ERP systems run finance, payroll, procurement and the supply chain, yet they often sit outside the vulnerability scanning, code review and threat detection that cover the rest of the estate. Attackers have noticed, so prompt patching of ERP platforms matters. General-purpose security tools rarely understand ERP internals such as transports, custom ABAP or PL/SQL code, authorisation objects and responsibilities. This vendor-neutral buyer's guide covers the four capability families buyers usually evaluate: vulnerability and patch management, transport and code review, segregation of duties and access control, and threat detection. ERP platforms are named alphabetically (Oracle, SAP); order is not a ranking. It is for security, ERP basis and internal audit teams.
Key takeaways
- ERP-aware tools are a separate category. Generic scanners and SIEM content miss ERP-specific configuration, notes, transports and authorisation logic.
- Patch intelligence must follow the vendor calendars. SAP publishes security notes on the second Tuesday of each month; Oracle publishes quarterly Critical Patch Updates, and its security alerts page now also lists monthly Critical Security Patch Updates.
- Segregation of duties needs ERP-level detail. Conflicts live in transactions, authorisation objects and responsibilities, not in directory groups.
- Detection depends on log coverage. A tool can only alert on what the ERP logs, so check which logs it reads and what it needs you to enable.
- Service and integration accounts are the quiet risk. RFC users, interface accounts and application service accounts often hold broad rights and static passwords.
Define requirements
- Landscape: which ERP products and versions (for example Oracle E-Business Suite or Fusion, SAP ECC, S/4HANA, BTP), how many systems and clients, on-premises or cloud, and which are internet-facing.
- Drivers: SOX or other financial controls, sector regulation, audit findings, a past incident or an upcoming migration.
- Ownership: who runs the tool (security operations, ERP basis team or internal audit) and who acts on findings.
- Custom code: volume of custom ABAP, PL/SQL or extensions, and how changes move through transports or patches.
- Access governance: whether an identity governance platform already handles SoD, or the ERP tool must.
- Integrations: SIEM, ticketing, change management and identity governance targets.
Platform hardening itself is covered in the SAP NetWeaver and S/4HANA Basis Hardening Guide and the Oracle E-Business Suite and Fusion Security Guide.
Capability areas
| Capability family | What it does | What to look for |
|---|---|---|
| Vulnerability and patch management | Finds missing security notes and patches, insecure parameters and exposed services | Coverage of monthly SAP notes and Oracle quarterly and out-of-band updates, KEV flagging, prioritisation by exposure, configuration baselines, agentless or light-agent scanning |
| Transport and code review | Scans custom code and changes before they reach production | ABAP and PL/SQL rules for injection, missing authority checks, hard-coded credentials and directory traversal; transport gating; integration with change approval; low false positive rate |
| SoD and access control | Detects conflicting rights and governs emergency access | Rule sets at transaction, authorisation object and field level, or responsibility and function level; mitigating controls; firefighter or emergency access with session logging and review; role simulation before assignment |
| Threat detection | Monitors ERP logs for attacks and misuse | Parsing of security audit, change, gateway and web logs; detections for new admin users, debug and replace, RFC abuse, mass data extraction and suspicious template or upload activity; SIEM forwarding |
| Integration and service account control | Inventories non-human accounts and interfaces | Discovery of RFC destinations with stored credentials, interface users with broad profiles, password age and last use. See the SAP Identity and Access Security Guide |
Suite or best of breed
Some buyers want one product covering all four families; others combine an identity governance platform for SoD with a separate ERP security tool for vulnerabilities and detection. A suite simplifies reporting and suits large landscapes with a dedicated ERP security team. Best of breed suits organisations where SoD is already run by audit or an IGA platform and the gap is technical security. Small organisations with one ERP system often start with patch and configuration assessment plus log forwarding, then add SoD tooling when audit requires it.
Patch cadence the tool must track
| Platform | Scheduled releases | Out of band | What the tool should do |
|---|---|---|---|
| Oracle | Critical Patch Updates on the third Tuesday of January, April, July and October; Critical Security Patch Updates on the third Tuesday of the other months (first released 28 May 2026, as listed on Oracle's security alerts page, checked 8 November 2026) | Security Alerts for fixes too critical to wait | Map each update to installed products and versions, flag internet-facing systems first |
| SAP | Security Patch Day on the second Tuesday of every month, with Patch Day Security Notes and Support Package Security Notes | Track SAP for Me for any note released or revised outside Patch Day | Compare implemented notes per system against the full list in SAP for Me, flag KEV entries |
Evaluation criteria
| Criterion | Minimum acceptable | Strong |
|---|---|---|
| Product coverage | Your main ERP product and version | All ERP products, cloud and on-premises, plus underlying databases and application servers |
| Patch content speed | Checks added within the month | Checks within days of vendor release, KEV entries highlighted |
| Code analysis depth | Pattern rules on custom code | Data flow analysis, authority check detection, transport gating |
| SoD granularity | Transaction-level rules | Object and field level, cross-system rules, simulation and mitigation tracking |
| Detection content | Basic audit log alerts | Maintained detections mapped to known exploitation, SIEM-ready events |
| Operational load | Documented system impact | Read-only technical user with least privilege, measured performance impact |
| Tool's own access | Dedicated technical account | Minimal authorisations documented per feature, credentials held in a vault, no shared passwords |
Questions to ask vendors
- Which ERP products, versions and cloud editions do you cover today, and which are on the roadmap?
- How soon after a vendor patch day do your checks appear, and how quickly do you add checks for actively exploited ERP flaws?
- Exactly which authorisations or database privileges does your technical user need, and can we reduce them per feature?
- Which ERP logs must we enable for your detections, and what is the expected storage and performance cost?
- How are SoD rule sets maintained, and can we import our existing rules and mitigating controls?
- Can code scans block a transport or patch, and how are false positives suppressed and reviewed?
- How do you find RFC destinations, interface users and service accounts with stored or never-changed passwords?
Red flags
- A technical user that needs full administrative profiles such as SAP_ALL or DBA rights to scan.
- Patch content that lags vendor releases by more than a month.
- SoD analysis that only reads directory groups or role names.
- "ERP detection" that turns out to be generic SIEM rules with ERP labels.
- No answer on service accounts, even though ERP application operating system accounts are a target in real attacks. See the Oracle E-Business Suite Exploitation 2025.
- Code scanning that cannot find hard-coded credentials, the flaw class behind SAP SQL Anywhere Monitor Hard-Coded Credentials 2025.
Proof of concept
- Scan one non-production system of each ERP product you run and compare missing patches and settings with your basis team's own records.
- Seed a test transport or patch with known insecure code (missing authority check, hard-coded password) and confirm the scan blocks or flags it.
- Load your SoD rule set, run it against a copy of production roles and check results against your last audit.
- Trigger test events (new privileged user, debug change, mass table download) and confirm alerts reach the SIEM within minutes.
- Review the tool's technical user authorisations with your basis team and record the least set that works.
- Measure system load during scans and agree scan windows.
How NHI Mgmt Group can help
We provide independent requirements and evaluation support for identity, access and application security programmes, including the ERP service accounts, RFC users and integration credentials that these tools must find. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Oracle E-Business Suite and Fusion Security Guide · SAP Identity and Access Security Guide · SAP BTP Security Guide · CIS Control 7 Continuous Vulnerability Management Guide