Since April 2026, your custom BAIP apps have officially graduated: they are now first-class targets for the hacker community in software supply chain attacks. The customers who ran vulnerability scanning at the time spotted the exposure fastest and rolled out SAP’s fixes within hours. Everyone else found out the hard way. According to Microsoft’s latest digital defense report 2026: “Open-source supply chain compromise” is the number one emerging threat for the next year (see page 36, threat landscape).
Knowing which CVE sits in your custom app on BAIP is only half the job. You also need to know whether someone is actively exploiting it right now – and that signal lives in your SOC, not in a scan report.
A mental model to dissect this space
Shift Left – secure code before it ships (static analysis, dependency scanning in your pipeline).
Shield Right – protect and monitor the running app at runtime.
The missing link – take the application vulnerability report’s runtime findings and correlate them everything else happening across your estate using your SIEM application.
This article is about that third piece. The application vulnerability report tells you a known CVE is live in a BAIP custom app. Microsoft Sentinel for SAP tells you the same tenant just saw a suspicious Entra ID sign-in, lateral movement, and sensitive SAP data download. Alone, each is noise. Together, they are an incident! See below incident graph and timeline informed by Microsoft Sentinel for SAP on the Microsoft Defender portal from an SAP attack replay.
What the application vulnerability report gives you
SAP’s first-party application vulnerability report continuously identifies known CVEs in the custom applications you run on BAIP – no agent to deploy, no separate scanner to license. It is the authoritative, SAP-sourced view of what is vulnerable in your code. If you are new to the Application Vulnerability Report, this is the fastest way to see your BAIP custom-code exposure.
Bringing it into Microsoft Sentinel for SAP BAIP
With the integration of the application vulnerability report into the Microsoft Sentinel Solution for SAP BAIP, your existing BAIP telemetry is enriched with these CVE findings. See below Screenshot from the Microsoft Sentinel Incident overview on the correlation of the SAP BAIP audit log and the Application Vulnerability Report findings.
It features the vulnerable CAP app which was used during the red team event at DSAG TechXChange 2026 showing AI prompt injection attacks.
The vulnerability signal can now be correlated with the rest of your security data.
Beyond the automatic correlation, you get out-of-the-box visualizations for querying and continuous monitoring, built for the people who own BAIP security day to day. If you already run the application vulnerability report but have never pushed its findings into a SIEM, this is the step that turns a periodic report into a live detection surface. See below visuals produced from the API output of the new vulnerability report service.
A mesh of screenshots from the updated workbook on Microsoft Sentinel for SAP
Comparing with shift-left approaches
GitHub Advanced Security is one sample of tackling vulnerabilities with the shift-left approach during design time till your DevOps pipelines and before code is put into production. It is excellent at what it does: finding vulnerabilities in source code before it ever ships. It scans your repositories, flags vulnerable dependencies, and catches secrets in commits.
The application vulnerability report answers a different question. It does not look at your repository; it looks at what is running on BTP and tells you which known CVEs are live in production right now.
GitHub Advanced Security secures the code on its way in. The application vulnerability report, correlated in Sentinel, tells you whether a live vulnerability is being exploited. They are complementary: one hardens the pipeline, the other watches the runtime.
What’s next?
We are expanding the correlation content: more out-of-the-box detection rules mapping application vulnerability report findings to active-exploitation signals, and richer workbooks for BAIP security personas. Expect tighter mapping between specific CVE classes and attacker behaviors that typically follow them.
In addition to that we would like to hear from you what you need most from the BAIP vulnerability space.
Turn on the application vulnerability report connector (preview*) using the service key, so CVE findings flow into Sentinel for SAP BTP.
Deploy the workbook “BAIP Activity” and analytic rules shipped with the Sentinel solution for SAP BAIP
Discover your current vulnerable apps from the workbook, and watch for correlated incidents, where a known vulnerability meets suspicious runtime activity.
Shift Left secures the code. Shield Right protects the runtime. Correlating the application vulnerability report in your SIEM closes the loop between the two.
* the connector remains in preview while the Application Vulnerability Report service is in Beta.
Closing the loop
Custom applications on SAP BAIP need continuous vulnerability visibility – but isolated findings are only the beginning. By bringing SAP application vulnerability report findings into Microsoft Sentinel, your SOC can connect known CVEs in production with suspicious activity across the broader environment and investigate incidents with the context they need.
Shift Left and Shield Right serve different, complementary purposes: solutions such as GitHub Advanced Security help secure code throughout development and delivery, while the SAP application vulnerability report identifies known vulnerabilities in applications already running on BAIP. Correlating those runtime findings in Sentinel closes the gap between vulnerable code and active threats.
Through close collaboration between SAP and Microsoft engineering, Microsoft Sentinel for SAP BAIP now delivers a broader, more actionable view of application risk.
Now we want to hear from you: which detections, analytics rules, or workbook insights would make the biggest difference for your SAP BAIP security operations? Share your priorities in the comments or reach out to us directly.
Cheers
Fabian and Martin
co-authored by Martin PankrazDear community, Since April 2026, your custom BAIP apps have officially graduated: they are now first-class targets for the hacker community in software supply chain attacks. The customers who ran vulnerability scanning at the time spotted the exposure fastest and rolled out SAP’s fixes within hours. Everyone else found out the hard way. According to Microsoft’s latest digital defense report 2026: “Open-source supply chain compromise” is the number one emerging threat for the next year (see page 36, threat landscape). Knowing which CVE sits in your custom app on BAIP is only half the job. You also need to know whether someone is actively exploiting it right now – and that signal lives in your SOC, not in a scan report. A mental model to dissect this space Shift Left – secure code before it ships (static analysis, dependency scanning in your pipeline). Shield Right – protect and monitor the running app at runtime. The missing link – take the application vulnerability report’s runtime findings and correlate them everything else happening across your estate using your SIEM application. This article is about that third piece. The application vulnerability report tells you a known CVE is live in a BAIP custom app. Microsoft Sentinel for SAP tells you the same tenant just saw a suspicious Entra ID sign-in, lateral movement, and sensitive SAP data download. Alone, each is noise. Together, they are an incident! See below incident graph and timeline informed by Microsoft Sentinel for SAP on the Microsoft Defender portal from an SAP attack replay. What the application vulnerability report gives you SAP’s first-party application vulnerability report continuously identifies known CVEs in the custom applications you run on BAIP – no agent to deploy, no separate scanner to license. It is the authoritative, SAP-sourced view of what is vulnerable in your code. If you are new to the Application Vulnerability Report, this is the fastest way to see your BAIP custom-code exposure. Bringing it into Microsoft Sentinel for SAP BAIP With the integration of the application vulnerability report into the Microsoft Sentinel Solution for SAP BAIP, your existing BAIP telemetry is enriched with these CVE findings. See below Screenshot from the Microsoft Sentinel Incident overview on the correlation of the SAP BAIP audit log and the Application Vulnerability Report findings. It features the vulnerable CAP app which was used during the red team event at DSAG TechXChange 2026 showing AI prompt injection attacks. The vulnerability signal can now be correlated with the rest of your security data. Beyond the automatic correlation, you get out-of-the-box visualizations for querying and continuous monitoring, built for the people who own BAIP security day to day. If you already run the application vulnerability report but have never pushed its findings into a SIEM, this is the step that turns a periodic report into a live detection surface. See below visuals produced from the API output of the new vulnerability report service. A mesh of screenshots from the updated workbook on Microsoft Sentinel for SAP Comparing with shift-left approaches GitHub Advanced Security is one sample of tackling vulnerabilities with the shift-left approach during design time till your DevOps pipelines and before code is put into production. It is excellent at what it does: finding vulnerabilities in source code before it ever ships. It scans your repositories, flags vulnerable dependencies, and catches secrets in commits. The application vulnerability report answers a different question. It does not look at your repository; it looks at what is running on BTP and tells you which known CVEs are live in production right now. GitHub Advanced Security secures the code on its way in. The application vulnerability report, correlated in Sentinel, tells you whether a live vulnerability is being exploited. They are complementary: one hardens the pipeline, the other watches the runtime. What’s next? We are expanding the correlation content: more out-of-the-box detection rules mapping application vulnerability report findings to active-exploitation signals, and richer workbooks for BAIP security personas. Expect tighter mapping between specific CVE classes and attacker behaviors that typically follow them. In addition to that we would like to hear from you what you need most from the BAIP vulnerability space. Get started today Enable the application vulnerability report for your BAIP custom apps. Deploy the latest Microsoft Sentinel Solution for SAP BAIP v 3.2.1. Turn on the application vulnerability report connector (preview*) using the service key, so CVE findings flow into Sentinel for SAP BTP. Deploy the workbook “BAIP Activity” and analytic rules shipped with the Sentinel solution for SAP BAIP Discover your current vulnerable apps from the workbook, and watch for correlated incidents, where a known vulnerability meets suspicious runtime activity. Shift Left secures the code. Shield Right protects the runtime. Correlating the application vulnerability report in your SIEM closes the loop between the two. * the connector remains in preview while the Application Vulnerability Report service is in Beta. Closing the loop Custom applications on SAP BAIP need continuous vulnerability visibility – but isolated findings are only the beginning. By bringing SAP application vulnerability report findings into Microsoft Sentinel, your SOC can connect known CVEs in production with suspicious activity across the broader environment and investigate incidents with the context they need. Shift Left and Shield Right serve different, complementary purposes: solutions such as GitHub Advanced Security help secure code throughout development and delivery, while the SAP application vulnerability report identifies known vulnerabilities in applications already running on BAIP. Correlating those runtime findings in Sentinel closes the gap between vulnerable code and active threats. Through close collaboration between SAP and Microsoft engineering, Microsoft Sentinel for SAP BAIP now delivers a broader, more actionable view of application risk. Now we want to hear from you: which detections, analytics rules, or workbook insights would make the biggest difference for your SAP BAIP security operations? Share your priorities in the comments or reach out to us directly. Cheers Fabian and Martin Read More Technology Blog Posts by SAP articles
