Why Onapsis

Onapsis vs. Generic Cybersecurity Solutions: Securing the ERP Application Blind Spot

Traditional vulnerability scanners, firewalls, endpoint detection and response tools, and general SIEMs are critical capabilities for any security program. However, they are not designed to manage the complexity of SAP business applications. Discover why Fortune 500 enterprises complement their generic security products with Onapsis, the only SAP-Endorsed application cybersecurity platform purpose-built for SAP environments.

Schedule a Custom Demo Explore SecOps & SIEM Integrations
Two technology professionals reviewing a tablet in a data center

Executive Summary: The SAP Application Security Gap in Traditional Cybersecurity Programs

Enterprises spend millions on defense-in-depth cybersecurity models, including firewalls, network security, endpoint detection and response (EDR), and general vulnerability management (VM) tools. However, market analysts, including Gartner and others, have noted that in-depth security of databases and applications like ERP systems (SAP or Oracle) are not widely supported in traditional Vulnerability Assessment solutions.

While traditional cybersecurity solutions protect the network, hypervisor and operating system, business-critical applications (such as those that run on SAP ECC, SAP S/4HANA, RISE with SAP, and SAP BTP) operate with complex application logic, custom code, and proprietary protocols that generic tools are ill-equipped to protect.

Unfortunately, this is exactly the layer where attacks against SAP systems happen today.

Defense LayerSecurity Technologies & Coverage
Perimeter & Network LayerFirewalls, WAFs, Network Security
Endpoint & OS LayerEDR, OS Patching, Host Security
Generic Applications Generic SAST, DAST, IAST
⚠️ THE SAP APPLICATION LAYER BLIND SPOTSAP Business Logic, SAP Transports, HANA, Fiori, SAP BTP, Custom ABAP or UI5 Code, SAP Security Notes, SAP Configurations, SAP User Authorizations, SAP APIs

  • Passive CVE Feed Reliance: Generic vulnerability scanners ingest public CVE feeds. Outside of what is publicly made available either through vendor patch notifications or crowdsourced communities, they cannot identify SAP misauthorizations, misconfigurations, or other application-layer vulnerabilities that expose the enterprise to risk. Further, non-public exploits, zero-day threats before public patches, or validating whether manual SAP Security Notes and workarounds were correctly applied are not possible with these tools.
  • No ERP Threat Intelligence: Traditional tools lack threat intelligence or feeds dedicated to ERP security, leaving security teams blind to active adversary tactics (TTPs), SAP threat intelligence, or even compensating controls that could protect critical SAP systems before patches can be applied.
  • Broad, Not Deep Technical & Language Scope: Generic static application security testing (SAST) tools from major vendors focus on capturing the broadest swath of coding languages but generally lack in-depth coverage for SAP coding languages (ABAP, Fiori, SAPUI5, XSJS, CDS). And the complexities of modern SAP development – from transport management to more modern SAP DevSecOps pipelines are not addressed.
  • Log Aggregation Without Context: SIEMs can collect raw SAP event logs, but lack out-of-the-box SAP threat detection rules, exploit signatures, and behavioral anomaly scoring specific to SAP applications, missing critical security events. Simply sending raw SAP logs to generic SIEMs doesn’t achieve security outcomes, and may significantly increase SIEM licensing costs.

Traditional vulnerability management tools are critical for enterprise defense-in-depth. They focus on a broad swath of infrastructure components, applications, operating systems, and endpoints. When pointed at an SAP system, however, these VM tools will potentially identify important vulnerabilities in the SAP system’s virtualization environment and operating system, but will generate a significant number of false positives or, worse, false negatives when pointed to assess the SAP application layer.

Onapsis is different:

  • Deep SAP Application Coverage: While generic scanners evaluate basic system, OS, or application security, Onapsis Assess is laser-focused on the SAP application layer, delivering 6,000+ checks across the complete SAP ecosystem, including ABAP, JAVA, HANA databases, SAP BTP, SAP Cloud Connector, SAP Web Dispatcher, BusinessObjects, SAProuter, and SuccessFactors. This knowledgebase has been refined over 17+ years, and battle tested against thousands of the world’s most complex SAP implementations.
  • Validation of Manual Notes & Workarounds: Over 50% of critical SAP Security Notes require manual post-installation configuration steps to effectively eliminate the risk. Generic scanners only check SAP patch and component versions, creating a false sense of security and/or producing a significant number of false positives. Onapsis Assess automatically validates whether manual actions and workarounds were executed completely, giving you peace of mind and avoiding wasted manual effort.
  • Business Risk Prioritization: Instead of dumping thousands of unprioritized CVE warnings on SAP Basis teams, Onapsis evaluates landscape context and business impact, reducing manual review effort from hundreds of hours per month to <1 hour.
Explore Onapsis Assess for SAP Exposure Management

Security Operations Centers (SOCs) rely on SIEMs for centralized log correlation. However, a SIEM is only as effective as its ability to process and understand the logs based on the threat intelligence and detection engineering capabilities developed on top of it.

Onapsis is different:

  • Deep Understanding of Business-Critical SAP Systems: Expansive rules encompassing 17+ years of deep SAP and cybersecurity expertise exist in Onapsis Defend. Out of the box, our continuous monitoring leverages 2,500+ rules to protect SAP landscapes.
  • Pre-Patch Protection for Critical Zero Days: Onapsis Defend delivers critical zero-day protection to our clients before SAP Security Notes are released. On average, Onapsis customers have protection 120 days before SAP discloses a vulnerability and technical patches.
  • Reducing SIEM Licensing Costs: Connecting SAP systems to a generic SIEM and ingesting all the SAP logs will not only result in missing critical security events (due to the lack of SAP-specific detections), but may also significantly increment volume-based SIEM licensing costs. Onapsis Defend pre-filters events through its SAP threat parsers, only sending the SIEM the signals, not the noise. If needed for compliance retention reasons, Defend can also forward the raw events to the SIEM, simplifying otherwise complex integrations.

Onapsis Defend and SIEMs: “Better Together”

Onapsis partners directly with leading SIEM vendors to eliminate SAP blind spots in the SOC. Onapsis Defend finds the worst threats, potential exploit attempts, and suspicious SAP insider behavior that can then be funneled to a SIEM and correlated with other events from the infrastructure:

Dimension / CapabilityGeneric SIEM Alone Onapsis Defend + SIEM (Integrated)
Out-of-the-Box SAP RulesVery few if at all2,500+ specialized SAP threat detection rules
SAP Exploit DetectionNo built-in SAP exploit detection or private exploit rules600+ SAP exploitation rules, unique to Onapsis. Critical alerts for potential SAP exploitation goes immediately to the SIEM
Zero-Day Pre-Patch RulesCannot detect zero-day SAP threats prior to vendor patch releasePre-patch protection rules delivered ~120 days before SAP Security Notes. Critical alerts for potential exploitation goes immediately to the SIEM
Dedicated SAP Research TeamNo dedicated ERP threat research teamThe industry-leading Onapsis Research Labs
Explore Onapsis Defend for SAP Threat Detection & Response

Traditional AST tools, like other categories noted here, offer broad and important coverage for various coding languages used across the enterprise. However, they all have in common:

  • A lack of depth for SAP-relevant coding languages such as ABAP, UI5, and others.
  • Missing support and context for the unique intricacies of SAP code development, its stages, and its change management processes.

Onapsis Control is different, delivering comprehensive testing for SAP code in development (and in IDE), at rest, and in motion (or transport) whether your teams are following legacy development on a full ECC stack or if you’re adopting more modern CI/CD capabilities:

  • Deep SAP Coding Knowledge: Generic SAST tools cover broadly utilized, standard programming languages like Java, .Net and Python. If they offer any SAP support, it’s usually a very limited number of test cases for static ABAP analysis, generally accompanied with high false-positive rates as they are less frequently maintained and tested only in limited lab environments. Onapsis Control performs comprehensive security testing across ABAP, Fiori, SAPUI5, HANA native (XSJS, CDS, SQLScript), and BTP Node.js. Our experts are continually updating our content with new test cases released frequently, ensuring the highest coverage, fidelity and consistent results.
  • Developer Productivity & Autocorrect: Where SAST products may stop at scanning a project in Git (at rest), Onapsis Control integrates completely into your team’s IDEs (VS Code, Eclipse, SAP Business Application Studio) with “One-Click Fix” automated code correction.
  • DevSecOps & Transport Integration: Scans code at rest, in motion, and in production (via Onapsis Assess), integrating natively with SAP TMS, ChaRM, Cloud ALM (cTMS), Rev-Trac, ABAPgit, and CI/CD pipelines (Azure DevOps, GitHub).
Explore Onapsis Control for SAP Custom Code Security

Comprehensive Platform Matrix: Onapsis vs. Generic Security Tools

Feature / DomainOnapsis PlatformPerimeter / EDRGeneric Vulnerability ManagementGeneric SIEM Generic Application Security
Endorsed by SAP (and Premium Certified)YesNoNoNoNo
Dedicated ERP Threat Research TeamYes
(ORL, 17+ yrs)		NoNoNoNo
Pre-Patch Zero-Day Protection RulesYes
(~120 days prior)		NoNoNoNo
Validates Manual Notes & WorkaroundsYesNoNoNoNo
2,500+ SAP Threat Detection RulesYesNoNoNoNo
Deep Code Scanning for multiple SAP languagesYesNoNoNo
Limited ABAP or none at all
In-IDE Automated SAP Code CorrectionYesNoNoNoNo

Proven Industry Leadership & Ecosystem Trust

  • The Only SAP-Endorsed Platform for SAP Cybersecurity: Premium Certified through invitation-only SAP testing, guaranteeing platform stability and API performance.
  • Onapsis Research Labs (ORL): Discovered and helped mitigate 1,000+ zero-day SAP vulnerabilities, credited by SAP Product Security Response Team, and trusted by government security agencies (US CISA, FBI, DoD, German BSI, ENISA), incident response (Mandiant, CrowdStrike, Deloitte) and threat intelligence (Recorded Future, Flashpoint) partners.
  • Industry Certifications: Veracode Verified (secured codebase), ISO 27001, ISO 20243, SOC 1/2 Type 2, and TISAX Level 3.

Bridge Your SAP Security Gap Today

Don’t let your most critical business applications remain a blind spot in your enterprise defense. Complement your existing security investments with the trusted market leader to protect what matters most.

Request a Custom Demo