Hybrid ERP + Cloud Security Intelligence
Your ERP and your cloud don't
exist in separate silos.
Your audit tool shouldn't either.
Deep security checks across your ERP and cloud — simultaneously. AWS & Azure connect via live API with no CSV export required. Schedule to run automatically. Cross-system SoD conflicts that single-platform tools miss entirely.
330+Automated Checks
9Platforms
55+Security Domains
8Cross-System SoD Rules
⚡ LiveAPI for AWS & Azure
One platform. Your entire stack.
Deep specialist checks for every system — connected by cross-system intelligence.
ERP & HR Platforms
SAP S/4 HANA
ERP Security Assessment
75+ checks
Oracle Fusion ERP
Cloud ERP Security Assessment
55+ checks
Microsoft Dynamics 365
D365 Security Assessment
44+ checks
Oracle NetSuite
NetSuite Security Assessment
45+ checks
Sage Intacct
Intacct Security Assessment
41+ checks
Sage X3
X3 Security Assessment
40+ checks
Sage 300 People
HR & Payroll Security · POPIA
36+ checks
Cross-System SoD Engine — 8 conflict rules spanning both layers
SAP ↔ NetSuite
Oracle ↔ Azure AD
D365 ↔ AWS
SAP ↔ AWS IAM
NetSuite ↔ Azure
Cloud Platforms
Amazon Web Services
⚡ LIVE API
AWS Cloud Security Assessment
41+ checks
Microsoft Azure
⚡ LIVE API
Azure Cloud Security Assessment
39+ checks
Built on three pillars
Not a checklist tool. A security intelligence platform.
Unmatched Depth
75+ SAP checks across 15 security domains
HCM payroll & ghost employee detection
Every finding ships with a specific remediation step
DOCX & PDF audit-ready reports, instantly
Cross-System Intelligence
8 cross-system SoD conflict rules (ERP ↔ Cloud)
Baseline drift — new, resolved, and persisting findings
Auto-mapped to SOX, ISO 27001, SOC 2, PCI-DSS, NIST
AI-generated CLI commands for Critical & High findings — copy-paste ready
Audit Workflow
Finding lifecycle — Open → In Review → Resolved
Scheduled recurring audits — weekly, monthly, or custom cron
Risk score trends & baseline drift across runs
Role-based access — Admin, Auditor, Viewer
55+ Security Domains
Click a platform to see its specific domain coverage.
Cross-System SoD fires when data from two or more platforms is uploaded. 8 predefined conflict rules identify users whose combined access creates an SoD violation no single-platform audit would detect.
SAP AP Entry ↔ NetSuite Payment Approval
AP invoice entry in SAP + payment approval in NetSuite bypasses dual-authorisation.
Oracle HCM Payroll ↔ Azure AD Global Admin
Payroll creation rights plus identity admin enables ghost employee creation.
SAP Vendor Create ↔ AWS S3 Full Access
Vendor master editor with unrestricted S3 can exfiltrate and conceal data.
D365 Vendor Maintenance ↔ NetSuite Payment
Vendor maintenance in D365 + payment approval in NetSuite circumvents segregation.
NetSuite AP Entry ↔ AWS IAM Admin
AP clerk controlling AWS IAM can create access paths bypassing app controls.
SAP Payroll Process ↔ Azure Storage Write
Payroll processor with cloud write can divert output files before GL posting.
Oracle GL Posting ↔ AWS CloudTrail Admin
GL poster managing CloudTrail can disable audit logging over their own transactions.
NetSuite Bank Account Edit ↔ Azure Key Vault
Bank account access plus Key Vault management creates a credential-diversion risk.
HANA Database
PUBLIC role grants, default users, encryption, password policy, audit policies.
RFC & ICF Security
Trusted RFC without SNC, RFC_READ_TABLE, unauthenticated ICF services.
System Parameters
auth/no_check bypass, SAP* backdoor, SNC enforcement, login thresholds.
Default & Critical Accounts
SAP*, DDIC, EARLYWATCH not locked in production; service accounts as dialog.
Table & Data Controls
SE16/SE16N in production, S_TABU_DIS change activity, CATT test tools.
Payment Run Security
F110 propose=execute SoD, unapproved payments, post-approval modifications.
Background Job Security
Jobs running as SAP*/DDIC, orphaned schedulers, dialog-type batch users.
Segregation of Duties
26 conflict rules across FI, CO, MM, HR — AP/payment, PO, GL, payroll.
Fiori / OData
Unauthenticated services, admin tiles, sensitive OData APIs exposed.
Change & Transport
Open transports, skipped QA, emergency transports, developer access in PRD.
ABAP / Authorization
Debug+replace, S_DEVELOP, sensitive t-codes, deprecated profiles.
Audit Logging
SM19 security audit log, event classes, HANA audit policies, retention.
Client Security
SCC4 production client settings, client-independent changes, CATT.
Emergency Access
Firefighter account usage, SAP GRC EAM log review, unreviewed sessions.
Software Currency
SPAM/SAINT patch levels, HotNews outstanding, version below minimum.
Identity & MFA
IDCS MFA enforcement, SSO, session timeout, time-based access.
User Management
Inactive accounts, locked users with roles, generic/shared accounts.
Segregation of Duties
8 SoD rules — AP/GL/PO/Bank/Payroll/AR conflict matrix.
HCM Segregation of Duties
Ghost employee, salary escalation, bank account diversion, payroll super-user.
Period Close Controls
Reopened closed periods, post-close journal entries, prior-year adjustments.
Fixed Asset Controls
Add+retire SoD, unapproved revaluations, below-threshold capitalization.
Reporting Security
BI Publisher/OTBI reports without row-level security, PII without masking.
Approval Workflow Controls
AME auto-approve rules, bypass rules on payments, single approver >$100k.
Intercompany Controls
Same user both sides, unapproved large amounts, non-eliminated balances.
Role Governance
Custom role proliferation, undocumented roles, >15 roles per user.
Data Security
Wildcard grants on sensitive objects, missing Oracle DPVS policies.
API & Integration Security
Wildcard OAuth scopes, unauthenticated endpoints, long-lived tokens.
Financial Controls
Journal approval disabled, payment threshold gaps, missing approvers.
Audit & Compliance
Disabled audit policies, incomplete DML coverage, AACG not configured.
System Administration
Admin roles on business users, privileged table access, unpatched CPUs.
Identity & Access
Excess System Administrator roles, guest accounts, service account controls.
MFA & Conditional Access
Users without MFA, no CA policy for D365, non-compliant device access.
Field Security
Salary/SSN field update rights, overshared records, hierarchy depth.
Audit & Compliance
Org-level audit disabled, critical entities not audited, short retention.
Platform Security
Unmanaged solutions in PRD, no DLP policies, high-risk connectors unblocked.
Integration Security
Personal account API connections, flows shared with Everyone, unsigned plugins.
Financial Controls
Open prior periods, unapproved journal entries, duplicate vendors.
Data Security
Record over-sharing, write-level POA grants, personal data unprotected.
Org Controls
Flat BU structure, users in root BU, organisation-wide access roles.
Identity & Access
Super Admin outside IT, shared logins, single-factor on sensitive modules.
Segregation of Duties
AP entry + payment approval, vendor create + payment conflict.
Audit & Compliance
SuiteAudit disabled, log retention below 12 months, system notes off.
Financial Controls
Journals without approval workflow, vendor bank change without dual auth.
TBA & Integration Security
TBA tokens with admin permissions, OAuth without expiry, RESTlet without auth.
Data Security
Payment data to non-finance roles, PII in saved searches, mass export open.
System Configuration
Weak passwords, session timeout off, HTTP not redirected, 2FA not mandatory.
Identity & Access
System Admin outside IT, shared web services credentials, inactive with roles.
Segregation of Duties
AP bill creation + payment approval, vendor + payment processing conflict.
Audit Trail
Audit trail disabled, login history not retained, entity-level audit off.
Financial Controls
Journal batches without approval, vendor payment without dual authorisation.
Web Services Security
Sender with unrestricted module access, API user with System Admin role.
Multi-Entity Security
Cross-entity access beyond role scope, top-level admin propagation.
System Configuration
Session timeout >60 min, weak passwords, debug mode in production.
Identity & Access
ADMIN/ADMIN default credentials not changed, shared accounts in PRD.
Segregation of Duties
Purchase entry + payment approval, vendor create + payment conflict.
ADXTRACE Audit
Audit table disabled for critical objects, connection log not retained.
Financial Controls
Journal entries without supervisor approval, open fiscal periods unrestricted.
Syracuse API Security
Web service endpoints without auth, REST API over HTTP, unrestricted function codes.
Data Security
Financial reports to non-finance users, data access rules not enforced.
System Configuration
Default credentials not rotated, debug mode in production, HTTPS not enforced.
Identity & Access (IAM)
Root access keys active, MFA missing, keys older than 90 days, wildcard policies.
S3 Data Security
Public bucket access, missing encryption, versioning disabled, no object lock.
Network Security
Open SSH/RDP to 0.0.0.0/0, VPC flow logs missing, default VPC in use.
CloudTrail & Audit Logging
No CloudTrail, single-region trail, log validation off, no CloudWatch.
Encryption (KMS & RDS)
Unencrypted RDS at rest, publicly accessible RDS, KMS without auto-rotation.
Access Control
Full admin (Action:* Resource:*) policies, wildcard trust roles, over-privileged principals.
Compliance
Root MFA not active, password policy below 14 chars, no alternate contacts.
Azure AD Identity & Access
More than 5 Global Admins, admin without MFA, stale accounts 90+ days.
Conditional Access
No CA policy requiring MFA, no sign-in risk for privileged users.
Storage & SQL Data Security
Public blob access, HTTP transfer allowed, TLS 1.0/1.1, SQL TDE disabled.
NSG & VM Network Security
SSH/RDP from Internet, all-ports-open rules, VMs without disk encryption.
Key Vault Management
No soft delete, no purge protection, unrestricted public access, no audit logs.
Audit & Diagnostic Logging
Activity Log not configured, retention under 90 days, no Log Analytics.
RBAC Access Control
Owner at subscription scope, guest users as Contributor, >3 Owner assignments.
Live API or CSV export — your choice
AWS & Azure connect directly via live API. ERP platforms use a read-only extraction script. No agents to install.
1
Select your platforms
Choose one or more platforms. Each has a tailored check set built for that system's data model and risk surface.
2
Connect live or upload
AWS & Azure: enter credentials and AuditCore pulls data directly — no CSV export needed. ERP platforms: run our read-only PowerShell or ABAP script.
3
Analyse & schedule
330+ checks — including cross-system SoD — complete in under 5 minutes. Set a weekly or monthly schedule and it runs automatically from then on.
4
Act on the findings
Professional report with executive summary, prioritised findings, remediation steps, compliance mappings, and a risk score.
Ready to see your full hybrid security posture?
Start free — 2 credits included. No credit card required. Results in minutes.