Opinion
AI made app building easier. Security must catch up.
"Business teams can now build applications with AI," writes Gera Dorfman, Chief Product Officer at Orca Security, "but fixing security flaws must not mean giving up control of the software they created."
A sales manager knows which deals are stuck and what would help move them forward. Until recently, turning that knowledge into an application usually meant competing for an engineering team’s time. AI tools let that manager build the application directly, then change it as the work changes.
Once the application handles company data, a mistake can expose records to people who should not see them. Its creator may know exactly what colleagues or customers should be able to do, yet have no idea how to check whether the software enforces those limits. Asking an AI tool to restrict access is not the same as checking that it has done so.
The built-in security checks in AI building tools are not enough to establish that an application is safe to use. Security teams need tools that understand how these platforms build and connect applications, so they can identify what is exposed and help the creator fix it. That support should let business teams keep developing their applications, with security expertise built into the process.
A partner portal built over a weekend shows what this looks like in practice. Its creator, the head of distribution at Orca Security, drew on two decades of experience with partners to build tools for campaigns and sales pipelines. The AI tool’s built-in scan gave the application a green light. The creator had the application’s code synced to the company’s GitHub repository so the team’s security tools could scan it. The company’s security team then tested who could access its data and uncovered problems before production, including access to other partners’ records.
The creator fed those findings back into the AI building tool, which produced fixes within minutes. The security team then tested the changes again. An outside firm also performed penetration testing before launch. The creator now changes the portal almost every day, with updates automatically syncing to GitHub and being scanned as they arrive.
Security review did not require handing the portal over to an engineering team. Its creator kept developing it, with specialist help to address the risks. Making that relationship routine across a company takes more than reviewing the applications that happen to reach the security team.
In addition, employees sometimes build through personal accounts, outside the organization’s usual development process. A small sales dashboard may use an account that can read the entire customer database. Security teams need to find these applications, identify the data they can read and check who can access that data through them. An application’s size says little about how much company data it can expose.
A finding then has to lead to a usable fix. Telling a sales manager that an application has an access-control problem does not tell them what to change. Security tools should produce findings that the builder can feed into the AI building tool to generate a fix. The security team then checks that the change closes the exposure while preserving the application’s intended business use.
AI is also making vulnerabilities easier to find, with new flaws coming to light every day. The same capability gives security teams a way to extend automated testing across the growing number of applications employees create. The tools must present their findings in a form non-technical builders can use to fix problems and keep developing their applications more securely.
Gera Dorfman is Chief Product Officer at Orca Security.
