What Building Application Security Into Shadow IT Looks Like

This article addresses application security for citizen (low-code/no-code) developers, emphasizing the scale, variance, and lack of security expertise in citizen development. It highlights a two-person team that remediated 70,000 of 80,000 discovered vulnerabilities within 90 days and recommends automated, self-service-driven AppSec controls—inventory, clear policy, automated assessment and retesting, self-service remediation guidance, SLA enforcement, and executive reporting—to manage risk without blocking business innovation.