Engineering Digital
Transformation with
Intelligence
We transform businesses through software innovation and intelligent systems. We enable digital transformation by combining deep engineering capabilities with a strong understanding of business, operational, and industry-specific realities.
Automotive / Cybersecurity
When attackers exploited a 10/10 vulnerability, three supply-chain applications needed a new home
SAP NetWeaver 7.5 → Spring Boot 3.5 on AWS | Automotive Tier-1
3 apps
Migrated off compromised platform
0
Unpatched vulnerabilities
Adopted
Pattern used for remaining estate
At A Glance
Industry
Platform
From
To
Transformation
Automotive / Cybersecurity
operations
SAP NetWeaver 7.5, Java EE 7
Datadog
Claude Code + GitHub
Copilot
TL;DR
A global automotive Tier-1 supplier ran three custom business applications on SAP NetWeaver 7.5: a Supplier Portal, a Quality Management module, and an EDI Gateway serving 14 trading partners. Together, these applications supported supplier collaboration, quality compliance, and trading partner integration across the manufacturing supply chain.
After CVE-2025-31324 (CVSS 10/10) was exploited, all three applications were migrated to Spring Boot 3.5 on AWS. Claude Code handled roughly 50% of the code transformation. AWS Transfer Family replaced legacy platform adapters for trading partner connectivity. AWS Secrets Manager, container scanning, and automated SBOM generation shipped as part of every build.
Context
A global automotive Tier-1 supplier ran three custom business applications on SAP NetWeaver 7.5: a Supplier Portal for onboarding and invoice management (25,000 lines), a Quality Management module for non-conformance tracking and CAPA workflows (18,000 lines), and an EDI Gateway for trading partner message processing across 14 active partners (12,000 lines). Together, these applications supported supplier collaboration, quality compliance, and trading partner integration across the manufacturing supply chain. All three sat on the same NetWeaver instance, deployed as Java EE 7 applications.
Inroduction
Attackers exploited CVE-2025-31324, a severity 10/10 unauthenticated file upload vulnerability in the SAP NetWeaver Visual Composer. The vulnerability was added to the government’s catalogue of actively exploited vulnerabilities. Security researchers reported that “nearly all” observed exploitation targeted manufacturing companies. Operations were disrupted while the incident was contained and the platform was patched.
With supplier onboarding, quality compliance, and trading partner communications dependent on the affected applications, the organisation needed to reduce platform risk without disrupting day-to-day operations.
The board mandated a modernisation programme. The engineering leadership needed a specialist team for one specific workstream: migrating the three custom applications off the compromised platform to a modern, actively maintained runtime.
The Problem
These were not simple applications. The Supplier Portal and Quality Management module called into the company’s SAP ERP system via direct connector calls for purchase order data, vendor master lookups, and quality module reads. The EDI Gateway depended on platform-specific integration adapters for connectivity with 14 active trading partners, handling message translation and protocol management that could not be simply rehosted.
“The breach did not create the modernisation argument. It removed every reason to defer it.”
Why this was hard
The trading partner integration was the highest-risk item. The legacy platform provided built-in adapters for partner connectivity, but these adapters were tightly coupled to the platform and had no portable equivalent. Each of the 14 trading partners had its own protocol configuration, message format, and connection requirements.
The Approach
A quality baseline was built against the patched platform. Claude Code handled roughly 50% of the code transformation: reading the full codebase, planning multi-file changes, converting Java EE annotations to Spring equivalents, and migrating configuration files. GitHub Copilot contributed another 20% at the IDE level. The remaining 30%, the SAP connector reconfiguration, the trading partner migration, and platform-specific API removal, required manual engineering and consumed about 60% of the total effort.
The EDI Gateway’s legacy platform adapters were replaced with AWS Transfer Family, which natively supports AS2 and SFTP protocols as a fully managed service. The 14 trading partner configurations were migrated to Transfer Family partner profiles, with each partner’s connectivity individually validated in a staging environment before cutover. This moved the organisation from maintaining custom adapters to a managed, PCI DSS-compliant file transfer service.
Security hardening shipped as part of the automated build pipeline: AWS Secrets Manager for all credentials and certificates, automated TLS certificate lifecycle, container image scanning blocking deployments with critical vulnerabilities, and a software inventory generated automatically on every build.
AI-assisted code transformation delivered roughly 15 to 25 percent acceleration end-to-end. Claude Code was strongest on multi-file refactoring. It did not replace the engineering judgment needed for the trading partner migration or SAP connector reconfiguration.
Outcomes Achieved
Risk reduction
Operational resilience
Strategic impact
Frequently Asked Questions
How does Claude Code compare to traditional migration tooling for this kind of workload?
Claude Code handled roughly 50% of the code transformation by reading the full codebase, planning multi-file changes, and converting annotations and configuration files. It was strongest on repetitive, pattern-based transformations across dozens of files simultaneously. It did not replace engineering judgment for platform-specific dependencies like SAP connectors or trading partner adapters. The realistic end-to-end acceleration is 15 to 25 percent, not the 40 to 50 percent that vendor benchmarks suggest.
Why was AWS Transfer Family chosen over open-source integration routes for the EDI Gateway?
AWS Transfer Family natively supports AS2 and SFTP protocols as a fully managed service with built-in trading partner management, S3 integration for file storage, and PCI DSS compliance. This eliminated the need to maintain custom adapters or configure open-source routing libraries, reducing the long-term operational burden for the 14 active trading partner connections.
What compliance evidence does the automated build pipeline produce?
Every deployment generates a software inventory (SBOM via CycloneDX), a container vulnerability scan report (via Trivy), and a test-pass log. These are stored as build artefacts alongside the deployable, so compliance evidence ships as part of the release process rather than being assembled manually before an audit.
At A Glance
Industry
Platform
From
To
Transformation
Automotive / Cybersecurity
Supplier, quality, and partner operations
SAP NetWeaver 7.5, Java EE 7
Spring Boot 3.5, Java 21, AWS, Datadog
Claude Code + GitHub
Copilot