Access Control Tools for SAP Environments

SAP remains a core backbone for many enterprises: ERP and HR data, portal-based business processes, SAP HANA data platforms, and ongoing S/4HANA migrations often coexist with custom ABAP/Java enhancements. Because SAP landscapes hold critical business information, they are a primary focus for auditors, making effective access governance—especially access control and segregation of duties (SoD)—a central requirement. At the same time, cloud adoption is expanding the scope beyond classic ABAP-based SAP systems to SAP SaaS (e.g., SuccessFactors, Ariba) and even non-SAP applications, increasing demand for both deeper SAP-specific controls and broader cross-application coverage.

The market segment therefore expands in two dimensions: breadth of supported environments (SAP Business Suite, HANA, S/4HANA, SAP and non-SAP SaaS) and breadth of capabilities (from entitlement/SoD analysis to mitigating access risk via firefighter access, lifecycle management, role optimization, access reviews, dashboards, and integrations with broader IGA platforms). Delivery models are shifting from ABAP-only deployments toward modern web experiences and SaaS, with Fiori as one option among several UI paradigms. KuppingerCole rates solutions primarily on baseline access governance capabilities, while assigning high importance to broad system support.

In leadership ratings, SAP is the clear overall and market leader, driven by scale and ecosystem. Other Overall Leaders include Xpandion, Security Weaver, Akquinet, and Saviynt—representing a spectrum from SAP-deep specialization (Security Weaver, Akquinet) to broader, cross-application approaches (Xpandion, Saviynt). Challengers such as Fastpath, SIVIS, CSI Tools, Soterion, and Wikima4 show differentiated strengths, including heterogeneous application support (Fastpath) and highly usable modern UI with usage-informed risk insights (Soterion). Vendor selection ultimately depends on required depth in traditional SAP versus breadth across heterogeneous and SaaS-heavy landscapes, and should include detailed evaluation plus a proof of concept.

• SAP is clearly ahead of competitors in Overall Leadership for access control tools for SAP environments.
• Overall Leaders are Akquinet, SAP, Saviynt, Security Weaver, and Xpandion.
• Product Leaders are Akquinet, SAP, Saviynt, Security Weaver, SIVIS, and Xpandion.
• Innovation Leaders are Akquinet, SAP, Saviynt, Security Weaver, SIVIS, and Xpandion.
• Market Leaders are SAP, Security Weaver, and Xpandion.
• Akquinet SAST Suite includes more than 4,000 automated checks.
• SIVIS Suite includes close to 20 separate modules.
• A SIVIS module provides more than 1,000 pre-defined roles.
• Fastpath Assure is provided as a SaaS solution.
• Soterion’s Access Risk Manager incorporates historical transaction usage data into its access-risk analysis.

• “Thus, the scope for centralized access controls is expanding beyond the traditional ABAP systems, and even beyond SAP.”
• “However, the tendency appears clear: Away from traditional ABAP, towards modern user experience, supporting the increasingly heterogeneous business application infrastructure.”
• “Picking the right vendor finally always will depend on your specific requirements and your current and future landscape that must be managed.”
• “Innovation is not about delivering a constant flow of new releases.”
• “Vendors below the line have a weaker market position than expected according to their product maturity.”
• “This shows how important a detailed analysis of the offerings in this market segment is, depending on both the required breadth of capabilities (beyond traditional SAP), and in depth (specifically for traditional SAP environments).”
• “The solution is focused on key requirements of customers, for rapid implementation, not overloaded with specialized capabilities.”
• “Amongst the challenges, we identify the current lack of support for SAP SaaS services such as Ariba and SuccessFactors.”
• “While analysis of the static authorizations within SAP environments is common, adding the historical usage data provides better insight into the real access risks.”
• “The Leadership Compass provides a comparison based on standardized criteria and can help identifying vendors that shall be further evaluated.”