SAP Security: A structured approach to achieving transparency in the SAP environment
How organisations can identify blind spots in SAP systems
SAP systems manage key business processes in finance, production, procurement and human resources. Traditional security architectures protect networks, endpoints and infrastructure. However, SAP-specific activities and attack patterns often remain a blind spot.
In this Expert Talk at the IT Online Conference 2026, Christian Schuller, Security Consultant, and Steven Schütz, Head of SAP Managed Services, describe how this blind spot arises, what risks it poses in day-to-day operations, and how to get started with SAP-specific threat detection without launching a project that takes months.
Watch the full recording, which lasts around 50 minutes including a Q&A session.
- Identifying typical vulnerabilities in SAP landscapes
- Understand why a SIEM alone cannot detect SAP threats
- Clarify responsibilities within RISE with SAP
- Understand NIS2 requirements for senior management
Why this Expert Talk is relevant
Many companies treat SAP security as a specialised technical matter for the Basis department. This is precisely where the gap arises: Basis teams are judged on availability, security teams often lack access to SAP systems, and no one is explicitly responsible for SAP security in particular.
Two developments are increasing the pressure: from December 2025, new requirements for NIS2-regulated organisations will come into force under the NIS2 Implementation Act. Senior management is responsible for implementing and monitoring the prescribed risk management measures and must attend regular training sessions.
At the same time, the window of opportunity for companies to respond to new vulnerabilities is narrowing. This makes it all the more important to detect suspicious activity in SAP systems at an early stage.
Who this Expert Talk is aimed at
This Expert Talk is aimed at specialists and managers with responsibility for SAP operations, SAP security, governance and IT risks. It combines the management and technical perspectives and highlights the need for action as well as concrete starting points for implementation.
Questions answered by the Expert Talk
- Where do typical security vulnerabilities arise in SAP landscapes?
- Why are SAP log data in the SIEM alone not sufficient?
- What role does the SAP Security Audit Log play in threat detection?
- How can critical alerts be responded to without jeopardising SAP operations?
- What security responsibilities remain with the organisation under RISE with SAP?
The speakers
Christian Schuller, Security Consultant, Claranet
Christian Schuller advises companies on SAP security and supports the planning and implementation of security measures in complex SAP landscapes.
Steven Schütz, Head of SAP Managed Services, Claranet
Steven Schütz is responsible for the operation of SAP environments, ranging from on-premises to the hybrid cloud. As deputy spokesperson for the DSAG working group ‘SAP with Microsoft’, he brings additional expertise to the interface between SAP operations, the cloud and security.
Taking a structured approach to SAP security
Three recommendations from the Expert Talk can be put into practice immediately: Clarify who in your organisation is responsible for SAP security. Check maintenance windows and test processes for periods during which known vulnerabilities have not yet been rectified. And ensure that your monitoring is configured appropriately and that security-relevant data is actually being analysed.
Would you like to explore the topic of SAP security in more depth for your organisation? A no-obligation 30-minute initial consultation provides time to discuss your questions, your current situation and possible next steps.