Citizen development: what security teams are missing in business-built apps

TL;DR: Citizen development is expanding because low-code, no-code and generative AI tools let business teams build faster, but the same shift creates shadow IT, unmanaged identities, weak logging and excessive access across business-built apps, according to Pluto Security. The security problem is not the tooling itself, but the assumption that platform controls substitute for application governance.

Editorial analysis by NHI Mgmt Group, based on content published by Pluto Security: “Citizen Development Security: When Business-Built Apps Bypass Security Teams”.

Key questions

Q: What breaks when citizen-developed apps are not brought under governance?

A: The main failure is that business-built apps begin to behave like production systems while remaining outside the controls that normally govern production systems.

Q: Why do business-built apps create identity risk even inside approved platforms?

A: Approved platforms can still host risky identities because the app, not the platform, defines who can act, what data can be reached and how long access persists.

Q: How should security teams govern citizen development without slowing delivery?

A: Use a guardrail model instead of a blanket approval model.

Practitioner guidance

• Create a full inventory of citizen-built applications Track every low-code app, workflow and automation as an individual asset, with business owner, data classification, environment and connector list recorded at intake.
• Put non-human identities under explicit ownership Assign a named owner to each service account, API token and bot tied to a business-built app, then review scope, rotation and revocation on a fixed cadence.
• Restrict connector and data-source permissions by default Start with least privilege for every integration, especially where low-code tools reach SaaS tenants, databases or regulated datasets, and require approval for scope expansion.

Bottom line: Citizen development creates a governance gap when business users build apps that inherit data access and integrations without the controls applied to enterprise software.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →