Author
Martin Hüsser
Published
12. October 2026
Many companies in the DACH region have recently welcomed a new team member. This person is exceptionally energetic, works across multiple teams and departments at the same time—and depending on which floor you’re on, goes by a different name. Most of the time, it’s Claude. Sometimes Codex. In one team we recently worked with, the newcomer was named Hermes.
You run into them in the hallway, at stand-ups, in the break room:
“I worked with Claude to customize my Excel spreadsheet.”
“Codex built me a new interface for my Access database.”
“Hermes now automatically organizes all my calendar entries.”
These aren’t quotes from a study. These are statements we’ve been hearing for weeks in our projects and long-term engagements, from people who don’t work in IT, but in financial control, sales, and customer service.
Claude is just one example. The AI model Claude, developed by Anthropic, is based on a Large Language Model (LLM) and has long been capable of more than just generating text: It develops applications, automates processes, and can collaborate with other tools. This makes it increasingly possible for people who have never developed software or automated processes themselves to create their own applications.
As a result, AI assistants are changing the way we work. What used to require a development assignment, a budget, or months of project time can now be accomplished in just a few hours using AI coding tools and Vibe Coding.
AI is transforming the world of work. And that’s good news—at least at first glance.
Because what’s happening here is exactly what digital transformation programs have been promising for a decade but rarely delivering: ideas that have been shelved for years are finally being implemented. Not as part of a project portfolio with a prioritization round, but on a Tuesday afternoon.
The exciting question, therefore, is not whether employees should take advantage of these opportunities. They’ve been doing so for quite some time. The question is how companies will handle it when an AI assistant in everyday work suddenly becomes a tool for their own development, automation, and process support—and the same security and quality requirements apply as for everything else produced within the company.
Here’s an example from one of our projects:
“I’ve always wanted a user interface for customer access for my application. But the internal software development team never had the capacity. Now I was able to build it myself, and my boss is thrilled! Customers can use our application directly.”
This isn’t a loss of control. It’s an employee who has filled a real gap without waiting for a budget. Anyone who treats such initiative as a problem risks, above all, squandering the opportunities this development offers.
What once began as “citizen development” with Excel macros or Access databases is taking on a new dimension thanks to AI coding tools and Vibe Coding: Today, employees can quickly develop applications that would previously have required traditional software development.
The goal, then, should be to shape this development in a meaningful way and leverage it to our advantage. After all, these tools will be with us for quite some time and will empower people in areas to which they previously had no access. That’s exactly why we’re not writing this post as a warning—but rather as an observation drawn from real-world experience.
The tipping point: When new developments clash with old processes
It’s not the in-house development itself that’s problematic. It’s the gap between new development practices and existing processes when employees develop applications outside of established processes.
Because the very same application that the boss was so pleased with looked like this during testing:
The internal program was never designed to be multi-tenant. It was an internal tool for internal users with internal permissions. The new customer access via the internet was given a clean, separate login—the developer had certainly thought of that. However, behind the login, the application continues to access the same shared database without checking which data record belongs to which customer. This means that anyone who is logged in can view the data of all other customers with just a minor change to the query.
No hacker attack. No zero-day vulnerability. A missing validation check that would have been caught at a review gate in any structured development process.
But this code never made it through a review gate. It slipped past the internal quality control of software development—not secretly, not maliciously, but simply because this path wasn’t even intended. The process involves requirements, tickets, sprints, and approvals. It does not account for a business unit finishing a customer-ready web interface on a Friday afternoon.
This is precisely where the real challenge lies: employees are building their own applications using AI. What starts as a small solution for their own daily work can quickly turn into a full-fledged business application. The organization’s task is not to prevent this development, but to create a clear and secure framework for its use.
And what about the dedicated employee from the business department? No one told them that an application with customer access is different from an internal tool requiring a login. The focus was on what matters: productivity, innovation, and staying competitive in the market.
This isn’t a criticism—it’s the norm.
AI Governance Instead of Bans: Enabling Employees to Work Safely
Even though many organizations react impulsively by blocking access—and this reflex is very understandable—it doesn’t work and actually makes the situation worse.
That’s because usage doesn’t stop; it can simply shift to personal accounts and devices—and a visible risk becomes an invisible one: shadow AI. The company loses track of the situation and, at the same time, the productivity gains.
It is therefore important to recognize that the problem isn’t that someone has built an application using Claude and Vibe Coding. The problem arises when Vibe Coding is used to create applications for which existing security and development processes were never designed.
The crucial question, therefore, is not whether employees are developing their own applications using AI and Vibe Coding. They’re already doing it. The question is whether the organization has created a secure and practical way for them to do so.
The alternative may be less convenient, but it works: create a clear, sanctioned process that’s faster than the unofficial one. An approval process that provides answers in days rather than quarters—one that your employees want to use, rather than circumvent.
This turns AI governance into more than just a set of rules. It requires clear responsibilities:
Who is allowed to use which applications and data? Who reviews new AI-powered applications? And who decides when a personal productivity tool becomes an application that is security-relevant or business-critical?
The AI tools in use also need a clear framework: proper anonymization, contractually regulated data processing, and the rule that no machine-generated finding may appear in a report without being reviewed. Especially when it comes to corporate and customer data, it must be clear under what conditions a tool may be used and where human review remains indispensable.
After all, the employee from the example above is not the risk. Once he knows what matters, he is the best control point the organization can have.
With our Business Application Security Check, we help you identify risks early on and securely deploy applications from business units:
AI Governance: How Companies Can Safely Enable AI-Supported In-House Development
This is the true purpose of AI governance: to create transparency, assess risks where they are relevant, and establish a framework within which business units can work independently. Based on our practical experience, three key tasks can be identified:
Three Key Tasks for Companies:
-
Know what’s being created.
Not every application created with AI is automatically a security risk. But companies should know where such applications are being developed, what data they process, and what role they play within the company and in the respective business unit. Only then can they assess what needs to be reviewed and where risks are actually relevant. -
Review before an idea becomes a business application.
A small automation tool for personal daily work is different from an application through which customers access company data. The closer an AI-powered application comes to customers, business processes, or sensitive data, the more important defined checks and clear responsibilities become. This isn’t just about obvious vulnerabilities. A lack of separation between customer data, overly broad permissions, access credentials embedded in the code, or unverified inputs are typical issues that must also be addressed in AI-powered applications. It is crucial that such questions are not raised only after the system goes live. -
Create a path that’s faster than working around the problem.
When approvals take months, employees often continue developing anyway. A secure process must therefore not only be secure but also practical: with clear responsibilities, understandable requirements, and a pace that fits the new way of working. Fast approval processes are not a convenience feature but a prerequisite for ensuring that security requirements actually work in day-to-day operations.
“A security process is only good if people actually use it. Security that is circumvented is not a secure solution.”
Conclusion: Know what’s being created. Assess what’s relevant. Enable what makes sense.
From our perspective, this is the crucial shift in perspective: AI governance does not mean controlling innovation until it no longer happens. It means creating a framework in which innovation can take place without security and accountability falling by the wayside.
And that is precisely what changes the role of the new employee. Claude remains quick, eager to experiment, and remarkably productive. His onboarding isn’t just a welcome meeting and an access badge. It consists of rules, guidelines, responsibilities, and processes that ensure a good idea is turned into a good and secure application.
Perhaps that’s the most exciting aspect of this development: We’re not just witnessing AI making its way into companies. We’re seeing how this is changing who in the company can develop and implement what.
The organization’s role is not to hold back this development, but to ensure that it can succeed safely.
If you’re wondering how to safely enable new business applications, what has already been developed within your organization, and how to handle it securely, we’d be happy to assist you with assessing your current situation, conducting security reviews, and establishing appropriate processes. Feel free to contact us at any time!
Caption: AI-generated image
