SAP Security Run

Someone has to keep SAP secure every month, not only at audit time.

A monthly rhythm for SAP security: patch-day triage, critical access review, monitoring that reaches your security team, and evidence filed as you go. For shops staying on ECC through 2030, and for S/4HANA.

Book a coverage review See what's included

Fixed scope. Ends with a log coverage map and a list of what nobody is checking today.

A month in the run. Drag through the weeks.

example month

Which week is it?Week 1

Done and recorded 0

This week 2

Critical access review
Monitoring and alert review

Planned 5

SAP Patch Day triage
Fix list to your Basis team
Interface and RFC review
Segregation of duties check
Evidence pack update

Week 1: we review who holds critical access. Monitoring review happens every week.

The problem

SAP security is a monthly job that most teams do once a year.

Patches arrive every month
SAP publishes security notes on the second Tuesday of every month. Someone has to decide which ones matter to you.
SAP sits outside the security team
In many companies the security operations team sees nothing from SAP at all.
Access drifts between audits
Roles are added for a project and never removed. Nobody looks until the auditor does.
Staying on ECC raises the stakes
An older system that stays in service longer needs more attention, not less.

An audit checks one day. Attackers get the other 364.

What we do

Connect, triage, review, file the evidence.

Step 01 of 4
Connect the logs
We map which SAP logs reach your security team today, and close the gaps. Where you have Microsoft Sentinel, we use it.
Step 02 of 4
Triage every Patch Day
Each month's SAP security notes, sorted for your systems, in order of urgency.
Step 03 of 4
Review access monthly
Critical access, interfaces and segregation of duties, checked on a fixed rhythm.
Step 04 of 4
File the evidence
Every check leaves a record, so the next audit is a hand-over, not a project.

Step 1 of 4

What you get

Six documents that show SAP is watched all year.

Tap a document to see what's inside.

Each system and its logs
What is monitored today
Gaps, in order of risk

How it fits

Your team applies the fixes. We run the rhythm.

This is a monthly review service. It is not round-the-clock monitoring, and it does not replace your Basis team.

SAP gives you

Notes and logs

Monthly security notes
The security audit log
Tools to apply patches

Microsoft gives you

A place to watch

Sentinel's solution for SAP
Alerts alongside the rest of your estate
Your security team's existing screens

We run

The monthly rhythm

Patch triage for your systems
Access and interface reviews
An ordered fix list for Basis
Evidence filed as we go

Who this is for

You run SAP, and nobody checks it between audits.

You are staying on ECC past 2027.
Your security team has no view into SAP.
Your Basis team is small and already stretched.
The same access and patching findings come back every audit.

How to start

01
Coverage review
Fixed scope. Ends with the log coverage map and the gaps.
02
Set up the rhythm
Detections, runbooks and the monthly calendar, agreed with your teams.
03
Monthly run
The reviews, the fix list and the evidence, every month.

Questions