The actual state, measured
The review reads the configuration actually active on the system, not just the declared parameters, for example the gateway rules really loaded. Each finding carries the measured value and its evidence.
Technical security review of SAP
An architect's view of your SAP systems' security, backed by a structured analysis method. You receive a prioritised assessment and actionable recommendations, not a raw list of alerts.
What makes the difference
More than a list of green or red checks: an architect's analysis, backed by evidence.
A 360° analysis
Findings are read together, with their dependencies and the safeguards that offset them: a weakness covered by an upstream firewall does not have the same priority as an exposed one. No all-or-nothing, but justified priorities.
Beyond standard checks
Encryption, certificates, exposed web services, audit logging: the review covers what the vendor's standard reports, such as EarlyWatch, do not look at, and complements them without replacing them.
A reproducible result
A deterministic method, 100% local, with no hallucinations: the collected data stays protected, and the same system gives the same result. A genuine audit deliverable, with every finding traceable and explained.
What is checked
Seven areas.
Kernel protection and patches
Kernel and SAP_BASIS versions checked against published vulnerabilities, exposure of kernel services.
Exposed web services
Configuration of exposed web services, authentication modes, encryption.
Critical system authorisations
Overly broad profiles, administration and development rights, access to sensitive tables, programs and functions, system commands, background jobs.
User accounts
Standard accounts, weak password algorithms, securing of access.
Connections between systems
RFC destinations, trust relationships (notably towards production), securing of exchanges.
Security audit log
Activation and configuration.
Encryption
Certificates and their expiry, encryption of communications (SNC, TLS).
When to request it
When preparing an audit campaign or at any time on an existing production system, and from the Realize phase for a cloud implementation.
What you receive
A report ranked by severity, the matching recommendations, and a debrief with your teams.
A read-only configuration audit
No action on the systems, no password read. Nothing to install, neither agent nor Solution Manager: the analysis is run on demand, from the auditor's workstation. The engagement takes place with written authorisation and within a defined scope.
Active tests
Targeted active tests can be run on a restricted scope and a dedicated environment, defined together.