Employees are building AI-assisted automations faster than existing security processes can review them.
The resulting “wild code” is not necessarily unauthorized software; it can be new tools with excessive access, data exposure or unclear ownership.
This article examines embedding controls into the app-building environment, alongside easy approved paths and traceability across creation and operation.
The risks of new tools
When employees build their own applications, risks are often created that are not immediately visible:
- Excessive access: Tools may have permission to read or change much more data than they actually need.
- Information report: Sensitive data may be disclosed to the wrong people or recorded in places where it is not secure.
- "Orphan" applications: If the creator of the tool leaves the company, the application can continue to operate without anyone knowing who is responsible for its maintenance.
- Unwanted actions: Due to a lack of oversight, it is difficult for security teams to pinpoint exactly what happened in the event of an error.
Why traditional measures are not enough
Many companies try to address the problem with training, specially isolated test environments, or approval committees. However, these measures often do not work. Employees pressed for time may look for quicker solutions by bypassing official rules, and a committee cannot review applications it does not know exist.
How can safety be ensured?
The most effective approach is to embed controls directly into the environment where employees build their applications. Experts suggest three basic principles:
READ ALSO
When does the home router really need to be replaced?
- Continuous supervision: Controls must be defined at creation time and remain active as long as the application is running.
- Easy approved routes: If the safe process is simple and quick, employees will follow it without trying to find workarounds.
- Transparency: Every application must be visible and controllable, so that it is always known who manages it and what data it uses.
The goal is not to stop creativity, but to ensure that any new application that touches sensitive systems remains auditable from day one.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
