Cyber attacks targeting critical SAP applications, mission-critical innovation, and complex supply chain applications within the Aerospace and Defense (A&D) industry carry existential risks. A successful breach doesn’t just impact the bottom line: it can compromise national security, leak sensitive military intellectual property (IP), and lead to debarment from government contracts. Not only this, but regulatory impacts with ITAR, EAR, NIST and their subsequent fines can be staggering. The A&D industry is also particularly susceptible to targeting with the rise in geopolitical conflicts, which are noted as the number one risk to the world according to the World Economic Forum. As A&D organizations accelerate their shift from legacy systems with modern digital transformation initiatives, they face the challenge of defending against state-sponsored actors, insider threats, all while navigating increasingly rigorous regulatory frameworks like CMMC 2.0.
Industry Impact at a Glance
- 1 in 3 A&D organizations reported a significant increase in cyber attacks targeting their supply chain within the last year.
- Top Threat: Theft of proprietary designs and sensitive defense data (ITAR/EAR) remains the primary objective for advanced persistent threats (APTs).
- 210% increase in SAP identified vulnerabilities in 2025 compared to 2024. Three of the largest SAP CVEs to date (CVE-2017-12637, CVE-2025-31324, and CVE-2025-42999) were identified as being actively exploited in the wild in early 2025.
Key Risk Factors
State-Sponsored Threats & Espionage A&D is a prime target for nation-state actors seeking to leapfrog technological gaps. SAP systems housing design specifications, materials science data, and procurement lists are high-value targets for industrial and military espionage.
Rigorous Regulatory Compliance Maintaining “License to Operate” requires strict adherence to DFARS, ITAR, EAR, and the emerging CMMC 2.0 standards. Failure to secure the SAP systems that manage controlled unclassified information (CUI) can result in massive 100M euro fines and loss of contract eligibility.
Fragmented, Global Supply Chains Modern defense platforms rely on thousands of Tier 1-4 suppliers. This interconnectivity creates a “weakest link” problem where vulnerabilities in a supplier’s SAP can serve as a backdoor into the prime contractor’s secure network.
Key Challenges
NIS2 Compliance Gaps While most A&D firms have strong perimeter security, many struggle to apply the granular controls required by NIST SP 800-171 to the application layer of their SAP systems, leaving a critical audit gap.
IT/OT Convergence Risk The integration of SAP systems with shop-floor Industrial Control Systems (ICS) for real-time production tracking has expanded the attack surface. Security teams often lack visibility into how a vulnerability in SAP could pivot into a production line disruption. An IT or OT attack could result in an undiscovered SAP disruption, resulting in data loss or operational halts.
Complexity of Secure Cloud Migration As agencies push for cloud-first initiatives, A&D firms are migrating legacy on-prem SAPs to GovCloud and SAP Sovereign Cloud environments. Ensuring security and compliance parity during and after this migration is a massive technical hurdle for under-resourced teams. And it doesn’t stop there–in the RISE with SAP shared responsibility model, SAP secures and operates the underlying cloud infrastructure, platform, and core technical controls, while A&D organizations remain responsible for securing their SAP applications, configurations, custom code, users, data, and compliance. For A&D environments, this means customers must actively monitor SAP-specific vulnerabilities, access risks, and threats across S/4HANA and BTP.
Lack of Visibility SAP applications have traditionally been a blind spot for A&D. Between SIEM tools monitoring infrastructure, operating systems, and database layers, a gap has existed for the SAP application layer. Now, more than ever, it requires a tailored solution to gain a true visibility of your landscape and actionable guidance to manage risk.
The Onapsis Solution
A Better Approach to A&D SAP Security
Securing your mission-critical SAP landscape doesn’t have to compromise your agility. Onapsis provides a dedicated cyber security platform for SAP that is purpose-built to meet the high-stakes requirements of the defense industrial base.
- Automate Compliance and Regulations: Map SAP security configurations directly to CMMC 2.0, NIST 800-171 controls, and NIST 800-53 policy, turning months of manual audit prep into automated, continuous monitoring. Onapsis also directly maps to SAP Baseline allowing our customers to automatically transition to scanning their systems against the latest SAP guidance with no operational burden.
- Protect IP and CUI: Gain deep visibility into who is accessing sensitive technical data within your SAP, with real-time alerts for unauthorized exports or suspicious behavior.
- Accelerate Secure Digital Transformation: Shift security left by integrating Onapsis into your DevSecOps pipeline, ensuring that custom code and system changes are secure before they ever touch your production environment. Onapsis also helps identify any inherent tech debt, allowing you to not only identify it, but resolve it.
- Mission-Ready Intelligence: Leverage threat intel from Onapsis Research Labs, the same team that discovered the most critical vulnerabilities in SAP and Oracle, to defend against A&D-specific attack vectors.
- Proactive Threat Detection: Utilize the industry’s largest library (2,500+) of pre-built detection rules specific for SAP enterprise threat detection. A&D organizations are able to accelerate remediation by understanding the root cause of threats and receiving clear guidance on how to mitigate them.
Case Study: Top-Tier Defense Contractor
Global Defense Leader Secures SAP GovCloud Migration and Achieves Audit Readiness
Challenge
A leading defense contractor was migrating its core SAP environment to a secure cloud to meet new government requirements. Their security team lacked the specialized expertise to verify that the new cloud configuration met DFARS/ITAR standards, and manual auditing was causing significant project delays.
Solution
By implementing the Onapsis Platform, the contractor automated their vulnerability management and compliance reporting. They were able to identify and remediate over 200 high-risk misconfigurations in their new environment before going live.
Results
Improved developer skills by immediately flagging vulnerabilities with specific and actionable guidance for business risk and remediation.
- 100% visibility into SAP application-layer risks across on-prem and cloud environments.
- 85% faster audit preparation time for NIST 800-171 compliance.
- Zero critical vulnerabilities in production following the go-live of their secure cloud instance.
- Reduced effort and time spent on previously manual code reviews.