A developer with database access runs a small script that queries production tables and writes the rows straight to local disk. No browser. No email client. No cloud sync. Proofpoint Insider Threat Management never sees the move, because the move never touched an application it watches. That is the gap behind the search for a Proofpoint alternative.
Proofpoint is good at what it watches. It sits on email, cloud applications, and endpoint file activity, and it catches the moves that run through them: the resignation-week customer list mailed to a personal Gmail, the folder synced to a consumer Dropbox, the design files dragged to a USB stick. Content inspection and behavioral analytics do the work. It scans attachments for card numbers and source code, and it flags the account whose upload volume jumps from near zero to large.
Those are real catches. They share one property. They all pass through an application Proofpoint hooks. The data rides a web connection it can inspect, an email protocol it can parse, or a file operation it can intercept at the application layer. Move the data through anything else and the inspection has nothing to read.
The vantage problem
Application-layer monitoring depends on knowing the application. A custom tool, a recompiled binary, a path that never opens a watched app: none of it trips a control that is waiting at the application layer.
The script above is one version. Here are two more.
An operator reads credentials out of a running process and ships them over a raw socket. No application sits in that path, so an application-layer tool has nothing to parse.
A user clones a private repository to a personal server over TLS. Proofpoint may notice the connection looks odd, but it cannot open the encrypted payload. It does not learn which files left or whether any of them held trade secrets.
The common thread is altitude. Tools that watch applications see application activity. Below that line, every process, whatever app it belongs to, eventually moves bytes on disk and across the wire, and that movement runs unwatched.
Watching where the data actually moves
A Proofpoint alternative, here, does not mean ripping out application monitoring. It means covering the floor underneath it, where application visibility ends and the data is still in motion.
That floor is the category Hilt works in: agentic Data Movement Governance, the runtime evolution of data detection and response. One lightweight collector watches data movement at the kernel, the one vantage where a move is visible no matter which application made it. It runs metadata only by default, so the team reads how data moves without reading the data. Content-aware inspection is there when a case asks for it. The pattern surfaces without it.
The collector watches. It does not sit inline, and it never blocks, drops, or alters traffic. It stays off the path at roughly 0.1% of one core and 4 to 8 MB of memory per host, single-tenant in your own cloud, and the events never leave your account.
From the kernel, four things become legible that the application layer cannot reach.
Process lineage. Not just that a file was written, but the chain that led there: which session, which parent process, which account.
File movement, regardless of the app. A custom tool writing to local disk is as visible as a browser saving a download. Both are bytes in motion.
Network movement, the moment it starts. Source, destination, protocol, timing, and the fact that a process which just read sensitive files then opened an outbound connection. The payload can stay encrypted; the shape of the move still shows.
A baseline with depth. Not "this account uploaded a lot to a consumer cloud" in isolation, but a connected picture: an unfamiliar job read a set of sensitive files, then reached out to destinations this account has never used, all inside one short window.
A move resolved to a person
Raw visibility is noise. What makes a case instead of an alert is resolving each move to a probabilistic, source-dependent identity and the job behind it. The signal is not "PID 47382 wrote a file." It is "the database admin account, running an unfamiliar job from a contractor laptop, outside its established pattern, reading sensitive records and then opening an outbound connection."
That is what folds a stream of individually permitted moves into one readable narrative. No single move was wrong. The pattern across them is.
Where the two lines split
Most insider activity uses standard apps, which is why Proofpoint catches most of it. People mail documents to personal accounts. They sync folders to consumer storage. They copy files to a drive. Where the move runs through an app Proofpoint hooks, Proofpoint sees it.
The harder share is the move that skips the application layer on purpose, or simply uses tooling that never wired into the DLP stack. An engineer at a cloud provider pulls customer data out of production to their own machine with a command-line tool. No browser. No upload. The application-layer control had nothing to inspect, so it stayed silent.
Runtime governance builds the case from the movement itself. The job was unfamiliar for that account. The reads were unusual: many sensitive records pulled into a new location. The timing was unusual: sustained work far outside this person's established pattern. Those signals describe one coherent move tied to one resolved identity, which is a case, not an alert.
What adding it looks like
You deploy one collector per host or workload, and it watches movement at the kernel. The whole point of that vantage is that it stays off the path. The collector observes. It does not stand in the flow of traffic, and it does not block.
The footprint is checkable, not a promise: roughly 0.1% of one core and 4 to 8 MB of memory per host. The same collector unit covers a cloud workload and a user endpoint, so cloud and endpoint are one model, not two stacks to run. It works in your own cloud across AWS, GCP, Azure, and Ali Cloud, single-tenant in your account, with macOS-compatible coverage for user endpoints through a compatibility layer and browser extension.
The value compounds at correlation. Raw movement has to map to accounts and to the jobs behind them. A move means far more once you know the account, the job, and whether it fits that account's pattern. Hilt resolves that at runtime, so the output is a written case rather than a queue of disconnected events. And because it describes behavior instead of matching a fixed list, it gets quieter as the baseline fills in. It is not hunting forbidden strings. It is learning what normal movement looks like for each account, so what it surfaces is what genuinely does not fit.
Run both
Proofpoint and runtime data movement governance are not rival buys. They are two altitudes.
Proofpoint owns the application layer, where a large share of insider activity lives. It integrates with email, SaaS, and file sync, and it carries business context Hilt does not, like department transfers and role changes. Runtime governance owns the layer below, where the data actually moves and where the activity that ducks application monitoring becomes visible. It watches at the kernel regardless of the app, resolves each move to an identity, and writes the case. When it sees a forming pattern of exfiltration, the response is host-level network isolation, quarantine from the control plane, never inline.
Run both and the coverage overlaps in a useful way. Both layers on the same activity raise confidence. Only the runtime layer firing means you caught a move that never crossed a watched application. Only Proofpoint firing means application activity the business context already explains.
Teams already running Proofpoint usually add runtime governance to their highest-value hosts first: database servers, build systems, credential stores, admin jump hosts. Those are the systems where valuable data leaves on access granted on purpose, and where the pattern across moves, not any single permitted action, is what you need to see while it is still forming.
If that is the layer you are missing, the next step is a 30-minute technical call to walk through where it would sit in your stack.