ABAP code is the custom application logic used to extend or modify SAP systems. Because it can change business behaviour, it must be governed like production software. Security teams should review it for unsafe logic, unauthorized access paths, and controls that prevent unapproved changes from reaching live environments.
Expanded Definition
ABAP code is the custom logic that shapes how SAP systems validate transactions, move data, and enforce business rules. In practice, it functions as production software inside an enterprise platform, so it must be treated as a governed change surface rather than a harmless configuration layer. That matters because ABAP can introduce new authorization checks, expose tables, call remote functions, or bypass standard controls if it is written or transported poorly.
For NHI and IAM teams, ABAP is relevant wherever service accounts, technical users, background jobs, or integration paths interact with SAP. Definitions vary across vendors when people describe “SAP security” as a single control domain, but ABAP should be separated from generic access administration because code-level logic can create access paths that no role review will catch. The most relevant external framing is the NIST Cybersecurity Framework 2.0, which emphasizes controlled change, access governance, and risk reduction across the full system lifecycle.
The most common misapplication is treating ABAP review as a one-time developer task, which occurs when security teams only inspect code after transport requests are already approved.
Examples and Use Cases
Implementing ABAP governance rigorously often introduces release friction, requiring organisations to weigh delivery speed against the cost of catching unsafe logic before it reaches production.
- A custom report reads sensitive HR tables and exports results to a file share, so reviewers check for authorization checks, logging, and data minimization.
- An ABAP function module is called by an integration service account, so teams verify whether it exposes a broader access path than the role assignment suggests.
- A transport contains a change that disables validation during batch processing, so change management confirms that the code cannot be promoted without peer review and testing.
- A background job runs under a technical user with broad privileges, so IAM teams assess whether the account is over-privileged and whether the job depends on long-lived secrets.
- A developer hardcodes credentials or connection parameters into ABAP, which is a direct secrets handling failure and should be reviewed against the guidance in the Ultimate Guide to NHIs and standard identity hygiene practices described by NIST Cybersecurity Framework 2.0.
ABAP also appears in migration, outsourcing, and ERP modernization programs, where third-party developers may change business logic without fully understanding the security impact.
Why It Matters in NHI Security
ABAP matters in NHI security because it can silently expand what a non-human identity is allowed to do. When ABAP code invokes privileged functions, weakens authorization logic, or stores secrets in code, the system may still appear compliant at the role level while actually enabling unauthorized machine action. That is especially dangerous in SAP environments where background processing and technical users are common and often under-reviewed.
NHI Mgmt Group research shows that Ultimate Guide to NHIs reports 30.9% of organisations store long-term credentials directly in code, which makes source-level review a security requirement, not a nice-to-have. The same research also notes that 97% of NHIs carry excessive privileges, a pattern that becomes more dangerous when custom ABAP logic can invoke those privileges without compensating controls. In governance terms, ABAP review supports the broader control intent of the NIST Cybersecurity Framework 2.0 by tying code change, access control, and operational resilience together.
Organisations typically encounter ABAP as a security issue only after an incident, unauthorized transport, or audit finding reveals that custom logic changed production behavior in ways role reviews never captured.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
