Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Joris van de Vis, Director Security Research, SecurityBridge
SAP landscapes are undergoing the fastest transformation in their history. S/4HANA migrations, RISE with SAP, hyperscaler integrations, API-driven architectures, and the rapid expansion of SAP BTP have fundamentally changed the attack surface. Attackers have noticed.
Recent real-world incidents demonstrate how valuable-and vulnerable-enterprise SAP environments have become. Beyond technically sophisticated exploits, attackers are increasingly finding success through misconfigurations, exposed interfaces, and integration weaknesses.
Our view; SAP is no longer a contained fortress. It is an interconnected node in a larger ecosystem-and attackers know exactly where the seams are.
Below are some likely SAP security focus areas we might see emerge in 2026.
1. SAP as Initial Access: From “Crown Jewels” to Entry Point
For years, SAP systems were treated primarily as a post-compromise target. But incidents like the Jaguar Land Rover breach (officially unconfirmed) show a shift: attackers increasingly use SAP components as the initial foothold into a corporate environment.
We expect more campaigns where attackers:
- Exploit internet-facing SAP components (Web Dispatcher, SAP NetWeaver Java, SICF services).
- Abuse weak authentication or misconfigured SSO for initial access.
- Leverage SAP RFC or batch jobs to move laterally
2. RISE with SAP & S/4HANA Cloud Misconfigurations
RISE landscapes and S/4HANA Cloud promise hardened infrastructure, but misconfigurations at the customer / application layer remain common and dangerous.
We expect to see:
- Over-privileged communication users exploited to pivot across hybrid environments.
- VPN, Direct Connect, and Cloud Connector/ACL weaknesses and misconfigurations providing unintended access routes.
- Incorrectly exposed OData and CDS-based interfaces.
3. Identity & SSO
With IAS, IPS, Azure AD, and OAuth/OIDC at the center of SAP authentication, identity has become the new control plane.
In 2026, we expect:
- More impersonation and trust-misconfiguration bugs.
- Escalation paths involving technical users and poorly restricted communication channels.
- Multi-tenant or cross-subaccount identity flaws in BTP.
4. APIs, SAP BTP, and Integration Layers as the New OWASP Frontier
The shift toward event-driven architectures and API-first design in SAP creates new exposure:
- OData endpoints accidentally exposed to the internet.
- BTP services used for persistence or lateral movement.
5. Software Supply Chain & Custom Code: The Weakest Link in 2026?
ABAP, Java, Node.js, UI5, CAP, and low-code extensions all coexist in modern SAP landscapes. Each adds dependencies-and risk.
Predictions include:
- Software Bill Of Material requirements extending to ABAP and BTP applications.
- Compromised transport requests and malicious SAP add-ons.
- Discovery of systemic flaws in key-user extensibility and low-code workflows.
6. AI in and Around SAP: New Data Leakage & Business Integrity Risks
SAP-integrated AI assistants and LLMs create a brand-new attack surface:
- Prompt injection to extract sensitive SAP data.
- Manipulation of AI-driven suggestions (pricing, fraud scores, approvals).
- Insecure AI connector configurations leaking data to external inference services.
How SAP Security Teams Should Prepare Now
With attackers targeting SAP earlier in the kill chain-and with incidents like Jaguar Land Rover proving that business data is the ultimate prize-defenders need both visibility and context.
Here are the key priorities for 2026:
? Treat SAP as an entry point
Continuously assess exposure of SAP HTTP interfaces, ICF services, Web Dispatcher, and cloud connectors.
? Harden identity and trust relationships
Enforce least privilege, validate IAS/Azure trust configuration, and detect impersonation paths.
? Secure APIs and integrations
Apply API security principles to OData, CPI, and BTP services, and monitor shadow interfaces.
? Shift from point-in-time scans to continuous surveillance
Real risk comes from configuration drift, missed SAP Notes, and unnoticed privilege escalation.
? Build (graph-based) attack path visibility
Model reachable attack chains before attackers discover them.
##
ABOUT THE AUTHOR
Joris van de Vis is Director Security Research at SecurityBridge. He is a seasoned SAP security specialist with a rich entrepreneurial background dedicated to advancing SAP security solutions and helping organizations stay secure in today’s challenging cybersecurity landscape.Before joining SecurityBridge, Joris co-founded Protect4S, which became part of SecurityBridge in September 2023. He was previously a SAP technology and cybersecurity specialist at Deloitte and held various SAP Netweaver consultant positions. Most notably, Joris contributed to the security of vital systems as a SAP technology and platform security specialist at the Ministry of Defence. He is a sought-after speaker at international security conferences, government events, and corporate gatherings. Joris holds a patent in Enterprise Automation System Vulnerability Assessment.
