Why Moving to SAP Cloud ERP Is A Security Decision — Not Just An IT Upgrade

The SAP ECC countdown is pushing organizations to make decisions. Mainstream maintenance for SAP Business Suite 7 core applications, including SAP ERP 6.0, ends on December 31, 2027, with optional extended maintenance available through 2030. As a result, many organizations are accelerating transformation programs under significant time pressure, often without fully considering strategic opportunities or evolving operational requirements. In a recent article, KPMG professionals warned that rushing can create a dangerous instinct to lift and shift customized practices into the cloud while focusing on architecture and licensing and leaving security for later.

The timing may also be a cause for concern. SAPinsider’s Cybersecurity Threats and Challenges to SAP Systems 2026 benchmark research found that SAP released more high-impact or critical patches in 2025 than in previous years, as flaws surfaced in aging solutions that are increasingly exposed in cloud environments. Yet only 17% of technology leaders rank improving cybersecurity and risk posture as a top business priority for 2026. That disconnect is where transformation programs can inherit risk.

Why Legacy SAP Security Habits May Break in the Cloud

For two decades, on-premise SAP systems sat deep inside the corporate network and were managed by standalone teams outside core IT and cybersecurity functions. Those teams relied on perimeter defenses, which left gaps in understanding SAP-specific vulnerabilities and allowed weaknesses in customized code to persist for years. Publicly documented exploits have since enabled a wider range of threat actors to target SAP environments, with significant operational and financial impact.

SAP Cloud ERP changes the exposure model rather than eliminating risk. It reshapes how core enterprise data is used in systems that interface directly with partners, customers and suppliers. Roles and authorization frameworks must adapt, while responsibility for security controls must be clearly allocated and monitored across the customer, cloud providers, hyperscalers, and application vendors.

SAP Joule adds another layer of complexity. KPMG professionals note that AI assistants and agents will likely require tighter authorization frameworks, because accessing systems through a chat prompt can be far easier than navigating a 20-year-old graphical user interface.

SAPinsider’s research reinforces this point. Identity and connectivity-centric threats – such as social engineering insider threats, credential compromise, insecure application configurations, and connections to other systems – now rank among respondents’ leading concerns. As SAP Cloud ERP adoption grows, many teams do not fully understand their responsibilities in the shared responsibility model. SAPinsider’s ERP Migration and Transformation 2026 benchmark found that concerns over access, authorizations, and cybersecurity planning rose as a deployment challenge this year. The report warns that neglecting these areas may result in systems vulnerable to an attack as soon as the deployment is complete.

Pursue The Value, Including The Security Value

KPMG firms’ central argument is that organizations that treat ERP modernization as a strategic initiative, rather than a response to an IT deadline, are better positioned to understand the risks and capture the value that justifies the investment. The security upside is significant. Bringing SAP into the enterprise security operations center can remove a long-standing monitoring blind spot. Aligning the program with digital initiatives across customer relationship management, human resources, and procurement can also support consolidating identity management, enterprise single sign-on and multi-factor authentication, and consistent access governance across SAP and non-SAP systems.

Realizing these benefits requires executive engagement from finance, cybersecurity, and governance, risk and compliance leaders, along with a review of the organization’s risk and control frameworks. KPMG professionals recommend establishing a dedicated security and governance workstream, which can represent 5% to 10% of total project spend.

Jan Stoelting, Partner, KPMG in Germany, summarized the stakes, “Organizations moving to SAP Cloud ERP inherit a new security model whether they plan for it or not,” he said. “The customer still owns custom code, user access, and application configuration, and those are exactly the areas attackers target. Building a dedicated security and governance workstream into the program from day one is how the migration becomes a step up in security posture rather than a step sideways.”

KPMG Firms’ Approach

To structure this work, KPMG firms focus on authentication, authorization, security management, and the controls that protect the integrity of functions and data. The approach utilizes the Enhanced SAP Secure Operations Map, which addresses procedural, organizational and technical risks, and implementing the Managed Detection and Response for SAP (MDR/S) service.

In practice, KPMG professionals support clients with control roadmaps built in SAP Signavio, authorization redesign for SAP Fiori catalogs, data services and segregation of duties, threat modeling to inform shared responsibility negotiations, monitoring tool selection across the core, hyperscaler, SAP BTP and SAP Business Data Cloud, legacy custom code review, and AI-supported identity management.

What This Means For SAPinsiders

Budget for security as a named workstream. KPMG firms’ benchmark of 5% to 10% of project spend gives CIOs and program managers a defensible planning range. Programs that omit it pay later in remediation costs, audit findings, or delayed go-lives.

Negotiate the shared responsibility model with evidence, not assumptions. KPMG professionals note that responsibility for security controls is now shared across cloud providers, hyperscalers and application vendors. Enterprise architects should document which controls sit with each party and use landscape-wide security surveys and threat modeling to inform those negotiations.

Redesign authorizations for SAP Fiori, AI agents, and SAP Joule. Legacy role sets may not be sufficient when AI assistants can access data and initiate actions through natural language prompts. Security teams should treat authorization redesign and enterprise identity and access management integration as core migration deliverables.

To learn more, explore: The move to SAP Cloud ERP is much more than an IT upgrade

Some or all the services described herein may not be permissible for KPMG audit clients and their affiliates or related entities.