At this point, it is important that the IT-Security experts address a common misunderstanding within the application team. IT-Security, particularly for complex enterprise-critical applications, is a skill and not a static attribute. There is an especially important and distinct difference which I will explain. A “Skill” is defined as something that can be taught, needs practicing, and which might improve going forward. With more practice, the skill level increases. Challenges, such as the detection of false positives, are part of the learning process, as this is the only way for a company to increase its level of experience in cybersecurity. If SAP security is wrongly perceived as an “attribute,” it is likely that the initiative will fail, as it is not a single event, it is a continuous problem. In the worst-case scenario, the issue is reported to senior executives as a “solved”, tick-box set.