NEW YORK — What happened: By late 2026, Low-Code/No-Code (LCNC) platforms have become ubiquitous in enterprises, empowering business users and 'citizen developers' to rapidly build applications, automate workflows, and create custom tools. While undeniably boosting productivity and accelerating digital transformation, a new report from the 'Cyber Resilience Alliance' (CRA) reveals that this widespread adoption is inadvertently introducing critical security vulnerabilities, often due to insufficient governance and a lack of security-first design principles among non-technical creators.
Why it matters: The promise of LCNC is speed and agility, allowing businesses to respond quickly to market needs without relying solely on scarce professional developers. However, if these rapidly built applications are insecure, they become attractive targets for attackers, potentially exposing sensitive data, creating backdoors into enterprise systems, or serving as vectors for malware. This undermines the very productivity gains they offer and poses significant reputational and financial risks. The scale of the problem is compounded by the sheer volume of LCNC apps being deployed across large organizations.
Deep dive: The CRA report highlights several key areas of concern. Firstly, many LCNC applications are built without robust input validation, leading to common web vulnerabilities like SQL injection or cross-site scripting (XSS), even if the underlying platform is secure. Secondly, insecure direct object references (IDOR) and broken access control are rampant, as citizen developers often struggle to correctly configure permissions across complex datasets. Thirdly, API keys and sensitive credentials are sometimes hardcoded or improperly stored within LCNC flows, making them easily discoverable. Finally, the rapid creation and deployment cycle often bypasses traditional security reviews, leading to a sprawling 'shadow IT' landscape that security teams struggle to monitor. The CRA estimates that over 60% of LCNC apps in large enterprises have at least one critical or high-severity vulnerability that could be exploited.
Report check: The CRA's '2026 LCNC Security Landscape' report draws its conclusions from penetration tests conducted on over 1,000 live LCNC applications across 50 major organizations, supplemented by surveys of security professionals. The claim that 60%+ of LCNC apps have critical vulnerabilities is a stark warning. While LCNC vendors argue their platforms are inherently secure, the report focuses on the 'application layer' built *on* these platforms, which is often where the weaknesses lie. The findings are generally corroborated by independent security consultancies reporting similar challenges. Rumors suggest that some major LCNC platforms are developing AI-powered security scanners specifically for citizen-developed applications, but these are still in early stages.
Open questions: How can enterprises implement effective security governance frameworks for LCNC development without stifling innovation and productivity? What role do LCNC platform vendors need to play in providing better built-in security features and developer education for non-technical users? Will the rise of AI-driven security tools be sufficient to address the scale of this problem, or will it require a fundamental shift in how LCNC applications are designed and deployed? What are the implications for compliance and regulatory bodies, particularly in highly regulated industries?