Topic starter
11/06/2026 11:12 pm
TL;DR: SAP remains a prime target because it holds critical business data, while attackers use public-facing exposures, identity abuse, and CVEs such as CVE-2025-31324 to reach databases and exfiltrate data, according to Acalvio. Preemptive deception, not prevention alone, is the practical control shift when patching lags and detection on SAP is incomplete.
Editorial analysis by NHI Mgmt Group, based on content published by Acalvio: “Beyond patching: why preemptive defense is essential to secure SAP”.
Key questions
Q: What breaks in SAP security when patching is the main defence?
A: Patching fails as a complete defence when attackers can use a single exposed SAP path, move faster than maintenance cycles, or pivot through trusted internal identities before remediation lands.
Q: Why do SAP service accounts create a larger risk than ordinary internal users?
A: SAP service accounts often carry direct reach into databases, middleware, or directory-linked trust paths that ordinary users never touch.
Q: How can security teams tell whether SAP detection is actually working?
A: Detection is working only if teams can see exploit attempts, service-account misuse, and database access paths early enough to intervene before data movement starts.
Practitioner guidance
- Map SAP service accounts as privileged attack paths Identify every SAP service account, database link, and directory-backed identity that can reach production data, then classify them by the blast radius they create if misused.
- Deploy decoys on public-facing SAP attack surfaces Place believable SAP NetWeaver or database decoys on internet-facing assets so exploit attempts generate high-confidence alerts before real systems are touched.
- Use honeytokens for identity-based tripwires Seed deceptive credentials in Active Directory and endpoint locations that attackers are likely to enumerate, then route any use attempt into SOC triage.
Bottom line: SAP security fails when organisations rely on patch cycles and segmentation as if they were complete containment controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 7:46 am
Prevention-only SAP security is an incomplete model: Patching and segmentation reduce exposure, but they do not answer the harder question of what to do once an attacker reaches a trusted SAP pathway. SAP estates are too operationally dense for patch cycles and network boundaries to function as the sole line of defence. The practical implication is that security programmes must assume initial access will happen and measure whether they can detect, divert, and contain the next step.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when SAP logs and EDR coverage are incomplete?
A: Treat incomplete telemetry as a structural condition, not a temporary gap. Build tripwires with deceptive identities and decoy assets, then route any interaction with them into SOC workflows so hostile movement becomes observable even when native logs are weak. The goal is earlier detection, not perfect endpoint visibility.
👉 Read our full editorial: SAP security needs preemptive defense beyond patching and segmentation