Security Teams Face Challenges Managing 'Wild Code' Created by Employees

The Rise of 'Wild Code'

Employees are increasingly building AI-assisted workflows and applications to automate tasks, such as sales managers creating tools to route leads and summarize requests. These custom solutions often become integral to daily operations, saving time and reducing manual effort within teams.

This rapid development of new capabilities by employees outpaces existing organizational processes for ownership, security, and maintenance. This phenomenon, termed 'wild code,' differs from unapproved software as it involves the creation of new functionalities rather than just the adoption of existing products.

Associated Security Risks

The primary concern with 'wild code' extends beyond vulnerabilities in the generated code itself. Even when functioning as intended, these applications can pose significant security risks. These include operating with excessive permissions, exposing sensitive data to unintended audiences, or performing actions without appropriate approval boundaries.

Specific risks identified are excessive permissions where workflows access more data than necessary, sensitive data exposure through unnecessary connections or broad output availability, unintended actions that modify records without proper authorization, and orphaned access when creators leave, leaving workflows unmanaged and their permissions unreviewed. Additionally, investigation gaps arise when security cannot trace actions or access during incidents.

Limitations of Current Security Measures

Current security approaches, such as employee education, sandboxes, and AI steering committees, are insufficient to fully control 'wild code.' These measures often fail to govern software they may not encounter or control its behavior once operational. Policies describe ideal scenarios but do not inherently enforce them in dynamic, employee-driven development environments.

Towards Sustainable Control

A more effective strategy involves embedding controls directly into the operational environment. This includes regulating what employees can connect to, defining the capabilities of their applications and agents, and continuously monitoring their activities once deployed. This approach aims to manage the risks associated with 'wild code' by establishing systemic safeguards rather than relying solely on preventative education or post-incident responses.