As SAP moves toward the Autonomous Enterprise, the question is no longer whether AI belongs in SAP security – but what kind, governed how, and signed by whom.
Financials, payroll, supply chain, master data, and IP. That value is exactly why the threat model is changing – and why generic AI bolted onto SAP is not enough.
HoursTime-to-exploit has collapsed. Attackers now use AI to read ABAP at scale and turn specialist-only attacks into guided workflows. The pool of people who can threaten an SAP system is larger than it was three years ago.
With SAP’s Autonomous Enterprise vision, agents execute real business processes inside production SAP – introducing new privileges, new entry points, and new questions about what an autonomous action even means.
The question is no longer whether AI belongs in SAP security.
It is what kind of AI, governed how, signed by whom.
Explains & recommends
Guides SAP security teams through work that used to require deep specialist knowledge – reviewing privileged session audit trails, interpreting unstructured SAP Note content, and reasoning about complex code findings.
Useful, not noisy
The platform enriches SAP security data with business and technical context – consumable by our own AI Companion or by any AI-enabled SIEM, including Microsoft Sentinel and Security Copilot.
Data-flow taint analysis pinpoints the sink; the Companion explains what the vulnerability does, why it’s risky, and how to fix it – in plain language. It explains and recommends. The developer decides.
Natural-language search across SAP Notes, configuration guidance, and SecurityBridge threat intelligence – the documentation hunt compressed to a question, with the context that makes an answer trustworthy.
Detect
Continuous monitoring surfaces threats, misconfigurations, and risky code the moment they appear – including SAP-specific risks generic tools miss.
Explain
The AI Companion translates each finding into plain language – what it is, why it matters, how urgent – with context tailored to your environment.
Remediate
Step-by-step guidance for code, configuration, and vulnerabilities – paths your team can execute without deep SAP security expertise.
Respond
Enriched SAP signals flow into Sentinel and Copilot, so your SOC can investigate and act in one place – with full SAP context already attached.
Security Dashboard – the SAP-native fundamentals the AI layer sits on top of: patch
compliance, open findings, and posture trend across the landscape. Switch the AI off
tomorrow and your posture is still intact.
Your chosen LLM connects to the platform through our MCP Server and Skills. The model belongs to you, the data stays inside your perimeter, the choice of provider is yours. We do not train models on customer data. We do not aggregate it.
BYO-AI · MCP Server · Skills
A named, accountable person directs the agent, authorizes the action, and signs the audit trail. Approval is the permission grant itself – scoped, time-windowed, revoked on completion roadmap. The agent has no standing permissions.
Approval is the permission grant
We apply the same skepticism to our own AI that we ask customers to apply to theirs. Skills ground the model in real data. We surface recommendations, not verdicts – every one inspectable back to its source. And AI features can be turned off entirely.
Models are wrong sometimes
Patch discipline, least privilege, interface governance, logging, segmentation – these still matter. AI helps defenders process larger volumes and react faster. It is a force multiplier on this work, not a substitute for it.
Depth over noise
Connect your trusted LLM through the MCP Server and Skills. The model belongs to you, the data never leaves your environment, and we never train on it or aggregate it across tenants.
Every recommendation is weighted, linked back to its sources, and inspectable – and you can switch the AI off entirely.
Rule-based SNote validation identifies which systems need a patch; AI extends it where SAP Notes carry unstructured context. CVA applies code-specific models to data-flow reasoning in custom ABAP.
* Images are for illustrative purposes only. Final product features, functionality, and user interface may differ.
The industry calls this human-in-the-loop. We call it human-in-the-lead – and the difference is accountability. A loop is a process step. A lead is a named person who directs the agent, authorizes the action, and signs an audit trail an auditor can verify against what actually happened.
The AI Companion proposes. The human decides what the intent of the action actually is. The agent has no independent intent of its own.
Approval is not a checkpoint inside an agent-controlled workflow. The agent has no permissions until the human grants them – scoped to the approved intent, time-windowed, revoked on completion.
A named person, with a timestamp, for a specific intent and a specific scope. That signature is the artifact DORA, NIS2, SOX, the EU AI Act, and ISO/IEC 42001 ultimately ask for.
The approval queue in practice: the agent has no standing permissions. A named person approves a scoped, time-windowed action – and the signed audit record corresponds to exactly what the agent did.
The Companion surfaces recommendations and people decide – recommend-not-execute, with scoped approvals and a full audit trail. Every recommendation links back to the underlying data and context, so the reasoning is inspectable.
Approval becomes the permission grant itself: scoped to the approved intent, time-windowed, revoked on completion. The agent receives permissions only for the action the human approved, only for as long as needed – so a compromised prompt cannot expand the agent’s authority beyond what was already signed for.
Some vendors lead with AI as the product – agentic gateways, AI-native scanners, autonomous response as
the headline. That’s a legitimate strategy, and it produces good press. Our position is different, and we think
stronger over time.
| The Pattern We See | Our Position |
|---|---|
|
Agentic gateways, autonomous response, self-healing SAP as the headline. |
Autonomy in production ERP is dangerous. Agentic capability ships when we can defend it to an auditor – not on a marketing clock. |
|
Generic security AI extended to SAP. |
SAP-native depth takes years to build: ABAP, transports, auth objects, SAP Notes. AI sits on top of that depth – not in place of it. |
|
AI announcements as the headline. |
The Autonomous Enterprise will multiply the volume of activity inside SAP. Attackers will hide in that noise. Detecting them takes SAP-native depth, not louder AI claims. |
|
“Human-in-the-loop” as a process checkpoint – approval bolted on top of an agent that already holds the permissions. |
Human-in-the-lead. Approval is the permission grant – scoped, time-windowed, tied to a specific intent. Not a soft checkpoint. |
JIT permissions on roadmap. We will not ship agentic features we cannot defend to an auditor
– because we built SecurityBridge to be the auditor’s evidence.
Useful whether or not you’re evaluating us. If a vendor can’t answer these cleanly, that tells you something.
If the AI requires customer SAP data to leave the perimeter, you’ve introduced a new attack surface.
If the answer is “we’re not sure” or “everything,” stop.
Always a human. By name. With a timestamp. And the signature should bind to the exact action the agent took – not a generic approval. That’s the difference between human-in-the-loop and human-in-the-lead.
The platform must still defend without the AI. If you switched the AI off tomorrow, your SAP security posture should still be intact.
Joule, BTP agents, and embedded copilots are privileged actors. Monitor them like any other.
Each major framework ultimately asks the same question: who is the accountable natural person for this decision, and can you prove what they approved? Human-in-the-lead is designed to answer it as an audit artifact.
To be precise
What we do is make preparing for an audit considerably less painful – particularly where the underlying check involves SAP-specific context that’s hard to articulate without deep platform knowledge. A named person directs the agent, authorizes the action, and signs – and the signature corresponds to exactly what the agent did.
Via SAP Generative AI Hub, the SecurityBridge MCP Server, and our Agent.
Intent-bound, just-in-time permissions, scoped to each human approval and revoked on completion.
For Privileged Access Management audit-trail review, Agentic Dashboards, CVA results review, and Patch Management validation.
Anomaly Detection, User & Entity Behavior Analysis, and a SecurityBridge Configuration Builder.
As the Autonomous Enterprise matures, Joule and BTP agents become privileged actors. We monitor them like any other – their actions, their scope, and the anomalies that matter.
The agent holds permission only for the approved action, only as long as needed – granted on approval, revoked on completion. A compromised prompt cannot expand authority beyond what was already signed for.
Holger Hügel
CTO, SecurityBridge
