Most large organisations run their finance, procurement and supply chain on SAP, which means the software sitting around SAP decides who can approve a payment, who can create a vendor, and who can quietly do both. That is the job these ten products do. They handle access risk, segregation of duties, user provisioning, role design and, increasingly, how many user licenses you are actually paying for.
Three things have pushed this category forward in the last two years. The move to S/4HANA and SAP Cloud ERP Private (formerly RISE with SAP) changed user licensing to a Full Use Equivalent model, where a user’s classification is driven by the authorisations assigned to them, so bad role design now shows up on the invoice and not just in the audit report. SAP Identity Management is heading for the end of its maintenance window in 2027, which is forcing a lot of SAP teams to pick a replacement rather than defer the decision. And mainstream maintenance for SAP’s own GRC 12.0, Access Control included, is set to end on 31 December 2027, with the successor built on SAP HANA. Every Access Control customer now has a migration to plan, and every vendor in this list knows it.
Below are ten vendors working in this space in 2026, with what each one is actually good at, who owns or funds them, and the kind of buyer they suit. Four are SAP specialists and one is SAP itself. One is a multi-ERP segregation of duties tool now owned by a privileged access vendor, and two are enterprise identity platforms that treat SAP as their most important application. The last two do not govern access at all: they cover the patching, custom code and threat detection underneath it, which is the other half of the conversation your auditor will want to have.
Soterion
Location: Johannesburg, South Africa, with regional teams covering EMEA, DACH, ANZ and North America.
VC Funding: Privately held. Founded in 2011 by Dudley Cartwright, who is still CEO.
Overview: Soterion builds GRC and SAP licensing software for companies running SAP, and nothing else. Its Access Risk Manager reports segregation of duties and sensitive access risk in plain business language rather than transaction codes, which is the point: the people signing off on access are usually finance and operations managers, not SAP security specialists. The SAP License Manager analyses actual system usage to work out the optimal number of FUE licenses, and a What-If Simulator lets an approver see the license cost of an access change before granting it. It ships as on-premise software, a SaaS product, or a managed service for teams without in-house GRC skills.
Best for: Mid-sized and large SAP customers who want access risk reporting the business can read, and anyone trying to get their FUE count under control before a renewal.
SailPoint
Location: Austin, Texas, USA.
VC Funding: Publicly traded on Nasdaq under SAIL. Previously owned by Thoma Bravo, it returned to the market in February 2025 at $23 a share, raising roughly $1.2 billion.
Overview: SailPoint is an identity governance company rather than an SAP company, but it is one of the most common ways large organisations govern SAP access as part of a wider identity programme. Identity Security Cloud is the SaaS platform, IdentityIQ the self-hosted option, and both handle joiner-mover-leaver automation, access certifications and policy enforcement across thousands of applications. Recent moves have gone after non-human identity: it bought Imprivata’s identity governance business in December 2024, acquired Tel Aviv-based Entro Security in June 2026, and launched Agentic Fabric in May 2026 to govern AI agents. SAP-specific risk analysis is generally handled through connectors and partners rather than deep native ABAP tooling.
Best for: Enterprises that need SAP governed inside a single identity programme covering every other system too.
Saviynt
Location: El Segundo, California, USA, with regional offices in London, Amsterdam, Dubai, Singapore and India.
VC Funding: Raised $700 million in a Series B growth round in December 2025 led by KKR, with Sixth Street Growth, TenEleven and existing investor Carrick Capital Partners taking part. The round valued the company at about $3 billion.
Overview: Saviynt sells a converged identity platform: identity governance, privileged access management, application access governance and identity security posture management in one cloud product. For SAP customers the draw is application access governance, which brings cross-application segregation of duties analysis into the same tool that handles the rest of the estate. The company says it works with more than 20 percent of the Fortune 100, and named customers include Levi’s, Kraft Heinz and Western Digital. Like SailPoint, it is now pushing hard on machine and AI agent identities, which was the stated reason for the KKR round.
Best for: Companies replacing several separate identity and access tools with one platform, particularly if privileged access is in scope.
Xiting
Location: Schöfflisdorf near Zurich, Switzerland, with subsidiaries in Germany, the UK, Romania and the United States.
VC Funding: Privately held. Founded as a GmbH in June 2008 by a group of SAP consultants and converted to an AG in May 2010. Around 140 employees.
Overview: Xiting sits between software vendor and consultancy. Its main product, the Xiting Authorizations Management Suite (XAMS), handles SAP role design and rebuilding, role testing, ABAP custom code vulnerability scanning and the creation of security concept documentation, which is the part most teams dread. The tools are SAP certified and the company holds SAP Gold Partner status, with more than 700 customers. Alongside the software it runs authorisation redesign projects, IAM work and security monitoring, so buyers usually get the tooling and the people together.
Best for: Organisations facing an SAP role redesign or an S/4HANA authorisation rebuild who want consultants and tooling from the same vendor, especially in the DACH region.
SAP
Location: Walldorf, Germany. Listed on the Frankfurt exchange and, as ADRs, on the NYSE under SAP.
VC Funding: Publicly traded. Reported FY2025 revenue of €36.8 billion, of which €21.0 billion was cloud.
Overview: SAP’s own answer comes in two parts. Access Control 12.0 is the incumbent almost every large SAP shop already runs: access risk analysis, emergency access management, business role management, access request management and user access review, deployed as a hub with a plug-in on each connected system. Mainstream maintenance ends on 31 December 2027, and the successor, SAP GRC edition for SAP HANA, consolidates Access Control, Process Control, Risk Management and Audit Management onto one HANA-based platform, with general availability expected in the second half of 2026. Cloud Identity Access Governance is the SaaS counterpart on SAP BTP, covering access analysis, access requests, role design, certification and privileged access for cloud applications, and it can run as a bridge alongside an existing Access Control instance.
Best for: SAP customers who already own Access Control and would rather migrate within SAP’s roadmap than run a procurement, and cloud-first estates where IAG can stand on its own.
Fastpath (Delinea)
Location: San Francisco, California, USA, with the Fastpath team still based in Des Moines, Iowa.
VC Funding: Majority-owned by TPG, with Thoma Bravo and PSP Investments as minority holders. Delinea was formed in 2021 from the Thycotic and Centrify merger, passed $400 million in ARR in August 2025 and is led by CEO Art Gilliland. It acquired Fastpath in April 2024 and StrongDM in March 2026, both on undisclosed terms.
Overview: Fastpath came out of the Microsoft Dynamics world and its strength is still breadth rather than SAP-native depth. It analyses segregation of duties and sensitive access down to the lowest securable object across more than 50 business applications, with SAP connectors covering ECC at transaction code and authorisation object level, S/4HANA down to the Fiori tile, plus Business One, CRM, Ariba and an integration with SAP GRC rather than a replacement for it. Around that sit automated access reviews, change tracking with before and after values, and access request workflows that simulate the risk of a request before it is approved.
Best for: Finance and internal audit teams who need one segregation of duties ruleset spanning SAP alongside Dynamics, NetSuite or Oracle, and who care more about a single audit report than SAP-specific tooling.
Pointsharp
Location: Stockholm, Sweden, with the SAP business in Karlsruhe, Germany, and offices in Denmark, the Netherlands, Switzerland and Finland.
VC Funding: Privately held, with Main Capital Partners as strategic investor since 2020. The SAP product arrived through the 2023 merger with SIVIS, a Karlsruhe company founded in 1999. Around 200 employees across the group.
Overview: Pointsharp Identity Governance and Administration for SAP is the former SIVIS Enterprise Security, and it is worth knowing that name because it is what most of the reference customers still call it. The suite runs segregation of duties analysis as a pre-check on access requests rather than only as an after-the-fact report, handles recertification campaigns, and includes an emergency access manager for time-boxed elevated rights. Role design is the other half of it: more than a thousand role templates and an authorisation robot for restructuring existing role concepts, plus provisioning connectors into Active Directory and Entra ID, and SAP license management in the same tool. Named customers include Audi, ThyssenKrupp and Vattenfall.
Best for: European SAP customers, particularly in DACH and the Nordics, who want role redesign, access governance and licensing in one EU-hosted product.
SecurityBridge
Location: Ingolstadt, Germany, with offices in New York, Amsterdam, London and Singapore.
VC Funding: Privately held and backed by Bregal Unternehmerkapital. Founded in 2012. Jesper Zerlang, previously chairman and before that CEO of Logpoint, took over as CEO in January 2026 from co-founder Christoph Nagy. Acquired Protect4S in 2023 and CyberSafe in 2025.
Overview: SecurityBridge is the technical security layer rather than access governance, and the company says so plainly: it positions itself as complementary to SAP GRC, not a replacement. The platform runs as an add-on inside SAP itself and covers patch management, vulnerability management, ABAP custom code analysis, interface traffic monitoring, threat detection and SIEM integration, across on-premise, S/4HANA, SAP Cloud ERP Private and BTP. Two modules touch access: privileged access management for named, logged superuser sessions instead of standing SAP_ALL, and the TrustBroker single sign-on and MFA stack picked up with CyberSafe. It claims more than 8,000 SAP systems protected across 300-odd organisations.
Best for: Teams whose segregation of duties controls are already in place but whose SAP patching, custom code and monitoring are not, and who want that running inside SAP rather than bolted on outside it.
Onapsis
Location: Boston, Massachusetts, USA, with offices in Heidelberg, Buenos Aires, Basingstoke, Dallas and Bucharest.
VC Funding: Around $117 million raised. The most recent round was $55 million in 2020, led by CDPQ and NightDragon, with LLR Partners, Evolution Equity and .406 Ventures among earlier investors. Co-founder Mariano Nunez is still CEO.
Overview: Onapsis is an SAP security company that has grown a compliance side, not an access governance vendor, and the distinction matters when you shortlist. Assess handles vulnerability and misconfiguration management, Defend does continuous threat detection including for BTP, Control scans ABAP custom code and gates transports, and Comply automates the collection of audit evidence against GDPR, PCI DSS, ISO 27001, NIST and NERC CIP. There are no segregation of duties rulesets or provisioning workflows here. What there is instead is Onapsis Research Labs, which contributes a large share of SAP’s critical security notes each year and, during the CVE-2025-31324 zero-day in 2025, published an indicator-of-compromise scanner jointly with Mandiant.
Best for: Organisations whose auditors have moved past who can approve a payment and started asking about unpatched systems, custom code and IT general controls.
IBS Schreiber
Location: Hamburg, Germany.
VC Funding: Privately held, founded in 1979, with no outside investment disclosed. Christopher Niekamp was appointed managing director in 2024 as the founding generation stepped back.
Overview: IBS Schreiber comes at SAP access risk from the audit chair rather than the security team, which shows in how CheckAud for SAP Systems works. It analyses an exported snapshot of the system rather than running inside it, and reports segregation of duties conflicts, critical authorisations and role concept problems against prebuilt rulesets aligned to DSAG recommendations, GDPR and SOX, with output structured for German audit standards. A can-do versus did-do comparison separates the risks that exist on paper from the ones someone has actually exercised, which is a quick way to cut a conflict list down to what matters. The 2026 release added an S/4HANA migration project view and support for Fiori and OData queries. There is no provisioning, no emergency access workflow and no license management here: it is an analysis and evidence tool, sold alongside the firm’s SAP audit training and consultancy.
Best for: Internal audit, revision and compliance teams, particularly in the DACH region, who need defensible segregation of duties evidence for an audit rather than a platform to operate access day to day.
Which one should you choose?
The split here is between depth and breadth, and now also between access and everything underneath it. Soterion, Xiting and Pointsharp are SAP specialists, and that shows in how their tools handle SAP’s own quirks, from FUE license classification to ABAP role design. IBS Schreiber comes at the same problem from the audit chair rather than the security team. Fastpath approaches it from the finance side, with one ruleset stretched across every ERP you own. SailPoint and Saviynt come at SAP from the identity side, which is the right call if SAP is one of forty systems you have to certify access for, and overkill if it is the only one that matters. SecurityBridge and Onapsis are not in the access governance business at all, and neither pretends to be: they cover patching, custom code and threat detection, which is the half of SAP risk that segregation of duties reporting never touches. SAP itself is the incumbent, and the 2027 maintenance date turns that from a default into a decision.
Budget and team size decide most of it. A company with a two-person SAP security team and an auditor asking about segregation of duties needs something the business can actually operate, and a $3 billion identity platform is not that. A global bank with SAP, Oracle and 200 SaaS applications has the opposite problem. Check three things before you shortlist. Whether the vendor’s SAP risk rule set can be customised to your processes. Whether the tool reports on license consumption as well as risk, since under the FUE model those are now the same conversation. And what the vendor’s answer is for SAP Access Control customers after 2027, because if they cannot describe that migration clearly they have not thought about the next two years as hard as you are about to.
