Open by culture. Confidential by obligation.

A university share holds public course material, unpublished results, personal student data and an industry partner’s confidential input — often in the same folder tree.

ProLionOct 29, 2026

Book a Demo

NetApp

Syslog CEF and REST, into the tool you already run

See it running

Confidential, and open to the whole faculty.

0:55

The cohort that left, and the accounts somebody can still use.

Turnover here is annual and structural. The permissions are not — and every account that outlives its owner is one an attacker can take over quietly.

Without

Everyone who ever joined a project is still in it.

Semester end Two hundred and forty accounts leave. The group memberships do not.
Year 2 An industry partner’s confidential dataset sits in a folder a whole faculty can open.
Year 3 The partner audits the institution before renewing the contract.
+4 weeks Nobody can produce the list of who could reach the data, because it was never kept.

Outcome

A research contract that is not renewed, a confidentiality clause the institution agreed to but cannot evidence, and no record of who actually opened the data.

With ProLion

The leavers show up in the first exposure report.

Semester end The exposure report lists the folders those accounts can still reach.
Week 1 They are closed, and every change is recorded as it happens.
Year 2 Classification flags the partner dataset as sensitive wherever a copy of it ended up.
Year 3 audit The access history is produced on the day it is asked for.

Outcome

Open where it should be open, closed where a contract says so — and the record to prove which is which.

A scenario, not a case study — built from the way these incidents actually run.

What the rules ask for.

Research organizations are in the NIS2 scope, and the data in them is governed by everything from the GDPR to the terms of a single research contract.

NIS2

Research organizations in scope

Risk-management measures including access control, and the reporting cascade

GDPR

Student and participant data

Including special-category data in clinical and social research

Funder and partner terms

Confidentiality by contract

An industry partner’s data carries obligations the institution agreed to in writing

Publication

Open where it should be

The point is not to lock everything down, it is to know which is which

Orientation, not legal advice. NIS2 applies through national transposition, so sector scope, thresholds and deadlines differ per country — check yours.