AI empowers non-programmers to build valuable tools, yet many go live without data, records, or critical-process risk review. Learn how to mitigate it.
The rise of everyday builders
Software development isn’t just for programmers anymore. With AI assistance, users can create sophisticated tools without a programming background or a traditional software development environment. This means those closest to an inefficient process are well-positioned to improve it themselves, but this shift also brings new risks. For example:
An academic advisor creates a tracker application for her work with students. It makes her better prepared and allows her to serve her students more effectively. What starts as a personal tool ends up being used by others in her department and soon tracks academic standing and disability accommodations without anyone reviewing how that sensitive information is protected.
A financial aid specialist builds a script that fixes a recurring data-entry error. It saves him several hours each week, but updates records using his credentials, and no one else knows how it works.
A facilities administrator creates a simple web form for routing room setup requests. It immediately simplifies coordination and reduces missed requests. It doesn’t handle sensitive data or change any official records, but within a semester several departments depend on it to plan events, and no one is responsible for maintaining it.
AI empowers users to quickly improve their own workflows. However, institutions must review those improvements through a risk lens and ensure policies and controls are in place to ensure sustainability.
Silent Adoption
Rapid development can easily result in experiments that move to adoption before institutional processes catch up, increasing cyber risk. Departments that don’t traditionally create software solutions may be unaware of their institution’s policies and obligations. This is particularly problematic for solutions that:
Additionally, when teams adopt solutions without understanding institutional obligations, they may fail to assign responsibility for maintenance, access control, support, and recovery.
Proportionate Risk Governance
Institutions should cultivate experimentation while establishing clear, reasonable controls to meet their obligations. Onerous or unclear policies can result in solutions being created and adopted without institutional visibility.
Review and adoption processes should:
Provide a clear progression from experimentation to adoption.
Define a classification system that identifies, at minimum, tools that handle sensitive data, change institutional records, or support critical processes.
Outline a “fast track” and associated criteria for low-risk applications.
Provide an approved adoption path for tools that are already operating.
For consequential tools, identify an accountable owner and define responsibilities for maintenance, support, access control, and recovery.
Establish a lifecycle management process that addresses changes to tool scope, data sensitivity, user base, and criticality, as well as its eventual retirement.
Additionally, institutions must prepare for the inevitable increase in assessment and support demands as a growing number of users create increasingly sophisticated tools. Policy alone does not supply extra capacity.
Risk-aware Innovation
AI-assisted development brings a historic change in how institutions solve problems with software. What once required substantial time and specialized expertise can now be created by non-experts in minutes, using natural language.
This is a tremendous opportunity for innovation and also a growing challenge for cybersecurity and risk professionals. As always, our mandate is to enable our institutions to innovate responsibly. The best risk management programs will preserve the freedom to experiment while applying controls that keep risk within acceptable limits.
Of course, not every prototype should become a supported service. On the other hand, not every experiment requires executive-level oversight. Between these extremes, oversight should depend on the data the solution handles, the records it changes, and the criticality of the functions it supports. Classification schemes should set clear expectations for accountability, access control, and support.
In this historic time, we as cybersecurity and risk professionals have an opportunity to help our institutions use these powerful capabilities responsibly, rather than merely react to the risks they introduce. By collaborating with those we serve, we can establish a clear path for responsible innovation.