CDS, or Core Data Services, is SAP’s model-driven way to define structured data views, relationships, annotations, and business logic foundations. Instead of writing many separate database or application-layer queries, developers use CDS to describe what data should look like and how it should be exposed to applications, reports, and services.
In cyber security, CDS matters because it often sits close to sensitive business data and becomes part of the application’s trust boundary. A poorly designed CDS view can expose fields that should stay hidden, weaken authorization checks, or publish data through APIs and Fiori apps more broadly than intended. Defenders review CDS access controls, restrict projections to the minimum needed, and align annotations with least-privilege design. Attackers look for CDS-backed services with excessive exposure or inconsistent checks, since those can reveal customer, finance, or operational records without touching the database directly.