Blog Posts

Features

Deep dives into MTC Skopos product features: automated remediation, AI Role Designer, did-do analysis, FUE optimization, and more.

IAM Business Role SoD Analysis: Find the SAP Risks Your IAM Grants

IAM Business Role SoD Analysis: Find the SAP Risks Your IAM Grants

iam business-roles sod access-risk-analysis cross-system sap-security grc compliance
2026-07-14

IAM tools assign business roles: named bundles that grant ERP roles across one or more systems. Approval workflows see the bundle name, not the authorizations behind it. MTC Skopos now imports business roles alongside your ERP exports and analyses the access they grant exactly like direct assignments, with full attribution, simulation, and remediation.

AI Role Designer: SoD-Free SAP Roles in Weeks, Not Months

AI Role Designer: SoD-Free SAP Roles in Weeks, Not Months

ai mcp sap role-design sod remediation s4hana authorization grc
2026-03-26

Role redesign projects typically stretch across months of consultant workshops, spreadsheet gymnastics, and back-and-forth validation cycles. The AI Role Designer collapses this into an iterative conversation: provide a functional blueprint, let AI analyze historical usage, generate a new role concept, run risk analysis, and refine until clean. Then build the roles, whether manually or through AI connected directly to SAP.

MTC Skopos

About the MTC Skopos product: positioning, case studies, and how it fits into your access risk analysis workflow.

SAP SoD Analysis for Freelance Consultants: Why We Built a Freelance Edition

SAP SoD Analysis for Freelance Consultants: Why We Built a Freelance Edition

freelance sap-sod independent-consultants mtc-skopos
2026-05-08

SAP SoD tools have historically been licensed for enterprises, leaving independent consultants stuck with spreadsheets and borrowed access. The MTC Skopos Freelance edition is a modular plan with the same engine as the Business edition: pay for the core platform and pick the modules you need. Up to 3 seats, full feature parity, no enterprise sales cycle. This article explains what it includes, why we built it, and the engagements where it pays for itself in a single project.

Planning SAP GRC or Pathlock? Start With MTC Skopos.

Planning SAP GRC or Pathlock? Start With MTC Skopos.

grc sod sap-grc pathlock risk-analysis remediation
2026-04-05

SAP GRC and Pathlock implementations take months. Your SoD risks are not waiting. MTC Skopos runs risk analysis and remediation from day one, with no infrastructure and no configuration project. Clean your authorization landscape before you automate it, stay clean during rollout, and transfer your validated ruleset to SAP GRC or Pathlock when it goes live. Then keep Skopos for the systems your GRC suite does not reach.

SAP FUE Optimization: Cut RISE License Cost 30-50%

SAP FUE Optimization: Cut RISE License Cost 30-50%

sap grc s4hana compliance fue license-cost rise-with-sap star-report fue-optimization
2026-02-06

SAP's FUE measurement model assigns every user a license tier based on their authorization profile, not their actual behavior. That gap between assigned and used access is where organizations hemorrhage money. Learn how the FUE calculation works, what the STAR ruleset actually measures, and how to use MTC Skopos to bring your license position back in line with reality.

SAP Authorization

Technical SAP authorization topics: role design, critical access, SoD rulesets, S/4HANA specifics, and authorization best practices.

Over-Privileged Users in SAP: Finding and Fixing Privilege Creep

Over-Privileged Users in SAP: Finding and Fixing Privilege Creep

over-privileged-users privilege-creep access-risk-analysis sap-authorization sap-security did-do access-review
2026-04-17

Over-privileged users are the quiet third category of access risk, behind SoD and critical access. They hold authorizations that expand their fraud surface, inflate FUE licensing, and create audit findings, even though nothing about their daily work requires the access. This guide explains how privilege creep happens, how to detect it with access risk analysis, and how to remediate without breaking business operations.

Critical Access in SAP: Sensitive Transactions & High-Risk Authorizations

Critical Access in SAP: Sensitive Transactions & High-Risk Authorizations

critical-access sensitive-access access-risk-analysis sap-security sap-authorization grc audit
2026-04-17

Critical access is a category of access risk separate from Segregation of Duties: transactions that cause damage on their own, without needing a conflicting partner. This guide lists the critical transactions every SAP environment should monitor, explains how to detect them with access risk analysis, and shows how MTC Skopos catches them in the same pass as SoD.

Authorization-Level vs Transaction-Level Access Risk Analysis

Authorization-Level vs Transaction-Level Access Risk Analysis

authorization-level-analysis transaction-level-sod access-risk-analysis sap-sod sap-authorization false-positives
2026-04-17

Most access risk tools analyze SoD at the transaction code level: if a user has tcode A and tcode B, flag a conflict. Authorization-level analysis goes deeper. It checks whether the user's authorization object values actually overlap, so conflicts that share no company code, plant, or organizational unit are filtered out. The distinction matters: transaction-level analysis on a large SAP landscape typically produces 3-10x more false positives than authorization-level analysis.

AI Risks in SAP Authorization: The New Threat Model

AI Risks in SAP Authorization: The New Threat Model

sap grc security ai authorization risk s4hana sap-security access-risk mcp
2026-02-26

Exploiting SAP used to require both system access and years of domain expertise. AI collapses that second requirement. An attacker with a basic SAP login and a language model can now navigate the system, understand authorization structures, and find exploitation paths that previously took specialists weeks to uncover. What does that mean for how you manage access risk?

Risk and Compliance

IT audit, internal controls, and compliance fundamentals: Segregation of Duties concepts, matrices, and templates.

Perspectives

Industry perspectives and opinion pieces on AI, SaaS, data ownership, and the evolving GRC landscape.

SAP Access Risk Report: What to Include and How to Build One

SAP Access Risk Report: What to Include and How to Build One

access-risk-report access-risk-analysis grc sod risk power-bi sap-reporting
2025-08-05

An access risk report documents the access risks in an ERP landscape: SoD violations, critical access, over-privileged users, and scope breaches, plus the remediation each one needs. MTC Skopos now ships an interactive Overview dashboard that gives you the executive summary of every analysis on the spot, and still exports the underlying risk models to Power BI, Tableau, or any BI platform for deeper dashboarding shaped around your own priorities.

Field Notes

A founder's notes from selling an offline SAP access-risk tool: how organisations actually evaluate, buy, and trust SoD tooling.

Two Years of Watching Companies Decide How to Handle SAP Access Risk

Two Years of Watching Companies Decide How to Handle SAP Access Risk

grc sod
2026-08-19

MTC Skopos was built to do consulting work at clients who had no access-risk tooling, by a security consultant and a software architect, and it grew to cover the analyses we were rebuilding in Python, SQL and Alteryx on every engagement: did-do, remediation, the authorization matrix, the role bill of materials. Then it started selling, to global firms, Big Four, boutiques, public bodies and S&P 500 companies. This introduces Field Notes, a six-part series on how those organisations actually evaluate and buy SoD tooling.

We Built a Desktop SoD Tool in 2024. Here Is the Boring Reason Why.

We Built a Desktop SoD Tool in 2024. Here Is the Boring Reason Why.

sap sod
2026-08-19

Field Notes article 2. The decision to ship MTC Skopos as a signed portable executable came from the consultant's laptop problem: locked-down client machines where nothing can be installed, so the analysis is either a spreadsheet that stops at transaction level or a SQL, Python or Alteryx build that is correct once and thrown away at the end of the engagement. What portable-and-signed solves, why the product is still sold as a subscription when there is nothing hosted, and where SaaS honestly wins.

Two Kinds of SoD Buyer, and Why One of Them Never Answers Your Email Again

Two Kinds of SoD Buyer, and Why One of Them Never Answers Your Email Again

grc assessment
2026-08-19

Field Notes article 3. Compliance-driven buyers need a defensible SoD report once, to close an audit finding, and then the need is gone. Efficiency-driven buyers produce that report repeatedly and it hurts. Both look identical during a trial. Three first-call questions that separate them, the trial-extension mistake we made for six months, and what happens after the yes, when the file moves to a procurement function that never saw the product.

They Already Own SAP GRC Access Control. They Are Still Shopping.

They Already Own SAP GRC Access Control. They Are Still Shopping.

grc sap remediation
2026-08-19

Field Notes article 4. Large enterprises with fully deployed SAP GRC Access Control kept asking for demos, and so did organisations already running a specialist analyzer such as CSI tools. They were not confused. Detection works; what is missing is everything after the report lands: remediation decisions, fast exploratory simulation, and output a business owner will read. The Excel file every security architect maintains is the market.

Send Us Your SOC 2 Report. But We Never Receive Your Data.

Send Us Your SOC 2 Report. But We Never Receive Your Data.

risk grc
2026-08-19

Field Notes article 5. Procurement asks an offline desktop tool for a SOC 2 report. The request is not unreasonable: certificates are a proxy for working processes, and a compromised build pipeline is a real risk. But the scope does not fit software whose boundary never contains customer data. What we offer instead: verifiable code signing, packet-capture-testable data flow, Ed25519-signed logs, an SBOM embedded in the binary, and the five questions security teams should ask in place of the certificate.

What If You Disappear? It Is a Good Question. Ask It of Everyone.

What If You Disappear? It Is a Good Question. Ask It of Everyone.

grc risk
2026-08-19

Field Notes article 6, closing the series. Every small vendor gets the disappearance question, and the honest answer splits it into four risks: operational continuity, data access, licensing, and maintenance. Three structurally favour local software; one genuinely does not. Software mostly disappears by sunset, acquisition and forced migration rather than by bankruptcy, which is a risk vendor size does not remove. What MTC Skopos commits to: if the company stops, the version you paid for keeps running, with no licence server in the way.