Not long ago, writing code was reserved for engineers. Today, anyone with access to AI can build apps, automate workflows, and ship to production\u2014no CS degree required. Sales reps, marketers, HR teams, and finance leads are all becoming creators. And that, Shahar Bahat argues, is the beginning of a new security crisis.<\/p>\n\n\n\n
\u201cBusiness users are now builders,\u201d she told me. \u201cBut they don\u2019t understand security\u2014and they\u2019re not supposed to.\u201d Shahar, a former Unit 8200 operator and product leader at both startups and Microsoft, co-founded Pluto Security to address what might be the fastest-growing attack surface in the enterprise: software built by non-developers.<\/p>\n\n\n\n
The shift is already here. At Microsoft, she saw it firsthand\u2014teams reduced in size, told to \u201cmove faster\u201d by embracing generative AI. \u201cIt wasn\u2019t a suggestion. It was an expectation,\u201d she said. Tools like Replit, Lavable, Base44, and internal copilots are being used to generate apps, integrations, and customer-facing tools\u2014often without security oversight, review, or even awareness.<\/p>\n\n\n\n
And these aren\u2019t harmless prototypes. \u201cWe\u2019re seeing AI-generated apps accessing production systems, integrating with sensitive data, and exposed to customers,\u201d Shahar explained. \u201cSecrets management, access control, logging\u2014it\u2019s all being skipped.\u201d<\/p>\n\n\n\n
Traditional security tools weren\u2019t designed for this world. They assume code flows through CICD pipelines. They assume trained developers. But this new category of creators\u2014what Pluto calls \u201cbusiness users\u201d\u2014operate outside those lanes. They\u2019re using no-code tools, AI agents, and browser-based IDEs to build software that matters, fast.<\/p>\n\n\n\n