How to mitigate the risk from AI-generated apps built by your 'citizen coder' employees
Tenable outlines governance controls to reduce risk from employee-built AI workplace apps.
Tenable describes security and compliance risks when non-technical employees use generative AI to build workplace apps without IT oversight, a practice it calls citizen coding or vibe coding. Those shadow AI apps may skip testing, contain vulnerabilities or risky open-source components, store sensitive data insecurely, lack patching and logging, and hold excessive privileges. Tenable says bans tend to drive the activity underground and instead recommends a structured multi-tier governance model with departmental AI leads, approval queues, and mandatory security training. It also warns that employee-built local data lakes can cause data sprawl and rising AI token costs, citing OWASP's Citizen Development Top 10.
- Unsanctioned AI apps can ship with vulnerabilities, weak data protection, and excessive privileges.
- Blanket bans often push citizen-coder development underground, Tenable argues.
- Tenable favors multi-tier governance, departmental AI leads, and mandatory security training.
- Local data lakes built for vibe-coded apps can create data sprawl and token costs.
- Vendors
- Tenable
From the original article
7 min read at tenable.com
AI tools let non-technical employees build workplace apps in minutes with natural language prompts. While these AI-generated apps boost productivity, they can create severe security and data risks. As Cybersecurity Awareness Month kicks off, we’re sharing how Tenable adopted a structured governance framework that allows our “citizen coders” to build secure and compliant apps with AI.
By Phillip Hayes · tenable.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.