Michael Burch - AI-Enabled Citizen Developers

When every employee can generate working software, who owns the risk? Michael Burch, VP of AI Enablement and Acceleration at Security Journey, explains how AI is turning nondevelopers into citizen developers faster than enterprises can build guardrails around them. He and the hosts examine rollouts that hand GitHub and Claude Code to hundreds of employees, the danger of measuring adoption instead of business value, and why prompt libraries alone do not meet people where they work. Michael argues for sandboxed workflows, automated security controls, clear limits, and AI champion programs that quietly carry security practices into every team. The discussion closes on evaluating generated code, token-cost incentives, and the need to define a measurable outcome before buying licenses or opening production access.Connect with Michael Burch:→ Michael Burch on LinkedIn→ Security JourneyMentioned in this episode:→ SecureMyVibe→ Manicode Security→ The Security Champions Podcast→ OWASP Low-Code/No-Code Top 10→ Claude CodeFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Meet Michael Burch02:12 From Army Ranger to AppSec education05:40 What is an AI-era citizen developer?06:52 When low-code guardrails disappear08:49 Giving GitHub to 200 nondevelopers12:16 The rollout is already underway13:23 What happens outside the pipeline17:20 Training gaps and adoption without outcomes20:03 Measuring ROI instead of usage22:28 Why prompt libraries are not enough25:28 Sandboxing citizen developers28:36 Are organizations waiting for a breach?29:56 Turn security champions into AI champions32:00 How AppSec teams need to change34:58 Guardrails, expectations, and saying no38:41 Can developers evaluate generated code?42:40 Token pricing and platform lock-in44:36 When token usage becomes the wrong incentive46:17 A practical plan for citizen development48:28 Closing thoughts