For most SAP Basis and security teams, the second Tuesday of every month brings a familiar ritual: SAP Patch Day. New Security Notes are released by SAP and the race begins to test and deploy fixes before attackers can exploit the newly disclosed vulnerabilities.
It’s an essential process. But if your SAP vulnerability management strategy starts and stops with applying SAP Notes, you are only seeing the tip of the cybersecurity iceberg.
SAP environments are complex, deeply interconnected ecosystems that run your organization’s financial, supply chain, and human resources operations. relying solely on reactive patching rather than continuous SAP threat exposure management leaves massive, invisible doors wide open for attackers. To truly protect your critical business applications, you have to look beyond the patch.
The Patching Illusion: Why SAP Notes Are Only Half the Battle
Applying an SAP Note fixes a specific bug or flaw in the standard software provided by SAP. It does not, however, fix human error, insecure settings, or legacy configurations that have drifted over time.
Think of it like securing a house. Installing a heavy-duty deadbolt on your front door is an excellent and necessary first step, but if the side doors and windows are left unlatched, you’ve only achieved partial security. The front entrance might be secured, but the rest of the perimeter remains exposed.
A comprehensive approach to SAP vulnerability management requires visibility into several critical layers that SAP Notes alone simply cannot address.
Three Areas of Hidden SAP Risk
To build a resilient cybersecurity posture, security teams must look into the operational and structural realities of their SAP landscapes. This means focusing heavily on three key areas:
1. System Misconfigurations
Insecure system configurations create a silent but severe layer of risk within SAP landscapes. An example of this is 10KBLAZE, a set of public exploits released in 2019 that targeted SAP Message Server and Gateway misconfigurations, that were estimated to be present in hundreds of SAP systems at the time. It is shockingly common to find internal communication settings like this left poorly secured, allowing unauthenticated remote attackers to bypass security controls entirely and seize full administrative control of the system without exploiting a software bug at all.
2. Custom Code Issues:
Most enterprises run vast amounts of custom code tailored to their specific business processes. SAP Notes only patch standard SAP code; they can’t fix issues introduced in custom code written by your own internal developers or third-party contractors. Insecure custom code can introduce severe vulnerabilities like SQL injection or unauthorized file access, allowing attackers to bypass standard SAP authorization checks entirely.
3. Over-Privileged Authorizations and User Access
We often focus so much on keeping external threats out that we forget to look at what’s happening within the system walls. Mismanaged user privileges create a ticking clock of risk, whether from an external actor abusing a hijacked account or an insider threat operating with too much power. An example of this is the SAP_ALL profile, which grants blanket administrative access. It is shockingly common to find regular business users or old test accounts still assigned these god-like privileges, creating massive insider threat vectors and compliance nightmares.
The Reality Check: An attacker doesn’t care whether they compromise your system through an unpatched vulnerability or a poorly configured Message Server. To them, an open door is an open door.
The Compliance Impact: Why Audits Demand More Than Just Patches
Relying solely on SAP Notes doesn’t just jeopardize your security; it also introduces immense regulatory risk. For organizations bound by frameworks like SOX, GDPR, or PCI-DSS, compliance isn’t a simple checklist of installed software updates. Instead, it relies heavily on the strength of your IT General Controls (ITGCs).
ITGCs form the foundational blueprint for data integrity, confidentiality, and operational security across your IT environment. When external auditors assess your SAP landscape, they are evaluating your operational discipline, not just your ability to keep up with patching. Patching fixes software flaws, but it does absolutely nothing to satisfy two of the most critical domains of ITGCs:
- Access to Programs and Data (User Settings): Auditors mandate a strict enforcement of the principle of least privilege and Segregation of Duties (SoD). If an auditor finds, for example, regular business users retaining SAP_ALL access, or old test accounts still active with administrative privileges, it represents a direct failure of your ITGC access controls.
- System Operations and Change Management (Configurations): ITGCs require that your systems remain in a known, secure, and authorized state. When configurations drift over time, such as leaving Gateway ACLs exposed to the 10KBlaze vector or allowing unencrypted RFC connections, it proves to auditors that your systems are not operating under controlled parameters.
Without continuous visibility into these configurations and user settings, your ITGCs crumble. You can be 100% up-to-date on your SAP Notes and still have security audit findings because your day-to-day operational controls are broken. To satisfy auditors and truly protect your organization, security teams must treat configuration and authorization hygiene as core pillars of their compliance strategy.
The Onapsis Advantage: Deep Visibility and True Exposure Reduction
This is where other SAP vulnerability management tools fall short, and where Onapsis delivers clarity. Onapsis goes beyond basic, surface-level scans to perform deeper, context-aware checks. Powered by 16+ years of experience and security best practices from the Onapsis Research Labs, we uncover the hidden security and compliance risks that other tools miss.
How Onapsis Lowers Your Exposure:
Accelerated and Fully Verified Patching:
Onapsis Assess streamlines your patching routine by automating the prioritization of monthly SAP Notes and uniquely validating correct implementation, including manual steps specified in the Note (insert link to manual validation blog once ready). Unlike other vendors that rely on self-reporting, Onapsis creates specific vulnerability checks to confirm that post-installation tasks, workarounds, or configuration changes were actually completed. You can trust that the risk was fully addressed.
Advanced Configuration and Authorization Assessment:
Onapsis Assess takes the guesswork out of SAP application and user settings, pinpointing your most critical misconfigurations and misauthorizations, and showing you exactly how to fix them. Onapsis Defend continuously monitors thousands of SAP configuration and user settings, and offers advanced customization capabilities so you can alert on virtually any setting change that you want to monitor. These alerts provide an early warning system for configuration drift or potential violations of your controls framework so you can address them before they’re flagged in an audit or leveraged by a bad actor.
Automated Code Security Throughout the Development Lifecycle:
Onapsis Control inspects your custom code during development and as it progresses through QA stages, identifying critical vulnerabilities before they ever reach production. Onapsis Assess is uniquely able to scan custom code that’s running in production, allowing you to identify vulnerabilities that have been discovered since the code was initially tested or that were introduced by imported, third-party-developed code.
Automated Compliance Mapping:
Onapsis Comply packs automatically map your SAP configuration and authorization settings against major compliance frameworks (e.g., SOX and GDPR). This automation eliminates manual efforts around ITGC testing and audit evidence collection, significantly improving accuracy while saving your team weeks of preparation time by providing instant, audit-ready reports already mapped to control points.
At the end of the day, effective SAP vulnerability management is about much more than just crossing the latest SAP Notes off your monthly to-do list. True exposure reduction requires a strategy that goes beyond standard patching to secure your configurations, custom code, and user privileges. With Onapsis, you gain the precise, prioritized insights needed to move beyond the patch, eliminate your blind spots, and dramatically reduce your total risk exposure.
Frequently Asked Questions
Why isn’t keeping up with SAP Notes enough to secure my SAP landscape?
SAP Notes are designed to fix specific software bugs and vulnerabilities in standard SAP code. However, they do not address human error, insecure architectural designs, custom code flaws, or identity risks. A system can be up-to-date on its patches but still be exposed due to misconfigured gateways (like the 10KBlaze vector) or over-privileged user profiles.
Can our standard enterprise vulnerability scanner find these hidden SAP risks?
No. “Traditional” vulnerability management tools don’t sufficiently support SAP. They lack the deep, application-layer awareness and specialized vulnerability checks required to analyze SAP’s internal tables, unique configuration parameters, custom code, and user authorizations.
How do SAP application configurations and user settings impact ITGC compliance for audits like SOX?
Regulations like SOX require you to prove that your systems are secure and your data is accurate. When auditors check your IT General Controls (ITGCs), your SAP configurations and user settings are the actual evidence they look at. That’s because these settings show exactly who has access, how changes are tracked, and whether your team has the right checks and balances in place.
About the Author
