Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Yair Finzi, CEO of Nokod Security
As assets created by no-coders, non-technical developers and citizen-developers become mainstream, 2026 will mark a pivotal year for security professionals. While the promise of rapid application delivery and democratized development is real, so too are the underestimated risks. Below are six predictions on what to expect in no-code/citizen-developer security next year.
No-Coders Developers Take Over Software Creation
By 2026, business-user “developers” will outnumber professional developers 4:1, forcing organizations to extend their governance programs to citizen developer platforms.
Explosion in Shadow Development
The typical enterprises will run an average of 4,500-6,000 AI-generated apps, workflows, and automations in 2026, with 66% remaining undiscovered by security and IT teams.
Data Exposure Accelerates as Integrations Grow
The percentage of citizen developer apps interacting with external APIs, LLMs, and SaaS data will jump from 15% to 30%, expanding this undefended attack surface.
No-Code Powers a New Class of Breaches
60% of enterprise data exfiltration incidents will be linked to citizen-developer automations and low-code extensions, not traditional malware.
Attacker Innovation Outpaces Defender Awareness
Adversaries will increasingly target no-code connectors, embedding malicious payloads into supply-chain-style dependencies that security tools don’t inspect today.
The First “Agent-Driven Ransomware” Campaign Surfaces
Attackers will exploit over-privileged AI agents to encrypt workflows and data, demanding ransom for recovery, without touching endpoints.
##
ABOUT THE AUTHOR
Yair Finzi, CEO and Co-Founder of Nokod Security, is a technology entrepreneur with more than 15 years of experience in cyber security. Prior to Nokod Security, he co-founded SecuredTouch and served as its CEO until the company’s acquisition by Ping Identity. Later, Yair served as a product leader at Meta, focusing on its global app for crowdsourcing. He started his career in the Israel Defense Force’s (IDF) elite cyber security unit and eventually became a Head of Department at the Intelligence Corps.
