Services
Four delivery modes — implementation, upgrades, migrations and support — applied across nine areas of the SAP security estate.
Service lines
Before the technology, the shape of the engagement. Most clients start in one of these four and move between them as the work changes.
Where you are, where you need to be, and the order to do it in — before anyone buys a licence.
The hands-on work: implementation, remediation and hardening across the SAP estate.
Specialist skills on tap, shared across clients — expertise you need regularly but not constantly.
We run it. Monitoring, patching, access reviews and support on a continuing basis.
Delivery modes
New deployments, scoped and configured against your control requirements, with handover documentation.
Version and support-pack upgrades with regression testing on your live rulesets and roles.
Platform and landscape moves that preserve control history, approvals and audit evidence.
Managed services — monitoring, patching, access reviews, audit response — on a continuing basis.
Governance and identity
Access Control, Process Control and Risk Management, configured so the workflow matches how approvals really happen in your business rather than how the default template assumes.
Identity Access Governance for estates that are no longer purely on-premise. Useful when access decisions have to span ECC, S/4HANA, SuccessFactors, Ariba and third-party SaaS at once.
Code and infrastructure
Access controls assume the platform underneath them is sound. Often it is not — unapplied security notes, custom code with injection paths, and RFC destinations with stored credentials are the common findings.
SAP Business Technology Platform uses a different authorisation model to the ERP most teams know. Extensions built there often get provisioned quickly and governed later.
Authentication
Access governance answers what a user is allowed to do. Authentication answers whether the person holding that account is who the account says they are — and SAP passwords alone have not answered it credibly for years.
SSO for SAP built on the Active Directory infrastructure you already run, so users authenticate once at the workstation and reach SAP without a separate password.
Not every action needs a second factor, and prompting for one on every screen trains users to click through. TrustBroker holds an authentication policy on each SAP system so the challenge lands where the risk is.
TrustBroker became part of SecurityBridge in 2025 and the two integrate: real-time signals such as anomalous logon behaviour or an unrecognised device can decide when MFA gets enforced. It also runs perfectly well standalone if authentication is the only thing you need right now — we deliver it either way.
Partner platforms
We are official trusted partners of SecurityBridge, Pathlock and Soterion — which means licensing, implementation and ongoing support can come from one place. TrustBroker sits within the SecurityBridge portfolio and is covered by the same partnership.
Real-time monitoring, vulnerability management, patch and code security built to run inside the SAP stack rather than beside it.
Single sign-on for SAP with multi-factor authentication applied by policy — at logon, or later, when a user reaches something sensitive.
Cross-application access governance and continuous controls monitoring for organisations running SAP alongside other business systems.
SoD analysis expressed in language business owners can approve, plus licence position management to keep your SAP measurement honest.
Salesforce
Quotes are raised in Salesforce and fulfilled in SAP. Credit limits sit in SAP and get quoted against in Salesforce. When the two are out of step, sales promises things operations cannot deliver — and the access controls you built on the SAP side stop at the boundary.
Sales Cloud and Service Cloud set up around your actual sales process rather than the demo org.
The join that makes both systems worth having — built on supported interfaces, not overnight spreadsheet exports.
Our SAP background is the reason to have us do this. Segregation of duties does not respect application boundaries.
Salesforce ships three releases a year. Someone has to test what they change before your users find out.
Describe the problem instead of the product. We will tell you what would actually fix it — including when the answer is nothing new.