Citizen developers are becoming a security problem

COMMENTARY: AI is basically turning a lot more employees into software builders, whether they think of themselves that way or not. People can now create apps, connect systems, and build agents without going through the usual engineering process, which means security teams have a lot more to keep an eye on. For MSSPs, that feels like a pretty clear opportunity around visibility, access controls and governance as more of this stuff starts popping up across customer environments.

For decades, enterprise security operated under a simple assumption: the people building software were software developers.

Development happened inside engineering organizations, followed established workflows, passed through code review, and moved into production through managed CI/CD pipelines. Security teams built governance around that model because, for the most part, it reflected reality.

Artificial intelligence has changed that assumption.

The biggest impact of generative AI isn't simply that developers write code faster. It's that millions of people who were never considered software developers can now create useful applications, automate business processes, build AI agents, and integrate enterprise systems with surprisingly little technical expertise.

Software development is no longer confined to engineering. It is becoming a capability that exists across the enterprise.

That shift has enormous security implications.

AI has expanded who can build software

The rise of AI-native development tools has dramatically lowered the barrier to creating software. Employees no longer need years of programming experience to automate workflows, connect APIs, build internal applications, or deploy AI-powered assistants.

Marketing teams are creating campaign automation. Finance organizations are building reporting tools. HR departments are experimenting with AI assistants. Operations teams are connecting systems that previously required engineering support.

These aren't traditional citizen developers building simple workflows with drag-and-drop tools. They're creating increasingly sophisticated software by describing business problems in natural language while AI generates much of the implementation.

The result is a much larger population of software builders operating throughout the enterprise.

This is not a temporary trend. It represents a fundamental change in how software is created. If everyone is becoming a developer, how do security models built for yesterday’s engineering teams prepare for tomorrow’s AI-powered builders?

Every builder is now part of the enterprise software supply chain

One of the most significant changes AI introduces is that software creation is no longer limited by programming ability.

An employee who understands a business process can increasingly create software that affects customers, employees, financial systems, or enterprise data.

That individual has effectively become part of the organization's software supply chain.

This does not mean every employee should be treated as a software engineer. It does mean governance models must recognize that software creation is becoming broadly distributed across departments that security teams historically never considered part of the development organization.

Identity, permissions, runtime visibility, auditability, and policy enforcement therefore become enterprise-wide capabilities rather than engineering-specific controls.

Security teams will need to collaborate more closely with business units, not because those groups are becoming technical, but because they are increasingly creating technical assets

The security model hasn't changed nearly as fast

While software creation has become more distributed, security governance remains largely centered on traditional development practices.

Organizations still focus on securing source repositories, protecting CI/CD pipelines, scanning application code, reviewing pull requests, and controlling production deployments. These remain essential controls, but they increasingly cover only part of the software creation lifecycle.

Many AI-assisted projects begin outside those established processes.

An employee might prototype an internal application in an AI coding assistant, connect it to company data, grant access to external services, and begin sharing it across a team long before security becomes aware it exists. An AI agent may call APIs, access SaaS platforms, retrieve sensitive information, or invoke external tools without ever fitting neatly into conventional governance workflows.

The challenge is not that these employees are acting irresponsibly. Most are solving legitimate business problems and increasing productivity.

The challenge is that the assumptions behind enterprise security no longer reflect where software originates.

Governance must expand beyond engineering

Historically, security teams asked questions such as:

Those questions remain important, but they are no longer sufficient.

Organizations increasingly need to understand a different set of operational questions.

These questions shift the conversation from software development to software operation.

As AI-generated software becomes more dynamic and autonomous, understanding runtime behavior becomes just as important as reviewing source code.

This shift represents a broader transformation in how organizations must approach security, one that extends beyond traditional development practices.

The next evolution of security

The rise of the citizen developer should not be viewed as a governance failure. It is evidence that AI is making software creation dramatically more accessible and allowing organizations to innovate faster than ever before.

Over the past decade, organizations learned how to secure professional software developers. Over the next decade, they will need to secure an enterprise where nearly every knowledge worker has the ability to create software.

The organizations that adapt their security programs to this new reality will be positioned to accelerate innovation while maintaining trust and control.

Those who continue building governance around the assumption that only engineering creates software may discover that the largest changes in their software ecosystem happened long before they knew where to look.

MSSP Alert Perspectives columns are written by trusted members of the managed security services, value-added reseller and solution provider channels or MSSP Alert's staff. Do you have a unique perspective you want to share? Check out our guidelines here and send a pitch to [email protected].