Skip to main content
This page walks you through what happens between signing your contract and seeing your first security findings. It covers who does what, the deployment timeline, and what to expect while the platform learns your environment.

Deployment phases

1

Infrastructure provisioning (Day 1)

Hilt provisions a single-tenant deployment in your cloud account. This includes the analytics database, dashboard, and ingest endpoint. See the deployment guide for your cloud: AWS, GCP, Azure, or Ali Cloud.Who: Hilt engineering, with your cloud admin granting access.You provide: A VPC or network segment, IAM/service-account permissions per the deployment guide, and DNS delegation if using a custom subdomain.
2

Collector deployment (Day 1-3)

Deploy the Hilt collector to your hosts. The collector is a single static binary (Linux) or a notarized system-extension app (macOS) with no dependencies and no kernel modules.Who: Your infrastructure team, using provided guides:Typical scope: Start with a representative subset (10–50 hosts) covering your main workload types. Expand once baseline is established.
3

Cold start & baseline (Weeks 1-2)

The detection models begin learning your environment’s normal behavior. During this phase:
  • Telemetry flows into the dashboard immediately, so you can browse activity from day one
  • Anomaly scoring starts but operates in cold-start mode with elevated thresholds
  • The platform builds behavioral baselines per host and per user
What to expect: Few or no findings in week one. The model needs to observe normal patterns before it can identify deviations, so this is by design.
4

Active scoring (Week 3 and onwards)

Once baselines stabilize, scoring thresholds lower and findings begin appearing. The system continues to refine as you provide feedback (confirming or dismissing findings).What to expect: Initial findings will include both genuine anomalies and patterns that are normal for your environment. Reviewing these (via the Anomalies page) trains the models to your specific context.

Who does what

First-week checklist

  • Dashboard accessible at your deployment URL
  • At least one collector reporting (check Collectors page)
  • Hosts appearing as “Active” in the fleet view
  • Events visible in Logs
  • macOS endpoints reporting (if applicable — see macOS Collector)
  • Your team has dashboard accounts with appropriate roles

Realistic timeline

The warm-up period varies by environment complexity. Environments with highly regular workloads baseline faster; diverse or bursty environments take longer.

Next steps

Last modified on October 8, 2026