AI turned every employee into a builder. It opened a security gap nobody's watching

AI turned every employee into a builder. It opened a security gap nobody's watching

If you work in sales, marketing, or legal, there's a decent chance someone on your team built an AI-powered tool in the last few months. It could be a workflow, a custom chatbot, or an automation that pulls data from multiple systems. Building it didn’t require IT and it likely works just fine. But it also isn’t on anyone’s security radar.

That's the pattern behind a new analysis from Vanta, an agentic trust management platform. Vanta tracked how job titles and security alerts shifted across its customer base over the past year. The analysis found a wave of employees outside traditional engineering roles now building and shipping their own tools, faster than the systems meant to catch security risk were built to handle.

Job titles are changing faster than security policy

Not long ago, "builder" meant something specific: an engineer, the kind of person who spent the day in a code editor. That's not true anymore. Vanta's data shows builder-type roles grew 311% year over year across its customer base. The "GTM engineer" title grew 1,329% and "Legal engineer" grew 850%.

The pattern reflects an expectation that's crept into jobs that used to have nothing to do with building: Ship it yourself. And when more people are building, more people are also choosing their own tools. Vanta found that organizations with builder roles use 42% more software vendors than organizations without them.

AI adoption and the rise of AI security alerts

The clearest gap between builder-heavy companies and everyone else shows up in AI adoption. Builder organizations adopt AI vendors at a 73% higher rate. They most often reach for the premier LLMs like OpenAI (used by 32% of builder organizations) and Anthropic (used by 26%).

These LLMs now show up more often than established software like HubSpot (25%) or Salesforce (22%). Core systems like CRMs aren't disappearing, but with AI, builders are likely stitching together custom workflows on top of those systems to suit their needs.

The rise in AI usage is also creating a security issue. Vanta’s data uncovered a new category of alerts tied to AI security. A year ago, it produced zero alerts across Vanta's entire customer base. Now it generates hundreds per month.

The vendor math gets worse from here

More from this section

+4

United States shows off ‘kamikaze drone boats’ in war games

Sargassum, the smelly nemesis of beach vacations, has become a self-sustaining disaster that will keep coming back

+4

Sweat-powered patch tracks Parkinson’s patient medication levels

When more vendors are adopted faster, it creates additional risk. Of all the vendors builder organizations use, more than one in three are flagged as high or critical risk, according to Vanta's data.

Some of that risk comes in through the back door. A separate Vanta analysis found 70% of organizations have "shadow AI," tools employees use without formal approval. The vast majority of shadow vendors never go through a security review, because no one in procurement knew they existed to begin with.

Builder culture adds another layer on top of that: workflow automations built in no-code platforms, open-weight AI models pulled from repositories like Hugging Face, AI agents wired directly into company systems. None of it looks like a traditional software purchase, so none of it trips the usual review process.

What companies can do about it now

Trying to slow builders down isn't realistic, and it's not really the point. A few adjustments actually address the gap:

• Stop routing every new tool through a slow intake form. Trigger review automatically based on what data or systems a tool touches, not on whether someone remembered to fill out a form.
• Find out what AI tools are actually in use, then build an approved list and clear rules for what's off-limits.
• Check open authorization (OAuth) grants and app access logs on a regular schedule, instead of waiting for employees to self-report.
• Extend code-review-style security gates to things built outside engineering: no-code apps, workflow automations, AI agents. "Built securely" should mean the same thing regardless of who built it.
• Catch configuration mistakes before they reach production by building security checks into the deployment pipeline itself.

Tools that automate parts of this, like continuously scanning for new vendors and scoring their risk, can keep pace with builders in a way manual review can't. But automation only closes the gap if it's paired with a policy that treats an AI agent wired into company systems with the same scrutiny as software bought through a normal purchase order.

The number of people at a company who can ship something new isn't shrinking. Somewhere right now, someone in sales or legal could be opening a tutorial and starting to build the next tool nobody in security will hear about until it shows up in an audit. Security teams need to redesign processes to work with this trend, not against it.

Methodology

The anonymized data used in this analysis comes from Vanta’s platform, spanning vulnerability management, vendor risk management, security alerts, and compliance workflows across thousands of businesses from February 2024 through April 2026. By integrating customer account data with platform activity, Vanta analyzed trends in remediation behavior, risk levels, alert engagement, and overall security posture across different segments and company sizes. Vendor risk levels and alert categories are based on Vanta’s internal scoring and detection frameworks, with a particular focus on emerging patterns such as AI tool usage.

This story was produced by Vanta and reviewed and distributed by Stacker.