
One lightweight collector watches data movement at the kernel. It runs single-tenant inside your own cloud, across AWS, GCP, Azure, or Ali Cloud, and on macOS-compatible user endpoints. The events it produces never leave your account.
The collector sits off the data path. It observes movement and resolves it to identity. It does not proxy traffic, terminate connections, or wedge itself between an application and the data it touches. That placement is what holds the overhead down and what makes it safe to run continuously in production, including where latency is a hard constraint.
Container orchestration and host agents are how teams instrument modern infrastructure, and you will hear them raised whenever this kind of monitoring comes up. The primitive is not the point. The layer that turns raw movement into a governed, identity-resolved view of where your data goes is the point. That layer is the product, and it is exactly what PAM, SIEM, and EDR leave out.
On a confirmed dangerous pattern, the collector does not block traffic. It triggers host-level network isolation from the control plane, quarantining the host so the movement stops, with nothing ever sitting in the path. Containment is a decision made against a resolved case, not a packet filter guessing in real time.
Sits beside PAM, does not replace it
Hilt does not replace PAM. It closes one gap PAM was never built to cover.
PAM controls access. It runs approval workflows, rotates credentials, pins privileged sessions to designated tools. Keep it. Nobody should trade access control for behavioral monitoring.
But PAM rests on an assumption: that an authorized user only moves data the way the job requires. That assumption fails in two places. Stolen credentials, and the insider who decides to walk. In both, the access stays valid and PAM has nothing to say, because no permission was broken.
Hilt catches the deviation that shows up when valid authorization gets misused. The volume that overshoots the task. The destination that does not fit the role. The hour that does not fit the user. It resolves each move to an identity and correlates the breaks across user, role, and infrastructure, which is what separates an odd-but-fine edge case from a real one.
PAM answers who gets privileged access. Hilt answers whether that access is being used the way it was approved for. Run together, they cover the full arc, from the authentication grant through the data that actually moves.
Most security teams already cover cloud, endpoint, email, and network. The data itself, in motion, on access granted on purpose, is the part that goes unwatched. For privileged users that is where a correct permission turns into a breach. If that gap is open in your stack, book a 30-minute technical call and we will walk through where it sits.