The SolarWinds Orion trojan carried a valid digital signature. The XZ Utils backdoor cleared code review from maintainers who had run the project for years. The 3CX installer shipped from a compromised build pipeline with signatures intact. Three breaches, three defenses that worked exactly as designed, three times the malicious code arrived holding a permission slip.
That is the trap. The binary is trusted. The signature checks out. The package manager pulled it. The endpoint agent let it run. Each gate did its job. By the time a forensic tool reads the wreckage, the attacker has already taken credentials and shipped your data somewhere it was never meant to go.
ENISA studied this. In its 2021 Threat Landscape for Supply Chain Attacks, 66% of the incidents analyzed targeted the supplier's own code. Once that code ships under a real signature, signature checking has nothing left to catch. The permission was always right. What changed was the behavior.
A valid signature tells you nothing about what the code does
A compromised npm package, a poisoned container image, a trojanized update: each shows up wearing legitimacy. Your package manager fetched it from the official registry. Your pipeline built the container from a trusted base. Your updater delivered it under a real certificate. Nothing tripped, because nothing was supposed to.
Network detection reads traffic after it leaves, when the data is gone. Endpoint detection matches known malware hashes, and a fresh supply chain compromise has no hash to match. Data loss prevention guesses ahead of time what a sensitive move looks like, and a permitted dependency reading a permitted file matches no rule written for an outsider.
You cannot read a binary and learn whether it means you harm. You have to watch what it does with your data, and you have to watch while the data moves. Not before, where a predictive tool is still guessing. Not after, where the forensic report is already an autopsy. No single action is the danger. The danger is the sequence, and every step in the sequence is permitted.
Where the pattern becomes visible
A compromised dependency stays quiet. It reads config it is cleared to read, opens connections it is cleared to open, touches credentials it was granted. Pull any one move out and it looks fine. The exfiltration lives in the shape of the whole run: a build tool that reads source and writes artifacts, and also reaches into a developer's home directory for cloud credentials and ships them outbound.
To see that shape you need a vantage underneath the application, where a Go service and a Python script and a Node process all resolve to the same handful of primitives. That vantage is the kernel. Hilt runs one lightweight collector that watches data movement at the kernel, metadata only by default, off the path. It never sits inline. It does not block, drop, or alter traffic. It does not have to read your data to see how your data is moving.
From the kernel, the noise of the application layer collapses into plain movement. A process tree forks where it has never forked. A workload reads a file outside everything it has ever touched, then dials a destination it has never reached. These are the moves a compromised dependency has to make to accomplish anything, and they show up as movement well before any after-the-fact report would name them.
SolarWinds reads here as the Orion process reaching for credentials and reaching outbound to hosts it had never contacted. XZ Utils reads as sshd moving data in a way that does not match how sshd has handled authentication on this box for its whole life. 3CX reads as a desktop app running reconnaissance and credential access nowhere near its normal profile. Permission, every time. The movement is what gave each one away.
The baseline most tools build falls apart in the cloud
To call a move anomalous you need to know what a normal move looks like, and most behavioral systems pin that baseline to a single asset. In the cloud that pin slips. Instances spin up and die. Auto-scaling churns the picture by the minute. You land on baselines so loose they wave real attacks through, or so tight they bury you under ordinary variance.
Catching a supply chain move means correlating across more than one axis. The identity behind a move. The role behind it, meaning what this service account or application identity should ever do. The population of like workloads, meaning how this workload type moves data across every instance of itself. A move that passes against one axis can stand out hard against another.
A compromised npm package running inside your app lights up across those axes at once. The instance launched minutes ago and has no history of its own. The role does have a movement signature. The population of identical workloads makes the one deviating instance obvious. Hilt resolves each move to a probabilistic, source-dependent identity and the job behind it, so the question stops being "has this exact container done this before" and becomes "do workloads in this role, run by this identity, move data this way." When the answer is no, you have your signal.
A build system that also reads cloud credentials
A build system reads source and writes artifacts. Normal. A build system reads source, writes artifacts, then reads cloud credentials and sends them outbound. Not normal. Every operation in that second list is permitted on its own. The sequence is the breach.
Detection has to carry movement as a pattern. Process A spawned by process B, performing operation C, followed by an outbound move D. It has to recognize that pattern as it forms, not reassemble it from logs once the data is already gone. This is different work from chasing opportunistic malware. The attacker here is not dropping ransomware or a coin miner. They are doing reconnaissance, settling in, and moving data through actions that each pass inspection.
XZ makes the point. The backdoor rewrote sshd's authentication path so crafted input opened the door. Signature and review missed it because sshd looked clean from the application's side. Watch data movement at the kernel and the discrepancy shows up from another angle entirely: sshd is moving and accessing data in a shape that does not match how authentication has always run on this host. The behavior is off, not the binary.
Light enough to run where the attack actually runs
Watching data movement at the kernel sounds heavy. Capture and correlate everything inline and it would be. Hilt does not work that way. The collector sits off the path, processes metadata by default, and never wedges itself into the flow of traffic, so it cannot add the latency an inline filter would.
The overhead lands around 0.1% of one core and a 4 to 8 MB resident footprint per host. That runs in production under full load, across cloud workloads and macOS-compatible user endpoints, with no trade between coverage and performance. Content-aware inspection is there when an investigation calls for it. The default is metadata only, which is both why the overhead stays low and why you never have to read your data to watch it move.
This is the part that matters for supply chain work. The compromised dependency does not execute on a test bench. It runs in production, next to everything else, at full volume. A control you can only afford to run in a corner is a control the attacker steps around.
Additive to the stack you already run
A shop running CrowdStrike on endpoints, Wiz for cloud posture, and Proofpoint on email covers a wide attack surface. None of the three is built to watch data movement at the kernel and resolve it to identity at runtime, which is the exact layer a trusted-but-compromised dependency lives in: a permitted binary, valid credentials, a move no rule was written to stop.
Hilt replaces none of them. It is the data movement governance layer beside them, catching what they were never designed to see: the dependency that passed every scan, the build tool that shipped under valid signatures, the library code review cleared. Keep your EDR, your CSPM, your email security. Add the ability to see the dangerous pattern in your data movement while it is still forming.
The next supply chain compromise is closer to when than if. When it lands, the catch will not come from a signature database or a threat feed. It will come from noticing that a trusted process is moving your data in a shape its peers never do. Hilt surfaces that move as it happens, writes the case, and responds with host-level network isolation (quarantine) from the control plane, so you act while the data is still yours instead of reading about it in the disclosure letter. If you want to walk through how that runs on your own infrastructure, we are glad to do it on a 30-minute technical call.