Why SAP Is Still a Goldmine for Attackers

Over 90% of the global top 1000 companies run critical business processes on SAP. Yet security remains a blind spot for most organizations. Joris van de Vis has spent two decades finding vulnerabilities in SAP systems. Close to 150 zero-day discoveries, all responsibly disclosed. In this episode, he breaks down why the obscurity that used to protect SAP systems doesn't work anymore. Open source tools like Metasploit, PySAP, and Hashcat have leveled the playing field. The impact when SAP gets breached? Joris points to Jaguar Land Rover. Billions in losses, nearly triggered bankruptcy. The alleged cause? An unpatched SAP vulnerability. He shares the patterns he sees during penetration tests. Insecure configurations from legacy installations. Missing patches. SAP* users in RFC connections from 20 years ago enabling lateral movement into production. His newest project? Sapology, an open source scanner for SAP systems. His advice? Assume breach. Monitor now. Detect early. Respond fast. Because the question isn't if you'll be breached. It's when.