A list of applied SAP notes is a statement about what has been installed on a system, while a vulnerability assessment from the RedRays Security Platform is a statement about what each SAP service answers, on the host and port where it answers, to a request sent from outside it.
Both documents are worth having. They are not substitutes for one another, and a team that has one and believes it holds the other is the ordinary way an exposed service survives an audit.
Because a note is applied to a system and an exposure belongs to a service. The two part company in at least three directions:
The reverse holds as well. An assessment that finds nothing on a service is not evidence that a note is applied, because it never asked which notes are applied. That is a different question, answered by the SAP Security Notes check that runs beside this one.
Because a service answering on a port tells you a family and not a state. A list of open ports narrows the question to a handful of SAP service types, and each of those types has its own body of checks that share nothing with the others. Nothing true of the Java HTTP stack is automatically true of the ABAP web stack. The port is what routes the question. It is not the answer, and it does not by itself say which questions are worth asking.
That is the boundary between the two capabilities. The SAP port and service scan produces the inventory and says so about itself. The assessment consumes it and asks what each entry in it is affected by.
Four reasons, and only the first is the one people expect.
The checks are not interchangeable. Each is written against one service family. Reproducing the work by hand means knowing, for every check, which family it belongs to and which of your services is in that family, before running any of it.
The same issue arrives several times, for different reasons each time. One issue on the plain and the encrypted face of one service is two answers, because it was two connections. A different service on the same machine yields issues that are not duplicates of anything on the first, because it was never asked the same questions. And a single issue can be written as a family of near-identical requests, one per configuration slot, so one system with several slots exposed shows the same title several times over.
The results cannot be folded back together afterwards. A decision belongs to a finding, and a finding belongs to a place. Closing one issue that appears on two ports is two decisions, on two rows, for one act of remediation. Multiply that by an estate and the bookkeeping, rather than the answering, is what makes the manual version fail.
What a manual sweep leaves behind is the part that matters most later. A spreadsheet of affected and not affected does not record which checks were attempted and did not match, which services were skipped because no credential was to hand, and which hosts were never reached. It cannot tell a system that was checked and is clean from a system nobody got to, and the next person to read it will not know that it cannot. Keeping those apart is the whole of what a clean report does not say, and it is the rule the platform is built around: a number nobody measured must never be shown as if it were measured.
Running both against one system and reconciling them line by line. That is honest work and it is not a measurement anyone has done for you. What can be said without it is narrower and still useful: a note list is evidence of installation, an assessment is evidence of exposure, and a finding raised against a service is a fact about that service on that port at that moment, whatever the note list says.
Yes, because patching and exposure are different properties. Optional services left enabled, administrative endpoints reachable from the wrong network, and missing configuration files that act as access controls are all states a fully patched system reaches without any missing note.
Where the underlying issue has one, the finding carries the note reference from the check catalogue. It does not check whether that note is applied, and it does not claim the note is missing.
No. It sends catalogued requests and reads answers. It does not chain findings, does not attempt exploitation, and does not reason about what an attacker would do next. Modelling paths through a landscape is the subject of threat modelling.
With the inventory. Run the port and service scan first, because the assessment can only ask questions about services somebody recorded.