Securing SAP Systems with Code Vulnerability Analysis

How Cognitus, an IBM Company, strengthened SAP application security by implementing the Cybersecurity Extension for SAP from Layer Seven Security.

Customer Profile

Cognitus is a global SAP consulting and solutions provider specializing in SAP S/4HANA, digital transformation, and industry-specific SAP innovations. As an IBM company, Cognitus supports complex SAP landscapes for customers across manufacturing, consumer products, life sciences, and other regulated industries. The organization develops and maintains a significant volume of custom SAP assets, including ABAP programs, enhancements, interfaces, and SAP UI5 applications, making application-layer security a critical component of its overall SAP risk posture.

Challenges

Cognitus recognized that custom SAP code represented one of the highest areas of cyber risk within its SAP environments. While standard SAP security controls addressed infrastructure and access management, limited visibility existed into vulnerabilities embedded within custom ABAP code and SAP UI5 applications. Manual code reviews and development-time checks were insufficient to identify exploitable weaknesses such as insecure authorization checks, injection risks, and flawed input validation. The organization required a scalable and repeatable approach to continuously assess custom SAP code for security weaknesses without slowing development or transformation initiatives.

Objectives

Cognitus implemented the Cybersecurity Extension for SAP to strengthen application-layer security across its SAP systems. The primary objective was to identify and reduce cyber risk introduced through custom SAP code by implementing continuous code vulnerability analysis for ABAP programs and SAP UI5 applications. Additional goals included improving security governance, enabling risk-based remediation, and embedding security into ongoing SAP development and modernization programs.

Methodology

Layer Seven Security deployed the Cybersecurity Extension for SAP to provide automated and continuous analysis of custom SAP code. The solution performed deep inspection of ABAP programs and SAP UI5 applications to detect security vulnerabilities, insecure coding patterns, and deviations from SAP secure development best practices. Code analysis capabilities enabled Cognitus to identify high-risk issues such as missing authorization checks, injection vulnerabilities, and logic flaws that could be exploited to bypass controls or access sensitive data. Findings were contextualized based on technical severity and business impact, allowing development and security teams to prioritize remediation efficiently.

Results

The implementation of the Cybersecurity Extension for SAP significantly improved Cognitus’s ability to manage application-layer cyber risk. Continuous code vulnerability analysis uncovered previously unknown security weaknesses within custom ABAP and SAP UI5 components. Security teams gained consistent visibility into code-level risks across SAP systems, while development teams benefited from clear, actionable findings aligned to SAP security standards. The organization reduced exposure to exploitation of custom code and strengthened confidence in the security of SAP-driven business processes.

Significantly improved visibility into application-layer cyber risk through continuous analysis of custom ABAP and SAP UI5 code, enabling security teams to uncover previously unknown vulnerabilities that were not detectable through standard SAP controls.
Reduced exposure to exploitation of custom SAP code by identifying high-risk issues such as missing authorization checks, injection vulnerabilities, and logic flaws that could lead to unauthorized access or data compromise.
More efficient and consistent remediation driven by contextualized findings that aligned technical severity with business impact, allowing development and security teams to prioritize fixes without slowing SAP development or transformation initiatives.
Lower reliance on manual code reviews and improved security governance through an automated, repeatable approach that supported secure SAP innovation at scale while aligning with enterprise and regulatory expectations.

Business Impact

By addressing custom code security as a core component of its SAP cybersecurity strategy, Cognitus reduced the likelihood of data breaches, unauthorized access, and business disruption originating from application vulnerabilities. The automated approach lowered reliance on manual reviews, improved security consistency across projects, and supported secure SAP innovation at scale. As an IBM company, Cognitus strengthened its ability to deliver secure, trusted SAP solutions to customers while aligning security practices with enterprise and regulatory expectations.

Summary

This case study highlights how Cognitus used the Cybersecurity Extension for SAP from Layer Seven Security to address cyber risks within custom SAP code. By focusing on continuous vulnerability analysis for ABAP programs and SAP UI5 applications, the organization strengthened SAP application security, reduced risk exposure, and established a scalable foundation for secure SAP development and transformation.

Highlights

Improved visibility into SAP application-layer cyber risk
Reduced exposure from vulnerable custom SAP code
Faster, prioritized remediation aligned with business impact
Automated code analysis replacing manual reviews
Scalable, consistent SAP security governance