10 Mar Power to the people

Dinesh Varadhrajan, Chief Product Officer at Kissflow, shines a light on shadow IT and explores how citizen development can empower employees and protect businesses.

Among the findings of PwC’s 2025 Global Digital Trust Insights study was the continued upward movement of cybersecurity on the C-suite’s agenda. In the Middle East, some 15 per cent of regional organisations reported data breaches costing in excess of US$100,000. Two in five (40%) technology leaders in the region now see data protection as their top investment target.

There are many ways an organisation is exposed to security risks — if you look at enterprises, decentralised tech is one of the top contributors to these security concerns. The spike in shadow IT had (and still has) deep implications for security as governments across the region seek to encourage and catalyse the growth of their digital economies while at the same time actively policing the rights and safety of consumers.

Keeping the lights on

So what factors drive the rise of shadow IT? Recent Kissflow research shows that a whole third (33%) of organisations face resource constraints in custom app development, and as a result the vast majority (80%) of tech leaders in the region see a pressing need to refine the app development process for effective digital transformation. Until this refinement is achieved however, what enterprises often end up with are a daunting backlog of app development requests, overworked IT teams, and frustrated business users.

This consequence chain, from the work pressures on the user at one end, to the subpar delivery of the technology function on the other, is not the fault of any of the players involved. After all, most employees who indulge in shadow IT are unaware of how it connects to non-compliance and data breaches. It is, however, important to come to terms with the risks and to adopt new methods to overcome them.

Risky business

The first and most obvious risk is the impact on visibility of the technology environment. IT and security professionals cannot protect what they cannot see, and unsanctioned apps can come with a range of vulnerabilities.

Also, a shadow asset could go offline, and data could be lost because of a lack of understanding of its storage. Even if the IT department is called in to address the issue, they may not be able to fix it because of a lack of documentation. Regular audits and better collaboration between IT and business can help to unearth shadow IT issues and establish a stronger governance layer.

Citizen development for the win

Shadow IT can quickly escalate into a serious issue, jeopardising the security posture of the entire organisation. To prevent things from spiralling out of control, organisations must work to bridge the understanding gap between IT and business users.

To do this effectively, there are three factors to consider: business complexity, technical complexity and security and compliance requirements. An application use case that scores particularly high on any one of factors should be managed by the IT department, while the remaining can be taken care of by the business teams. Sounds simple, right? But this collaboration is not possible without a low code no code (LCNC) platform.

LCNC platforms allow non-technical employees to become citizen developers. Platforms are designed in a way that allows business-oriented domain experts to visually build apps that fulfil all of their requirements with little need to involve IT. These development platforms automate code construction to ensure only native-friendly, secure, compliant and efficient solutions are built. Critical to addressing the challenge of shadow IT specifically, leading LCNC platforms include integrated governance layers, which means IT and security teams can impose their discipline on citizen developers without the need for constant personal involvement.

Kissflow’s recent survey with enterprise CIOs also highlighted the positive outcomes of citizen development. Ninety-two per cent of tech leaders agree that citizen development is a pivotal strategy in achieving digital transformation goals and helping reduce the IT backlog by 65 per cent. Citizen development unlocks the ability to leverage employees’ creativity, expertise and opinions to drive innovation and address growing business needs. Resisting it would only lead to missed opportunities, slower response times, and piling technology backlogs as IT needs to catch up with the increasing demand for apps.

Out of the shadows

While it is still all but impossible to entirely eliminate shadow IT, this challenge and its associated risks can be controlled to a greater extent by choosing the right LCNC platform. And with Gartner already having estimated that in 2024, 80 per cent of the tech stack would have been built by non-technical developers, it is the prudent way to embrace the inevitable and gain an edge against the competition.