Services / 04

SAP, industrial & IoT security

“It runs the plant or the ERP.”

I assess SAP systems, industrial networks and connected devices. We agree what can be tested—and what must be left alone—before touching production. You get a report of what I found and what to fix, with the testing limits made explicit.

ERP/SAP · OT/SCADA · IoT

Who it’s for

  • Industrial sites Manufacturers, utilities and plants with OT networks.
  • Companies that run on SAP You want to know who can reach the ERP and what they can do once in.
  • Makers of connected devices Testing helps you prepare for the EU Cyber Resilience Act. It isn’t a conformity assessment.
  • Consultancies I also take subcontracting engagements, and I can deliver under your brand with a white-label report.

What I test

Three areas, which can be scoped together or separately.

  • SAP authorizations and roles Excessive rights, critical combinations of rights, default users.
  • SAP RFC connections and gateway Gateway ACLs and the message server.
  • SAP web front ends NetWeaver and Fiori, tested as web applications.
  • SAP security configuration Checked against a baseline.
  • IT/OT segmentation Can an attacker get from the IT network into the industrial one?
  • Passive OT assessment Traffic capture and an asset inventory, with no active scanning.
  • PLCs and industrial protocols Active testing of PLCs and of protocols such as Modbus, S7 and OPC UA, on a replica, a lab or a test bench.
  • Production OT Active testing on production only in agreed maintenance windows.
  • IoT firmware Extraction and analysis: secrets, the update mechanism, binaries.
  • Hardware interfaces UART, JTAG and SPI flash.
  • Radio BLE, Wi-Fi and other radio protocols.
  • Backend and companion app The cloud backend of the device and its mobile app.

Frameworks: IEC 62443 · OWASP ISVS · ETSI EN 303 645 · SAP Security Baseline

How it runs

  1. Scoping & authorization

    Targets, goals, dates and limits. For SAP and OT, this is where we decide which systems I may touch, which I leave alone, and which tests run only on a replica or in a maintenance window. We also agree whether AI tools may be used on your data: local models by default, cloud models only with your written agreement. Signed rules of engagement before testing starts.

  2. Testing

    Manual, with tooling as support. Critical findings are reported as soon as I find them, not at the end.

  3. Report & debrief

    Proof, impact and concrete fixes ranked by risk, then a call with your team.

  4. Retest

    Once the fixes ship, I verify them and send an updated report. Evidence and your data stay encrypted during the engagement and are deleted 90 days after the final report.

What you get

  • A report What I found, with proof and impact, and concrete fixes ranked by risk. In French or English, as you prefer.
  • The testing limits, made explicit What was tested, what was left alone and under which conditions, so a clean result isn’t read as covering more than it did.
  • A debrief call and a retest I walk your team through the findings, then verify the fixes once they ship.

No public case study for this service yet. See selected work.

Questions

Will it stop the plant?

Testing on the industrial network starts passively: traffic capture and an asset inventory, with no active scanning. Active tests on PLCs and protocols run on a replica, a lab or a test bench, and on production only in agreed maintenance windows. All of it is written into the rules of engagement before anything starts.

Can you test a replica?

Yes. That’s where active tests on PLCs and industrial protocols run, so production isn’t touched.

Do you need the device?

For hardware interfaces such as UART, JTAG and SPI flash, and for radio testing, yes: I need a physical device. We settle the details at scoping.

On-site or remote?

Remote by default. I come on-site anywhere in France when the work needs it. We decide which parts need me there at scoping.

Talk about your project

I reply within two working days. Tell me whether it’s SAP, an industrial site or a device, what must not be disturbed, and roughly when you want it tested. I send a quote after scoping.