How to mitigate the risk from AI-generated apps built by your 'citizen coder' employees

The rise of generative AI tools has empowered non-technical employees to create fully functioning applications quickly, often without IT or security involvement. These 'citizen coder' applications can introduce shadow AI risks including critical vulnerabilities, misconfigurations, insecure access to sensitive systems, lack of patching and monitoring, and excessive privileges. Unlike traditional low-code/no-code platforms that are monitored and managed, AI-generated apps are often consumer-grade and individually accessed, increasing risk exposure. Even when policies exist, the sheer volume of apps can overwhelm governance processes. Tenable's approach involves implementing a structured governance framework with departmental AI leaders overseeing tool approvals and app development, alongside mandatory security and compliance training for citizen coders. This approach aims to provide security guardrails while enabling productivity gains from AI-assisted app development.

Unsanctioned AI-generated applications built by non-technical employees can introduce critical security vulnerabilities, misconfigurations, and weak data protection controls into organizational environments. These applications may access sensitive systems insecurely, have excessive permissions, and are often excluded from patching, monitoring, logging, and disaster recovery processes. The proliferation of such apps can overwhelm IT and security teams, increasing the risk of unnoticed security gaps and compliance violations. This shadow AI risk can lead to potential data breaches, unauthorized access, and operational disruptions if not properly governed.

Tenable advises against blanket bans on AI-aided application development, as prohibitions may drive activities underground. Instead, organizations should implement a structured, multi-tiered governance framework that includes peer leadership roles responsible for tool approval, managing development requests, and tracking application ROI. Mandatory security and compliance awareness training for citizen coders is essential. IT and security teams should establish clear policies and controls to oversee AI-generated applications, ensuring they undergo quality assurance, vulnerability scanning, and proper access management. This governance approach balances enabling productivity with maintaining security and compliance.