Avantra handles RISE with SAP security monitoring for the layer that stays with the customer under the RISE with SAP shared responsibility model. SAP operates the infrastructure, network, database, and operating system, while the customer still owns application configuration, users and authorizations, custom code, and requesting the SAP Security Notes that SAP doesn’t apply proactively.
What changes for SAP security under RISE with SAP
RISE with SAP moves infrastructure operations to SAP. It does not move application security.
Under RISE with SAP S/4HANA Cloud, private edition, SAP acts as the cloud service provider. SAP runs the hyperscaler accounts, the network, the database, and the operating system. The customer keeps everything inside the application: data, users, roles, authorizations, custom code, and application-level configuration.
The split is defined in SAP’s Roles and Responsibilities (R&R) document for each RISE offering. Standard, tailored, and customer data center options assign tasks differently, so the R&R attached to your contract is the source of truth.
The practical effect for SAP Basis and security teams: fewer infrastructure tasks, the same accountability for application-layer risk, and less direct access to the systems that carry that risk.
This guide covers security responsibilities only. For performance, SLA, and operational visibility in SAP-managed systems, see RISE with SAP monitoring: overcoming the black box.
Who owns what: SAP vs. customer security responsibilities
Under RISE with SAP, SAP secures the platform and the customer secures what runs on it. The table reflects the standard private edition model; check your contract’s R&R for tailored terms.
| Security area | SAP’s responsibility | Customer’s responsibility |
|---|---|---|
| Hyperscaler infrastructure and network | Operates and secures | None |
| Operating system and database | Patches, hardens, and operates | None |
| Baseline system hardening | Applies a standard hardened build at handover | Maintains application-level settings after go-live |
| SAP Security Notes (application layer) | Applies HotNews (Very High priority) notes proactively; applies other notes on request, or more broadly through an optional Cloud Application Service | Identifies and assesses the remaining relevant notes, requests them, and tests and validates every implemented note |
| Users, roles, authorizations, SoD | Provides the tooling; optional service for SoD risk detection | Designs, assigns, reviews, and enforces |
| Custom code | None | Secures, tests, and remediates |
| Security audit logs and incident response | None in the standard scope | Reviews logs, detects privileged access abuse and unauthorized changes, feeds the SIEM or SOC |
| Security KPIs and dashboards | Not included in standard RISE services | Builds and maintains its own view |
The recurring misunderstanding is Security Notes. SAP applies the most critical HotNews notes itself, but in the standard model the customer still identifies the remaining relevant notes and asks SAP to apply them.
For building that security KPI view, see the SAP security dashboard guide.
The security visibility gap when transitioning off Solution Manager
RISE with SAP contracts do not include SAP Solution Manager usage rights. Customers keep Solution Manager only through an existing on-premises maintenance contract or a separate subscription to SAP Solution Manager, private cloud edition.
SAP Cloud ALM is included with RISE and is SAP’s target ALM platform for it. Many RISE customers therefore start transitioning off Solution Manager during or after the move.
That transition is where security monitoring visibility drops. Years of Solution Manager setup often carry security-relevant work that nobody thinks of as “security tooling”:
- Missing Security Note tracking through System Recommendations
- Configuration baselines checked through Configuration Validation
- Custom alerting on system logs, jobs, and critical transactions
- Security-relevant alert thresholds tuned to each landscape
None of this transfers to SAP under RISE. Each item needs a new owner and a new tool, or it quietly stops.
What Cloud ALM covers for RISE with SAP security monitoring
SAP states there is no functional parity between SAP Cloud ALM, SAP Solution Manager, and SAP Focused Run. Cloud ALM is built cloud-first and covers a different scope.
Cloud ALM for Operations centers on four areas: business process monitoring, integration and exception monitoring, job and automation monitoring, and health monitoring. These cover whether business processes and interfaces run. SAP has also added security capabilities: Cloud ALM’s Configuration & Security Analysis checks connected SAP cloud services, such as SAP BTP and SAP Cloud Identity Services, against SAP’s published security recommendations.
For RISE private edition systems, much of the hands-on security work, such as proactive Security Note implementation beyond HotNews, sits in optional Cloud Application Services, purchased separately. Entitled customers also currently receive one Cloud ALM tenant per customer number, which matters for organizations running several landscapes or business units.
Cloud ALM is the right home for lifecycle management and operations under RISE. Security posture monitoring for the customer-owned layer needs a deliberate plan alongside it.
Where Avantra fits in RISE with SAP security monitoring
Avantra covers the monitoring that stays with the customer under RISE with SAP, without duplicating the infrastructure security SAP already runs. It works alongside SAP Cloud ALM through the Avantra and SAP Cloud ALM integration, and alongside Solution Manager where customers still use it.
For RISE customers, Avantra SecOps monitors the application layer:
- SAP HotNews and Security Notes. Avantra checks newly published HotNews notes against each managed system and tracks their status per system, so teams can confirm what SAP has applied and see anything still open.
- Configuration drift and profile parameters. Policy checks on logging, password, and login rules run continuously and alert on unexpected changes.
- Users and authorizations. Avantra checks authorization policy compliance and flags elevated or orphaned accounts.
- Certificates across S/4HANA, BTP, SAP Integration Suite, and Cloud Connector, before they expire.
- Logs and system events for specific jobs, transactions, and security-relevant activity.
Checks run as often as every five minutes. Alerts route into ServiceNow and the existing incident process, and findings build an audit trail as they happen.
Most RISE customers still run some on-premises or hyperscaler SAP during the move. Avantra monitors ECC, S/4HANA on-premises, and RISE systems from one console, so security coverage does not split along the migration line. RISE systems are monitored agentlessly: an Avantra agent on the customer’s network connects to the SAP application layer, with no access to the SAP-managed host.
Compare Solution Manager, Cloud ALM, and Avantra for RISE security monitoring
Avantra complements Cloud ALM and Solution Manager under RISE with SAP by adding security operations depth across the customer-owned layer.
| Category | Solution Manager | Cloud ALM | Avantra |
|---|---|---|---|
| Availability under RISE | Requires an on-premises maintenance contract or a Solution Manager, private cloud edition subscription | Included with RISE with SAP | Licensed separately; runs alongside both |
| Monitoring focus | Customer-specific ALM for on-premises and hybrid landscapes | Business processes, integrations, jobs, and system health for cloud-first landscapes | SAP operations and security posture anywhere SAP runs |
| Security operations | Limited automation; not designed specifically for security management | Configuration & Security Analysis checks SAP cloud services against SAP security recommendations; proactive Security Note work beyond HotNews sits in optional Cloud Application Services | Security Note applicability, configuration drift, profile parameters, authorization policy, certificates, log monitoring |
| Multiple landscapes or tenants | Not designed for multi-tenant management | One tenant per customer number; multiple tenants managed separately | One console across multiple Cloud ALM tenants, BTP, and on-premises landscapes |
| Hybrid on-premises plus RISE | Not designed for Cloud ERP | Cloud-first; Focused Run integration requires running both solutions | One console across ECC, S/4HANA on-premises, hyperscaler, and RISE, with RISE systems monitored agentlessly at the application layer |
For the full operations comparison, see Solution Manager, Cloud ALM, and Avantra.
Frequently asked questions
Does RISE with SAP include security monitoring?
RISE with SAP includes SAP’s security operations for infrastructure, network, database, and operating system, but not monitoring of the customer’s application layer. Application security audit logging, threat detection, and incident response stay with the customer. Standard RISE services do not include a security KPI dashboard.
Who applies SAP Security Notes under RISE with SAP?
Under the standard RISE model, SAP applies HotNews (Very High priority) Security Notes proactively, and the customer identifies, assesses, and requests the remaining relevant notes. An optional Cloud Application Service extends SAP’s proactive identification and implementation to more notes, with the customer still responsible for testing. Avantra tracks HotNews status for each system, so teams can confirm what has been applied.
Can I keep Solution Manager’s security checks under RISE with SAP?
Only with the right entitlement. RISE contracts do not include Solution Manager usage rights, so keeping System Recommendations and Configuration Validation requires an existing on-premises maintenance contract or a subscription to SAP Solution Manager, private cloud edition.
Does SAP Cloud ALM cover security monitoring for RISE with SAP?
Partly. SAP Cloud ALM’s Configuration & Security Analysis checks connected SAP cloud services, such as SAP BTP, against SAP’s published security recommendations, while Cloud ALM for Operations focuses on business process, integration, job, and health monitoring. Proactive Security Note work for RISE private edition beyond HotNews sits in optional Cloud Application Services.
How does Avantra handle security monitoring for RISE with SAP?
Avantra monitors the customer-owned security layer of RISE with SAP systems: Security Note applicability, configuration drift, profile parameters, authorization policy, certificates, and logs. It monitors RISE systems agentlessly at the application layer, integrates with SAP Cloud ALM, and covers on-premises and RISE systems from one console.
Does Avantra replace SAP’s security services under RISE?
No. Avantra complements the security SAP delivers under RISE. SAP secures the platform; Avantra gives the customer continuous visibility into the application-layer responsibilities SAP’s R&R leaves with them.
Know what RISE with SAP leaves with you.
CTA body: Map your customer-owned security responsibilities against what you monitor today. We’ll show how Avantra covers the gap alongside Cloud ALM.
Book a RISE monitoring review → /book-a-demo-avantra/