Your audit evidence and your user-admin queue, run by agents.
Two of the most repetitive jobs in SAP security — assembling ITGC audit evidence and clearing the user-administration queue — handled end to end by an agent that proposes every change and waits for a human to approve it.
New Now runs natively on SAP BTP, inside your own subaccount →Audit Agent
Your SAP ITGC audit evidence — selection screens, result screenshots and real .xlsx exports — captured read-only and packaged into one SHA-256 hashed zip. The four weeks your team spends feeding the auditor, gone.
User Admin Agent
Your SAP user-admin queue — unlocks, resets, role requests, new joiners — read, proposed and closed in one conversation. The admin approves every change.
Where does our data go? Nowhere outside your SAP landscape.
Syntasec now deploys into your own SAP BTP subaccount. It reads SAP through your Cloud Connector, and the AI runs on your SAP AI Core.
Your BTP subaccount
Deployed inside your own subaccount. Logins go through your XSUAA and role collections.
Cloud Connector, read-only
Reads SAP over RFC through your Cloud Connector. No inbound ports.
Nothing installed in SAP
No ABAP transports. Nothing added to S/4HANA or ECC.
AI on your SAP AI Core
Claude via the generative AI hub, not an external endpoint.
New on BTP: Agent Lens. RPA bots, AI users and integration users already log on to your SAP. Agent Lens shows who each non-dialog identity is, from evidence, what it can do, and what it actually ran. A person decides what each one is.
Your SAP audit evidence, collected by an agent.
Every audit cycle, your auditor asks for the same 20–25 ITGC controls, each with five or six evidence items. Screenshots of the selection screen. Screenshots of the results. The underlying data as a download. Four hundred to six hundred artefacts a year, captured by hand, forever.
The agent doesn't replace your auditor. It replaces the four weeks your team spends feeding them.
Runs on your Windows machine, driving your own SAP GUI session · Read-only — no write access to production
Evidence lands in your SharePoint, never on our servers · Works with S/4HANA, ECC and RISE
Three steps. Same evidence format your auditor already accepts.
Nothing changes for the auditor. They still receive screenshots and data downloads — the artefacts they have always asked for. What changes is who spends the month producing them.
Kick it off, or let it run itself
Launch from the desktop app, or schedule it for the first morning of your audit cycle. The agent attaches to your own SAP GUI session, so it inherits your authorizations. No service account. No stored SAP password.
It drives SAP the way your analyst does
Transaction by transaction: enter the selection criteria, screenshot it, execute, screenshot every page of results, export the data as real .xlsx. Read and display only — no write access to production, ever.
One zip, per control, hashed
A folder per control, a Word document with every screenshot inline, a combined workbook, and a SHA-256 hash recorded at capture time. It lands in your SharePoint and your manager gets the link.
Your user-admin queue, closed in one conversation.
Unlocks, password resets, role requests, new joiners, and the "why can't I run this transaction?" tickets — read from ServiceNow, Microsoft Teams, or a pasted message, and resolved in a single thread where the admin approves every change.
What it does
Reads a user-admin ticket, finds the user across every connected system, and proposes the fix: unlock, password reset, role assignment, or new-user setup. For an access error it reads an authorization trace — SU53 / STAUTHTRACE — to find the exact role behind the failure, then proposes it.
Runs where your admins already work: SAP ECC & S/4HANA · Microsoft Teams (Copilot Studio) · Claude.ai · web console.
Proposes, never decides. Nothing auto-executes — the admin types a one-time confirmation code to run any change. Passwords are delivered by a one-time link, never shown in chat and never seen by the AI. Every action is logged. Human approval gates every action.
Open the live demo.
It's already running.
A self-guided sandbox on a sample S/4HANA landscape — the real product, real agents, sample data. Nothing to install, no email required.
Run the Audit Agent
Kick off a security audit on the sample PRD system and watch findings and evidence assemble in front of you.
Ask the Chat Agent
Type “Who has SAP_ALL?” or “Show SoD conflicts in finance” and get grounded answers from the sample posture.
Explore the dashboards
CVSS-ranked vulnerabilities, live threat patterns, behavioral drift, and the FUE licensing position — all clickable.
Beyond the audit cycle
The audit agent is one part of Syntasec — an on-premise SAP security platform with continuous vulnerability scanning, threat detection, SoD analysis, RISE licensing and a full agent layer on top. Most teams start with the audit evidence problem, then grow into the rest.
One platform. Two layers.
A security engine that continuously scans your SAP landscape — and an agent layer on top that your team talks to.
Nine SAP security capabilities
Continuous, AI-powered security across your entire SAP landscape — the foundation every agent runs on.
Vulnerability Management
1,400+ SAP-specific controls, continuously scanned with CVSS scoring across access, passwords, RFC, and transport.
Threat Detection
215+ real-time attack patterns across SM20, SM21, and STAD with configurable alerting.
Behavioral Drift Analysis
User-behavior anomaly detection with ML — surfaces insider threats and compromised accounts.
Audit Automation
Auditor-grade evidence packs with SHA-256 integrity. Maps to SOX ITGC and ISO 27001.
ABAP Code Analysis
AI review of custom code for security flaws — injection, authority bypass, hardcoded credentials.
SoD / Access Risk
Segregation-of-duties conflict detection on top of SAP GRC, grounded in your ruleset.
FUE License Optimization
Fixed-User-Equivalent exposure analysis — a defensible RISE licensing position ahead of audit.
Role & Access Governance
Least-privilege role design and review — PFCG engineering with org-level cascade.
Teams & Copilot
Query your security posture in plain English via 45+ MCP tools — first in SAP security.
Nine agents that do the work
your team dreads
They connect to your systems, run on a schedule, capture evidence, and report — so your team converses with results instead of logging into systems one by one.
Audit Agent
Connects to a target system, runs a full security audit, captures evidence straight from SAP, and emails a findings report to your security manager.
User Admin Agent
Reads user-admin tickets from ServiceNow, Teams or a pasted message, finds the user across systems, and proposes the fix — unlock, reset, role assignment or new-user setup. Nothing runs until an admin confirms.
Inactive User Agent
Flags dialog users dormant beyond your threshold from synced SAP data and reports them — it never locks or changes anything in SAP.
SoD Agent
Deterministic conflict detection on top of SAP GRC. Reasons remediation and surfaces ruleset gaps in plain language, grounded in your ruleset.
Access Request Agent
Turns an inbound access-request email into a SAP GRC request. AI parses the ask; deterministic rules own the decision and clarify when details are missing.
FUE Analysis Agent
Classifies users by RISE Fixed-User-Equivalent tier and quantifies license exposure across your landscape — a defensible FUE position ahead of audit.
Role Build Agent
Derives least-privilege SAP roles from real usage — cascades org levels and checks for SoD conflicts before packaging a transport-ready PFCG change.
FF Log Review Agent
Scores every SAP GRC Firefighter session for risk, checks whether activity matches the stated reason, and sends reviewers a Teams card with what to ask.
Chat Agent
Ask plain-English questions over your live SAP security posture — vulnerabilities, users, roles, SoD — and get grounded answers in seconds.
Guardrail by design. Every agent finds, classifies and proposes — and where an agent can act, a human approves and confirms first. No agent remediates or executes changes in SAP on its own — human approval gates every action.
Built on Claude. Not locked to it.
Syntasec is AI-agnostic by design. Run the reasoning layer on the engine your policies allow — from best-in-class cloud AI to a model that never leaves the building — and change your mind later without re-platforming.
Claude
The default engine — frontier reasoning in the cloud, for the richest analysis and the sharpest agent decisions.
AWS Bedrock
Claude inside your own AWS account and region — the same reasoning, kept within your cloud compliance boundary.
On-premise model
An open model — Gemma (Google DeepMind), Qwen, or similar — running on your own hardware. Nothing leaves your network — full data sovereignty, no external calls.
Rule-based
No LLM at all. A deterministic engine that runs entirely offline — for air-gapped landscapes and instant, repeatable results.
One platform, four engines — your SAP data never leaves your network, whichever you choose.
Learn how teams secure SAP with SyntaAI
Built by SAP security veterans
SyntaAI is founded by SAP security practitioners who spent years doing this work by hand — and built the platform they wished they'd had. Thirty-five years of combined SAP security and automation experience behind every agent.
Bhargavi Maddipati
Fifteen years in SAP Security and GRC, with deep expertise in access governance, segregation of duties, and the audit realities the platform is designed around.
Jani K
Twenty years across SAP Security and Automation — pairing hands-on security depth with the automation engineering the agent layer is built on.
See the whole platform
run against your SAP.
Get a personalized demo of the platform and the agent layer — on your infrastructure, live in 2–4 weeks.