Enterprise resource planning systems centralise core business processes and the data that supports them. In security terms, they are high-value targets because finance, HR, supplier, and operational records often sit behind the same access paths and privilege model.
Expanded Definition
Enterprise resource planning, or ERP, refers to tightly integrated business systems that share transaction data, identity controls, and workflow logic across finance, HR, procurement, inventory, and operations. In NHI security, the key issue is not the application label but the concentration of privileged access paths and machine-to-machine dependencies. An ERP platform often becomes a control plane for both humans and automated processes, which makes its service accounts, API keys, integrations, and batch jobs part of the security boundary.
Definitions vary across vendors when ERP extends into cloud add-ons, embedded analytics, or low-code automation. The operational question is whether the system enforces strong segregation between human users, application identities, and administrative functions. That distinction aligns with the risk-based approach in the NIST Cybersecurity Framework 2.0 and with NHI governance guidance in the Ultimate Guide to NHIs — Why NHI Security Matters Now.
The most common misapplication is treating ERP access as a single user-permission problem, which occurs when service accounts and integrations inherit broad entitlements without separate lifecycle controls.
Examples and Use Cases
Implementing ERP access rigorously often introduces operational friction, requiring organisations to weigh business continuity against tighter privilege boundaries, more approvals, and slower emergency changes.
- A finance bot posts invoices into the ERP through an API key that is rotated and monitored like any other secret, rather than being embedded in a deployment script.
- An HR integration uses a dedicated service account with scoped permissions for employee records, reducing the blast radius if the connector is compromised.
- A procurement workflow calls an external supplier portal from the ERP and must authenticate with short-lived credentials instead of a long-lived shared token.
- An administrator reviews dormant ERP accounts after a role change and disables access that is no longer needed for daily operations.
- Security teams trace a hard-coded credential in a legacy integration after studying exploitation patterns such as the ASP.NET machine keys RCE attack and Gladinet Hard-Coded Keys RCE Exploitation.
These patterns map well to federation and workload identity practices described by SPIFFE, especially when ERP workflows span multiple services and deployment environments.
Why It Matters in NHI Security
ERP environments are attractive to attackers because they concentrate payroll, supplier payments, customer data, and operational records behind a limited number of privileged paths. When non-human identities inside ERP are poorly governed, the compromise is often not just access loss but business process manipulation. NHIMG research shows that 97% of NHIs carry excessive privileges, which means ERP connectors, schedulers, and integration accounts are frequently over-scoped by default. That is especially dangerous when secrets are stored outside dedicated controls, as highlighted by the Ultimate Guide to NHIs from NHI Mgmt Group.
ERP also matters in Zero Trust programs because identity boundaries must extend to machines, not only employees. If an organisation cannot inventory which service accounts can approve payments, alter vendor records, or export HR data, it cannot enforce meaningful least privilege or incident containment. In practice, ERP mismanagement turns ordinary automation into durable attack infrastructure, a problem that the NIST Cybersecurity Framework 2.0 helps structure through access, monitoring, and recovery outcomes. Organisations typically encounter the true severity of ERP identity risk only after a fraudulent transaction, data exfiltration, or integration outage, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | ERP service accounts and API keys are NHI assets that need inventory and ownership. |
| NIST CSF 2.0 | PR.AC-1 | ERP access hinges on authenticated identities and controlled access paths. |
| NIST Zero Trust (SP 800-207) | SP 800-207 | ERP integrations should be continuously evaluated under Zero Trust principles. |
| NIST AI RMF | ERP automation and AI-assisted workflows need risk-based governance and monitoring. | |
| OWASP Agentic AI Top 10 | A-01 | Agentic ERP automations can overreach if their tool access is not constrained. |
Catalog ERP machine identities, assign owners, and review each integration for least privilege.
