Waseem Ajrab & Julian Petersohn

SAP Attack Surface

Wasim Ajrab and Julian Petersohn map SAP’s scale—hundreds of millions of lines of code, sprawling ERP processes, routers, gateways, and cloud connectors. Legacy RFC/DI protocols from the 1990s lacked encryption by default, exposing business, healthcare, and financial data paths.

Cloud and AI Expansion

SAP pushes RISE managed offerings and Joule AI while customers receive lengthy add-on security service lists. Presenters argue complexity and proprietary stacks multiply patch and monitoring burden; AI features have already introduced vulnerabilities in customer cloud environments.

Common Security Myths

They debunk beliefs that SAP is “secure by default” because it is German-made, that zero trust is a purchasable SAP product, and that identity management alone secures the platform. SAP Basis teams often lack hardening skills; controls concentrate on production while dev/staging networks stay flat and interconnected across hyperscalers.

Red Team Perspective

Standard passwords and overlooked interfaces beyond IAM illustrate why SAP complexity aids attackers. The talk urges holistic network segmentation and specialist defense rather than isolating authorization teams with large budgets but narrow scope.