Central ATC on SAP BTP - does one run also check ABAP code security?

On 16 October 2026 SecurityBridge announced that its Code Risk Analyzer now integrates directly with the central ABAP Test Cockpit (ATC) on SAP BTP. Until now, SecurityBridge security checks ran in the ATC of an on-premise system. They can now also run in the central check system that SAP uses to analyse customer code ahead of an SAP S/4HANA conversion and to assess clean core readiness.

The practical point is simple. A conversion team runs an ATC check on SAP BTP anyway, to find out which Z objects stand in the way of SAP S/4HANA. If security checks live in a separate tool on a separate schedule, the same code clears the quality gate and either skips the security gate altogether or meets it weeks later.

The short version:

1/ the central ATC on SAP BTP checks code in on-premise systems remotely through SAP Cloud Connector - the same mechanism SAP uses to assess custom code for SAP S/4HANA,

2/ SecurityBridge checks can join that run, so clean core and security findings land in one list and one exemption process,

3/ the central check opens an RFC connection from SAP BTP into your systems, and that connection needs securing in its own right,

4/ in a conversion plan, security checks belong in the readiness analysis, well before go-live.

The central ATC on SAP BTP in an SAP S/4HANA conversion

SAP BTP, ABAP environment ships apps for analysing customer code: Custom Code Migration for conversion preparation, and a separate app for cloud readiness analysis. The ABAP environment acts as the central check system, while the SAP ERP and SAP S/4HANA systems in your data centre become checked systems. The connection runs through SAP Cloud Connector over RFC, and the checked systems need so-called remote stubs installed so the central ATC can read their code.

For a conversion team this is convenient: one run covers many systems, results sit in one place, and exemptions go through the standard ATC approval workflow. We covered what the readiness analysis does not show in our piece on the limits of SAP Readiness Check, and how a conversion reshapes the attack surface in our article on secure SAP S/4HANA conversion.

What SecurityBridge Code Risk Analyzer adds

Code Risk Analyzer is the SecurityBridge platform module for static security analysis of ABAP code. The product page calls it Code Vulnerability Analyzer - it is the same module. It should not be confused with SAP Code Vulnerability Analyzer, SAP’s own product with a similar name.

According to the vendor, the module detects, among other things:

• SQL injection in Open SQL, dynamic clauses and ADBC,
• missing authority checks, including in remote-enabled function modules,
• direct changes to SAP standard tables,
• directory traversal,
• constructs that can act as a backdoor in the code.

The checks run in tools ABAP developers already use: SAP Code Inspector, ATC and ABAP Development Tools for Eclipse. Below is an SAP Code Inspector result view, with SecurityBridge categories listed alongside the standard SAP checks.

According to the vendor documentation, the integration with the central ATC on SAP BTP relies on the SecurityBridge platform installed on premise: the ABAP environment on SAP BTP talks to the SecurityBridge controller, which supplies the rules and the results. It is not a standalone cloud scanner but an existing platform reaching a new place where checks run.

One run instead of two tools

More and more ABAP code is written with AI assistants. As we described in our piece on securing AI-generated ABAP, such code usually compiles and meets the functional requirement, yet easily skips an authority check or builds a query from user input. A clean core readiness check will not catch that, because it looks for something else: use of released APIs and compliance with the extension model we covered in our piece on clean core in SAP BTP.

Two gates in two tools mean two schedules in practice. Security findings reach a different team, in a different format and usually later. When both checks run in one central ATC run:

• one list of fixes - developers see clean core and security findings in the same view and touch each object once,
• one exemption process - a deviation from a security rule goes through the same approval mechanism as any other ATC exemption and is documented,
• one piece of audit evidence - the run result shows that code passed both checks before transport, which helps in NIS2 and DORA audits.

A new gate opens a new connection

Central checking comes with a security cost of its own. To read code, the ATC on SAP BTP needs:

• an RFC connection and a technical user in every checked system,
• remote stubs installed in each checked system,
• an allow list of resources in SAP Cloud Connector, i.e. the function modules the SAP BTP environment may call.

This is a connection from the cloud into the systems that run your finance, logistics and HR. We treat it like any other privileged RFC channel. The Cloud Connector allow list covers only what the SAP and SecurityBridge scenarios require. The technical user can read code and nothing more. Calls are monitored the same way as other RFC connections. If the SecurityBridge platform already monitors your landscape, this channel should be in scope from the day the integration goes live.

Where security checks fit in a conversion plan

In SAP S/4HANA conversion projects we bring code security checks in at four points:

1. Readiness analysis. The first central ATC run includes the security checks from the start, so the full scope of code remediation is known before the schedule and budget are set.
2. Code clean-up. Objects with critical security findings are fixed together with objects that block the conversion. Code nobody uses is deleted rather than repaired.
3. Exemption rules. An exemption from a security rule is approved by whoever is responsible for SAP security, not by the development lead who raised it.
4. After go-live. The same check variant stays in place as a gate before transport, so new code, including AI-assisted code, passes both checks with every change.

If you are planning a conversion or already running one, start with a review of your ABAP code: our SAP Code Vulnerability Analyzer and custom code review service checks Z code for vulnerabilities and delivers a remediation plan ordered by severity. More on how we run SAP S/4HANA conversions and deploy the SecurityBridge platform on our service pages.

Sources

• SecurityBridge, “Product Update: SecurityBridge Code Risk Analyzer Now Integrates with Central ATC on SAP BTP”, LinkedIn, 16 October 2026 - SecurityBridge post (accessed 19 October 2026)
• SecurityBridge, Code Vulnerability Analysis - product page (accessed 19 October 2026)
• SAP Help Portal, Custom Code Migration in SAP BTP, ABAP environment - SAP documentation (accessed 19 October 2026)