SAP license reduction and SAP security
SAP prices S/4HANA and RISE by what your users' roles allow. ClearSeat measures what they actually use, then gives your own security team a safe, evidence-backed plan to close the gap.
The problem
A user's FUE tier is set by the most powerful authorization they hold, not by what they do. SAP's own measurement counts authorizations only. In the estates we measure, the two numbers are far apart.
of users count as Advanced FUE by authorization in a typical estate
of users is what recorded usage supports as FUE. A 10,000-user estate should need about 1,000 to 2,000.
a year for every 1,000 FUE, locked in at RISE signature or renewal
How it works
Your team executes, on your calendar. Nothing is installed in your SAP systems, and your data never leaves your environment.
We measure your authorization FUE with SAP's own classification logic, so it reconciles to the STAR report SAP will use, and give you the baseline in writing.
Your systems record usage trace data for 60 to 90 days while business runs as normal. We check weekly that it's accumulating.
We measure usage FUE, agree a target with you, and build a change-by-change plan. Every change names the users affected and shows that no one loses access they used.
Your security team applies the changes in weekly waves using the method we hand over. We re-measure as the changes go in and close with a report.
One measurement, three outcomes
Remove the FUE tiers nobody earns through actual use. Paid for from the savings.
The same usage evidence shows the access nobody uses. Removing it shrinks what an attacker or an insider can reach, with the impacted users known before every change.
With access right-sized, the rest of the posture gets fixed in order: assessment, hardening, patching, detection.
Most clients start with the license number. The security work follows from the same data.
SAP security services
ClearSeat is built by SAP security practitioners. These are the services that need deep SAP expertise and that most firms can't staff.
A structured review across the layers of your SAP estate, with findings ranked by risk and a plan your team can act on.
Define the security baseline for your SAP estate and put it in place: the settings, roles and controls every system must meet, with a check that proves it.
Usage-based removal of access nobody uses, built on the same evidence as our FUE reduction. Available on its own or as the natural follow-on.
A running program for SAP Security Notes and vulnerability findings: triage, scheduling, remediation tracking and verification, so patch day stops being a scramble.
Detection use cases for the SAP application layer feeding your SIEM or SAP's own tooling, with playbooks and rehearsals so an incident is handled, not improvised.
Secure configuration of the SAP technical layer: parameters, services, gateway, RFC and interfaces.
Control of the accounts that can do anything in SAP: scope, monitoring and emergency access that holds up to audit.
Finding and fixing the vulnerabilities in your own ABAP and extensions, with a review process that keeps them out.
Purpose-built tools for your SAP security problems, built on your behalf and owned by you.
Questions we get on the first call
No. We work from standard export files on a device you issue. Nothing is installed in SAP, on your network, or in the cloud, and nothing is left behind.
Your SAP security team, on your calendar, in weekly waves. We provide the plan, the method and the evidence, and we stay on the call while it happens.
A laptop or virtual desktop with an account, export files from your SAP systems that your Basis or security team produces, usage trace recording switched on for 60 to 90 days, and a sponsor who can accept the plan.
Against your own baseline. We measure authorization FUE with SAP's classification logic so it reconciles to the STAR report, then measure the FUE of the plan you accept, change by change. The difference is the validated reduction.
No, it makes their number bigger. Advisors negotiate the price per FUE and the contract terms. We reduce the number of FUE they negotiate over. Many engagements come through advisors.
Usually yes. Most tools count authorizations or estimate usage from transaction statistics, and none of them hands your team a change-by-change plan with the impacted users named. If your tool records usage, we can often use its data.
It is if it's done blind, which is why we don't. Every change in the plan names the users affected and shows that no one loses access they actually used. Where someone would, the plan includes a mitigation role.
Working files stay on the device you issued and are deleted at close; we keep no copy. The only things that leave are the report and the plan workbook your team needs. A one-page engagement security brief for your infosec team is available on request.
About ClearSeat
ClearSeat is led by people who have run SAP security, sold enterprise software, and sat in the CISO chair at Fortune 500 companies. The team is small by design: the people you meet are the people who do the work.
Contact
Thirty minutes. Bring your STAR report if you have one and we'll size the opportunity on the call. If you don't, we'll show you how to get it.
Prefer email? [email protected]
For your infosec or third-party-risk team, we have a one-page engagement security brief ready to send.