AI Is Already in Use Across Your Business. Governing It, Testing It, and Seeing It Is the Work That Comes Next.
Download Policy Under NIS2: What Irish Organisations Need to Evidence
Ask an IT manager how software gets onto a laptop and the honest answer has changed a lot in ten years. There was a time when it arrived through a build, a deployment tool, or somebody from IT sitting at the desk with a licence key. Now it arrives because a project needs a PDF converter by Thursday, because a customer sent a link to a file transfer service that expires in seven days, because a supplier portal only exports in a format nobody in the office has, or because someone found a browser extension that shaves twenty minutes off a weekly task.
None of that is reckless behaviour. It is people doing their jobs on the tools available to them. What it does mean is that the browser has become the main way things get into an organisation, and most download policies were written for a world where that was not true.
The site is no longer a useful unit of control
Category-based web filtering was a sensible answer to the question it was built for. Group sites by type, permit the ones that make sense for the business, block the categories with no business use alongside known-bad domains, and the risk profile of a typical workday drops sharply. That worked because the browser was mostly somewhere staff went to look at things.
The weakness shows up as soon as the browser becomes where the work happens. A permitted category tells you nothing about what came down inside it. Cloud storage, file transfer services, developer repositories and supplier portals all sit in categories almost every organisation allows, and every one of them can deliver an executable. A fake installer served through a paid search advert appears under a domain with a perfectly clean reputation, bought that morning. An extension that requests permission to read and change data on every site passes through the same permitted category as a spell checker.
Blocking the category instead creates a different problem. Each block becomes a ticket, and the tickets accumulate faster than any small team can clear them. What follows is predictable: the file gets emailed to a personal address and carried back in, or it travels on a USB stick, or someone opens a temporary exception that quietly becomes permanent because nobody had time to go back and close it. The control looks tight on paper while the actual traffic routes around it.
Moving the decision to the file
Organisations handling this better have stopped asking whether a site is acceptable and started asking whether a specific file, arriving on a specific device, requested by a named person, should be allowed.
That sounds like more work. In practice it turns out to be less, because most downloads are boring. The sites and applications people rely on every day get pre-approved once, so the bulk of activity carries on without anybody waiting on IT. What falls outside that set gets scanned and then blocked, allowed, or held for approval depending on what it is and who asked. Approval can be tied to an MFA prompt, so a request cannot simply be clicked through by whoever happens to be at the keyboard, and it can take account of the device itself. A machine three months behind on patches gets a different answer to a compliant laptop.
Scanning the file itself is worth having whatever else is going on. A bad download is still one of the easiest ways into an organisation and checking the file as it lands, catches things that never went near the office network. A lot of people are working from home or sitting in a customer's building these days, so plenty of what they download never passes through anything the network team can see.
The record is the part people underestimate
Every one of those decisions leaves a line: a user, a device, a file, a time, an outcome. That by-product is turning out to be as valuable as the control itself, because of who is now asking questions.
Ireland still has not enacted the National Cyber Security Bill, the vehicle for bringing NIS2 into Irish law. In July the European Commission referred Ireland to the Court of Justice over the delay, and the Minister for Justice has said he expects to notify transposition by the end of the year. Whatever the exact date, the practical pressure arrived long before the legislation. DORA has applied to financial entities since the start of 2025 and pushes obligations down through their ICT suppliers. Insurers want evidence of endpoint controls before they will quote. Large customers send sixty-question security assessments to logistics providers and software firms with a dozen staff on the payroll.
None of those parties can find anyone. All of them can stop a deal, which tends to concentrate minds faster than any regulator.
When one of those questionnaires asks an organisation to describe its download policy, the difference between a paragraph and a report is significant. A paragraph describes an intention. A report shows a quarter of decisions with names and dates attached, which is exactly the demonstrable proportionality that Article 21 of NIS2 keeps circling back to.
Where it sits with what is already running
This does not replace EDR, which is built to spot and contain something already executing on a machine. It does not retire web filtering either, which still handles reputation and category at a scale nothing on the endpoint can match. Governing the
download decision sits in front of both, cutting down what they must deal with and producing a record that neither was designed to keep.
For teams already running endpoint privilege management, the logic will feel familiar. Granting a user elevated rights for one task, with an approval step and an audit trail attached, is the same discipline applied at a different moment in the day. Extending it to browsing and downloads keeps one policy and one body of evidence rather than two that have to be reconciled every time somebody asks.
The organisations getting these questions first are rarely the ones with the biggest security budgets. They are the ones sitting inside somebody else's supply chain, which in Ireland covers most of us.
Join us on Wednesday 9th September
Jeff Jones of Admin By Request joins Renaissance to introduce Web Access Management, a new addition to the Admin By Request platform that governs web access and downloads at the endpoint rather than in the network path.
Jeff will show how trusted sites and software get pre-approved so everyday work carries on, and how anything riskier is scanned, blocked or sent for approval without building a queue IT cannot clear. He will also walk through the audit trail an auditor or a client questionnaire would want to see, and where the product sits alongside EPM, EDR and existing web filtering.
The session is relevant whether the environment in question is your own or a customer's.
Register here: https://renaissance.renaissance.ie/c/456992/