Security & Compliance Analysts Are Quietly Building Headless ERP
I don’t care what SAP says about Joule or S/4HANA.
The truth is, the people who actually keep the lights on—the security analysts, the compliance officers, the ones who’ve spent the last decade patching ECC6 systems—have already moved on. They’re not waiting for a cloud migration that’s been delayed for five years. They’re not asking for permission. They’re building.
And they’re doing it with the same tools Salesforce gave away for free.
Headless CRM wasn’t a product launch. It was a blueprint.
Salesforce didn’t just expose APIs. They handed over the keys to their entire platform: every workflow, every permission, every customer record, every approval chain. And then they said: "Go build your own interface. Use ChatGPT. Use Slack. Use a terminal. We don’t care. Just don’t log in."
The result? 4.5 million MCP calls. Nearly a trillion API interactions. Custom agents on Slack grew 300% in six months.
And now? Someone’s doing the same thing to ERP.
Not SAP. Not Oracle. Not even Rimini Street.
It’s the security team.
The ones who’ve been told for years that they can’t touch production systems. The ones who had to watch as CFOs signed off on billion-dollar ERP upgrades while their own tools couldn’t even scan a single SAP transaction log without a three-week ticket backlog.
They’re not waiting for a vendor to give them a "composable" ERP. They’re stitching one together from the inside out.
Here’s how.
First: They started with PostgreSQL.
Seth Ravin at Rimini Street said it plainly: "PostgreSQL is number one. MongoDB is number two." He wasn’t talking about marketing. He was talking about what’s actually happening in the back rooms of Fortune 500 finance departments. Teams are quietly pulling transactional data out of SAP ECC—via APIs they weren’t supposed to have—and dumping it into open-source databases. Not for analytics. Not for reporting. For control.
They don’t want SAP’s data model. They want to know who accessed a payment approval, when, and from where. They want to correlate that with firewall logs, SIEM alerts, and user behavior analytics. And they want to do it without waiting for a quarterly S/4HANA release cycle.
So they built a layer.
A UI layer. But not the kind you click through. The kind that lives inside Slack.
Remember Agentforce Experience Layer? The one Salesforce built to render decision tiles and workflow cards inside chat apps? The one that lets agents approve refunds or trigger audits without ever opening a browser?
That’s what they’re using.
Not because they’re Salesforce fans. Because it works.
A compliance analyst in London doesn’t open SAP. She types: "Show me all journal entries flagged by anomaly detection in the last 48 hours, with approver names and IP logs." And her Slack bot—trained on SAP’s own API docs, her org’s security policies, and three years of audit findings—returns a card. Clickable. Drillable. Signed off by her team’s control framework.
No tickets. No waiting. No "that’s not in the roadmap."
And it’s not just Slack.
It’s Teams. It’s WhatsApp. It’s even the terminal.
A security engineer in Toronto runs s4hana audit --from 2026-06-10 --to 2026-06-15 --user=finance-team --output=json and gets back a file with 87 anomalies. He doesn’t need to know what an "ECC6 transaction code" is. He just needs to know which ones violated PCI-DSS.
That’s headless ERP.
Not a new product.
A new mindset.
The vendors built their business on control. On upgrade cycles. On the fear that if you don’t move to S/4HANA, you’ll be left behind.
But what if you’re already ahead?
What if you’re not waiting for SAP to give you AI agents?
What if you’re using AI agents to bypass SAP entirely?
Gartner says only 39% of ECC customers have even started their migration. SAP missed its €2 billion cloud revenue target by a country mile.
And yet, here’s the kicker:
Ravin says the agentic AI trend is "scaring the hell out of everyone from SAP on down."
He’s right.
Because this isn’t about technology.
It’s about power.
For decades, ERP vendors held the keys. They decided what was "supported." What was "secure." What was "future-proof."
Now? The people who live with the consequences of those decisions—the ones who get called at 3 a.m. when a payment goes rogue—have the tools to build their own future.
They’re not replacing SAP.
They’re making SAP irrelevant.
And the best part?
They’re not even trying to.
They’re just making their jobs work.
That’s the real disruption.
Not the headlines.
Not the press releases.
But the quiet, methodical dismantling of vendor control, one Slack message at a time.
