TL;DR: Enterprise risk is now spanning SAP, cloud platforms, infrastructure, and non-human identities, and the article argues that periodic access reviews no longer provide enough context to govern that spread, according to Saviynt. The security question is no longer whether controls exist, but whether identity data, entitlement context, and activity signals are unified enough to manage risk continuously.
At a glance
What this is: This is an analyst-style argument that enterprise risk management for SAP and business applications now has to follow identity and activity across systems, not stop at individual application controls.
Why it matters: It matters because IAM, IGA, PAM, and NHI programmes all inherit the same blind spot when they certify access in one system without seeing how that access combines and behaves elsewhere.
Context
Identity-driven risk management is the shift from reviewing access inside one application to governing how access and activity combine across SAP, business applications, cloud platforms, and infrastructure. The article argues that the control point is no longer the system boundary but the identity layer that moves across those systems.
That matters for enterprise governance because periodic certifications only provide a snapshot, while risk in modern estates is created continuously as entitlements change and are used. The article also extends the problem to non-human identities and automated activity, which means the same governance model has to span human, machine, and AI-driven access patterns.
Key questions
Q: How should security teams govern access across SAP and business applications?
A: Security teams should govern access by linking identity, entitlement, and activity data across systems instead of certifying each application separately. The goal is to identify toxic combinations, cross-system approval paths, and privilege accumulation that only appear when workflows are analysed end to end. That requires continuous context, not a once-a-quarter snapshot.
Q: Why do periodic access reviews miss enterprise risk in hybrid environments?
A: Because they only capture a point in time. In hybrid estates, access changes continuously across cloud platforms, infrastructure, and business systems, so a certification can be valid when signed and stale almost immediately after if the entitlement is combined with other access or used in a different context.
Q: What breaks when SoD is checked only inside one application?
A: Cross-application duty conflicts stay invisible. A user can look compliant in SAP or in a business app on its own, yet still hold a toxic combination when procurement, payment, finance, or HR entitlements are considered together.
Q: How should organisations connect IAM, PAM, and governance for NHI security?
A: Start by sharing ownership, entitlement, and session context across the three domains. IAM should not make decisions blind to privilege, PAM should not operate without lifecycle context, and governance should recertify based on real usage. The goal is coordinated control, not a unified toolset.
Technical breakdown
Why SAP access control no longer contains enterprise risk
SAP Access Control was built to govern risk within a single application boundary, but modern enterprise risk now forms across multiple systems. Segregation of Duties conflicts can emerge only when entitlements in two or more applications are combined, which means a clean result in one system can still produce risk elsewhere. That is why application-local controls miss the wider pattern. Identity context has to be joined to entitlement data and activity signals before the control plane can explain what access really means across the estate.
Practical implication: Treat SAP-local certification as incomplete unless it is joined to cross-application entitlement analysis.
How cross-application SoD risk appears in business applications
Business Application Risk Management addresses risk that is distributed across systems such as procurement, finance, CRM, and HR platforms. The key technical issue is not only whether a user has access, but whether that access in combination with other access creates an incompatible duty chain. In practice, this requires correlation across heterogeneous entitlements and workflow paths, not a static role review. Without that correlation, the same user can appear compliant in each application while still creating a fraud or control failure when the systems are considered together.
Practical implication: Map SoD rules to cross-system entitlement combinations instead of evaluating each application in isolation.
Why continuous visibility matters more than periodic reviews
Periodic access reviews are snapshot controls. They can confirm whether access was approved at a point in time, but they do not explain how access is being used between review cycles, nor do they keep pace with fast-changing environments. As access is created, modified, and consumed across cloud platforms and infrastructure, the risk picture changes too quickly for point-in-time governance to stay current. Continuous visibility closes that timing gap by tying entitlement context to actual activity so that governance reflects the live state of the estate.
Practical implication: Shift from certification-only governance to continuous entitlement and activity monitoring.
Breaches seen in the wild
- SAP Kubernetes secrets exposure 2023: Kubernetes secrets committed to GitHub exposed 203 valid registry credentials, including SAP artifact repository access. SAP closed it after Aqua's report.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity is becoming the enterprise control plane, not just an access layer. The article’s strongest point is that risk is now distributed across SAP, cloud platforms, infrastructure, and non-human identities, so the governance model has to follow identity wherever it operates. That reframes IGA from a control-reporting function into the mechanism that connects access, entitlement, and activity across the environment. Practitioners should treat identity context as the organising control for enterprise risk.
Cross-application risk is a governance problem, not an application problem. A user can be compliant in each system and still create unacceptable risk when those entitlements are combined. That is why isolated SAP controls and isolated business-app controls both fail to see the full duty chain. The practical conclusion is that governance has to evaluate combinations of access, not just individual approvals.
Periodic certification assumes risk is stable enough to be sampled, and that assumption is no longer valid. The article makes clear that access and activity are continuously changing, especially in hybrid estates where cloud and infrastructure expand the blast radius. Snapshot reviews were designed for slower-moving environments. The implication is that identity governance must move closer to runtime context and live entitlement state.
Identity-driven risk management: This article is really describing a named operating model in which identity becomes the common control layer for SAP, business applications, cloud, and non-human activity. That model matters because it links governance, PAM, and risk intelligence into one decision surface instead of four disconnected ones. Practitioners should think in terms of unified identity control rather than separate application governance projects.
Governance for non-human and AI-driven activity is now part of the same risk equation. The article is explicit that automated processes and AI-driven activity belong inside the governance perimeter, not outside it. That widens the scope of enterprise risk management beyond user lifecycle and into machine and agent behaviour. The practical conclusion is that identity programmes must stop treating non-human access as an exception case.
What this signals
Identity-driven risk management: SAP governance is no longer a narrow application-control problem. Once access crosses into business apps, cloud platforms, and infrastructure, the programme has to evaluate combined entitlements and live usage rather than relying on isolated certification outcomes.
The governance gap is timing as much as scope. Periodic reviews can still be useful, but they need to sit inside a continuous model that sees how access is created, changed, and exercised across the enterprise.
For practitioners, the practical shift is to build one entitlement and activity view across human, machine, and automated access paths, then use that view to prioritise SoD conflicts and privileged exposure before audit pressure forces the issue.
For practitioners
- Unify SAP and business-app entitlement data Create a single view of access across SAP, non-SAP business applications, cloud platforms, and infrastructure so risk can be evaluated in context, not per system.
- Model cross-application SoD combinations Define incompatibilities across procurement, finance, HR, and payment workflows so a clean result in one application does not hide a combined duty conflict elsewhere.
- Replace snapshot reviews with continuous monitoring Use ongoing entitlement and activity signals to validate whether access remains acceptable between certification cycles, especially where access changes frequently.
- Bring non-human identities into governance scope Apply the same review, risk scoring, and approval logic to automated processes and AI-driven activity that you use for human users and privileged accounts.
Key takeaways
- Enterprise risk now crosses SAP, business applications, cloud, infrastructure, and non-human activity, so single-system governance no longer gives a complete control picture.
- The article’s evidence points to a structural gap in periodic reviews, which cannot keep pace with access that changes and combines continuously across systems.
- Practitioners need continuous, cross-application identity governance that joins entitlements and activity so SoD, audit, and privilege risk can be assessed in context.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article extends governance to non-human and automated access that can widen enterprise risk. |
| Recommendation — Review non-human access scope and remove privileges that are not needed across business systems. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on entitlement governance across applications and hybrid environments. |
| Recommendation — Apply PR.AA-05 to evaluate entitlements continuously across SAP, business apps, and cloud platforms. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Cross-application risk grows when access is broader than the task requires. |
| Recommendation — Use AC-6 to limit combined access paths that create SoD or privilege risk across systems. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article discusses how access and activity combine across systems in ways that are hard to control. |
| Recommendation — Map cross-system access paths to TA0006 and TA0008 when entitlement combinations expand the attack surface. | ||
Key terms
- Identity-Driven Risk Management: An approach that treats identity as the main control surface for enterprise risk across applications, infrastructure, and automation. It combines entitlement, activity, and ownership data so practitioners can see how risk forms across systems rather than inside one product boundary.
- Cross-Application Risk: Risk that emerges only when access and workflow data from multiple systems are evaluated together. A user or service account may appear compliant in one application while still creating a toxic combination or fraud path when combined with privileges in another system.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- Continuous visibility: The ability to observe control operation, exceptions, and remediation as they happen across systems. In identity and governance programmes, continuous visibility means teams can trace who approved what, what changed, and whether the control actually executed without waiting for a later review cycle.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 2, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org