How SAP Guardian Supports MSSP-Delivered SAP Security Services

The MSSP Challenge with SAP Security Monitoring

Most MSSPs already manage SIEM, endpoint detection, and network monitoring for their clients. Adding SAP security services introduces friction points that generic tools cannot resolve. Understanding these challenges explains why CyberSilo SAP Guardian is architected the way it is — as a dedicated SAP security layer that plugs into an MSSP's existing delivery model.

SAP Log Formats and Data Sources

SAP does not produce standard syslog or Windows Event Log output. Security-relevant data is spread across:

• SAP Security Audit Log (SM19/SM20) — configurable to track logons, transaction starts, RFC calls, and authorization failures
• ABAP System Log (SM21) — application-level errors and warnings, including potential exploitation attempts
• Change Documents (SCU3, CDHDR/CDPOS) — configuration and master data changes across all SAP modules
• Authorization Trace (SU53) — real-time authorization failure details
• RFC Monitoring (SMGW, SMQR) — remote function call statistics and errors
• Dispatcher and Gateway Logs (SMICM) — web service and HTTP/HTTPS access logging

General-purpose SIEM tools struggle to parse these formats without custom parsing rules that require ongoing maintenance. CyberSilo SAP Guardian includes pre-built connectors for all these SAP data sources, normalizing them into a consistent schema that MSSP analysts can query and alert on immediately.

The ABAP Authorization Complexity

SAP authorization is not role-based in the traditional sense — it is activity-based and authorization-object-based. A single SAP role can contain hundreds of authorization objects, each with specific field values that define what the user can see and do. This creates two major monitoring challenges:

• Authorization creep detection — determining when a role change grants unintended access to sensitive transactions
• Segregation of duties (SoD) violations — identifying when a single user possesses conflicting authorizations (e.g., both vendor creation and invoice approval)

CyberSilo SAP Guardian continuously ingests authorization snapshots from SAP systems and compares them against a configurable SoD rule library. When a change introduces a conflict — whether through a role assignment, a role modification, or a direct authorization assignment (SU01/SU10) — the platform generates an alert with the specific authorization objects in conflict and the business risk rating.

Architecture for MSSP Delivery

CyberSilo SAP Guardian is designed from the ground up for multi-tenancy, a non-negotiable requirement for MSSPs that manage SAP environments across multiple clients. The architecture supports three deployment models, each suited to different MSSP service tiers.

Multi-Tenant SaaS Deployment

In this model, CyberSilo SAP Guardian is deployed as a cloud-based platform. Each client SAP system connects via a lightweight on-premises collector agent that extracts logs and transmits them over TLS-encrypted connections to the central platform. The collector agent requires minimal privileges — RFC user with read-only access to the security-relevant tables (TADIR, USR02, UST10S, AGR_1251, CDHDR, etc.) and authorization to read the security audit log via SM19.

Benefits for MSSPs:

• Zero infrastructure management at client sites beyond the collector agent
• Centralized configuration, alerting, and reporting across all clients
• Automatic platform updates and compliance baseline updates
• Scalable from small SAP ECC systems to large S/4HANA landscapes with multiple application servers

On-Premises Multi-Tenant Deployment

For clients with strict data residency requirements — such as government contractors, defense organizations, and certain financial services firms bound by local data protection laws — CyberSilo SAP Guardian can be deployed on-premises within the client's infrastructure while still supporting MSSP remote administration.

In this model, the MSSP retains administrative access to the platform via a secure jump host or VPN, configures monitoring policies remotely, and receives alerts through the same console as the SaaS deployment. This enables MSSPs to offer SAP security monitoring as a managed service even in environments where data cannot leave the organization's network.

Hybrid Architecture

Many MSSPs find that a hybrid approach works best. Sensitive authorization change data and SoD analysis stay on-premises, while business-continuity-significant alerts — such as emergency user logins (SU01 — display, SU01 — change), transport releases during non-business hours, or RFC destination changes — are forwarded to the cloud-based platform for MSSP SOC triage. CyberSilo SAP Guardian supports configurable data routing at the field level, giving MSSPs granular control over what data leaves the client environment.

Core Capabilities for MSSP Service Offerings

MSSPs can package CyberSilo SAP Guardian into several distinct service tiers, each addressing a specific buyer persona within the client organization.

Continuous Threat Detection and Insider Threat Monitoring

Insider threats remain the highest-impact SAP security risk. A disgruntled Basis administrator or a compromised super-user account can exfiltrate data, modify financial records, or disable controls within minutes. CyberSilo SAP Guardian detects insider threat indicators through:

• Privileged user behavior analytics — tracking SAP_ALL and SAP_NEW profile usage, emergency user logins, and direct table access via SE16N or SM30
• Anomalous transaction sequencing — detecting when a user executes a chain of transactions that violates an organizational SoD rule, even if each transaction individually is authorized
• Logon pattern analysis — identifying logins from unusual IP ranges, at unusual hours, or using multiple SAP clients simultaneously
• File and spool monitoring — tracking sensitive report outputs (e.g., salary lists, vendor master data exports) to end-user workstations

MSSPs can offer this as a premium "Insider Threat Detection" add-on service, providing monthly executive reports with risk scoring and recommended remediation actions.

SAP Audit Log and Compliance Reporting

SAP audit logging (SM19 configuration) is often misconfigured or incomplete. A common finding during compliance automation audits is that critical events — such as RFC destination changes or user lock reasons — are not being logged. CyberSilo SAP Guardian includes an audit log health check that validates the SM19 configuration against the SAP security baseline and industry best practices (ISO 27001, PCI DSS, SOX).

Once audit logging is confirmed complete, the platform generates pre-built compliance reports aligned with each framework. For MSSPs, this means being able to deliver compliance-ready audit packages without manual report creation. Reports include:

• User access review evidence (supported by authorization snapshots)
• SoD conflict matrix with remediation priority
• Emergency user usage report with business justification validation
• Transport release and change management audit trail
• Failed login attempt summary with account lockout analysis

SAP Authorization Change Monitoring

Changes to SAP authorizations — whether through PFCG role changes, direct SU01 assignments, or ABAP code modifications — represent the most common attack vector for privilege escalation. CyberSilo SAP Guardian monitors all authorization change sources in real time:

• PFCG role changes — any modification to a role's menu, authorization, or user assignment
• SU01 user attribute changes — modifications to user type, validity period, locked/unlocked status, or assigned roles
• Direct authorization assignment — rare but high-risk changes made via SU10 or batch input
• Profile generator changes — modifications to the authorization profile generated by PFCG
• ABAP code changes — SE38/SE80 modifications that could introduce backdoors or bypass authorization checks

Each change event is correlated with the change requester, the change implementer, the transport request (if applicable), and the business context. This creates a complete audit trail that satisfies even the most stringent compliance requirements.

Integrating SAP Guardian into MSSP SOC Workflows

For an MSSP to operationalize SAP security monitoring, the solution must integrate with existing SOC tools and processes without requiring a dedicated SAP specialist on every shift. CyberSilo SAP Guardian achieves this through three integration layers.

SIEM and SOAR Integration

CyberSilo SAP Guardian feeds normalized, enriched alerts into the MSSP's existing SIEM ecosystem via standard formats — syslog (CEF, LEEF), REST API, or direct integration with platforms like Splunk, Microsoft Sentinel, and IBM QRadar. The enrichment includes:

• SAP-specific metadata (client, user ID, transaction code, authorization object, RFC destination)
• Risk scoring based on sensitivity of the affected authorization object
• Compliance relevance tags (SOX, GDPR, PCI DSS) for automated compliance reporting
• SoD conflict context where applicable

For MSSPs using ThreatHawk SIEM + SOAR, the integration is bidirectional — CyberSilo SAP Guardian sends enriched events that trigger automated SOAR playbooks for common scenarios like emergency user review, lockout notification, and transport approval verification.

Triage Workflow Without SAP Expertise

SOC analysts typically lack SAP Basis knowledge. CyberSilo SAP Guardian addresses this by providing alert context directly within the SOC console. Each alert includes:

• A plain-language description of the security impact (e.g., "User JOHN.DOE was granted SAP_ALL via role Z_SUPER_USER — this grants unrestricted access to all transactions")
• The specific authorization objects that changed and their sensitivity rating
• A link to the SAP recommendation in the CyberSilo knowledge base for suggested remediation
• The affected compliance frameworks (SOX, ISO 27001, etc.) and the specific control mapping

Compliance Framework Mapping

MSSPs offering SAP security services must demonstrate alignment with their clients' compliance obligations. CyberSilo SAP Guardian maps every monitored event and generated report to specific control requirements from the major frameworks.

SOX Compliance for SAP

For publicly traded clients, SOX compliance requires controls over financial system access, change management, and segregation of duties. CyberSilo SAP Guardian addresses:

• COBIT 5 DSS05.04 — logical and physical access controls (through authorization monitoring and SoD analysis)
• COBIT 5 DSS06.03 — roles and responsibilities (tracked through role change monitoring)
• COBIT 5 DS05.03 — change management (through transport request tracking and SE38 code change monitoring)
• SAP-specific SOX controls — including critical transaction logging, user access reviews, and SoD remediation validation

The platform generates quarterly SOX compliance reports that include user access review schedules, SoD conflict remediation timelines, and evidence of continuous monitoring — reducing the client's audit effort by an estimated 60–70%.

ISO 27001 and SAP Security Baseline

ISO 27001 Annex A.9 (Access Control) and A.12 (Operations Security) map directly to SAP authorization monitoring and change management. CyberSilo SAP Guardian tracks compliance with the SAP Security Baseline, a set of mandatory configuration settings published by SAP. Non-compliant settings — such as weak password profiles, unencrypted RFC connections, or disabled security audit logging — are flagged as configuration drift alerts with ISO 27001 clause references.

Pricing and Service Tier Modeling for MSSPs

CyberSilo SAP Guardian supports the pricing models that MSSPs typically need to offer flexible service tiers. Understanding the cost structure of enterprise security monitoring helps MSSPs position SAP Guardian competitively.

Per SAP System Licensing

The most common model for MSSPs is per-SAP-system licensing, where the price scales with the number of SAP systems (production, QA, development, sandbox) being monitored. This aligns with MSSP billing models where each client pays per system or per landscape. CyberSilo SAP Guardian supports unlimited users per system, making it cost-effective for large SAP deployments.

Per Active User Licensing

For MSSPs serving clients with fluctuating user counts — seasonal businesses, project-based engagements, or organizations with extensive external consultant access — per-active-user licensing provides flexibility. The platform tracks active users across the monitoring period and invoices accordingly, with caps available for budgeting predictability.

Service Tier Example

Implementation Process for MSSPs

MSSPs can onboard new SAP clients to CyberSilo SAP Guardian through a repeatable four-phase process that minimizes disruption to the client's operations.

Comparison with Alternative Approaches

MSSPs evaluating how to deliver SAP security services typically consider three approaches: extending a general-purpose SIEM, reselling SAP's own GRC solution, or deploying a dedicated SAP security monitoring platform like CyberSilo SAP Guardian.

General-Purpose SIEM with SAP Parsers

Some MSSPs attempt to configure their existing SIEM to ingest SAP logs. While this works for basic log collection, it fails on authorization context. A SIEM cannot interpret an ABAP authorization object, cannot model SoD relationships, and cannot detect a privilege escalation that occurs through a role inheritance chain. The customization effort required to build and maintain SAP-specific correlation rules is substantial and often unsustainable across multiple clients with different SAP configurations.

SAP GRC Access Control

SAP GRC Access Control is powerful for access request management and SoD analysis but is not a real-time security monitoring tool. It lacks insider threat detection, anomalous behavior analytics, and integration with MSSP SOC platforms. Additionally, SAP GRC licenses are expensive and require dedicated SAP GRC specialists — a resource constraint for most MSSPs. CyberSilo SAP Guardian complements SAP GRC by providing the continuous monitoring layer that GRC was not designed to deliver.

Dedicated SAP Security Platform

CyberSilo SAP Guardian is purpose-built for the MSSP delivery model. It provides immediate value through pre-built connectors and threat detection rules, requires no SAP development expertise to operate, and integrates seamlessly with existing SOC infrastructure. The platform's multi-tenant architecture and configurable data routing addresses both on-premises and cloud deployment requirements without sacrificing security or compliance completeness.

Building the Business Case for SAP Security Services

MSSPs considering the addition of SAP security services must evaluate the business case from both their own operational perspective and their clients' risk perspective.

MSSP Revenue Opportunity

SAP security monitoring commands premium pricing compared to standard SIEM-based services. The average SAP system at a mid-market organization carries 5–15 times the security risk per user compared to the general IT environment, and compliance requirements demand specialized attention. MSSPs can price SAP security services at 3–5x the rate of general SIEM monitoring, with the differentiation being the purpose-built threat detection and compliance reporting that CyberSilo SAP Guardian provides.

Client Value Proposition

For the client organization, the value proposition is clear. The cost of a single SAP security incident — whether it involves financial fraud, data exfiltration, or compliance failure — far exceeds the annual cost of dedicated SAP security monitoring. Clients who have experienced an SAP security incident or who have been cited by auditors for insufficient SAP controls are particularly receptive to managed SAP security services. The integration of threat intelligence into SAP monitoring adds another layer of value, correlating external threat feeds with SAP system activity to detect compromised credentials or lateral movement from the network into SAP.

Operational Efficiency for the MSSP

From the MSSP's standpoint, CyberSilo SAP Guardian's multi-tenant architecture means that one platform instance serves all clients. The same threat detection rules, compliance report templates, and SOC integration configurations apply across the client base, with client-specific customizations handled through configurable policies rather than separate deployments. This reduces the operational overhead of managing SAP security services and allows MSSPs to scale their SAP practice without proportional increases in headcount.