22 Jan Shining a Light on Shadow IT: How Citizen Development Empowers Employees and Protects Businesses

As the Middle East advances in AI and cloud technologies, achieving cyber resilience is more critical than ever, Dinesh Varadharajan, Chief Product Officer at Kissflow writes about integrating robust cybersecurity measures into strategic planning and IT.

Among the Middle East findings of PwC’s 2025 Global Digital Trust Insights study was the continued upward movement of cybersecurity on the C-suite’s agenda. Some 15 per cent of regional organisations reported data breaches costing in excess of USD$100,000. Two in five (40 per cent) technology leaders in the region now see data protection as their top investment target.

There are many ways an organisation is exposed to security risks — if you look at enterprises, decentralised tech is one of the top contributors to these security concerns. The spike in shadow IT had (and still has) deep implications for security as governments across the region seek to encourage and catalyse the growth of their digital economies while at the same time actively policing the rights and safety of consumers.

Keeping the lights on

So what factors drive the rise of shadow IT? Recent Kissflow research shows that a whole third (33 per cent) of organisations face resource constraints in custom app development, and as a result, the vast majority (80 per cent) of tech leaders in the region see a pressing need to refine the app development process for effective digital transformation. Until this refinement is achieved, however, what enterprises often end up with are a daunting backlog of app development requests, overworked IT teams, and frustrated business users.

This consequence chain, from the work pressures on the user at one end to the subpar delivery of the technology function on the other, is not the fault of any of the players involved. After all, most employees who indulge in shadow IT are unaware of how it connects to non-compliance and data breaches. It is, however, important to come to terms with the risks and to adopt new methods to overcome them.

Risky business

The first and most obvious risk is the impact on the visibility of the technology environment. IT and security professionals cannot protect what they cannot see, and unsanctioned apps can come with a range of vulnerabilities.

Also, a shadow asset could go offline, and data could be lost because of a lack of understanding of its storage. Even if the IT department is called in to address the issue, they may not be able to fix it because of a lack of documentation. Regular audits and better collaboration between IT and business can help to unearth shadow IT issues and establish a stronger governance layer.

Citizen development for the win

Shadow IT can quickly escalate into a serious issue, jeopardising the security posture of the entire organisation. To prevent things from spiralling out of control, organisations must work to bridge the understanding gap between IT and business users.

To do this effectively, there are three factors to consider: business complexity, technical complexity, security and compliance requirements. An application use case that scores particularly high on any one of factors should be managed by the IT department, while the remaining can be taken care of by the business teams. Sounds simple, right? But this collaboration is not possible without a low code no code (LCNC) platform.

LCNC platforms allow non-technical employees to become citizen developers. Platforms are designed in a way that allows business-oriented domain experts to visually build apps that fulfil all of their requirements with little need to involve IT. These development platforms automate code construction to ensure only native-friendly, secure, compliant, and efficient solutions are built. Critical to addressing the challenge of shadow IT specifically, leading LCNC platforms include integrated governance layers, which means IT and security teams can impose their discipline on citizen developers without the need for constant personal involvement.

Our recent survey with the enterprise CIOs also highlighted the positive outcomes of citizen development. 92% of tech leaders agree that citizen development is a pivotal strategy in achieving digital transformation goals and it helps in reducing the IT backlog by 65%. Citizen development unlocks the ability to leverage employees’ creativity, expertise, and opinions to drive innovation and address growing business needs. Resisting it would only lead to missed opportunities, slower response times, and piling technology backlog as IT needs to catch up with the increasing demand for apps.

Out of the shadows

While it is still all but impossible to entirely eliminate shadow IT, this challenge and its associated risks can be controlled to a greater extent by choosing the right LCNC platform. And with Gartner already having estimated that in 2024, 80% of the tech stack would have been built by non-technical developers, it is the prudent way to embrace the inevitable and gain an edge against the competition.

Dinesh Varadharajan is the Chief Product Officer at Kissflow. He leads the product management team at Kissflow, a unified low-code/no-code platform that bridges the gap between business users and IT to simplify work management. Dinesh is a hands-on executive with a wide range of experience working with bleeding-edge technologies, developing great products, and mentoring highly productive teams. He has profound knowledge of design and technical implementation of BPM solutions.