ERPScan Smart Cybersecurity Platform for SAP

Short Summary

SAP systems often form the operational backbone of enterprises, concentrating critical business, employee, and customer data across ERP, SAP HR, SAP CRM, and SAP NetWeaver-based portals, with additional functionality frequently embedded through ABAP or Java custom code. This centrality makes SAP landscapes both a prime audit focus and a high-value attack surface, especially given their complexity, individualized configurations, and exposure through internet-facing components such as SAP Router, portals, or CRM. SAP security is framed as broader than classic Segregation of Duties (SoD) governance: it also includes application platform hardening (patching, configuration, credential strength, and vulnerability management) and custom code risk (insecure or malicious code paths). Growing threat volume and limited specialist staffing increase the need for intelligent, assistive detection and response capabilities.

ERPScan, founded in 2010 and headquartered in Palo Alto with a European HQ in Amsterdam, positions its Smart Cybersecurity Platform for SAP as a holistic suite built on lifecycle phases. Earlier product focus areas—vulnerability management, source code security, and SoD analysis—remain central, now organized into modules for Assess, Detect (including machine-learning-supported user behavior analytics), Respond (tasking, notifications, and integrations), Protect (hardening, automated corrections, and virtual patching), and Monitor (executive-ready visibility). The platform is designed as non-intrusive and agentless, using read-only connectors across many SAP technologies and related databases. It supports one-off scans through continuous operation, discovers SAP landscape topology by network scanning, and visualizes risks via a “threat map.” Integration with broader security and governance ecosystems (SIEM/RTSI, ITSM, GRC, SAP GRC) enables operationalization of findings through APIs, tickets, and exported control monitoring. Strengths include breadth, connectors, analytics, reporting, and deployment flexibility, while challenges include validating fit of agentless/virtual patching approaches, maturing newly added features, and achieving broader global partner reach.

Interesting Facts

• SAP environments commonly store critical business information in ERP systems, employee “golden source” data in SAP HR, and customer data in SAP CRM.
• SAP systems are major targets for internal and external auditors.
• SAP landscapes can be vulnerable to both internal and external attackers due to complexity and individualized configurations.
• ERPScan was founded in 2010 and has U.S. headquarters in Palo Alto, California.
• ERPScan added a European headquarters in Amsterdam, Netherlands.
• The platform supports blackbox penetration testing scans without authentication.
• Whitebox assessments include checks for misconfiguration in authentication, encryption, monitoring, and excessive user access.
• Compliance checks cover GDPR, SOX, PCI-DSS, and NERC-CIP.
• The solution can be deployed on-premises, in the cloud, or as SaaS.
• The platform can integrate with SAP GRC and export results into SAP GRC Process Control.

Notable Quotes

• “For many enterprises SAP systems are the backbone of the IT infrastructure.”
• “This is often considered the first (and sometimes the only) aspect of SAP security.”
• “Proactive patch management, the identification of unexpected or even rogue user behaviour; and adequate responses to these are aspects gaining more and more importance.”
• “The increasing number of potential threats and threat vectors combined with the lack of experienced security personnel demand intelligent solutions providing assistance in all areas of SAP security including detection and response.”
• “ERPScan extended the current version of the product to provide a holistic approach towards SAP security.”
• “The system is designed to be non-intrusive in that it does not require changes to SAP functionality, configuration or the installation of agents.”
• “All components are designed to be read-only, passive and detective, with a clear focus on identifying and reporting existing vulnerabilities.”
• “This information is then enriched by associating identified vulnerability and risk information, and visualised as a highly intuitive, so-called threat map.”
• “Major improvements have been applied to the user interface, implementing a 3-click strategy for coherently getting to relevant information…”
• “Several newly added features need to be considered as V1.0 offerings with basic functionality and improvement expected over time.”