SAP Security Testing for
the Systems That Run Your Business
SAP holds your financials, supply chain and employee data, which makes it a high-value target. We assess roles and authorisations, system configuration, interfaces and custom code across your SAP landscape, and show you how to close the gaps.
SAP security testing
Hands-On Assessment of Your SAP Landscape, From Roles to Custom Code
Our assessments cover SAP ECC and SAP S/4HANA, SAP Fiori and Gateway, SAP HANA and the interfaces between them. Every finding is validated by a tester and traced to the role, parameter or code that causes it, with a fix your SAP Basis and security teams can apply.
100%
Findings manually validated by a tester
6
Phase, standards-aligned methodology
40+
Enterprise and government clients
15+
Countries served
Why iSpyCyber
Why Organisations Choose iSpyCyber for SAP Security
SAP risk is business risk. Our findings show what could lead to fraud, data theft or downtime, not just which settings differ from a baseline.
Business risk first
We show which findings could lead to fraud, data theft or downtime, so you fix what matters to the business first.
Roles and segregation of duties
Critical authorisations and segregation of duties conflicts are analysed in depth, because excessive access is where many SAP risks begin.
Full landscape view
Application servers, databases, interfaces, web front ends and transports are assessed together, so attack paths between them are not missed.
Custom code included
Custom ABAP is reviewed for missing authority checks, injection and other flaws that configuration checks cannot see.
Safe for production
Most checks are read-only, and any active test is agreed with your SAP Basis team and run at a time that suits you.
Audit-ready evidence
Findings and retest results give your internal and external auditors clear evidence for IT general controls and compliance.
Coverage
What We Test in Your SAP Landscape
From users and roles to interfaces and custom programs, we look at the areas attackers and fraudsters use most.
Roles and authorisations
Critical authorisations such as SAP_ALL and debug access, segregation of duties conflicts and over-privileged users and roles.
Standard and default users
Users such as SAP*, DDIC and TMSADM, default passwords, and the control of emergency and firefighter access.
System configuration
Security-relevant profile parameters, password and logon policies, and client and system change settings.
RFC and gateway security
RFC destinations with stored credentials, trusted system relationships, and gateway and message server access control lists.
SAP Fiori, Gateway and web services
ICF services, OData services and Fiori apps exposed to users and the internet, tested for access control and injection flaws.
Custom ABAP code
Missing authority checks, SQL and command injection, directory traversal and hard-coded credentials in custom programs.
SAP HANA and databases
Database users and privileges, encryption, and direct database access that bypasses SAP application controls.
Patching and SAP Security Notes
Missing SAP Security Notes and support packages, prioritised by exploitability and exposure.
Logging and monitoring
The Security Audit Log, change documents and table logging, and whether critical activity would be detected.
Methodology
A Six-Phase SAP Testing Methodology
Aligned to NIST SP 800-115 and SAP security guidance, with every finding risk-rated using CVSS.
Phase 01
Scope and plan
We agree the systems, clients and interfaces in scope, the access we need and the test windows with your SAP Basis team.
Output: Signed scope and test plan
Phase 02
Configuration and patch review
Review of security parameters, default users, interfaces and missing SAP Security Notes, using read-only access.
Output: Validated configuration findings
Phase 03
Authorisation analysis
Analysis of users and roles for critical authorisations and segregation of duties conflicts.
Output: Access risk analysis
Phase 04
Exploit and validate
Testers confirm exposed services, interface weaknesses and code flaws by hand, within agreed limits.
Output: Evidence for each finding
Phase 05
Report and debrief
A risk-rated report with evidence and fixes, walked through with your SAP, security and audit teams.
Output: Report and debrief session
Phase 06
Fix and retest
We retest remediated findings and issue an updated report confirming closure.
Output: Retest report
Engagement models
Choose the Assessment That Fits Your Landscape
Start with a configuration and authorisation review, add penetration testing, or focus on your custom code.
Configuration and authorisation review
A read-only review of system settings, users, roles and patch levels.
Best for: Regular assurance and audit evidence
SAP penetration test
A configuration review plus hands-on testing of interfaces, web front ends and exposed services.
Best for: Internet-facing and business-critical systems
Custom code review
A manual-led review of custom ABAP for security flaws, with fixes your developers can apply.
Best for: Heavily customised systems and new developments
Not sure which approach you need?
Tell us about your environment and we will recommend the right scope.
Deliverables
Reports Built for Leadership, Engineering and Auditors
Executive summary
Business risk in plain language, with an overall rating and the issues leadership and audit need to know about.
Technical findings
Each finding with affected systems, evidence, a CVSS rating and step-by-step remediation.
Remediation roadmap
Fixes prioritised by risk and effort, including the SAP Security Notes and role changes to apply.
Retest report
Confirmation of which findings are closed, for your records and auditors.
Standards
Supports Your Compliance and Assurance Requirements
- ITGC and SOX
- ISO/IEC 27001
- SOC 2
- PCI DSS
- DPDP Act 2023
- GDPR
- RBI guidelines
- SEBI CSCRF
- NIST SP 800-115
- OWASP Top 10
iSpyCyber provides testing and evidence that support these requirements. Certification and attestation are issued by accredited bodies and auditors.
SAP, SAP S/4HANA, SAP Fiori and SAP HANA are trademarks or registered trademarks of SAP SE. iSpyCyber is not affiliated with SAP SE.
FAQ
SAP security testing questions, answered
The basics
What is SAP security testing?
An assessment of the users and roles, configuration, interfaces and custom code of your SAP systems to find weaknesses that could lead to fraud, data theft or disruption, with clear steps to fix them.
Which SAP systems do you assess?
SAP ECC and SAP S/4HANA, SAP NetWeaver ABAP and Java systems, SAP Fiori and Gateway, SAP HANA databases and the interfaces between them. Tell us about your landscape and we will confirm the scope.
Do you check segregation of duties?
Yes. We analyse users and roles for critical authorisations and common segregation of duties conflicts, and can align the analysis with your own rule set if you have one.
Working with us
Will testing affect our production SAP system?
Most checks are read-only. Any active testing is agreed with your SAP Basis team, limited in scope and scheduled for a suitable time. Where possible, we test on a quality or pre-production system that mirrors production.
What access do you need?
Usually a user with read-only access to system and security settings, plus network access to the systems in scope. We agree the exact access with your team in advance.
How long does an SAP security assessment take?
It depends on the number of systems and clients and whether custom code is included. We confirm the timeline in our proposal after a short scoping call.
Do you retest after we fix the issues?
Yes. Once you have remediated, we retest each finding and issue an updated report confirming which issues are closed.
Still have a question? Talk to our security team.