From Runways to Ransomware: Defending SAP Custom Code in the Age of Agentic Commerce

The retail and fashion manufacturing landscape is transforming at a blistering pace. Between the rise of autonomous AI shopping agents and hyper-accelerated trend cycles, brands are deploying cloud-native architectures faster than ever before. However, as organizations push to modernize their SAP environments and leverage AI for custom code development, they are unintentionally opening the door to devastating cyber threats. With high-profile incidents like the ransomware attack on VF Corporation and tightening global regulations such as the EU ESPR, relying on reactive security is no longer an option. Embracing a DevSecOps strategy to “shift left” is the only viable path forward.

Key Takeaways

• A 35-Million-Customer Cautionary Tale: The December 2023 cyberattack on apparel giant VF Corporation disrupted holiday order fulfillment and compromised the data of 35.5 million consumers. It is a stark reminder that compromised backend systems carry catastrophic operational and reputational costs. 
• The Hidden Cost of AI Acceleration: While AI coding tools (like SAP Joule) enable developers to write custom applications at unprecedented speeds, these models suffer from “context blindness”. Without a deep understanding of your specific SAP architecture, they can easily omit critical authorization checks. 
• Strict New Mandates for Supply Chains: Retailers are facing a wave of new compliance requirements, from the EU’s Ecodesign for Sustainable Products Regulation (ESPR) to strict data privacy laws like GDPR. These mandates require verifiable, secure-by-design backend systems. 
• Securing the Digital Storefront: Shifting left empowers teams to catch and fix vulnerabilities during the development phase. Onapsis Control automates SAP custom code security, allowing brands to protect their Clean Core, overcome the cyber talent gap, and safely accelerate innovation. 

The Holiday Nightmare: When Retail Supply Chains Go Dark 

Imagine it is the middle of the peak holiday shopping season. Global demand is surging, but suddenly, distribution centers grind to a halt, and e-commerce inventory screens freeze. This is not a hypothetical scenario.  Rather, it is exactly what happened to VF Corporation, the parent company of iconic brands like Vans, The North Face, and Timberland, in December 2023.

A ransomware attack encrypted critical IT systems, severely delaying order fulfillment and store replenishments worldwide. By the time the dust settled, hackers had stolen the personal data of approximately 35.5 million consumers. With the average cost of a data breach in the manufacturing sector reaching $5.56M, and 30% of retail ransomware attacks tracing back to exploited vulnerabilities, it is clear that adversaries are moving beyond basic phishing. They are targeting the custom applications and SAP application layers that hold a brand’s most valuable intellectual property and customer data.

AI Coding Assistants: Moving Fast, But Are You Breaking Things? 

To keep pace with viral, platform-driven consumer demands, fashion manufacturers are turning to artificial intelligence. Developers are heavily utilizing AI coding assistants to write custom SAP code faster than ever.

For example, an AI assistant tasked with building a fast-track return interface might inadvertently introduce an ABAP Open SQL injection vulnerability or use insecure, hardcoded credentials. Suddenly, what was supposed to be a simple customer service portal becomes a backdoor for attackers to extract the PII of millions of shoppers or manipulate critical inventory databases. AI inadvertently expands the attack surface by introducing hidden vulnerabilities and shadow dependencies that a human reviewer might easily overlook in the rush to production. 

The Expanding Compliance Web: ESPR, ESG, and Data Privacy 

The regulatory landscape for fashion and retail is becoming significantly more rigid. Regulators are moving past voluntary mission statements and demanding ironclad, third-party proof of sustainability and security. 

·       EU ESPR (Ecodesign for Sustainable Products Regulation): This aggressive new law mandates circular economy practices, specifically banning the destruction of unsold apparel and requiring Digital Product Passports. If the SAP backend storing your material traceability is breached or manipulated, compliance is voided. 

·       Expanded Data Protection: As retail shifts toward Agentic Commerce, the volume of processed data is skyrocketing. Consequently, GDPR and CCPA enforcement is expanding, making continuous cybersecurity auditing a mandatory component of high-risk data processing. 

Closing the Cybersecurity Talent Gap 

Why are so many organizations falling victim to these attacks? The reality is a severe talent shortage. Structural workforce issues have left a 45% cybersecurity expertise gap in the retail supply chain.

Security teams simply don’t have the bandwidth to manually review millions of lines of custom code…let alone the specialized ABAP knowledge required to interpret SAP code. It is no surprise that 46% of retail organizations that suffer breaches attribute the compromise to an “unknown security gap”.

Automating Security with Onapsis Control 

You cannot sacrifice speed for security, but you also cannot afford a multi-million-dollar breach. The answer is DevSecOps. As the undisputed experts in SAP cybersecurity and the only application security vendor in the SAP Endorsed Apps program, Onapsis enables fashion and retail brands to build security directly into their development lifecycles.

Onapsis Control acts as an automated quality gate, giving you the power to:

• Integrate Seamlessly: Embed security scans directly into developer IDEs and CI/CD pipelines to ensure only clean code enters production. 
• Validate AI-Generated Code: Automatically scan code written by both humans and AI to catch missing authorization checks and shadow dependencies. 
• Maintain Audit-Ready Compliance: Test custom developments against hundreds of test cases to ensure alignment with GDPR, ESPR, and strict ESG mandates. 

Consider the success of JYSK, a global home furnishing retailer with over 3,600 stores and 34,000 employees. By integrating Onapsis Control into their SAP development workflow, JYSK automated complex security tasks and significantly reduced the risk of vulnerabilities ever reaching production. This shift not only secured their migration to hybrid cloud architectures but elevated their security maturity well above the consumer products and retail industry average.

In today’s retail environment, protecting your brand starts with protecting your code. Automate your security, shift left, and deliver innovation without compromise.

Frequently Asked Questions

Why are retail manufacturers increasingly targeted through their SAP applications? 

Threat actors know that SAP systems are the nervous system of modern retail, controlling everything from e-commerce fulfillment to supply chain logistics. A single vulnerability in a custom SAP application can allow attackers to freeze global operations or steal millions of customer records, making it a highly lucrative target for extortion. 

What exactly is “context blindness” in AI-generated SAP code? 

While AI tools generate code quickly by recognizing standard patterns, they do not understand a specific brand’s proprietary business logic or unique security rules. This “context blindness” often results in the creation of code that works functionally but lacks essential security guardrails, like mandatory authorization checks. 

How do changing ESG regulations (like the EU ESPR) intersect with SAP security? 

New ESG mandates have moved beyond voluntary goals to strict legal requirements. The EU ESPR, for instance, bans the destruction of unsold apparel and requires verifiable Digital Product Passports. If the SAP databases storing your material traceability and compliance data are breached, altered, or taken offline, your organization cannot prove compliance and risks severe penalties. 

What role does Onapsis Control play in DevSecOps for retail supply chains? 

Onapsis Control acts as an automated gatekeeper within the software development lifecycle. By moving security testing to the earliest phases of development (“shifting left”), it automatically scans and identifies vulnerabilities in both human- and AI-written code before it can be deployed to production, thereby saving time, reducing costs, and preventing operational downtime.