What counts as one landscape?
One SAP product line with its system chain: for example your S/4HANA or ECC with its DEV, QA and production systems plus the database underneath. If you run several separate product lines (say ECC, BW and Solution Manager), each is its own landscape, and every additional landscape costs 20% less. If you are unsure how your setup counts, send me the system list and you will get a straight number before anything starts.
What access do you need to our SAP system?
For a Security Check, a named read-only account with display authorisations plus VPN or jump-host access, the same path your own administrators use. Nothing is installed, no agent, no external scanner pointed at your network. For patch implementation we agree on a separate change-capable account and a maintenance window in advance. An NDA is signed before any access is granted.
Will you touch production without us knowing?
No. Detection work is read-only by design. Every change, whether a note implementation, a parameter change or a role adjustment, goes through your own change process: tested in DEV, validated in QA, transported to production in an agreed window, and documented afterwards.
We already have a Basis team. Why would we need you?
Because Basis and Security are different skill sets. Your Basis team keeps the systems running, applies support packages and manages transports. SAP Security is authorisations, exploitability assessment, hardening, audit controls and the SAP-specific threat landscape. I work alongside the Basis team, not instead of it. Most clients keep their Basis team exactly as it is and plug the security gap.
Do we need SAP GRC or a commercial scanning tool first?
No. Everything in the Security Check is done with what SAP already gives you plus my own analysis, with no licence purchase required. If you already own GRC or a third-party SAP security tool, I will use it and help you get real value out of it rather than selling you another one.
How long does a Security Check take?
About two weeks from the moment access works, for one landscape including its DEV and QA systems. The result is a prioritised report plus a one-hour call to walk through it. Urgent cases before an audit date can be compressed, so tell me the deadline on the first call.
Our audit is in four weeks. Is that too late?
Usually not. Four weeks is enough for a gap analysis, the quick wins that remove the most likely findings, and a prepared evidence pack. What cannot be done in four weeks is a full role redesign, so we triage: fix what the auditor will look at, and put the rest on a documented remediation plan, which auditors accept far better than an unexplained gap.
Which SAP versions and databases do you cover?
SAP ABAP (classic ECC and NetWeaver) and S/4HANA on the application side. On the database side SAP HANA, plus Oracle, IBM DB2, MaxDB and Sybase ASE for older landscapes. Gateway, Web Dispatcher, SAProuter and RFC interfaces are part of every review.
Can you forward SAP security events into our SIEM?
Yes. That means configuring the Security Audit Log and table logging so they contain the events that matter, then getting them into your SIEM or SOC with detection rules tuned for SAP, so your SOC sees a real SAP alert instead of thousands of unreadable lines.
How do you handle our data and confidentiality?
NDA first, always. Reports stay on EU infrastructure and no business data is extracted, only the configuration, authorisation and log metadata needed for the analysis. If your policy requires it, I work entirely inside your environment and leave no copies behind.