Your ERP Is Under Attack: Are You Ready?
As companies accelerate their digital transformation and move Enterprise Resource Planning (ERP) systems to the cloud, the risks of cyberattacks have never been more pressing. In a conversation with cybersecurity experts, Robert Holland, Cloud Leader, WIS & ERP Today, discusses how the centralized role of ERP systems has made them a prime target for attackers. While cloud-based ERPs offer real-time data and streamlined decision-making, they also create new vulnerabilities. In this post, we explore how organizations can better secure their ERP systems in the face of evolving threats.
Experts like Mariano Nunez of Onapsis emphasize that modern ERP systems, especially those in the cloud, are exponentially more exposed than in the past. Recent campaigns against SAP systems have demonstrated that sophisticated threat actors, including nation-states and criminal groups, are capable of exploiting zero-day vulnerabilities, often before patches are available, making timely remediation challenging. Patching delays and the slow rollout process leave systems vulnerable for extended periods.
Security threats have also evolved through social engineering, AI-driven phishing, and increased attack surfaces due to cloud and AI technologies. Organizations must implement multi-layered defenses, adopting strategies like zero-trust models, defense-in-depth, and automation to prioritize and manage security patches effectively. Industry-specific challenges are prominent; for example, healthcare and energy sectors require strict access controls and a security-first mindset to protect sensitive data and ensure operational continuity.
Leadership support and organizational culture are critical. Many organizations struggle to secure executive buy-in, but experts suggest framing cybersecurity as integral to business risk management, especially during ERP modernization initiatives. Continuous innovation in security practices—such as automation and integrated security platforms—is vital to stay ahead of threats.
Looking ahead, Holland stresses that cybersecurity is an ongoing journey, not a one-time project. Organizations must foster preparedness, rapid incident response capabilities, and a culture of security awareness. With the increasing sophistication of attacks—exploiting outdated vulnerabilities, AI-driven social engineering, and cloud vulnerabilities—being proactive is essential. Leaders should adopt a holistic, layered security approach, understand shared responsibility models in cloud environments, and collaborate with specialized vendors like Onapsis to protect their most valuable applications.
In an age of advanced threats, businesses must be ready for potential breaches—whether big or small. Preparing for ERP attacks isn’t just about technology; it’s about fostering a security-conscious culture at every level.
Retiring Lawson, PeopleSoft, or Oracle? APIX archives the entire application — every table, every year, attachments and security included — into your own AWS account in about 30 days, so you can decommission the legacy system and keep full access to the history.
