Australia Leads APAC on SAP Application Security

With Mastering SAP Collaborate, an SAP TechEd on Tour event, arriving in mid-November 2026, SAPinsider has been speaking with event sponsors about what makes the Australian SAP market distinct. In a recent conversation, Onno Coenen, Managing Director APAC at SecurityBridge, offered a perspective shaped by years working with SAP customers in Europe and the US, including being based in Singapore for the last eight.

His message is direct. Australian organizations are consolidating on SAP Cloud ERP faster than most, and their cybersecurity teams are waking up to the SAP application layer as a blind spot. But the business case, the buying center, and the obstacles look different from those in the Americas and EMEA.

What Makes the Australian Market Unique

The first difference is scale. In Europe, Coenen notes, many long-standing SAP customers, particularly large German manufacturers, run dozens or even hundreds of SAP landscapes. That is rarely the case in APAC, even in a mature SAP market like Australia. Coenen said that most of the organizations SecurityBridge speaks with are already using RISE with SAP or planning the move, and their landscapes are consolidating into a single SAP S/4HANA system, a few SAP Business AI Platform accounts, and some additional cloud solutions.

That changes the conversation. “Patching is a significant task for one system, let alone for hundreds of systems,” Coenen says. When a customer runs hundreds of systems, automating a painful process makes the business case on its own. With a consolidated SAP Cloud ERP landscape, the case must be made differently.

RISE with SAP also brings what Coenen calls the biggest misconception in the region: the assumption that SAP is taking care of application security. “That’s the number one mistake,” he says, and it remains the most common discussion SecurityBridge has with prospects and customers. SAP manages much of the underlying infrastructure under SAP S/4HANA Cloud Private Edition, but users, configuration, custom code, and activity inside the application remain the customer’s responsibility.

The second difference is who is driving the decision. In Australia, CISOs, SOCs, and broader cyber teams are realizing that SAP is often missing from their SIEM. Recent SecurityBridge engagements in Australia were led by cyber teams, often while already-overloaded SAP teams resisted taking on another project. “The responsibility and mandate is shifting from the SAP teams to the cyber teams,” Coenen says.

He sees Australia as a front-runner in APAC, likely because organizations there take regulation and frameworks such as NIST more seriously. Singapore and Japan also treat SAP security as a priority. Across much of developing Asia, however, cost remains the main reason for inaction, and some organizations still believe the problem can be solved with manual effort. With only a limited number of SAP security vendors operating in the region, the first job is often building awareness rather than winning a product comparison.

Australia has its own remediation hurdle too. ABAP development is often handled by contractors or service providers rather than employees. By the time a first scan surfaces thousands of custom code vulnerabilities, the people who wrote that code have frequently moved on, and the findings can feel too overwhelming to tackle.

How SecurityBridge Is Helping Customers Respond

SecurityBridge runs on any ABAP stack, including SAP S/4HANA within RISE with SAP, where Solution Manager is no longer part of the picture. Coenen sees customers arrive through two doors, split roughly evenly.

The first is vulnerability management. An Australian energy provider had a company-wide vulnerability management program in which SAP was one subprogram. Its SAP team needed a solution specific to SAP and started with SecurityBridge’s security compliance and patch management capabilities. Over time they plan to extend into threat detection and other capabilities.

The second door, and the faster-growing one, is real-time visibility. Cyber teams want SAP application-layer activity flowing into their monitoring capabilities so that the systems running the business are no longer a black box to the SOC.

Hard deadlines are accelerating both. Coenen gave an example of one of Australia’s largest banks where management issued a directive requiring the SAP team to patch within seven days. With criminals using AI to exploit vulnerabilities soon after SAP’s Patch Tuesday, teams can no longer wait a month or more. Meeting that kind of target, he says, “can only be done with an advanced tool.”

SAP’s own field teams are also shaping demand. As SAP sales teams position offerings such as SAP Enterprise Threat Detection and Code Vulnerability Analyzer to RISE customers, awareness grows, and customers who find those options too complex or too costly look for alternatives. Since SecurityBridge is available through SAP Store, this gives SAP sales teams another option to put in front of customers.

Coenen’s core message is that the SAP application layer holds the crown jewels, not the network or the operating system. Protecting SAP only at the perimeter is like securing a building with just a fence and a front door. An attacker who has already gained network access, or an employee representing an insider threat, can “just walk straight through your application.” With AI and geopolitical tensions raising the stakes, he says, “companies cannot afford to wait.”

What This Means for SAPinsiders

Clarify who owns application security under the RISE with SAP model. Review your SAP Cloud ERP contract and particularly the shared responsibility model with SAP. Assume that user access, configuration, custom code, and application-layer monitoring are yours to secure, and make sure someone is accountable for each.

Bring your SAP and cyber teams together around measurable targets. Get SAP activity into your SIEM and SOC, and set a time-to-patch target, for example a seven-day window. Then test honestly whether manual processes can meet it and prioritize custom code findings by risk so remediation stays manageable when original developers are gone.

Connect with SecurityBridge at Mastering SAP Collaborate. Visit the SecurityBridge team at ICC Sydney on 18–19 November. Bring your questions on RISE with SAP security responsibilities, SIEM integration, and accelerating patch timelines, and pair those conversations with sessions in the event’s Security & Risk track.