An advisor opens the CRM and pulls a household's full financial picture to prep for a review. The reporting tool reaches into the custodian to refresh positions. At tax season a year of statements goes to an outside accountant. The portfolio team exports a book to model a reallocation. Every one of those moves is sanctioned. Every one of them is also how a client's most sensitive data leaves where you thought it lived.
Your wealth management security program checks whether the access was granted. It does not watch the pattern of movement that rides on access you granted on purpose. That is the gap, and in a wealth practice it is the gap through which a book of business walks out the door.
The dossier an RIA actually holds
A registered investment advisor holds about as concentrated a file on a family as exists outside a bank. Account numbers and balances. Tax returns and W-2s collected at onboarding. Estate plans, trust documents, beneficiary designations. Social Security numbers for everyone in the household. A transaction history that, read together, says where a family's money is and how it moves.
None of it sits still. It is the working material of the relationship, so it travels: into Redtail or Wealthbox, out to Orion or Black Diamond for performance reporting, across to the custodian's portal, into a planning tool, onto an advisor's laptop the night before a meeting. The practice is worth what it is because that data moves. The exposure rides on the same property.
Permission is the wrong question
Most wealth security spend controls access. MFA on the CRM. Role-based permissions in the reporting platform. A signed agreement with the custodian. These are correct, and they answer one question well: should this person be allowed to touch this data.
They were never built to answer the next one. Once a permitted person touches permitted data through a permitted channel, what does the movement look like, and does it fit what that person normally does.
Picture an advisor on their way out to a competing RIA. Their access is clean. They have always been able to pull client lists, export book-level reports, and email statements. In the weeks before they resign they do exactly those things, only more of them, off-hours, across the whole book instead of the few households a review would touch. No password is shared. No permission is exceeded. Every action is one the practice authorized years ago.
That is the permitted-pattern blind spot. The threat here is not an outsider breaking in. It is sanctioned access used at an unsanctioned scale, and the tools that gate access cannot see it, because from where they sit nothing broke.
What runtime governance sees that access controls miss
You can only catch the dangerous pattern at runtime, while the data moves. Not in advance, where predictive tools guess and bury the team in false alarms on ordinary client work. Not after, where the forensic timeline and the notification letter to clients are all that is left.
Hilt works in that runtime window. It is runtime Data Movement Governance. It watches data movement at the kernel, metadata only by default, off the path. It does not read the client's tax return to do its job, and it does not have to. It resolves each move to a probabilistic, source-dependent identity: which advisor or service account, which job, which destination, and whether this move fits the pattern that identity has shown across months of how your data really travels.
When the departing advisor starts pulling the whole book, the deviation shows up on several layers at once. The job is unusual for that identity. The read spans high-value client paths in a tight window. The volume leaving is unlike anything that role normally sends. Take any one signal alone and it is the noise of a busy practice. Together they are a pattern, and Hilt writes it up as a case, not another alert nobody reads.
When a pattern crosses the line, the response is host-level network isolation, quarantine from the control plane. Hilt never sits inline. It never blocks or alters a client transfer, and never stands between the custodian and the report. It observes the move and isolates the host. Legitimate client service keeps running while the dangerous host stops.
The regulator is asking the same question
SEC Regulation S-P, the safeguards rule, the cybersecurity expectations examiners bring to RIAs, the breach-notification obligations that follow a client-data exposure: they converge on one duty. You protect nonpublic personal information, and you are expected to know when it moved in a way it should not have.
Access logs tell you who could touch the data. They do not tell you what this advisor's data actually did, resolved to the job behind it and scored against how it normally moves. Ask most practices how they would catch a client-data exfiltration that used legitimate credentials, and the honest answer is that they would hear about it after, from the custodian or the client. Runtime governance changes that answer.
Where Hilt sits in the stack
Hilt adds the one layer your other controls were not built for: the behavior of client data as it moves across all of them, resolved to identity, scored against normal, surfaced as a case in time to act. Your CRM permissions, your custodian's security, and your email security each cover real ground. On the endpoint, Hilt can stand in for your endpoint sensor, and many firms retire their EDR once it is in place; keep an EDR alongside only if you also want the malware-and-intrusion layer, which Hilt does not cover.
It is light enough for a practice that runs no security operations center. One collector per host or workload, on the order of 0.1% of one core and 4 to 8 MB of memory, single-tenant inside your own cloud. The client data and the events Hilt derives from it never leave your account. For a fiduciary that is not a footnote. It is the point.
The firms most exposed are not the ones with the weakest access controls. They are the ones whose entire value is a movable book of sensitive client data, governed only by who is allowed to touch it. If you cannot tell an advisor prepping a review from an advisor packing to leave, that is what you are missing.
If that is the question you want answered for your practice, the next step is thirty minutes, engineer to engineer, on how Hilt resolves a client-data move to the identity behind it and what it would surface in your environment.