Accessible AI tools allow employees to build their own solutions ("vibe coding"). While empowering, this creates a massive, ungoverned "creation sprawl" of tools. CIOs now face the challenge of managing costs, capturing innovation, and consolidating these disparate, employee-built applications.

Todd McKinnon believes that while security and infrastructure software are more insulated than productivity apps, CEOs must be paranoid. The power of new AI development tools makes the threat of customers building their own solutions, instead of paying for SaaS, a real concern for everyone.

In large enterprises, AI adoption creates a conflict. The CTO pushes for speed and innovation via AI agents, while the CISO worries about security risks from a flood of AI-generated code. Successful devtools must address this duality, providing developer leverage while ensuring security for the CISO.

AI tools that automatically write applications often pull assets from open-source libraries. This creates a massive security risk, as these agents must be explicitly directed to use secure, vetted repositories to avoid introducing vulnerabilities at scale without human oversight.

Recent security breaches (e.g., Gainsight/Drift on Salesforce) signal a shift. As AI agents access more data, incumbents can leverage security concerns to block third-party apps and promote their own integrated solutions, effectively using security as a competitive weapon.

The rapid adoption of "vibe coding" apps by employees using production data has created a new "shadow AI" attack vector. This has spurred a market for enterprise-grade platforms that "harden" these tools by adding permissions, auditing, and IT oversight, turning a security risk into a new B2B software category.

The emergence of AI that can easily expose software vulnerabilities may end the era of rapid, security-last development ('vibe coding'). Companies will be forced to shift resources, potentially spending over 50% of their token budgets on hardening systems before shipping products.

A cybersecurity expert argues the primary AI threat is internal, not external. Employees without formal training ("citizen developers") are building insecure apps, and AI agents can autonomously exceed their mandates. This shifts the security focus from preventing outside attacks to implementing strong internal AI governance.

Within large engineering organizations like AWS, the push to use GenAI-assisted coding is causing a trend of "high blast radius" incidents. This indicates that while individual productivity may increase, the lack of established best practices is introducing systemic risks, forcing companies to implement new safeguards like mandatory senior staff sign-offs.