Tenable outlines five-tier AI governance to curb shadow AI risk from employee 'citizen coder' vibe-coded apps
Tenable published a blog post, the first in its Cybersecurity Awareness Month series, on the security risks of workplace applications that non-technical employees ("citizen coders") build with generative AI tools. Such apps often bypass QA, testing and IT/security oversight, and become shadow AI assets with vulnerabilities, misconfigurations, weak data protection and excessive privileges. The post says blanket bans tend to backfire because employees hide their activity. It recommends structured governance combined with mandatory training. No specific incident, threat actor, vulnerability or exploitation is described.
Technical Details
- Risks cited, drawing on the OWASP Citizen Development Top 10: untested code with critical vulnerabilities and risky open-source components; insecure access to critical systems and storage of sensitive data; no patching, monitoring, logging, backup or disaster recovery coverage; excessive permissions outside IAM control.
- Consumer-grade generative AI tools are used individually by employees, unlike monitored SaaS low-code/no-code platforms.
- Citizen coders may build local data lakes from their legitimate access to business apps, causing data sprawl and rising AI token costs.
- The volume of apps can overwhelm IT and security review queues even when employees follow policy.
Remediation
- Adopt a five-tier AI governance model: Strategy (executives), Governance (AI Governance Board and Technical Council), Execution (AI Functional Leads and R&D Champions), Enablement (IT, L&D and Communications working group), Community (Slack channels).
- Have departmental AI Functional Leads approve tools, skills, connectors and data access, and flag unvetted external AI components before production.
- Tie AI tool access to mandatory security and responsible-use training, backed by webinars, courses and peer support.
- Prefer governance over blanket prohibition.
Linha do tempo
-
Tenable outlines five-tier AI governance to curb shadow AI risk from employee 'citizen coder' vibe-coded apps
ler a análise desta fonte ocultar
Tenable published a blog post, the first in its Cybersecurity Awareness Month series, on the security risks of workplace applications that non-technical employees ("citizen coders") build with generative AI tools. Such apps often bypass QA, testing and IT/security oversight, and become shadow AI assets with vulnerabilities, misconfigurations, weak data protection and excessive privileges. The post says blanket bans tend to backfire because employees hide their activity. It recommends structured governance combined with mandatory training. No specific incident, threat actor, vulnerability or exploitation is described.
Technical Details
- Risks cited, drawing on the OWASP Citizen Development Top 10: untested code with critical vulnerabilities and risky open-source components; insecure access to critical systems and storage of sensitive data; no patching, monitoring, logging, backup or disaster recovery coverage; excessive permissions outside IAM control.
- Consumer-grade generative AI tools are used individually by employees, unlike monitored SaaS low-code/no-code platforms.
- Citizen coders may build local data lakes from their legitimate access to business apps, causing data sprawl and rising AI token costs.
- The volume of apps can overwhelm IT and security review queues even when employees follow policy.
Remediation
- Adopt a five-tier AI governance model: Strategy (executives), Governance (AI Governance Board and Technical Council), Execution (AI Functional Leads and R&D Champions), Enablement (IT, L&D and Communications working group), Community (Slack channels).
- Have departmental AI Functional Leads approve tools, skills, connectors and data access, and flag unvetted external AI components before production.
- Tie AI tool access to mandatory security and responsible-use training, backed by webinars, courses and peer support.
- Prefer governance over blanket prohibition.