Onapsis

Onapsis provides a security and compliance platform purpose-built for SAP and Oracle business-critical applications — ERP systems that run finance, supply chain, and core operations for large enterprises but that traditional application-security and vulnerability-scanning tools generally do not cover well. The Onapsis Platform covers vulnerability and configuration management, code security, and threat detection specific to SAP/Oracle environments, and its Onapsis Research Labs team works directly with SAP’s own Product Security Response Team to find and help patch critical vulnerabilities before they are exploited.

That research relationship has produced independently significant results: Onapsis Research Labs co-discovered the 2022 ICMAD vulnerabilities (including CVE-2022-22536, rated a maximum CVSS 10.0), which CISA added to its Known Exploited Vulnerabilities catalog and which affected up to 40,000 SAP customers; more recently, Onapsis Research Labs directly observed active exploitation of CVE-2025-31324 and CVE-2025-42999, both of which CISA also added to its Known Exploited Vulnerabilities catalog in 2025. This is a rare case of a vendor’s security research being independently validated by a government agency’s own exploitation tracking rather than resting on the vendor’s own claims.

Founded in 2009 (originating in Argentina before relocating its headquarters to Boston, with offices in Heidelberg and Buenos Aires), Onapsis has raised roughly $116 million across multiple funding rounds, including a $55 million Series D led by CDPQ and NightDragon to expand into securing mission-critical SaaS applications beyond on-premises SAP, alongside earlier backing from LLR Partners and .406 Ventures. It reports roughly $93.5 million in estimated annual recurring revenue as of 2025, reflecting a mature, scaled business within its ERP-security niche rather than an early-stage startup.