5 Key Takeaways from the Gartner Market Guide 2026 for SAP Security Professionals

Share
  • Security, SAP

Just a few years ago, in many organizations, access management boiled down to periodic access reviews. Once a quarter or once a year, process owners received a list of users and confirmed who should retain access to the system.

Today, that approach is no longer enough. Companies are using an ever-growing number of business applications, integrations, technical accounts, bots, and AI-based solutions. As a result, the question is no longer solely "who has access?”, but also „whether that access is still justified and how it is being used?”.

In the latest Gartner guide concerning Identity Governance and Administration (IGA) there are several observations that should be of particular interest to teams responsible for SAP Security. It is these that show the direction in which identity and access management will develop in the coming years.  

1. The End of the Era of Quarterly Reviews/Recertifications

For years, periodic access reviews were the primary means of controlling access. The problem is that risk does not wait until the end of the quarter.

If an employee receives inappropriate permissions today, the organization should be able to detect it immediately, not only during the next review. Gartner points out that the IGA market is heading toward continuous, automated access management that enables ongoing response. 

From an SAP perspective, this means that increased emphasis on monitoring permission changes, risk analysis, and ongoing control of user activity.

More and more often we hear from clients that the recertification process itself is merely a confirmation of the system's state. The real value emerges when an organization is able to detect threats on an ongoing basis.

2. Many Companies Still Don't Know Who Really Has Access to Their Systems

This is one of the most interesting conclusions of the report. Gartner points to the problem of inactive accounts, orphaned users, and identities that remain outside the organization's control.

Sound familiar? During SAP audits, it often turns out that some users have accumulated roles and permissions over the years. A change of position, participation in a project, or temporary substitution led to new access being granted, but no one took care of removing those that were no longer needed.

And this comes to light during audits – on average, only about 10% of granted permissions are actually used by employees. The rest is unnecessary risk.

That is why the first step to improving security is not implementing yet another tool. It is gaining full visibility of who has access to key processes and data.

3. Manual Compliance Processes Can No Longer Keep Up With Reality

Not long ago, preparing documentation for an auditor meant exporting data to Excel, analyzing it manually, and exchanging dozens of emails.

At the current scale of IT environments, this approach is becoming less and less effective. Gartner emphasizes that Manual processes are time-consuming, prone to errors, and often lead to problems demonstrating compliance during audits.

This is especially true for organizations using SAP, where the number of users, roles, and dependencies between systems can be very large.

 More and more companies are automating:

  • SoD (Segregation of Duties) controls,
  • access recertification processes (review),
  • audit reporting,
  • monitoring high-risk activities.

 

As a result, security teams spend less time preparing reports and more on actually managing risk.

4. AI is Starting to Play a Significant Role in Identity Governance

Artificial intelligence is now present in almost every discussion about cybersecurity. The same is true in the area of Identity Governance.

According to Gartner organizations should consider using AI-supported IGA platforms, which help identify risky situations, automate decisions, and streamline access management processes.

In practice, this can mean:

  • detecting unusual user behavior,
  • identifying risky combinations of permissions,
  • recommending changes to roles,
  • faster detection of potential violations.

What matters most, however, is that AI allows for analyzing far more data than a human can. In SAP environments, where thousands of business operations are performed every day, this is of huge importance.

5. We Need to Start Managing Not Only Users, But Also Bots and AI Agents

For years, identity management focused primarily on employees and business partners.

Today the situation looks different. Organizations have technical accounts, system integrations, RPA robots, bots, and an ever-growing number of AI agents performing specific business tasks. Gartner points out that these identities, too, require proper oversight and control. 

Importantly, such accounts often have very broad permissions.

That is why the question we should increasingly be asking is not:

„Kto ma dostęp do systemu?”

but:

"Who or what is using this access and what actions is it performing?"

This way of thinking is exactly what will shape the modern approach to security in the coming years.

Why Does this Matter for Organizations Using SAP?

All the trends described lead to one conclusion: access management ceases to be purely an administrative task, and becomes a key element of risk management.

Organizations must not only know who has access to critical business processes. They should also understand how these permissions are used, what risk they generate, and whether they are still needed.

Dlatego coraz większą rolę odgrywają rozwiązania wspierające ciągły monitoring, analizę ryzyka dostępowego oraz automatyzację procesów związanych z bezpieczeństwem i zgodnością.

At Lukardi, we observe that it is precisely these areas that are becoming today a priority for SAP Security teams, audit and compliance. Companies are no longer looking solely for tools to manage roles. They expect full risk visibility and the ability to respond in real time.

And this is exactly the direction that Gartner points to as the future of Identity Governance.

Find Out What the Level of Access Security is Like in Your SAP Environment

Does your organization have full control over user permissions, technical accounts and SoD processes? Or does it still rely on periodic recertifications and manual reports?

Lukardi experts help organizations identify access risks, automate governance processes and implement a modern approach to SAP Security in line with the latest market trends.

Get in touch with us and find out how to increase security and compliance in your SAP environment. Book a consultation with Lukardi experts.

Source: 2026 Gartner Market Guide for IGA | Pathlock Analyst Reports

5 Key Takeaways from the Gartner Market Guide 2026 for SAP Security Professionals

Tomasz Jurgielewicz

Head of Security Development at Lukardi.
He carries out comprehensive security and license cost optimization projects, focusing on areas such as: - identification of authorization conflicts and authorization reorganization, - identification of SAP vulnerabilities, - integration of SIEM solutions with SAP, - SAP license optimization.