Application Vulnerability Report Service is currently in Beta Phase |
What Is Application Vulnerability Report?
Security is a top priority in today’s digital landscape, especially when applications rely heavily on open-source components. These components, while powerful and cost-effective, often come with publicly known vulnerabilities that can put your business data at risk.
The Application Vulnerability Report is a newly introduced feature for SAP Business Technology Platform (BTP) services that helps you detect and remediate vulnerabilities in your Cloud Foundry applications. This tool scans your application for known security issues based on Common Vulnerabilities and Exposures (CVEs), ensuring that you stay ahead of potential threats.
Currently in Beta Phase and available in eu-10 region.. Once Beta Phase is completed.. roll-out to other regions are expected in Q2 or Q3 2026.
How to enable in your tenant ?
Go to Entitlements in your SAP BTP Sub-account to add Application Vulnerability Report to add the plans
Service Marketplace
Search for application-vulnerability-report-service in the SAP BTP Service Marketplace
Create Instance in your Cloud Foundry space
- Go to your Cloud Foundry Space (example : Dev, UAT, TST...etc)
- Create a new Instance for Application Vulnerability Report with default plan
- Provide a Instance Name
Create Service Key
- Create a New Service Key for API Access
Allow the User to Access the Space
You need to manually add the [email protected] user to your Cloud Foundry space. This enables the application vulnerability report to download the droplets of the respective applications and scan them accordingly.
- Log on to the CF space that you want to scan.
- Select the Space Members tab and choose Add Member.
- Enter the [email protected] user and assign the Space Auditor role to it.
Why Is This Important?
Open-source vulnerabilities are one of the most frequent security challenges in modern application development. Attackers are quick to exploit these weaknesses, and failing to address them promptly can lead to severe consequences, including data breaches and compliance violations.
By using the Application Vulnerability Report, you can:
- Identify vulnerabilities early in your application lifecycle.
- Understand the severity of each issue based on CVE data.
- Take corrective actions quickly to secure your SAP BTP landscape.
Application Vulnerability Report - Process overview
The application vulnerability report supports you in the detection of vulnerabilities in custom applications during runtime. Instead of a shift-left support approach during pipeline runs, this service provides security-relevant information for what has already been deployed (and maybe forgotten). The service scans the applications using a proprietary scanning layer that utilizes open-source scanners such as Open Source Vulnerabilities (OSV) and trivy, as well as custom SAP BTP-specific and 0-day exploit targeted scanners. This unique combination offers a very broad and up-to-date coverage of vulnerabilities in your applications. By using an API, you can integrate the report data into your incident and security workflow.
Overview of the each Process flow
1. Applications Running on SAP BTP
- This is the starting point.
- It includes all your Cloud Foundry applications deployed on SAP Business Technology Platform.
- Example : CAP, Python, Javascript, Java, Go, Dot-Net... any programming languages those are deployed in your Space.. (This also includes NPM Libraries, Pip libraries or any libraries which are consumed in your applications)
- These applications often use open-source libraries and packages, which can have vulnerabilities.
2. Scanning Layer
This layer performs the security scans on your applications. It's currently runs weekly scan. It consists of multiple scanning sources:
Commercial
Uses commercial vulnerability databases and tools to identify known issues.Trivy/OSV
Trivy is an open-source vulnerability scanner, and OSV (Open Source Vulnerabilities) is a database of vulnerabilities in open-source software.
These help detect issues in widely used open-source components.BTP Specific
Scans for vulnerabilities specific to SAP BTP services and configurations, ensuring platform-level security.0 Day
Focuses on zero-day vulnerabilities, which are newly discovered and not yet patched.
These are critical because attackers often exploit them quickly.
3. Application Vulnerability Report for SAP BTP
- After scanning, all findings are consolidated into a single report.
- This report provides:
- List of vulnerabilities
- Severity levels
- Recommendations for remediation
- It acts as a centralized dashboard for security insights.
4. API for Customers
- Customers can access the report via API.
- This allows integration with:
- Security dashboards
- CI/CD pipelines
- Monitoring tools
- Ensures automation and continuous security checks.
5. Customers
- End-users (developers, security teams) consume the report and take corrective actions to secure applications.
Technical Usage
How to get findings of your deployed CF applications running.
Example : Scanned Finding Report
Bluesky
