How it deploys
Syntasec deploys into your own BTP subaccount, so it sits inside the landscape you already run and govern.
- Reads SAP over RFC through your Cloud Connector. Read-only, with no inbound ports.
- No ABAP transports. Nothing is installed in S/4HANA or ECC.
- Logins through your XSUAA and role collections. Access follows the identity setup you already have.
- AI runs on your SAP AI Core. Claude via the generative AI hub, not an external endpoint.
What it does
- 1,400+ security checks: parameters, critical authorizations, RFC destinations, ICF services, users and patch status.
- Multiple systems from one cockpit: S/4HANA, ECC and GRC.
- AI Triage: every open finding gets a priority, a false-positive likelihood, and the fix steps with transaction codes, weighted by system tier.
- SyntaAI Agent: ask “what should I fix first on PRD?” in plain English.
- Agent Lens: who your non-dialog, RPA, AI and integration users are, what they can do, and what they ran.
New on BTP: Agent Lens
RPA bots, AI users and integration users already log on to your SAP systems. Agent Lens inventories every system, communication and service user, classifies each one from evidence (job steps, RFC destinations, workflow and ALE), resolves what it can do, and checks your registered RPA, AI and integration users against what they actually ran and where they logged on from. It never calls an identity an AI agent on its own: a person makes that call, with a reason.
AI Triage and the agents find, classify and propose. No agent remediates or executes a change in SAP on its own. Human approval gates every action.
Your choice of AI engine still applies
On BTP, AI runs on your SAP AI Core. Syntasec remains AI-agnostic, so you can choose the engine your policies allow. See the engine options, the Syntasec platform, and the two flagships: Audit Agent and User Admin Agent.
See Syntasec running in a BTP subaccount.
Tell us about your landscape and we'll walk you through a BTP deployment.