Topic starter
02/06/2026 7:01 pm
TL;DR: Enterprise risk is now spanning SAP, cloud platforms, infrastructure, and non-human identities, and the article argues that periodic access reviews no longer provide enough context to govern that spread, according to Saviynt. The security question is no longer whether controls exist, but whether identity data, entitlement context, and activity signals are unified enough to manage risk continuously.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “SAP Identity Security and Business Application Risk Management Are at an Inflection Point”.
Key questions
Q: How should security teams govern access across SAP and business applications?
A: Security teams should govern access by linking identity, entitlement, and activity data across systems instead of certifying each application separately.
Q: Why do periodic access reviews miss enterprise risk in hybrid environments?
A: Because they only capture a point in time.
Q: What breaks when SoD is checked only inside one application?
A: Cross-application duty conflicts stay invisible.
Practitioner guidance
- Unify SAP and business-app entitlement data Create a single view of access across SAP, non-SAP business applications, cloud platforms, and infrastructure so risk can be evaluated in context, not per system.
- Model cross-application SoD combinations Define incompatibilities across procurement, finance, HR, and payment workflows so a clean result in one application does not hide a combined duty conflict elsewhere.
- Replace snapshot reviews with continuous monitoring Use ongoing entitlement and activity signals to validate whether access remains acceptable between certification cycles, especially where access changes frequently.
Bottom line: Enterprise risk now crosses SAP, business applications, cloud, infrastructure, and non-human activity, so single-system governance no longer gives a complete control picture.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 7:18 pm
Identity is becoming the enterprise control plane, not just an access layer. The article’s strongest point is that risk is now distributed across SAP, cloud platforms, infrastructure, and non-human identities, so the governance model has to follow identity wherever it operates. That reframes IGA from a control-reporting function into the mechanism that connects access, entitlement, and activity across the environment. Practitioners should treat identity context as the organising control for enterprise risk.
A question worth separating out:
Q: How should organisations connect IAM, PAM, and governance for NHI security?
A: Start by sharing ownership, entitlement, and session context across the three domains. IAM should not make decisions blind to privilege, PAM should not operate without lifecycle context, and governance should recertify based on real usage. The goal is coordinated control, not a unified toolset.
👉 Read our full editorial: Identity-driven risk management for SAP and business apps