Citizen development - Handling a world of limitless code

The game changed the moment large language models made writing functional software as easy as writing an email. At Sophos, we watched something remarkable happen, highly technical people across the business, sales engineers, analysts, product managers, began shipping internal tools at a pace nobody had planned for. Automations, dashboards, web apps, and integrations all useful, and almost entirely invisible to architecture and security teams.

This is not a Sophos problem. It is an industry problem. And the organisations pretending it is not happening are accumulating risk they cannot see.

This talk is a real-world account of how Sophos recognised citizen development not as a threat to be stopped, but as an engineering capability to be shaped. We will walk through how we moved from a world of ungoverned internal tooling to a lightweight, scalable framework that gives builders the autonomy they need while giving security and architecture the visibility they require.