The data has to stay in the building.

Public bodies are in the NIS2 scope, hold personal data by the tonne, keep it for decades under archival law, and in many cases may not hand any of it to a cloud service to be analyzed.

ProLionOct 29, 2026

Book a Demo

NetApp

Syslog CEF and REST, into the tool you already run

See it running

The archive share, and the night someone encrypted it.

1:01

A Friday evening somebody chose on purpose.

Attacks on public bodies are timed for the weekend, because that is when nobody is looking. The archive is also the one system you cannot simply rebuild from somewhere else.

Without

They picked the weekend. It is long, and the records are old.

Fri 17:40 An attacker starts renaming files in the citizen-records share.
Fri–Sun The run works through twenty years of archived records. Nobody is in the building.
Mon 08:00 Counter services cannot open a file. The restore takes the week.
+2 weeks The authority cannot tell the supervisory body which records were affected.

Outcome

Counter services down for days, a ransom note waiting on Monday, an archival duty you cannot evidence, and a notification built on estimates.

With ProLion

The run stops at the fourth file.

Fri 17:40 The mass rename is caught on the event stream, not on the next scan.
+4 sec The account is blocked. Nobody has to be called in.
Mon 08:00 Counter services open as usual.
Report The affected files are listed with user, path and timestamp, and restored from snapshot.

Outcome

A weekend that stays a weekend, and a record of exactly what happened, kept on your own hardware.

A scenario, not a case study — built from the way these incidents actually run.

What the rules ask for.

Three duties pull in the same direction: protect it, prove it, and keep it where it belongs.

NIS2

Public administration in scope

Risk-management measures including access control, and the 24-hour, 72-hour and one-month reporting cascade

GDPR

Citizen data, by default

Lawful basis, minimization, and the ability to say who could reach a record

Archival law

Retention measured in decades

Records outlive systems, staff and the groups they were filed under

Sovereignty

Analysis on your own hardware

For many bodies, sending file contents to a cloud service to be classified is not an option at all

Orientation, not legal advice. NIS2 applies through national transposition, so sector scope, thresholds and deadlines differ per country — check yours.