31 Dec 2026

Varonis is pulling the plug on on-prem. ProLion isn’t.

Learn how to keep your data →
ProLion Platform
Industries
Healthcare

Who can open a patient record?

The policy says the care team. The share says Everyone. Between the two sits an audit, a regulator and, increasingly, an agent that answers with whatever permissions the person asking happens to have.

ProLionOct 29, 2026

Book a Demo
NetApp

Syslog CEF and REST, into the tool you already run

See it running

The same night twice, once without us.

Film still: Healthcare
0:57

The night someone got into the imaging archive.

Ransomware crews go after hospitals because downtime is measured in diverted ambulances. Here is the same night twice — once with nobody watching the file layer, once with ProLion on it.

Without

They encrypt for four hours before anyone notices.

  1. 02:14 An attacker, signed in on a service account, starts encrypting the imaging archive.
  2. 02:14–06:00 The night passes. The encrypted files replicate to the second site on schedule.
  3. 06:40 A radiologist cannot open a study. Imaging is declared unavailable.
  4. Day 2–9 Appointments are canceled, the archive is restored from tape, and the authority asks which records were affected.

Outcome

Days of diverted care, a ransom demand, and a NIS2 notification you cannot complete because nobody can say which patient records the attacker touched.

With ProLion

They get four seconds.

  1. 02:14 The same account starts encrypting. The pattern is caught on the file system’s own event stream.
  2. 02:14 +4 sec The account is blocked. Every other account on the share keeps working.
  3. 02:20 The on-call engineer opens the incident with the list of files it touched attached.
  4. 06:40 Radiology starts the day as usual. The handful of touched files came back from the last clean snapshot.

Outcome

One account blocked, no care diverted, and the 24-hour early warning is a file list instead of a guess.

A scenario, not a case study — built from the way these incidents actually run.

What the rules ask for.

Health data is special-category data under the GDPR, health is an essential sector under NIS2, and patient records are kept for decades — which means the permissions on them have decades to drift.

GDPR
Special-category data, Art. 9
Health data needs a lawful basis and tighter protection than ordinary personal data — and you have to be able to show who could reach it
NIS2
Health as an essential sector
Risk-management measures including access control, plus incident reporting on a 24-hour early warning, 72-hour notification and one-month final report
Retention
Patient records for decades
National medical-record retention runs far longer than any staff member stays — so does the folder they once had access to
HIPAA
For US entities
The Security Rule requires audit controls that record who did what in systems holding ePHI; the 2024 proposal would tighten logging, MFA and encryption, and is not final

Orientation, not legal advice. NIS2 applies through national transposition, so sector scope, thresholds and deadlines differ per country — check yours.

Where it goes wrong on the shares.

Almost never in the clinical system. It goes wrong in the file share next to it: the export somebody made for a study, the scanned consent forms, the folder a department created in 2016 and nobody has owned since.

Find the records outside the record system
Classification recognizes health, personal and financial data in the files themselves — including the exports nobody logged.
Answer the access question
Effective permissions through every nested group: not who is in the care team, but who can actually open the folder.
Evidence without a fire drill
Every read, write, rename and delete with user, path and timestamp, mapped to GDPR and NIS2 controls.
Contain an attack mid-shift
The account encrypting a share is cut off in seconds. The rest of the ward keeps working.
Nothing leaves the hospital
Classification and analysis run on your own hardware. Patient files are not sent to a cloud service to be read.
Restore what was hit
Single-file restore from existing snapshots, scoped to the account — not a rollback of the whole department’s morning.
What this looks like in practice

“Without these solutions, I would feel less comfortable.”

Ivo Dissel
IT & System Admin, OLVG Amsterdam
Talk to usAll industries

Let’s solve your data challenges.

Connect with our engineers to find the right approach for your infrastructure.

Book a DemoTalk to an expert

What you would be running

One platform, two packages.

One appliance on your own hardware, in two feature packages. DataGovernance contains everything in DataDefense.

One Platform

Two Packages

ProLion DataDefense

Base

For IT teams who need critical data up, recorded and recoverable.

  • File visibility, who did what and when
  • Ransomware containment in four seconds
  • Single-file restore from snapshot
  • Capacity, growth and hot/cold reports
  • Permission insight and broken inheritance
  • Four-eyes principle
  • SIEM, SOAR and ITSM integration
  • SSO via Entra ID, Okta, SAML, OIDC
Find out more

ProLion DataGovernance

DSPM

For security, compliance and AI teams who have to prove and control who reaches what.

Everything in DataDefense, plus:
  • Access analytics — effective permissions
  • Real-time permission audit log
  • Activity Zones and quarantine
  • Active Directory security
  • Unlimited file activity retention
  • SharePoint Online and OneDrive
  • Classification of sensitive data
  • Remediation of permissions and labels
Find out more

Wherever your data already sits — NetApp, Lenovo, Dell and Microsoft, read at the data layer itself, with no agent on the file server.

Talk to an engineer who knows your data.

Four fields, and somebody who knows ONTAP, PowerScale and what FPolicy does. Not a qualification call.

Four fields. No hidden newsletter.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.