Premchand Kurup and Christoph Nagy discuss integrating SAP intelligence with SOC operations to strengthen visibility, resilience and incident response
SAP’s growing role across finance, procurement, supply chains, HR and production has made its security critical to business resilience across the GCC. Cloud migrations, connected applications and expanding digital ecosystems are also exposing organisations to vulnerabilities that conventional security tools may not detect within the SAP application layer. In this interview, Premchand Kurup, CEO of Paramount Assure, and Christoph Nagy, Co-founder of SecurityBridge, discuss the need to embed security into SAP transformation programmes, integrate SAP intelligence with wider SOC operations, and explain how their partnership helps customers gain a more complete view of cyber risk.
Interview excerpts
Why has SAP security become an increasingly important cybersecurity issue for businesses in the GCC?
Premchand: SAP security is a business-resilience issue because the platform underpins finance, procurement, supply chains, HR and production. Across the GCC, migrations to S/4HANA, RISE with SAP, BTP and other cloud services are connecting SAP more closely to the wider technology estate. SecurityBridge’s late-2025 review counted 207 published SAP security notes, 39% more than in 2024. Yet SAP security is still too often treated as an access or governance, risk and compliance issue. The risk also includes vulnerabilities, insecure configurations, custom code, privileged activity and suspicious behaviour within SAP. An attacker need not shut SAP down: unauthorised access to financial, employee or operational data can cause serious harm. SAP must therefore sit within the wider cybersecurity programme where it supports critical operations.
As organisations continue to digitalise, what should they think about when it comes to security from the outset?
Premchand: Security needs to be designed into transformation from the start, not added after go-live. During an S/4HANA or cloud programme, organisations should address roles and authorisations, privileged access, integrations, custom code, logging and monitoring. The same applies when SAP connects to BTP, cloud applications, APIs and third-party platforms, because every connection expands the attack surface. This is not theoretical: SecurityBridge disclosed five SAP zero-day vulnerabilities in Q3 2025 across S/4HANA, NetWeaver and Ariba, with severity scores up to 9.9 out of 10. It is far easier to address these issues during design and implementation than through a later audit or incident. The practical message is to involve the security team early in every transformation journey.
What are the security risks when SAP environments are not fully connected to wider cybersecurity operations?
Christoph: The main risk is a visibility gap. A SOC may monitor endpoints, networks, identities and cloud platforms, yet have little view of activity inside SAP. If a suspicious SAP event does not reach the SOC or security information and event management platform, the team cannot see the full incident. SAP brings its own users, roles, transactions, custom code and application-level events, which conventional security tools may not interpret in context. As a result, SAP and cybersecurity teams can each see part of the chain, while neither sees the whole.
The priority is not to create another security silo, but to feed relevant SAP intelligence into existing monitoring and incident-response processes, giving the SOC a connected view of risk.
What does the Paramount and SecurityBridge partnership bring to customers beyond their existing security tools?
Christoph: The partnership is designed to strengthen, not replace, what customers already use, including their SIEM, SOC, identity and privileged-access platforms. The common gap is the SAP application layer. SecurityBridge provides SAP-specific visibility into configuration weaknesses, vulnerabilities and patches, custom ABAP code, and security events. That intelligence can be brought into the customer’s existing SOC and SIEM, rather than creating a separate security operation. Paramount adds local consulting, implementation, support and SAP-security expertise: understanding the customer’s landscape, identifying gaps and helping remediate the issues found. The result combines SecurityBridge’s SAP-specific technology with our regional cybersecurity, SOC and SAP-security capabilities, giving customers a more complete and workable view of risk.
Source: Tahawul Tech