SAP systems are increasingly in attackers' crosshairs. Each migration to RISE, S/4HANA, or BTP expands the attack surface further. Onapsis Research Labs has published its SAP security checklist for 2026 with concrete recommendations for security teams.
Automate Patch Management
Vulnerability and patch management deserves particular attention. This includes timely implementation of SAP Security Notes and HotNews, review of security-critical configurations, and hardening of components like SAProuter, Web Dispatcher, and encrypted communication channels.
Many organizations still rely on manual processes, creating unnecessary risk exposure. Automated security note reviews offer clear advantages in speed, efficiency, and contextual enrichment compared to manual workflows.
Identity Management and Threat Detection
Overprivileged user accounts remain among the most common security risks in enterprise applications. Regular reviews of authorization concepts, segregation of duties, privileged accounts, and emergency access are non-negotiable. Multi-factor authentication should be consistently enforced for administrators and external access.
The ability to detect attacks early is growing in importance as AI-assisted attack methods become more capable. SAP-specific threat detection solutions and integration of SAP telemetry data into existing SIEM and SOAR platforms are strongly recommended.
Getting Cloud Responsibility Right
As business-critical processes move to the cloud, the shared responsibility model becomes more significant. Even when infrastructure is managed by the provider, responsibility for business data, user access, authorization concepts, APIs, and custom code stays with the customer organization.
Regulatory requirements such as ISO 27001, DORA, NIS2, and NIST should be continuously reflected in SAP security controls. Regularly tested backup and disaster recovery concepts, as well as targeted training for SAP, IT, and SOC teams, complete a solid security posture.