Your business people are building apps with AI right now.. whether IT has signed off or not.
I recently spent some time going through what CIOs and CISOs are saying publicly about vibe-coded apps (the ones business folk build themselves with Claude, ChatGPT, Lovable and the like), and the most common answer was no. Not “not yet”, not “let’s work out how”.. just no.
And honestly, I get it. If I were sitting in the CISO chair, looking at an app someone in finance built over a weekend, connected to the ERP and running on a vendor’s cloud, I would be saying no too (loudly!!).
The problem is, blocking something never works.. it never has, and it never will. When you say no, the business builder doesn’t stop building, they just stop telling you. The app moves to a personal account, on someone else’s cloud, and out of sight of every control you have spent years putting in place.. which is the exact opposite of what the no was meant to achieve.
So I pulled together the ten objections that came up most often:
Apps with sensitive data get published to the open internet, often with no authentication.
Hardcoded secrets end up in code and in public GitHub repos.
IT can’t see these apps, and they aren’t in any inventory.
They skip governance, architecture review, security review and change management.
Business builders don’t understand application-level authentication, access control or data classification.
AI-generated code is insecure by default.
Nobody supports or maintains them, and the builder may have left.
They create sprawl and a new wave of technical debt.
They can’t meet SOX, SOC 2 or regulatory audit obligations.
The vibe-coding platforms themselves are a third-party risk.
Every one of these is a real concern.. none of them are unreasonable. But read the list again and you’ll notice that almost all of them are about where these apps run, and who controls that, rather than about business people building things in the first place.
I’ve written up an answer to each one over on the Portainer blog: Ten reasons CIOs and CISOs block vibe-coded apps, answered