In this episode of the SAPinsider Las Vegas 2025 podcast, host Robert Holland SAPInsider speaks with JP Perez-Etchegoyen, CTO and co-founder of Onapsis, and Gaurav Singh, Senior Cybersecurity Manager at Under Armour, about the growing importance of cybersecurity in SAP landscapes. The conversation centers around their newly released book, Cybersecurity for SAP, the first SAP Press book to bridge the gap between traditional SAP security and modern cybersecurity practices. Perez-Etchegoyen and Singh discuss key challenges SAP customers face—like increased landscape complexity, cloud transitions, and lingering myths that SAP systems behind firewalls are secure. They emphasize the critical need for collaboration between SAP and security teams, a shift in mindset toward proactive cybersecurity, and the adoption of risk-based strategies. The duo also highlights the importance of purposeful action, education, and building strong cybersecurity programs tailored to evolving SAP environments.

An Interview with Mariano Nunez of Onapsis. In this episode of the SAPinsider Las Vegas 2025 podcast, host Robert Holland SAPInsider speaks with Mariano Nunez, CEO and co-founder of Onapsis, about the evolving cybersecurity landscape for SAP customers. Nunez shares key challenges organizations face in securing SAP applications—especially during cloud migrations like RISE with SAP—highlighting the confusion around shared security responsibilities between SAP and its customers. He emphasizes the importance of visibility, automation, and expert guidance to build secure-by-design cloud environments and ensure compliance. The conversation also explores the surge in cyber threats targeting SAP systems, the growing role of AI in both offensive and defensive security strategies, and the critical need for specialized SAP cybersecurity expertise. Nunez encourages SAP professionals to expand their skills into cybersecurity, noting the career opportunities emerging at this intersection. He also discusses Onapsis’ unique role as a cybersecurity partner with an SAP-endorsed app and the value of people, processes, and partnerships in creating comprehensive security solutions.

CISA recently updated their Known Exploited Vulnerabilities (KEV) catalog with an SAP vulnerability: CVE-2017-12637. When exploited, this vulnerability affecting SAP Netweaver AS Java application servers can enable unauthenticated threat actors to take full control of unprotected SAP systems.

While this is a known security vulnerability that was promptly patched by SAP in 2017, Onapsis Research Labs have observed this issue being present in several environments to this day.

Onapsis Research Labs has also recently identified active exploitation via our global SAP Threat Intelligence Network, and we will be sharing our findings with the public.

Sichere SAP-Lösungen für Logistik und Produktion mit RISE und BTP

Ein Webinar im Rahmen der 20. IT-Onlinekonferenz: Produktions- und Logistikprozesse mit SAP – Die führende Konferenz für SAP-gestützte Produktion und Logistik.

Die digitale Transformation in Produktion und Logistik, angetrieben durch SAP RISE und die SAP Business Technology Platform (BTP), eröffnet Unternehmen neue Möglichkeiten zur Prozessoptimierung. Gleichzeitig entstehen Herausforderungen, diese geschäftskritischen Systeme sicher und compliant zu gestalten.

In diesem Webinar erfahren Sie, wie Onapsis Unternehmen unterstützt, SAP-Anwendungen in Cloud- und hybriden Umgebungen zu schützen, Sicherheits- und Compliance-Anforderungen zu erfüllen und die Integrität sensibler Daten und Prozesse sicherzustellen.

Highlights:

Effiziente Sicherheitslösungen für hybride SAP-Landschaften.
Echtzeit-Bedrohungserkennung und Schwachstellenmanagement.
Best Practices für SAP RISE und BTP.

Learn best practices for security and resilience of SAP systems in the utilities sector

In this session you will learn how Eversource is adapting to the evolving threat landscape. Hear from security leaders about why they chose Onapsis and how leveraging the Platform has helped to save money, ensure security, and pinpoint vulnerabilities.

With 2024 behind us, the best way to prepare for a successful 2025 is to evaluate the past. JP Perez-Etchegoyen and Paul Laudanski from Onapsis Research Labs (ORL) will recap trends from 2024 and provide best practices to prepare you for threats targeting business critical applications in 2025.

In this session you’ll gain a greater understanding of:

Macro trends and observations gleaned from the extensive security research conducted by Onapsis Research Labs
A comprehensive recap of critical patches and noteworthy news from 2024, ensuring you can prioritize to support your team’s efforts
Actionable insights to empower your team in securing your SAP landscape in 2025 and beyond.

In this session we explore the transformative changes introduced by the NIS2 Directive

This discussion will provide a comprehensive overview of how NIS2 differs from the original NIS Directive and what these changes mean for organizations relying on SAP systems. Organizations across the EU are going to be impacted when NIS2 goes into effect and need to be aware of the impact it will have on SAP system landscape.

Everything you need to know in the world of ERP security with The Defenders Digest. Hear directly from Paul Laudanski & JP Perez-Etchegoyen of Onapsis Research Labs as they chat through monthly highlights and need-to-know information around SAP and Oracle security.

SAP offers a highly secure and compliant cloud infrastructure for RISE with SAP customers. With the peace of mind that SAP is managing the security of the foundational layers, customers can concentrate on their own security and compliance responsibilities: protecting business processes, sensitive data, and any extensions or customizations.

To implement effective controls and governance in these areas, the right teams and tools are essential. Onapsis delivers SAP-endorsed technology, threat intelligence, and expertise to help RISE with SAP customers meet their application security and compliance responsibility in the cloud.

In this informative presentation featuring Roland Costea, CISO at SAP Enterprise Cloud Services (ECS), and Mariano Nunez, CEO & Co-Founder of Onapsis, you will discover how the people, processes, and technologies at SAP ECS combined with the Onapsis capabilities, empower customers to better secure their Cloud ERP systems and promote long term business resilience.

Onapsis Research Labs observed and analyzed malicious activity detected though our global threat intelligence cloud. A system running SAP was compromised and turned into a command and control bot by injecting a malicious file via an SAP vulnerability. The C2 initiated a distributed denial of service attack involving Cloudflare.

Our team will review the details of this attack including source IP addresses, the malicious file, the installation of midnight commander, and cover the commands that were executed on the host system that included an assessment of the compromised SAP system during this session.