Onapsis and Recorded Future Put SAP Exploit Window at One to Three Days

Onapsis and Recorded Future research found that SAP vulnerabilities patched in 2025-2026 had a median of one to three days between an SAP Security Note release and the first verified public exploitation or proof-of-concept, compared with 489 days for vulnerabilities patched in 2021. ERP News published the findings on October 30, 2026.

What the Days to Zero Research Measured

The findings appear in the companies' Days to Zero research overview, which draws on more than 1.2 million threat-intelligence events spanning 2023 through the first half of 2026. Onapsis published its accompanying research summary on October 29. SAP is a German enterprise software company founded in 1972 that sells cloud ERP, HCM, procurement and expense software to large enterprises, according to akta.pro company records.

The reported median combines two milestones: verified public exploitation and publication of a proof-of-concept. A public demonstration is not necessarily evidence of an attack on a production system, and the comparison covers vulnerabilities with observed milestones rather than every SAP vulnerability. The public summary does not give the sample size behind each annual median.

The researchers counted 933 distinct SAP-relevant documents on actor-operated underground channels in 2025, up from 419 in 2023, an increase of approximately 123%. They identified 26 distinct ransomware and extortion groups in SAP-relevant content during 2025, compared with eight in 2023, and 30 groups appeared at least once across 2023 through the first half of 2026. Those figures measure documents and group appearances, not successful SAP breaches.

Onapsis reported that the Qilin ransomware group updated its encryptor to terminate SAP background services before encrypting files, and that 11 Qilin leak-site victims had exfiltrated files labeled "SAP" during a 40-day period in early 2026. Onapsis announced Control Central, a product for SAP application security testing and custom code security supporting RISE with SAP, Dark Reading reported in August 2026.

SAP's Data and AI Buildout

SAP announced plans in June 2026 to acquire Dremio, a cloud data lakehouse, alongside a $1.17 billion commitment to AI startup Prior Labs, according to akta.pro funding records. The same records list a $4.1 billion post-IPO debt round in May 2026 and total funding of $5.4 billion. SAP opened a data center in Mumbai in June 2026 to support local data residency for its Business Network.

Earlier SAP Security and AI Signals

Onapsis released a study in August 2026 finding that 58% of organizations had adopted AI applications interacting with ERP systems in the past six months, while more than 70% of cybersecurity leaders had limited or no trust in AI's ability to protect critical business data, ERP News reported. At Tech Edge 2026, SAP's Richard Grangeier said AI can replicate small applications but not large ERP systems, citing operational risks, and SAP unveiled AI agent tools and expanded SAP Business Data Cloud, Naver reported in October 2026.

SAP's Stated Next Steps

SAP said new lakehouse features would launch in Q1 2026, Naver reported. SAP India committed to preparing 2 million people for the future of work by 2030, part of a global pledge to equip 12 million people with AI-ready skills by 2030, the Deccan Herald reported in October 2026.