31 Dec 2026

Varonis is pulling the plug on on-prem. ProLion isn’t.

Learn how to keep your data →
ProLion Platform
Industries
Financial services

DORA asks what happened. You have to be able to answer.

Operational resilience stopped being a policy document in January 2025. It is now a register, a reporting clock and an expectation that you can show what an incident touched — down to the file.

ProLionOct 29, 2026

Book a Demo
NetApp

Syslog CEF and REST, into the tool you already run

See it running

The supervisor asks. The evidence is already there.

Film still: Financial services
1:03

The group membership an attacker is counting on.

Attackers rarely break in. They sign in — on an account that kept access it should have lost two years ago. Here is what that costs you, and what changes when the access is visible.

Without

Two years of access nobody meant to grant.

  1. Week 0 A relationship manager moves to another team. The old group membership stays.
  2. Week 28 Their account opens the client share they no longer need and copies 4,100 KYC documents in an evening.
  3. Week 30 A client asks how their file ended up elsewhere. The share-level permissions are all anyone can produce.
  4. Week 32 The report to the supervisor describes the gap rather than the facts.

Outcome

A DORA major-incident report you cannot evidence, a client relationship that does not survive the conversation, and no way to say whether it was your employee or whoever took over their account.

With ProLion

The access is gone in week one, and the odd evening is flagged anyway.

  1. Week 0 The permission audit log records the move. The exposure report lists what that account can still reach.
  2. Week 1 The stale membership is closed, with the before-and-after on record.
  3. Week 28 On an estate where it was missed, the behavior baseline catches the mass read and restricts the account to its activity zone.
  4. Week 30 The client question is answered in the meeting, from the file-level record.

Outcome

The access never outlives the role — and if it does, the evening it is used is the evening it is caught.

A scenario, not a case study — built from the way these incidents actually run.

What the rules ask for.

DORA has applied since 17 January 2025. It does not replace the GDPR, NIS2 or your retention duties; it sits on top of them and asks for evidence.

DORA
ICT risk management and incident reporting
In force since 17 January 2025: classification criteria, major-incident reporting to your authority, and resilience testing
DORA
Register of information
ICT third-party arrangements recorded and submitted; what each provider can reach is part of the picture
GDPR
Customer data, and the fines behind it
Up to €20M or 4 % of global turnover — and the burden of showing who had access
Retention
Records kept for years
Transaction and communication records outlive the people who created them, and the groups they were in

Orientation, not legal advice. NIS2 applies through national transposition, so sector scope, thresholds and deadlines differ per country — check yours.

Where it goes wrong on the shares.

The core banking system is audited to death. The file shares around it — the credit files, the KYC scans, the model exports, the folder the project team opened in 2019 — are where access quietly spreads.

Who can reach the payroll share
Effective permissions resolved through nested groups, ranked by the sensitivity of the data behind them.
Evidence in the meeting, not next week
The file-level record of every access and every permission change, searchable when the auditor asks.
Real-time permission audit log
Every ACL and ownership change: who changed what, when, and to what.
Contain, then report
The account is cut off in seconds, and the list of files it touched is the attachment your incident report needs.
Mapped to the frameworks
Findings mapped to GDPR, NIS2, ISO 27001 and DORA controls.
On your own infrastructure
No file is sent to a cloud service to be classified, which keeps the third-party register shorter.
What this looks like in practice

“Without these solutions, I would feel less comfortable.”

Ivo Dissel
IT & System Admin, OLVG Amsterdam
Talk to usAll industries

Let’s solve your data challenges.

Connect with our engineers to find the right approach for your infrastructure.

Book a DemoTalk to an expert

What you would be running

One platform, two packages.

One appliance on your own hardware, in two feature packages. DataGovernance contains everything in DataDefense.

One Platform

Two Packages

ProLion DataDefense

Base

For IT teams who need critical data up, recorded and recoverable.

  • File visibility, who did what and when
  • Ransomware containment in four seconds
  • Single-file restore from snapshot
  • Capacity, growth and hot/cold reports
  • Permission insight and broken inheritance
  • Four-eyes principle
  • SIEM, SOAR and ITSM integration
  • SSO via Entra ID, Okta, SAML, OIDC
Find out more

ProLion DataGovernance

DSPM

For security, compliance and AI teams who have to prove and control who reaches what.

Everything in DataDefense, plus:
  • Access analytics — effective permissions
  • Real-time permission audit log
  • Activity Zones and quarantine
  • Active Directory security
  • Unlimited file activity retention
  • SharePoint Online and OneDrive
  • Classification of sensitive data
  • Remediation of permissions and labels
Find out more

Wherever your data already sits — NetApp, Lenovo, Dell and Microsoft, read at the data layer itself, with no agent on the file server.

Talk to an engineer who knows your data.

Four fields, and somebody who knows ONTAP, PowerScale and what FPolicy does. Not a qualification call.

Four fields. No hidden newsletter.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.