The Age of the Citizen Developer: Mitigating Risk While Cultivating Enthusiasm

AI is rapidly democratizing technology, placing powerful development capabilities into the hands of nontraditional users. Large language models now enable individuals with limited technical backgrounds to build applications, automate workflows, and generate insights at unprecedented speed. This shift has ushered in the Age of the Citizen Developer.

While this shift unlocks significant innovation, it also introduces a new category of risk. Citizen developers are increasingly deploying applications and workflows outside traditional engineering and security oversight, often without fully understanding the downstream impact on data exposure, compliance obligations, access control, and system integrity.

A July 2025 IBM report on the cost of a data breach (newsroom.ibm.com/campaign?item=2377#) highlights this growing risk: 13% of organizations have reported breaches of AI models or applications, and, among those, 97% lacked proper access controls. Even more concerning, 63% of affected organizations had no formal AI governance policy in place. Combined with widely cited International Monetary Fund studies projecting that global cybercrime costs will reach $23 trillion by 2027, these statistics highlight a significant and growing risk.

Increasing Attack Surface

When implementing AI workflows, organizations must assess compliance, vulnerability, exploitability, and exposure risk continuously. Systems created or influenced by citizen developers often introduce new access paths and data flows that fall outside traditional security models. This makes them particularly attractive to threat actors.

An increase in access points combined with insufficient governance creates conditions that attract cybercriminals. Before permitting AI tools to access valuable datasets, leadership should require clear answers to the following questions:

♦ Is the current security adequate for AI to process data?
♦ Is the data cleansed for the specific analyses being conducted?

These questions are essential for responsible AI deployment. Data outliers should be assessed for their value in modeling rather than automatically discarded. Such decisions directly impact the integrity of AI outputs and data security.

Security-First AI Management Strategy

Effective AI deployment requires adherence to key operating principles that must be implemented, managed, and monitored for compliance with organizational policies.

A formal management program, supported by strong governance, system tracking, and clear accountability, is essential. This ensures organizations maintain visibility over data flows, access, and usage within AI systems.

Access control is only part of the challenge. Allowing data replication through pathways created by citizen developers introduces additional risks. Organizations must implement frameworks that preserve data confidentiality and compliance when AI tools interact with enterprise information.

Effective AI operations require security engineering and data governance based on risk tolerance, transparency, and shared responsibility. Security teams should collaborate with data stewards, and citizen developers must understand the downstream impact of their data usage.

Data in AI pipelines must be checked for accuracy, bias, lawful processing rights, data integrity, and appropriate outlier handling. Organizations should use automated tools with manual oversight for vulnerability assessments, and code reviews should identify potential security flaws in algorithms and software.