What Soterion does

Soterion (legal entity Soterion Technologies GmbH, registered in Leinfelden-Echterdingen, Germany) provides business-centric Governance, Risk and Compliance (GRC) and SAP licensing software for organisations running SAP. Its nine-module platform — Access Risk Manager, Basis Review Manager, Central Identity Manager, Continuous Controls Manager, Data Privacy Manager, Elevated Rights Manager, Password Self-Service Manager, Periodic Review Manager, and SAP License Manager — is purpose-built for SAP ECC, S/4HANA, and SAP Cloud ERP Private (RISE with SAP) environments, with cloud delivery hosted on Microsoft Azure. Core capabilities include SoD/access risk identification with a "What-if" Allocation Simulator, FUE license optimisation based on actual system usage, continuous controls monitoring of SAP transactions, GDPR-aligned personal-data discovery in SAP tables, and workflow-driven firefighting access provisioning.

The company monetises through three streams: subscription-based GRC software (cloud and on-premise, annual billing), professional SAP security consulting, and GRC managed services. Go-to-market is direct enterprise sales with a "Book A Demo" CTA, supplemented by regional sales leadership in DACH (Andreas Knab) and Benelux (Emile Steyn), event-driven demand generation through SAP user communities (DSAG, VNSG, SAUG, SAMS), a podcast and blog-led content motion, a United VARs channel partnership, and advisory relationships with Big 4 audit firms. Soterion reports 150+ customers across mining, manufacturing, retail, healthcare, banking, defense, media, telecom, and beverage verticals, including Nedbank, Bupa, NTT, Komatsu, Macsteel, JD Group, Italtile, Clicks, Lundin Mining, SSR Mining, Denel Dynamics, Media24, Lenmed, and Swinkels, with disclosed outcomes such as a 98% SOD reduction and the first Full System Reliance from external auditors in three years for an enterprise client. The company is privately held with no disclosed funding, operates with 11–50 employees, and holds ISO 27001 certification and an annual SOC (ISAE 3402) report from a Big 4 auditor.

Name

Soterion

Legal name

Soterion Technologies GmbH

Website

https://soterion.com

Company type

Private

Founded year

2013

Operating status

Operating

Headcount range

11–50 employees

Short description

Soterion provides business-centric Governance, Risk and Compliance (GRC) and SAP FUE licensing software for organisations running SAP ECC, S/4HANA, and RISE with SAP, serving 150+ enterprise customers globally via subscription, consulting, and managed services.

Ownership category

akta.pro rank

Product category

SAP GRC Software

NAICS

Computer Systems Design and Related Services (5415), Custom Computer Programming Services (541511), Other Computer Related Services (541519)

SIC

Services-Prepackaged Software (7372), Services-Computer Programming Services (7371), Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

IT Governance, Risk & Compliance (IT GRC) Platforms (HDAEALAK)

akta.pro secondary industries

Enterprise Application Security, GRC & Compliance Services (BPAEAGAL), Governance, Risk & Compliance (GRC) Managed Services (BPAEADAJ)

Keywords

• SAP GRC software
• Access risk management
• Segregation of duties
• SAP license optimization
• Enterprise compliance software

Headquarters

HQ city

Johannesburg

HQ country

South Africa

HQ region

Africa

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. GRC Software Licenses/Subscriptions: Subscription-based software licensing for the Soterion GRC platform with flexible subscription options. Includes cloud-hosted SaaS offerings as well as on-premise deployment options.
2. SAP Security Consulting Services: Professional advisory security services provided by expert SAP security consultants to complement the software platform.
3. GRC Managed Services: Managed services offering for holistic GRC capability, providing ongoing support and management.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels7 records

Core offering

Soterion develops and sells a business-centric Governance, Risk and Compliance (GRC) software platform purpose-built for organizations running SAP ERP systems (ECC, S/4HANA, and RISE with SAP). Its integrated suite of nine modules delivers SAP access risk identification, segregation-of-duties monitoring, periodic access reviews, user provisioning, elevated/firefighter access management, GDPR data privacy mapping, password self-service, and SAP FUE license optimization, complemented by expert SAP security consulting and managed services. The platform is offered as cloud-hosted SaaS on Microsoft Azure or on-premise, with ISO 27001 certification and annual SOC ISAE 3402 reporting.

Product overview

Soterion is a business-centric Governance, Risk and Compliance (GRC) software provider specialising in SAP environments. The company offers an integrated suite of nine GRC solutions comprising Access Risk Manager, Basis Review Manager, Central Identity Manager, Continuous Controls Manager, Data Privacy Manager, Elevated Rights Manager, Password Self-Service Manager, Periodic Review Manager, and SAP License Manager. Together, these modules provide SAP customers with in-depth access risk reporting, SAP (FUE) licensing optimisation, and compliance management capabilities. The platform is designed to translate technical GRC language into business-friendly concepts to enhance decision-making and accountability.

Differentiator

Problem solved

Functional benefit

Brands

• Access Risk Manager: User-friendly web application for identifying SAP access risk exposure with risk remediation recommendations and What-if Allocation Simulator.
• Basis Review Manager
• Central Identity Manager
• Continuous Controls Manager
• Data Privacy Manager
• Elevated Rights Manager
• Password Self-Service Manager
• Periodic Review Manager
• SAP License Manager

Products and services

• Access Risk Manager Provides the ability to identify SAP access risk exposure using a user-friendly web application, with risk remediation recommendations and a What-if Allocation Simulator for proactive SAP access risk management. Used by SAP customers to identify and remediate segregation-of-duties and access risk violations.
• Basis Review Manager Compares SAP Basis Configuration to an industry best-practice set of rules to establish complete compliance and avoid adverse audit findings. Used by SAP customers preparing for annual external audits of system-level SAP controls.
• Central Identity Manager Introduces the Business Role concept to improve efficiencies in SAP user provisioning by standardizing job functions across the organisation. Used by SAP customers to streamline and standardize user identity and access provisioning.
• Continuous Controls Manager Enables organisations to identify risks where an SAP user has performed conflicting functions for the same document, enabling automated and alert-based continuous monitoring of materialised risk violations in SAP transactional data. Used by SAP customers for ongoing SoD violation detection.
• Data Privacy Manager Analyses all tables in SAP and highlights those containing personal or sensitive information, categorising data by Data Domain and Subject. Used by SAP customers to support GDPR and POPIA personal-data discovery and compliance.
• Elevated Rights Manager Grants sensitive fire-fighting access in an automated workflow-driven process and enables structured review of activities performed during Elevated Rights Access periods. Used by SAP customers for emergency/firefighter access management and audit-ready review trails.
• Password Self-Service Manager Provides SAP users with the ability to reset their own SAP passwords, reducing the burden on authorisation support teams and associated costs. Used by SAP customers to lower support cost and business downtime.
• Periodic Review Manager Facilitates periodic reviewing of SAP user access, analysing associated risks and evaluating necessary controls to align GRC capacity with business targets. Used by SAP customers to run business-friendly periodic access certification campaigns.
• SAP License Manager Assists organisations in gaining clarity on actual user license requirements based on actual system usage, not just SAP role design indicators, helping optimise SAP FUE licensing costs. Used by SAP customers (including RISE with SAP / SAP Cloud ERP Private deployments) to prevent mid-subscription true-ups.
• SAP Security Consulting Professional advisory SAP security services provided by expert SAP security consultants to complement the Soterion software platform. Used by SAP customers seeking hands-on expertise in SAP role design, authorisations, and access risk remediation.
• GRC Managed Services Managed services offering providing ongoing support and management for a holistic GRC capability. Used by SAP customers that want to outsource the operational running of GRC processes to Soterion's experts.

Quantifiable outcome

• Reduced SOD count by 98% without impact on business
• +2 more outcomes

Named customers14 records

Segments1 record

Ideal customer profiles1 record

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature10 records

Partnerships

Six partnerships are on record, tiered minor.

• Axl & TraxminorImplementation/ SI/ Consulting Partner · 7 October 2025Partner in presenting customer case studies at VNSG events. Axl & Trax is an SAP consulting partner that co-presents with Soterion on topics such as SAP authorizations and license optimization with real customer examples.
• VNSG (Association of Dutch-speaking SAP Users)minorOthersSoterion is a member of VNSG, the key network for SAP users in the Dutch-speaking community since 1988, representing around 9,000 SAP professionals from more than 700 Dutch companies.
• DSAG (German-Speaking SAP User Group)minorOthersSoterion participates in DSAG events. DSAG is a leading SAP user association representing over 4,000 companies across Germany, Austria, and Switzerland.
• SAUG (SAP Australian User Group)minorOthersSoterion partnered with SAUG to deliver Solution Series Webinars on topics like Managing SOD risk in SuccessFactors. SAUG is an independent not-for-profit industry association with over 6,000 members from 300+ companies.
• SAMS Europe/DACHminorOthersSoterion is a member of SAMS Europe and SAMS DACH communities, leading events for software asset management (SAM) and license optimization professionals in Europe since 2000.
• United VARsminorChannel Partner/ Reseller/ DistributorPartnership shown in footer indicating VAR/channel relationship for resale or distribution of Soterion solutions.

Scale indicators3 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• SAP Identity Management (SAP IDM / SAP Identity Governance): SAP's native identity governance and user-provisioning offering. Competes with Soterion's Central Identity Manager and Elevated Rights Manager inside SAP shops, often as the default included capability.
• SailPoint: Market-leading identity governance platform with SAP and ERP connectors. Competes indirectly for the same access-risk, SOD, and periodic-review buyer, but is broader in scope than Soterion's SAP-only focus.
• ServiceNow Governance, Risk, and Compliance: ServiceNow's integrated GRC/IRM suite, increasingly used by large enterprises to centralize risk and compliance workflows. Competes for the same first-line-of-defence buyer Soterion targets but as part of a much broader platform investment.
• One Identity (OneLogin / Quest): Identity governance and administration vendor with SAP integration capabilities. Targets the same access-control and periodic-review use cases that Soterion's Periodic Review Manager addresses, but from a broader IGA platform.
• SAP GRC (Access Control, Process Control, Risk Management): SAP's own bundled GRC suite for S/4HANA, sold directly into the SAP install base. It is the dominant incumbent alternative and competes head-to-head with Soterion's Access Risk and Continuous Controls modules.
• Saviynt: Enterprise identity governance and GRC platform with deep ERP/SAP integration capabilities. Competes for the same identity-and-access governance buyer, but operates across a much wider technology footprint than Soterion.

Emerging players

• ProcessUnity: Cloud-native GRC platform for risk and compliance programs. Adjacent to Soterion on the GRC layer (controls, policy, risk) but broader in scope and less SAP-specialized.

Direct peers

• Pathlock: Formed from the merger of Appsian and Security Weaver, Pathlock is a direct competitor offering access governance and application GRC controls purpose-built for SAP and other ERP systems, targeting the same SAP-focused GRC buyer.
• ERP Risk Guard (formerly ERP Maestro): Specialized vendor of automated access controls and Segregation of Duties monitoring for SAP. Directly overlaps Soterion's Access Risk Manager and Periodic Review Manager modules for the SAP GRC buyer.
• Greenlight Technologies: Specialized vendor of access-risk and SoD monitoring solutions for SAP environments. Closely comparable to Soterion in target buyer (SAP security/GRC teams), product scope (access risk, controls monitoring), and customer profile.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks7 records

Key highlights7 records

Customer concentration

• YouTubeyoutube.com/playlist?list=PLQRAaemIJ3vIJrZuz5XA-nNAF3H0PA1t0&feature=shared
• LinkedInlinkedin.com/company/soterion
• Xx.com/soteriontech

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles8 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Soterion