Vibe Coding Forem: Swatantra Kumar

Low-Code, high impact: the new frontier of AI accessibility

Swatantra Kumar — Sat, 27 Dec 2025 18:08:27 +0000

How Low-Code is breaking barriers and democratizing AI

AI is no longer confined to research labs or elite developer teams – it’s now a strategic imperative across industries. Yet for many organizations, AI adoption stalls after pilot phases. The reason? Technical complexity, high costs, and a reliance on scarce technical talent.
Low-Code platforms are shifting this paradigm. By enabling business users to design, deploy, and manage AI-driven solutions – with minimal code – these tools are breaking down traditional barriers to innovation. This article explores why democratizing AI through Low-Code is no longer a trend, but a critical strategy for scaling transformation, empowering workforce, and unlocking enterprise-wide value.

Why AI fails to scale – and the urgency to solve it

Artificial Intelligence (AI) has rapidly risen from a niche innovation to a top-tier strategic priority for the enterprise. According to recent research, 89% of the global CEOs rank AI as the most critical technology for ensuring future profitability and competitiveness. Yet, despite the growing investment and enthusiasm, most organizations are struggling to operationalize AI at scale.

The current state of enterprise AI adoption is marked by a curious paradox. On one hand, the proliferation of AI experimentation is undeniable – McKinsey reported that 78% of businesses report using AI in at least one business function, a significant leap from just a year ago. On the other hand, only a few of these initiatives transition beyond limited pilots. This gap suggests that while organizations are eager to explore AI, they struggle to scale it. In fact, the same report notes that only 4% of companies feel fully equipped to realize AI’s full potential across their enterprise.

This disconnect reflects more than just a maturity curve; it signals a deeper structural challenge. Traditional AI development is resource-intensive, in terms of skill, effort and investment. As a result, many promising AI projects become trapped in what’s often referred to as the “pilot purgatory”, successful proofs-of-concept that never scales into production.

Moreover, the pace of AI innovation is accelerating faster than organizational capabilities can keep up. Generative AI models like GPT-4 and Claude 3 have introduced unprecedented capabilities, but harnessing these tools effectively requires not just access. It demands the ability to integrate, customize, and deploy them within real business contexts. And herein lies the gap: most enterprises are not lacking in AI ambition, but in the operational agility to deploy AI across business units at scale.

The consequences of inaction are mounting. Competitors who move faster on AI are seeing significant gains – in productivity, cost efficiency, customer satisfaction, and innovation velocity. For IT leaders, the question is no longer whether to invest in AI, but how to accelerate and scale that investment responsibly and effectively.

The imperative is clear: enterprises need a way to scale AI beyond the confines of technical teams. They need tools and platforms that reduce complexity, shorten time-to-value, and broaden participation in AI development. In short, they need to democratize AI.

Low-Code AI is not just a technological evolution – it is a leadership imperative. The CIO/CTO/CDO who champions it unlocks an exponential force multiplier across business agility, talent leverage, and innovation scalability.

Low-Code AI platforms represent a compelling answer to this challenge, and as we’ll explore in the following sections, they are already transforming how organizations turn AI aspirations into operational realities.

Breaking the technical barrier

Despite the growing urgency to adopt AI, one of the most persistent roadblocks organizations are facing today is the steep technical barrier to entry. Developing AI solutions, the traditional way demands a rare blend of expertise – data science, advanced mathematics, machine learning, software engineering, and enterprise architecture. These capabilities reside in highly specialized teams that are not only costly to build but increasingly difficult to scale.

The result is a growing bottleneck. Even in enterprises with dedicated AI teams, bandwidth limitations often mean that only the highest-priority initiatives receive attention. Meanwhile, countless promising use cases across various functions, operations, marketing, HR, finance, IT, risk, and customer service go unaddressed – not for lack of value, but due to limited resources and technical complexity.

This gap is further widened by the ongoing talent shortage. According to industry data, 46% of technology leaders cite the lack of AI skills as a top challenge, while 41% specifically highlight the shortage of professionals with relevant AI experience. Hiring and retaining top AI talent has become not just competitive, but prohibitively expensive for many organizations.

Beyond talent, the development lifecycle for AI projects is inherently complex and slow. From data wrangling and model training to integration and testing, it can take months to bring a single AI solution from concept to production. For instance, a customer support chatbot built with conventional methods often begins with weeks of data wrangling to consolidate customer queries from CRM, email, and call logs. From there, data scientists must clean and label the data, developers build and train models, and engineers integrate the solution into existing systems – only to spend additional weeks testing for edge cases and security compliance. Altogether, it can take 3 to 6 months or more just to move from concept to a functioning prototype. This protracted timeline is increasingly at odds with business expectations for agility, especially in today’s era of real-time decision-making and continuous digital transformation.

These challenges often culminate in what experts describe as the “AI execution gap”. Organizations know what they want to do with AI. They may even have proof-of-concepts that show potential. But they can’t move fast enough, or, at scale – because the development-to-deployment model itself is too constrained, overly centralized, and reliant on the pragmatism, capacity and appetite of enterprise architecture, security and risk.

This is where IT leaders must begin to rethink how AI is built and who gets to build it.

Rather than relying solely on small, overburdened technical teams, the future of scalable AI requires expanding access. It demands tools that lower the barrier to entry, shorten the development lifecycle, and allow business units to actively participate in AI solutioning – without compromising security, governance, or enterprise architecture.

Low-Code and No-Code platforms have proven to the solution purpose-built for this challenge. Low-Code is a team sport. They don’t just supplement traditional AI development; they reimagine it. With visual interfaces, reusable components, and built-in integrations, these platforms eliminate the need for deep coding skills and allow a broader set of users to contribute to AI innovation – while remaining within a controlled safety net defined and governed by IT.

The rise of Low-Code AI is not just about acceleration – it’s about inclusion, it’s about broadening participation. And that inclusion may be the key to finally closing the gap between AI ambition and AI achievement, allowing those closest to business challenges to become active problem solvers and innovators.

The rise of Low-Code AI

As organizations seek to overcome the traditional barriers to AI adoption, a new development paradigm is emerging – Low-Code AI. Low-Code AI combines the power of artificial intelligence with the simplicity of Low-Code development. This combination allows businesses to build intelligent applications faster and more efficiently when compared to traditional development. By integrating AI capabilities into a Low-Code platform, organizations can take advantage of automation, machine learning, as well as data-driven insights without extensive coding knowledge.

These platforms are fundamentally reshaping how intelligent solutions are conceived, created, and deployed by extending development capabilities beyond the traditional confines of IT and into the hands of domain experts, analysts, and business users.

At its core, Low-Code AI is about radical simplification. By offering drag-and-drop functionality, pre-configured AI models, visual workflows, and seamless integration with enterprise data systems, Low-Code platforms reduce the complexity of building AI applications by as much as 90%. The result is a dramatic acceleration in solution development and a significant reduction in time-to-value.

More importantly, these platforms expand who can build. No longer is AI creation the exclusive domain of data scientists and professional developers. With intuitive interfaces and natural language-based interactions, Low-Code tools enable citizen developers – employees with deep process knowledge but little to no coding background – to create sophisticated AI agents, chatbots, automation tools, and analytics workflows.

AI agents are software systems that use AI to pursue goals and complete tasks on behalf of users. They can remember across tasks and changing states; they can use one or more AI models to complete tasks; and they can decide when to access internal or external systems on a user’s behalf. They show reasoning, planning, and memory and have a level of autonomy to make decisions, learn, and adapt.

This shift is more than technological – it’s cultural. It represents a democratization of innovation, where those closest to the business problem are empowered to solve it. This approach not only improves speed and relevance but also significantly relieves pressure on IT teams, enabling them to focus on more strategic architecture and governance concerns.

The business case for Low-Code AI is becoming impossible to ignore. A recent survey by Gartner projects that by 2026, 80% of application development will be driven by non-IT users. This is not merely a forecast; it’s a reflection of a fundamental shift in how enterprises will deliver value through technology.

Platforms such as Microsoft Power Platform, OutSystems, and Mendix are leading this charge. They come with embedded AI services, secure data connectors, and enterprise-grade governance features. Microsoft’s Copilot Studio, in particular, stands out for its tight integration with familiar tools like Microsoft Teams, Dynamics, and Azure, making it uniquely accessible and scalable for enterprise environments.

With Low-Code AI, organizations can:

Accelerate innovation by collapsing development cycles
Empower business users to solve their own challenges
Reduce costs by minimizing reliance on scarce technical resources
Drive agility by quickly iterating and deploying solutions in production

This isn’t just a productivity boost; it’s a fundamental rethinking of how enterprises innovate at scale. As we’ll explore in the next section, tools like Copilot Studio are not just making this possible; they are making it easy, secure, and enterprise-ready.

Inside Copilot Studio: AI in everyone’s hands

As organizations seek to enhance their enterprise AI capabilities and develop AI agents, Microsoft provides a comprehensive suite of tools that enable customization and extension of existing functionalities. By integrating external data sources, creating plugins, and developing tailored AI agents, organizations can deliver more personalized, efficient, and intelligent user experiences across various business scenarios.

Microsoft categorizes Copilot agents into three main types:

Retrieval agents. These agents excel at efficiently locating and summarizing information. Typically, straightforward and easy to implement, they can be developed by citizen creators utilizing M365 Copilot. Additionally, they facilitate integration with users’ Microsoft Graph data.
Task agents. These agents automate repetitive or multi-step tasks, enhancing efficiency and minimizing errors. Typically, they are developed by business users who possess considerable digital skills. With the help of Low-Code AI tool Copilot Studio, creators can utilize organizational data beyond personal graph data.
Autonomous agents. These agents can plan, adapt, and act independently, even coordinating with other agents or humans. Their development involves sophisticated technical complexity and advanced functionality. Creating autonomous AI agents requires highly skilled IT professionals with expertise in programming and systems architecture. The art of the possible is attained using tools like Azure AI Foundry and Copilot Studio.

These agents differ in their complexity, length, and capabilities according to the specific requirements of the business. Their functions range from providing support and facilitating actions to independently orchestrating and executing processes. With advancement in the space of AI agents, humans will gradually move away from “in” the loop towards “on” the loop.

The “human in the loop” approach ensures that a human retains full authority to initiate or stop any action executed by an intelligent system upon reviewing its insights. In contrast, the “human on the loop” model shifts human oversight to a more supervisory role, distancing direct control from the center of automated decision-making. While humans maintain the ability to monitor and intervene in the system’s operation, the AI proceeds autonomously without requiring prior human approval, unlike systems designed with a “human in the loop” framework.

As observed organizations embrace Low-Code AI to accelerate AI development, Copilot Studio has emerged as a transformative enabler of this movement. Built within Microsoft’s Power Platform ecosystem, Copilot Studio is a fully integrated environment designed to bring AI creation within reach of every business function, regardless of technical background.

What sets Copilot Studio apart is its natural language interface. Users don’t need to write code or understand complex algorithms. Instead, they can describe workflows, ask questions, or define outcomes in plain English. The system then interprets these inputs to configure and deploy AI agents – virtual assistants that can answer questions, automate tasks, extract insights, and interact with other systems.

This simplicity is underpinned by serious enterprise-grade capabilities. Copilot Studio leverages Microsoft’s trusted stack: Power Virtual Agents, Azure OpenAI, Dataverse, and Power Automate, to offer robust backend integration, data management, and automation across business systems. Whether embedded in Microsoft Teams, published on a website, or used within mobile apps, these agents are designed to function seamlessly in real-world enterprise contexts.

Consider a few typical use cases:

HR teams building employee self-service bots for queries on policies and benefits
IT departments deploying agents that triage service tickets and reset passwords
Finance teams automating responses to invoice and budget inquiries
Operations leaders configuring agents to track shipments, inventory, or vendor performance

These aren’t theoretical examples. Organizations across industries are already achieving measurable gains with Copilot Studio. A global retailer reported a 70% reduction in time to deploy AI solutions and over 80% of IT support queries resolved autonomously. In healthcare, AI agents guide patient triage and scheduling, freeing clinicians to focus on critical care. Legal firms are saving thousands of hours annually on document summarization and case prep through automated assistants.

What’s equally important is how Copilot Studio supports scalability with governance. It includes role-based access controls, data-loss prevention (DLP) policies, and audit logging by default – giving IT leaders confidence that innovation by business users does not compromise security or compliance. Agents can be developed in isolated environments (dev/test/prod) with clear oversight, making the platform enterprise-ready from day one.

In this way, Copilot Studio redefines AI adoption from a centralized, developer-led function to a distributed innovation model. It creates a future where employees are no longer just users of AI – they are active co-creators, building solutions that directly address their everyday challenges.

This is not about replacing technical teams; it’s about augmenting them. It’s about enabling IT to lead by empowering the business – not bottlenecking it. And it’s a powerful response to the enterprise AI challenge: making smart, scalable, secure AI available to everyone.

Real-world impact: industry use cases that prove the model

While the promise of AI is compelling, what ultimately convinces IT leaders and executives to act are tangible outcomes. Copilot Studio has already begun delivering real-world value across industries, showcasing Low-Code AI is a competitive advantage being realized today.

Banking: reinventing engagements using AI agents for customers and employees A major Dutch bank used Microsoft Copilot Studio to create AI assistants for customers and employees. These agents manage over 3.5 million conversations per year, automating more than 50% of interactions and streamlining internal support. This improves both customer experience and operational efficiency.
Energy: multilingual customer support at scale A leading sustainable energy provider developed a multilingual AI agent using Copilot Studio, integrated into its live chat in just three months. The agent now handles 24,000 chats per month serving 1.5 million customers, increasing capacity by 70% without escalating to human agents—demonstrating rapid deployment and significant customer service gains.
Telecom: streamlining retail operations with AI A large telecom service provider utilized Copilot Studio and Power Platform to develop an AI agent that collects product data from over 20 different device manufacturers. This provides retail staff and call centers with real-time product information, improving customer service and operational efficiency across retail outlets.
Manufacturing: enhancing accuracy and driving savings with AI A multinational materials science and chemical company developed AI agents with Microsoft Copilot Studio to streamline invoice processing and detect billing anomalies. One agent extracts data from invoices, while another enables employees to flag discrepancies using natural language. The company expects this to enhance accuracy in logistic rates and billing, potentially saving millions of dollars.

These use cases tell a consistent story: AI doesn’t need to be locked in the hands of specialists to create value. With the right platform, everyday business users – those closest to the problem, can drive innovation. The impact is seen not just in efficiency, but in agility, empowerment, and engagement.

It becomes clear that with great accessibility must come great responsibility. To ensure long-term success, AI democratization must be guided by governance, transparency, and ethical safeguards.

AI Governance: innovation with accountability

As organizations unlock the power of Low-Code AI platforms, one critical question consistently surfaces among IT and business leaders: How to scale AI safely and responsibly? While democratization is a catalyst for innovation, it also introduces new challenges around governance, compliance, and ethical AI use.

Copilot Studio was designed with these concerns in mind. It incorporates enterprise-grade governance capabilities from the ground up, enabling organizations to encourage innovation without compromising control.

Built-in governance frameworks

Copilot Studio offers robust administrative tools that empower IT to enforce governance policies across all environments. These include:

Data Loss Prevention (DLP) Policies: control which data can be used by AI agents, ensuring sensitive information is protected.
Role-Based Access Controls: define who can create, deploy, or manage agents – down to individual user roles or business units.
Environment Segmentation: separate development, testing, and production environments to reduce risk and ensure stability.
Audit Logs and Monitoring: track all interactions, changes, and deployments for full traceability and compliance audits.

This makes it possible for IT teams to maintain visibility and oversight, even as business users independently build and deploy AI solutions.

Responsible AI by design

While built-in governance provides confidence, organizations must also address ethical, regulatory, and operational risks. Responsible usage of AI is essential. Embedding ethics, transparency, and governance at every stage of the AI journey is crucial to earn and maintain trust.

At KPMG, we recognize that accelerating the adoption of AI must go hand-in-hand with mitigating its risks. That’s why we’ve embedded responsibility at the heart of our AI strategy through our KPMG Trusted AI framework. This framework ensures that AI solutions are designed, built, deployed, and used in a manner that is ethical, transparent, and aligned with our professional standards and values.

It is crucial that trust should be embedded by design. Microsoft has embedded ethical AI guidelines into the DNA of Copilot Studio. This includes transparent decision-making, adherence to privacy laws, and built-in risk mitigation tools. Features like AI explanations, user feedback prompts, and model confidence scoring help ensure that the AI operates in a trustworthy and explainable way.

In addition, organizations can deploy pre-built templates and learning modules that guide users through responsible design practices, educating employees not just how to use AI, but how to use it thoughtfully, ethically, and responsibly.

Key challenges still remain

While Copilot Studio addresses many foundational governance needs, several challenges persist:

Integration with legacy or non-API systems: these systems often require UI-based automation that can break with interface changes, posing reliability and maintenance risks.
Bias and model drift: ensuring that AI outputs remain fair and accurate over time requires ongoing monitoring and refinement – something many organizations are still maturing.
Governance at scale: as the number of citizen developers grows, maintaining consistent policies and standards across functions become more complex.

To address these, organizations must treat AI governance not as a one-time configuration, but as an ongoing discipline. This includes establishing cross-functional governance councils, updating DLP policies regularly, and investing in AI model monitoring capabilities. This ensures that business-led innovation can proceed confidently under the stewardship of IT and risk leaders.

A roadmap to adoption: operationalizing Low-Code AI at scale

Successfully deploying Copilot Studio isn’t just about turning on a tool – it’s about building an ecosystem that supports sustained innovation, responsible use, and business alignment. For IT leaders, this means creating a structured, repeatable adoption framework that balances empowerment with oversight.

Table 1 provides a 10-step roadmap that helps organizations transition from experimentation to enterprise-wide impact with Copilot Studio.

Step 1: Define vision and success metrics

Start with a clear articulation of strategic objectives. Whether the goal is to reduce operational overhead, enhance customer responsiveness, or expedite time-to-market, it is essential to establish measurable Key Performance Indicators (KPIs) – such as reduced ticket resolution time, increased self-service rates, or productivity gains – to guide and assess success.

Step 2: Assess readiness and foundation

Evaluate the current digital maturity, technical infrastructure, and AI literacy. Identify gaps in data availability and quality, user training, and security protocols. Ensure that necessary licenses, access to Copilot Studio environments, and alignment with the Power Platform foundation, such as the Center of Excellence (CoE), are in place.

Step 3: Establish governance and security frameworks

Create a governance structure that includes IT, business, legal, and compliance stakeholders. Define DLP policies, role-based access controls, environment segmentation, and audit processes. Use platform’s built-in features to enforce consistency without stifling innovation.

Step 4: Provision environments and infrastructure

Configure development, test, and production environments in the Power Platform Admin Center. Isolate business scenarios by department or function and manage access via security groups. This foundation will support safe experimentation and scalable deployment.

Step 5: Pilot a high-value use case

Start with a small but meaningful scenario. Choose a high-impact, low-risk use case, such as an HR FAQ bot or IT service triage assistant. Run a 6-week pilot to validate the business case, gather feedback, and identify gaps in user enablement or governance.

Step 6: Train and onboard across roles

Empower all stakeholders with tailored learning paths:

Executives: Strategic briefings and KPIs
Business users: Interactive workshops and in-app guidance
IT and developers: Hands-on labs and governance playbooks

Use Microsoft’s built-in tutorials and Copilot Studio documentation to accelerate onboarding.

Step 7: Scale deployment in phases

Expand adoption in logical waves—first within similar departments, then across the enterprise. Reuse successful agents and governance artifacts to avoid reinventing the wheel. Monitor adoption levels and resolve friction points proactively.

Step 8: Measure impact and optimize

Track agent performance through built-in analytics dashboards. Analyze usage trends, user satisfaction, and business outcomes. Use this data to continuously improve agents, refine training, and ensure ROI.

Step 9: Cultivate community and continuous learning

Foster a “Copilot Champion Network” of power users and internal advocates. Host office hours, share success stories, and create a feedback loop to support peer learning and innovation.

Step 10: Expand into advanced scenarios

Once foundational use cases are scaled, move into more complex territory:

Multimodal interactions (voice, images)
Autonomous workflows and decision-making
Deeper integration with external APIs and enterprise data lakes

This is the way to future-proof AI investment and extend impact.

Following these strategic guidelines ensures that Copilot Studio evolves to an integral strategic capability within the organization. Copilot Studio democratizes AI access by empowering the entire workforce, marking a shift from AI as a support function to AI as a business partner. This transformation leads to enhanced decision intelligence, elevated customer experiences, and built-in organizational agility. The roadmap facilitates a broader transformation, placing human-agent collaboration at the forefront of productivity.

Looking ahead: the future of work with AI

We are standing at a pivotal moment in the evolution of work. The rise of AI – not just as a tool, but as a collaborator – is fundamentally reshaping how people engage with technology, make decisions, and deliver value. Low-Code AI Platforms are at the forefront of this shift, enabling organizations to reimagine the workplace as a space of human-agent collaboration, not just automation.

For example, a multinational financial services company, Wells Fargo, developed an agent using Microsoft Copilot Studio and Teams, providing instant access to guidance on over thousand internal procedures to support 35,000 bankers. Now, 75% of searches happen through the agent, cutting response times from 10 minutes to just 30 seconds. The AI agent and human employees collaborate enhancing speed, accuracy, and focus on customer engagement.

From tools to teammates

Historically, technology has been used to assist workers in executing predefined tasks. But with the introduction of intelligent copilots, AI is evolving from a passive utility to an active partner. An adaptive agent capable of interpreting context, making decisions, and executing workflows independently or in tandem with humans.

This means employees will no longer work with tools – they’ll work alongside them. The AI agents can surface insights in real-time, respond to changing conditions, and personalize interactions based on role, location, or even sentiment. As they learn and adapt, they become integral members of the workforce – augmenting, not replacing, human capability.

Emerging trends shaping the tuture of work

Multimodal interaction
Like Google AI Studio, Copilot Studio is evolving to support input beyond text – enabling users to interact with AI through voice, images, documents, and even video. This unlocks new frontiers for user engagement and accessibility.
Autonomous workflows
AI agents will soon be capable of executing complex, end-to-end tasks with minimal oversight. From onboarding new employees to coordinating logistics across multiple vendors, these agents can drive continuity and precision at scale.
Contextual intelligence
Future AI systems will be deeply aware of organizational structure, individual roles, line of business KPIs, and business context. This allows AI to tailor responses and actions dynamically, aligning perfectly with each user’s needs and goals.

AI + human collaboration: competitive advantage redefined

According to Microsoft’s 2025 Work Trend Index, the organizations leading in AI adoption aren’t just using the technology – they’re restructuring their workflows around it. These “frontier firms” are:

Embedding AI into every function, not just IT or analytics
Reducing cognitive load by automating routine and redundant tasks
Elevating decision-making with real-time insights and recommendations
Creating a more agile, empowered, and engaged workforce
This evolution positions AI not as a cost-cutting tool, but as a growth multiplier – enhancing employee satisfaction, reducing burnout, and fueling continuous innovation.

Bottom line: from potential to performance

The journey toward enterprise AI has long been framed by potential – visionary projections of productivity, innovation, and transformation. But for many organizations, that potential has remained just out of reach, confined by complexity, cost, and limited access to technical expertise.

Low-Code AI platforms are changing this narrative. They offer a new path – one that doesn’t depend solely on scaling technical teams, but on empowering every part of the organization to participate in innovation. By lowering the barrier to entry, these platforms democratize AI development, solving meaningful business problems at scale.

With Copilot Studio, business users become creators. IT shifts from bottleneck to enabler. And AI becomes embedded in the fabric of everyday work – not as a siloed function, but as an organizational capability.

This isn’t just about doing more with less. It’s about doing more with what you already have – unlocking the expertise, insights, and initiative that already exist within your teams.

The future of enterprise success will be defined by accessibility, agility, and inclusivity. Organizations that embrace Low-Code AI will move faster, adapt better, and innovate more sustainably – because they are powered by everyone, not just a few.

For CIOs and IT leaders, the imperative is clear: lead the charge in building responsible, scalable, and participatory AI ecosystems. The future of work isn’t just about deploying AI, it’s about designing for AI-native workflows. This requires equipping your teams with the tools, training, and trust to innovate. Establish governance models, guardrails that enable freedom within a framework, and technology architecture to support seamless human-AI synergy. And most importantly, shift the mindset – from AI as a project to AI as a platform for empowerment.

Final thought: The democratization of AI is no longer a buzzword. It is the blueprint for digital transformation in the AI era. With Low-Code AI platforms, we’re not just talking about the future – we’re building it. One empowered employee at a time.

This article was written by Swatantra Kumar and originally published at https://www.compact.nl/articles/low-code-high-impact-the-new-frontier-of-ai-accessibility/

Trust by Design: rethinking technology risk

Swatantra Kumar — Sat, 27 Dec 2025 16:30:03 +0000

Enhancing technology risk management in agile environments to ensure auditable trust!

In society, there is a growing call for trust in technology. Just think about the data leaks and privacy issues that hit the news almost on a daily basis. Organizations tackle these issues through risk management practices and implementing controls and measures to ensure meeting the risk appetite of the organization. But the implications go further, last year the Dutch privacy watchdog stated that organizations should be very careful in using Google cloud services due to their poor privacy practices. This is not only challenging for the vendor but also for the clients using the services. Another example is Apple. They are doubling down on privacy in their iCloud and iOS offerings, so users trust them more as a brand, which increases their market share.
This raises several questions: What is trust? When do we decide to trust someone or something? And how can you become trusted? Do we overlook what trust really means, or do we have an innate sense for “trust”? But how does that work for organizations consisting of hundreds or thousands of people and complex business-to-business structures?

Introduction

The questions above seem to be easily overlooked when someone says, “trust me on this one”, or “have some trust in this”. For example, imagine you are buying a used car and the salesperson shows you a car and says “trust me, it is in perfect condition” we first want to look under the hood, open all doors, ask for a maintenance log, and of course do a test drive. Then imagine a colleague with whom you have been working for years tells you to trust them on some work-related topic, you tend to trust that person in an instance. That is looking at trust from a personal perspective. For business to business, the easiest direction to point at are contracts and formal agreements. But these only go so far and do not protect organizations or, maybe to a greater extent individuals against every risk. It’s important to not only look at whether a solution works well, but also if it meets your trustworthiness requirements across the wider value and supply chains. In our hyper-connected world, we rarely see stand-alone technology solutions anymore; we see systems of systems interacting in real-time. The ability to govern technology comprehensively can help you avoid potential ecosystem risks while fostering stronger alliances based on shared governance principles.

The concept of trust

In the audit, we use the saying “tell me, show me, prove it” (or something similar) where we list three ways to support a claim in order of lowest to the highest level of assurance. This implies that trust is the lowest level of assurance which is, strictly speaking, of course true. However, despite this, humanity has built many constructs of trust which we rely on, on a daily basis: money, legal structures, law, and governments, just to name a few. In the book Guns, Germs, and Steel: The Fates of Human Societies by Jared Diamond, the concept of creating these “fantasy” constructs in which we put a lot of trust, is posited as a cornerstone of human progress.

In the risk management world, an example of trust we often come across is assurance reports. Frameworks such as ISAE, SOC, and ISO are trusted to be relevant and properly applied. These are all tools or constructs that we trust to keep our data, investments, or processes safe. These constructs are used as ways of trusting each other in the B2B world. These types of trust concepts are, to an extent, widely accepted, and rightfully so. However, isn’t it strange that we put so much trust in the authors of the frameworks or the independent auditors that validate these frameworks? Is this a case of blind faith or is it the trust we have and put in these types of constructs based on something more that we might take for granted?

The concept of trust is hard to define. You can look it up in a dictionary and depending on the one you use, the definitions vary. However, you can leave it up to academia to relentlessly structure things. In a meta-analysis, a well-founded concept of trust has been derived. The act of trusting, or trusting behavior has 5 different precursors, where trusting intention (1) directly causes the trusting behavior. Trusting Intention is the extent to which one party is willing to depend on the other party even though negative consequences are possible. In general, people tend to form trusting intentions based on their beliefs, or trusting beliefs (2). These are formed from current, and prior experiences (dispositional trust (3)). In addition to that, there is a component that is caused by the system (4), and trust in that system (5). The system in this context can be a wide variety of systems given the situation, for example, an IT system or a management system.

Another concept of trust is that individuals want to have an amount of certainty that positive events unfold, and do not like risks that might reduce the certainty of said events. Trust could therefore also be considered as a feeling that there is low exposure to risks. This concept of risk exposure is also used in research to understand technology adoption, and trusting behavior. This research mentions predictability and reliability as two core features that can be used to evaluate trust in technology.

Most of these conceptions of trust are based on personal trust, or the trust behaviors of an individual. There is however a distinction between personal trust and organizational trust. The latter is considered to be a function of the combined personal trust of the employees of an organization. This seems to indicate that the predictability, reliability, and usability of technology can increase trust in a technology through the reduction of risks towards the potential benefits of using said technology. This, however, does not explain how organizations trust technology or other organizations. On the other hand, organizations consist of individuals that work together, so there is a clear connection between personal and organizational trust. There are different views on how this works, and the debate on how trust complements or replaces formal agreements and contracts seems to be ongoing. A lot of research was done into various facets of trust and how it works between two actors. What literature does agree on is that trust can work as a less formal agreement between organizations and allows for less complex and costly safeguards when compared for contracts or vertical integration.

Based on this, we broadly derive that trust will always play an important and above all positive role in organizational and interpersonal relationships (although the exact implications might be not completely understood at this point). It does however show us that trust can complement governance models and operationalizing this concept can be beneficial to organizations on various levels, bringing efficiency gains and maybe even competitive advantage. Trust in technology can be achieved by the demonstration of predictable and reliable positive outcomes, and a high degree of usability.

Achieving trust in practice

Now that the theoretical concept is uncovered to a degree, we can look at the practical aspect and a framework that is capable of governing how a trust should operate. First, we should probably set some conditions. As the concept of trust is very broad, we cannot cover the entire topic; we will therefore first look at the internal organization, the way organizations adopt technology and perform innovation and change projects.

Usually, these types of changes are governed by risk management processes that try to optimize the benefits while at the same time reducing the risks of non-compliance, security deficiencies, or reduced process effectiveness.

“Risk management” is the term used in most cases, but we also see that “risk management and a lot of other stuff” is sometimes more applicable to reality. With “other stuff” we mean a lot of discussions on risks and mitigation, creating a lot of controls for things that might not really need controls in the first place. Then we come to testing these, sometimes overcomplete, control frameworks, to a degree that some organizations are testing controls for the sake of testing them. Testing is followed by reporting and additional procedures to close gaps that are identified. Usually, this has to be done on top of regular work instead of having embedded or automated controls that just operate within the processes themselves. In various industries, regulators impose more and more expectations regarding the way that risks are managed. In addition, there are increasing expectations from society on how (personal) data is protected, and the way organizations deliver their services. This includes far-reaching digitization and data-driven processes, required to support customer requirements. These expectations, technological advancements, and the ever-increasing competitiveness in the market create a gap between often agile-driven product delivery and risk management. Unfortunately, we also see that, as a natural reflex, organizations tend to impose even more controls on processes which further inflates the “other stuff” of risk management.

From a classical risk management standpoint, risks are mostly managed through the execution of controls and periodic testing of said controls. These controls are usually following frameworks such as ITIL or COSO. In many organizations, this type of work is divided between the so-called first, second, and third lines of defense. Recently we have seen that especially the first and second lines of defense are positioned closer to each other. In practice, this results in more collaborative efforts between the first and second lines. Regardless of how exactly this structure should be implemented, the interaction between the first two lines of defense is increasingly important: organizations’ risk management practices often struggle to keep up with the momentum of the product teams that are releasing changes, sometimes multiple times a day. These releases can introduce risks such as privacy or contractual exposures that can be overlooked by a delivery-focused first line.

Innovations and technology adoptions are performed by the collective intelligence of teams that have a high-risk acceptance and focus on getting the highest benefit. Collective intelligence can be broadly defined as the enhanced capacity for thought and decision-making through the combination of people, data, and technology. This not only helps collective intelligence to understand problems and identify solutions – and therefore deciding on the action to take – it also implies constant improvement. The experiences of all involved in the collective are combined to make the next solution or decision better than the last. However, risk management practices are required to be embedded within the innovation process to ensure that the risk acceptance of the organization as a whole is not breached. Take for example the processing of personal data by a staffing organization. This can be extremely beneficial and lead to competitive advantages if done properly. However, this is not necessarily allowed in the context of European legislation. This is where risk management plays a significant role in, for example, limiting the usage of personal data. In innovative teams, this is however not always perceived as beneficial. Risk management can therefore be seen as a limiting factor that slows down the organization and makes processes murky and bureaucratic. Unfortunately, this compliance pressure is true and present in a lot of organizations, see Figure 1. There is, however, another perspective that we want to highlight.

A good analogy is a racing car, which purpose is to achieve the fastest track times. This is achieved by a lot of different parts all working together to reach the fastest time. As racing tracks usually consist of higher and lower speed corners; a strong engine and fast gearbox are not enough to go the fastest. Good control with suspension and brakes that can continue to operate under a lot of stress, is just as important as the engine. This is no different with business teams, they need a powerful engine and gearbox to go forward quickly, but the best cars in motorsports have the best brakes. These roles are performed by an organization’s risk management practice. Data leaks, hacks, and reputational damage can be even more costly than slow time to market. However, there is an undeniable yearn from business teams to become more risk-based as compared to compliance-based.

In an agile environment this is also, or maybe even more, true. To achieve risk management in an agile world, risk management itself needs to become agile. But with the ITIL or COSO focused periodic testing of controls, the outcomes will lag behind. Imagine that testing changes every quarter. Before this has been tested and reports are written, numerous new changes will have been triggered already. With a constantly changing IT landscape, the gap between the identified risks from these periodic controls will no longer be an accurate representation of the actual risk exposure. This is called the digital risk gap, which is growing in a lot of organizations.

To close, or at least decrease the gap, the focus should be on the first line process; the business teams that implement changes and carry forward the innovations. It is most efficient to inject risk management as early in the innovation process as possible. In every step of the ideation, refinement, and planning processes, risk management should at least be in the back of the minds of product owners and product teams.

To achieve this risk awareness and to close the digital risk gap a framework has been developed that incorporates concepts from agile, software development, and risk management to provide an end-to-end approach for creating trust by reducing risks in a proactive and business-focused approach. This is what we call Trust by Design, and takes the concepts from the integrated risk management lifecycle (see Figure 2) into practice.

The goal of Trust by Design is to achieve risk management practices in an agile world where trust is built by design into the applications and solutions by the people who are building and creating them. Due to the high iterative and fast-paced first-line teams that are almost coming up with new cool ideas on a weekly basis, the second line struggles to keep up. To change this, we should allow the first line teams to take control of their own risks, and build a system of trust. The second line can digitize the policies into guardrails and blueprints that the first line can use to take all the risk that is needed as long as the risk appetite of the organization is not breached.

Looking at how trust is achieved, there are three main principles we want to incorporate into the framework. The first is predictability. This can be achieved by standardizing the way that risks are managed because a highly standardized system functions in a highly predictable way. We strongly believe that 80% of the risk procedures that are taken within organizations, which seem to be one-of or custom procedures, can in fact be standardized. This is, however, not achieved overnight, and can be seen as an insurmountable task. The Trust by Design framework takes this transition into account by allowing processes to continue as they are at first but standardizing on the go. Slowly, standardization will be achieved, and trust will grow because the procedures are much more manageable and can be easily adapted to new legislation or technological advances.

Secondly, there is reliability. A standardized system allows for much better transparency across the board, both on an operational and a strategic level. But determining if processes are reliably functioning calls for transparency and well-articulated insights into the functioning of these processes. By using powerful dashboards and reporting tools pockets of high risk, developments can be made insightful, and even be used as steering information. Imagine if an organization is undertaking 100 projects of which 50 are processing highly sensitive personal data. Is that in line with the risk appetite, or should it be reconsidered? By adopting the Trust by Design framework these types of insights are available.

Lastly, there is a usability component. This is how the business teams perceive the guardrails and blueprints that are imposed. The Trust by Design approach is meant to take risks into account at the start of developing applications or undertaking changes. To achieve this, there are three basic building blocks that need to be defined. The first is the process itself, which also includes the governance, responsibilities between various functions, and the ownership of the building blocks themselves is defined. The second building block is the content, consisting of the risks, control objectives, and controls. And the third is where this content is kept, the technology to tap into the content and enable the process.

Following the three components of trust, the Trust by Design framework aims to reduce the complex compliance burden for business teams and increase the transparency for decision-makers and the risk management function within organizations. The Trust by Design framework aims to reduce the two most time-consuming phases in risk management for innovations and developments; determining the scope of the measures to be taken, and implementing said measures, while at the same time creating trust within the organization to leverage the benefits.

In practice, the framework is meant to be embedded within the development lifecycle of innovation, development, and changes. In Figure 3 the high-level framework overview is shown and consists of four major stages.

The first is the assessment stage, where through standardization business teams use business impact assessments and the following deeper level assessments to determine the risk profile of innovation or development. These are standardized questionnaires that can be applied to a technology, product, or asset throughout the development journey. The results of the questionnaires are used to funnel risk assessments and lead to a set of well-articulated risks, for which control objectives are defined. These control objectives can then be used to determine the risk appetite that the business is allowed, or willing to take, resulting in controls/measures. In the third stage, these can be implemented into the product at the right stages of the development cycle. These controls/measures can be seen as a set of functional/technical requirements that are added from a risk-based perspective. By applying this approach, by the time a development is completed or migrated into production the major risks are already mitigated in the development process itself. By design.

Lastly, there is the outcome where products are “certified” as the assessments, risks, the associated measures and the implementation can be transparently monitored.

These stages are constantly intertwined with the development processes. As circumstances change, so can the assessments or controls. Moreover, in environments where stringent controlling of certain risks is not necessary, guidance or blueprints can be part of the operation stage, helping innovation teams or developers with certain best practices based on the technology being applied, or the platform being used.

A case study

At a major insurance company, this approach has been adapted and implemented to enable the first line in taking control of the risks. The approach proposed at this organization is based on four steps:

a high-level scorecard for a light-touch initial impression of the risks at hand,
a deep dive into those topics that actually add risk,
transparently implementing the measures to mitigate risks, and
monitoring the process via dashboards and reports.

By using a refined scorecard on fifteen topics that cover the most important risk areas, product teams understand what risks they should take into account during the ideation and refinement processes. But also, which risks are not important to the feature being developed. This prevents teams from being surprised when promoting a feature to production, or worse once it is already out in the open. By applying risk-mitigating measures as close to the process step where the risk materializes, an acuminate risk response is possible, preventing over or under control. This requires specific control designs and blueprints that allow teams to implement measures that fit their efforts. The more precise these blueprints are the less over-controlled teams will be. It is important to note that for some subjects organizations might decide that over-controlling is preferred to the risk of under-controlling depending on the risk appetite.

Based on the initial impressions the scorecard is used to perform a more specific assessment of the risks and the required measures. This deep-level assessment sometimes requires input from experts on topics such as legal or security. In several organizations, a language gap exists between the first and second lines. One of the product owners we spoke to said, “I do not care about risk management, I just want to move forward as quickly as possible. For me this is only paperwork that does not help me accomplish my objectives“. Risk management consultants are also often guilty of speaking too much in a 2nd line vocabulary. It is important that we understand the 1st line and their objectives towards effectively designing a scorecard. In a way, this type of scorecard can be seen as the “Google Translate” between the 1st and 2nd lines. By asking the right questions in the right language the risks can become more explicit, and the required measures to mitigate the risk can be more specific. This reduces overcontrolling and leads to lowered costs and more acceptance from the product teams. The communication between the first and second lines is imperative to a successful implementation of a Trust by Design approach. This is also in line with the earlier mentioned IIA paper, in which the second line will become a partner that advises the first line, instead of an independent risk management department.

Since true agile is characterized by fast iterations and does not plan ahead too far, using a scorecard with an underlying deep level assessment helps product teams to quickly adapt to changes in the inherent risk of the change at hand. This “switchboard” approach allows much more agility, and still allows organizations to mitigate risks.

Developing this type of “switchboard” that leads users from high-level risks to more specific risks and the required standard measures, should be done iteratively. We also learned during our implementation that there is no way to make such a system exhaustive. At best we expect that 80% of the risks can be covered by these standard measures. The remainder will require custom risk mitigation and involvement of the 2nd line.

Implement measures, measure the implementation

Once the specific risks are identified, the agile or scrum process can be followed to take measures into account as if they are (non) functional requirements. This way, the regular development or change process can be followed, and the development teams can work on these in a way that is familiar to them.

The technology used by our insurance client to manage projects is Azure DevOps. It is used for both developments and more “classic” project management. This tooling allowed us to seamlessly integrate with the process used by teams in their daily routines. In addition, by structuring the data from the scorecard, risks were made transparent to all lines of defense. Through structured data, it is possible to create aggregations or to slice and dice data specifically for different levels of management and stakeholders. Using PowerBI or the standard Azure DevOps dashboarding decisions regarding risk mitigation and risk acceptation is open for all to see. In addition, the Power platform can be considered to further automate the processes and use powerful workflows to digitize the risk policies and inject these directly into the change machine of the 1st line.

How about the controls?

This leaves us with one more question, how do we connect these measures to the controls in the often exceptionally large and complex control frameworks? Especially since ITIL/COSO worlds are looking back, by periodically (weekly, monthly, etc.) testing controls using data and information from events that have passed. Based on this testing, the current, or even future situation is inferred. Agile is more responsive, in the moment and per occurrence. So, this inference can no longer be easily applied. Of course, large organizations cannot simply change their risk universes or control frameworks. So how do we connect these measures to controls?

This is a difficult question to answer, and counterintuitively, one to at first ignore. Once the first line starts to work with the standard measures, gaps between the operational risk management and the control testing world will become apparent. These can then be fixed relatively quickly by adapting the measures to better align with the controls. In other cases, we expect that controls also need to be reassessed. Especially given huge control frameworks of highly regulated organizations this will also be an opportunity to perform rationalization and cull the sometimes overcontrolled nature of organizations. In addition, it also presents the opportunity to further explore options of control automation that can lead to further savings and efficiency.

Measure or control?
We make the distinction between control and measure. In the first stages of implementing the approach, this will be apparent. Controls are periodically tested, whereas measures will be an explicit part of the development process, just like any (non)functional requirement. But we expect that this distinction will fade as the change process itself will eventually become the only control to mitigate risks in the future.

Conclusion

In our vision, a major part of risk procedures will migrate into the changing realm instead of control testing procedures that are static in nature (see Figure 4). As organizations become more software-development oriented (in some shape or form), it allows us to reconsider the approach to testing controls and mitigating risks. Imagine a bank changing the conditions on which someone can apply for a loan, nowadays this involves a lot of manual checks and balances and testing before all kinds of changes are applied and manual interventions are needed. Since the risks of these changes are not holistically considered during the development process, controls are needed in the production environment to ensure the proper functioning of the systems after the change. The digitized organizations of the future will converge their risk processes into the release cadence and will never worry about testing controls other than access controls and security. They know the as-is state, and they know the delta, that which is being added, changed, or removed is done according to the appropriate risk appetite by design. Finally, Trust by Design will also provide the foundation to develop digital trust metrics. Digital trust captures the confidence that citizens have in the ability of digital technology, service, or information providers to protect their interests. This allows internal organizations, their clients, and society to trust the processes and technology.

This article was originally published at https://www.compact.nl/articles/trust-by-design-rethinking-technology-risk/

Governance of Power Platform – as enabler, not as gatekeeper

Swatantra Kumar — Sat, 27 Dec 2025 14:01:14 +0000

Seven layers of governing Power Platform, not only at scale but also at speed

In today’s digital age, organizations are under immense pressure to define, ideate, build and deliver services at consistently shortening time to market. With a demanding market, an unpredictable and slowing economy, and a global shortage of skilled labor, low-code platforms are increasingly seen as a boon for enterprises aiming to fuel digital transformation by building new apps, modernizing application landscapes, or automating processes quicker and more efficiently. Low-code/no-code (LCNC) tools have seen steady growth due to their effectiveness in addressing some of the challenges in technology – primarily for digitizing workflows, enhancing user experiences, promoting internal efficiency, and their ability to quickly fill the workforce gap. Low-code application platforms are emerging as a key accelerator for app development and delivery. However, there are still challenges ahead due to a vacuum of battle-tested IT governance for low-code platforms. This article covers our view on the governance of one of the leading LCNC tools, Power Platform, and why it is important while planning, securing, deploying, and supporting applications built on the platform.

Low-code – introduction, demand and market

The pandemic has brought about years of change in the way organizations across sectors and regions do business. A study by McKinsey revealed that companies have accelerated digitization by three to four years ([LaBe20]) in just a few months’ time of the pandemic. It even found that the share of digital or digitally enabled products has accelerated even more. The study calls out that filling the gaps for technology talent is one of the major challenges companies are facing and will continue to face: “Respondents from the companies that have executed successful responses to the crisis report a range of technology capabilities that others don’t – most notably, filling gaps for technology talent during the crisis, the use of more advanced technologies, and speed in experimenting and innovating.”

This raises the immediate question of where you can find the technology talent needed to provide this increasing volume of applications in a world where talent shortage is already a problem.

Low-code/no-code platforms can help. One part of the answer is that everybody in an organization is empowered to build applications, using low-code/no-code, without the need for IT centralized delivery. For example, in a study conducted by Forrester (depicted in Figure 1) for Microsoft’s LCNC tool, Power Platform, app development costs were reduced by 74% and application management and maintenance costs by 38%. Gartner states that by 2025, 70% of new applications developed by enterprises will use low-code or no-code technologies, coming from less than 25% in 2020.

According to Gartner, low-code application platforms are defined as software that enables rapid development and deployment of custom applications by abstracting and minimizing traditional-coding, in order to develop a complete application consisting of user interfaces, business logic, workflow, and data services. It also provides reasonable tools to properly secure and govern these platforms.

Low-code platforms change the game for building solutions in an enterprise. The focus shifts from IT-owned projects, to democratized implementation of apps – driven by business, domain experts, and non-IT people. Traditionally, applications were left to the IT departments to be developed, maintained, and supported. As a result, a large backlog of IT projects exists, neglecting many smaller but still valuable business cases due to time, cost, and resource restrictions. This results in both frustration and un-leveraged business value.

With the low-code platforms, the IT department is no longer in a central position as an implementing and operating authority. It is, together with the whole organization, the enabler for the digital savvy business users, the Citizen Developers (CD).

Given the capabilities the low-code platforms are bringing to the ecosystem, it is becoming the solution of choice for Line of Business leaders including CIOs, and CTOs to fill immediate gaps in the workforce, development capacity and tackle IT challenges to ensure business continuity.

Take a look at the key industry trends, and indicators vis-à-vis low-code/no-code (LCNC):

Forrester research said that the total spending on the low-code market will reach $21.2 billion by 2022.
According to Business Wire, the future is low-code or no-code with an expected growth rate of 44.4% by 2022 to $27.23 billion (up from $4.32 billion in 2017).
The digital world expects over 500 million apps and digital services to be built and deployed by the end of 2023, according to IDC FutureScape. That is more than all of the software solutions created in the last four decades.
A report by Gartner forecasts that by 2024, low-code adoption will be so widespread that 75% of the software solutions built around the world will be made with the help of such tools.

The imposing numbers and claims in Figure 2 show the trends that the LCNC industry is expanding at a fast pace. Be it Digital Process Automation (DPA), Robotic Process Automation (RPA), Business Process Automation (BPA), Business Intelligence (BI), or, application development, the LCNC market and demand for the tools are growing in all these segments with very positive growth outlook. Rising low-code platforms are driving about 50% annual growth in a market populated by dozens of vendors.

The Microsoft Power Platform has some unique selling point(s) USPs that give them a favorable position over other leaders in the Gartner magic quadrant for low-code applications. Given the vital importance of maintaining a single source of truth in enterprises, Power Platform brings the business process on a single platform allowing the full cyclical approach to Analyze (Power BI), Automate (Power Automate), Act (Power BI), Assist (Power Virtual Agents) and Assemble (Power Apps) enabling end-to-end capabilities that work together and integrate seamlessly with the Microsoft ecosystem, eliminating the need and dependency on multiple separate software tools. The cherry on the cake is its seamless integration with Azure Active Directory for a comprehensive, integrated security and a single-sign-on approach throughout your systems.

Power Platform is designated for a wide range of users and use cases. It opens up the approach of building applications of varying complexity, ranging from simple personal productivity to more complex use cases by bringing together teams from different areas for the purpose of bringing apps to life faster, also known as the “Fusion Teams” (see Figure 3) approach. A fusion team comprises:

Code-first developers (also referred to as professional developers), who can extend or build upon the platform using traditional code first within IT departments.
Citizen Developers, who can build solutions without writing code and, most importantly, know their requirements. Operating within the business, they are experts in their domain and do not require a deep knowledge of IT.
And finally, IT professionals, who can operate as the administrator or in the governance team.

Governance of the Power Platform

The confluence of rising IT needs, coupled with the scarcity of developers and seamless integration with the Microsoft ecosystem of products has driven an increasing desire and need for Power Platform. However, there are some challenges that need to be addressed to establish solid confidence in adopting any low-code platform in the organization. The most common inhibitors to adoption that are observed are:

Security risks regarding Shadow IT
Business-managed IT (BMIT)
Data security concerning connectors,
App or flow ownership managed by the business
Maintaining environment health
Information security & risk management
Compliances issues
Monitoring and tracking of apps and flows, etc. To address these concerns and to leverage the full potential of the platform for the benefit of an organization, it is imperative to establish a successful governance framework.

Digital governance is the key mechanism organizations use to ensure that software development aligns with strategic objectives, business goals, commercials, data protection, maintaining compliance standards, and protecting the chain of value creation, value delivery, and value capture. It encompasses the norms and standards that shape the regulation regarding the development and use of technologies by offering a formal framework for achieving measurable progress while safeguarding the value flow.

While governance is important to ensure that problems are anticipated and solved early, to leverage the full potential of the Power Platform, it is important to strike a balance between the organization’s needs in terms of security, compliance, and regulations (such as GDPR, etc.), yet at the same time giving teams enough freedom to innovate and create value for themselves and the enterprise.

The Microsoft Power Platform provides the necessary means to strike that balance: “long-leashing” your organization, but still enabling central governance. The central effort of CIOs and Risk departments to mitigate risks is initially contrary to the idea of the autonomy that Microsoft Power Platform requires. Governance is distinguished into the following divisions:

Proactive governance
Reactive governance

Proactive governance deals with the central requirements that are defined within the platform (the so-called guardrails), ideally before it is rolled out. This includes security requirements, environment and licensing strategies, cost implications, roles, and responsibilities. Being proactive, can and should be done upfront to ensure the first level of governance and security.

Reactive governance describes continuous monitoring and alerting based on standardized yet specific indicators to enable a clearer view of the Power Platform. It is used to assess adoption KPIs, as well as to respond quickly where necessary.

A comprehensive governance concept is fundamental to every technology and software platform. This is especially true for low-code platforms due to their democratized nature. Figure 4 covers the seven layers or areas as advised by Microsoft to get started, while considering using, adopting, deploying, managing Power Platform and its governance. The beauty is that each of these layers is independently manageable and gives the flexibility to choose the layers in any order. Each of these layers concerns the proactive or reactive governance or both approaches. It’s important to mention that the governance is not a one-off exercise, it needs to be constantly reviewed and refined based on the evolving needs of the organization itself, but also given new functionality is provided by Microsoft regularly.

Platform Overview – environment, apps, platform

Power Platform provides an easy interface for business users to create apps and flows while simultaneously providing robust tools for pro developers, making it possible to integrate innovative solutions across Azure, Dynamics 365, and standalone applications. A common issue that arises is the ownership status of these apps and flows. If a user creates an app and then leaves the organization, the app is left without an owner, and is unable to be edited or shared. Without governance, this problem too often becomes apparent after the fact.

You should have product discovery periodically to understand the status and origin of apps and flows in your environments. Having a Strategy & Vision defined is fundamental for any further efforts in the Power Platform. For instance, as a part of the strategy, consider identifying such artifacts that are orphaned or unused, and then act according to governance policy, e.g., archiving orphaned apps or changing the app ownership. The Power Platform Center of Excellence starter kit provides functionalities to identify such objects and reassign the orphaned apps by changing the app ownership or archiving the unused apps.

The same applies to the platform evaluation as the Power Platform is constantly evolving, and new features must be continuously evaluated to determine how they can be used meaningfully by the organization.

Platform Architecture

You must know your environment to govern it better. A Power Platform environment is a space to store, manage, and share your organization’s data, apps, chatbots, and flows, and is tied to a geographic location. Environments serve as a container that administrators can use to manage apps, flows, connections, and other assets, along with permissions to allow organization members to use the resources. Therefore, start by understanding, and developing an environment strategy.

An environment strategy primarily entails environment provisioning, managing access rights and other layers of data security, and effectively organizing underlying resources in a way that supports productive development in your organization.

Figure 5 exemplifies such an environment strategy as published by Microsoft. There are multiple types of environments that all have different purposes, such as:

*Default *– This environment is the standard out-of-the-box environment. Each tenant has a default environment and should be used for personal productivity only and should not be used for critical business applications. It is recommended to rename this environment accordingly to reflect the purpose.
*Developer *– These environments are intended only for use by the owner, which makes it perfect for the development teams to work in isolation on an application.
*Sandbox *– These environments are non-production environments, which should be used for development and testing your development before moving into a production environment.
*Production *– This is your environment where your solutions will be accessed by end users. It is advised that the development team does not have any admin access to this environment, and it is purely the IT team that deploys the solutions to this environment.

Furthermore, assign your admins the Power Platform service admin role, which grants full access to Power Apps, Power Automate & Power BI. Restrict the creation of net-new trial and production environments to admins. Next, establish the environment management policy, and processes to request the creation of environments, and request access. Clear roles and responsibilities across the organization on support, and ownership. Defining the tiered application models along with specific lifecycles of apps support.

Besides the environment, understand your organization’s tenants to govern it better. A tenant refers to the container in which all your different environments sit. Check the tenant settings and harden them as per your organization’s requirements.

Next to it are connectors and on-premise data gateways, which have a crucial role while interacting with different systems. Connectors are essentially proxy wrappers around the application programming interfaces (APIs) provided by services that allow apps and flows to easily interact with the service. On-premise data gateways enables Power Apps and Power Automate to reach back to on-premises resources to support hybrid integration scenarios. The gateway leverages Azure Service Bus relay technology to securely allow access to on-premises resources. Inside the tenant, within each database environment – there are data connectors and controls. These need to be secured with the right roles and permissions to ensure the users have access only to the tools and environments they need.

Secure

A major benefit of Power Platform and its integration into the Microsoft ecosystem is that users are automatically authenticated. It is the key that enables proper governance of the Power Platform. Every action maker, and Citizen Developers make, happens with an authenticated account. This means that they cannot go beyond their granted permissions on SharePoint, Teams, Dataverse (formerly, CDS, Common Data Service), or any other system where data interacts. Defining security is fundamental to the implementation of the Power Platform within an enterprise. It contains necessary decisions on:

Azure AD conditional access at the Tenant level .
Setting up data loss prevention policies at the Environment level designed to enforce rules for accessibility of connectors and access to business data.
Establishing resource permissions for apps, flows, and custom connectors at the Resource level.
Assign Dataverse security roles.
Defining Cross-tenant inbound and outbound security and compliance concepts, detailing access from and to the data sources.

These belong to the proactive governance area; it is important to have these defined and implemented properly before the rollout of the platform.

Monitor

Monitor is the reactive area of the governance approach. It is important to monitor who is accessing your apps and flows and how these are being used to ensure security policies are effective. The Security & Compliance Center can be used to review out-of-box activity logs and analytics. Configure audit logs and make use of APIs to access logs and leverage management connectors for powerful reporting.

Alert & Act

Alert & Act too are the reactive area of the governance approach. It is advised to automate your audit and alert process using Power Automate. It deals with ongoing monitoring of standard and specific KPIs of your apps and flows across the enterprise to gain meaningful insights into adoption. This greatly helps in discovering any risks early in the process, identifying and empowering champions, welcoming new makers, and fostering the best practices.

With the digital innovation and enablement, the Power Platform brings to the organization – both the IT and risk management functions are quickly overwhelmed by the number of apps that are built. It is no longer about one app at a time that undergoes a development lifecycle. Therefore, it is important to automate the policies outlined, have alerting mechanisms in place, necessary actions defined and applied to remediate the potential risks with the growing number of apps. As an example, create workflows using management connectors that either permit or restrict behavior based on your organization’s Data Loss Prevention (DLP) policies.

Deploy

The application lifecycle includes governance, development, and maintenance. In Power Platform, with Application Lifecycle Management (ALM), you get a bird’s eye view of your projects including requirements management, resource management, nurturing and system administration such as data security, user access, change tracking, review, audit, deployment control, and rollback in a way that other approaches fail to deliver. You get increased visibility into workflow, enhanced compliance, faster deployments, and higher quality products. Learn and facilitate the ALM toolset and best practices. Solutions are the mechanism for implementing and deploying ALM in Power Apps and Power Automate. A solution is either managed or unmanaged. The beginning state of solution is the unmanaged solution. Unmanaged solutions are used in development environments while you make changes to your application. Managed solutions are used to deploy to any environment that isn’t a development environment for that solution. It is a finalized solution that can be distributed and installed.

Educate & Support

An overarching aspect of managing Power Platform is nurturing the continued growth and onboarding of makers and driving your organization to adopt a digital culture. A maker is someone who creates and enforces business processes, structures the digital collection of information, improves the efficiency of repeatable tasks, and automates business processes. Evangelism, community, and training are proven ways to create awareness of the platform’s capability and provide support within an organization. At the same time, it is an integral part for people in an organization to understand concerns, and regulations that they need to respect. Therefore, it is vital to provide well explained, persona-based entry points into the Power Platform. That can be done through central communication, as well as providing specific information to new makers to ensure they have the resources they need to be productive and successful with these tools. To enable people, clear and concise communication is crucial.

Experience from the practice

When approached by organizations who struggle with leveraging the full potential of the Power Platform within their organization, the following patterns are usually observed:

The adoption of the Power Platform is either minimal or cannot be assessed at all. Key indicators are not regularly reviewed.
The fear of security breaches or of not being compliant with regulations results in a reduced, half-hearted implementation of the Power Platform.
Regular review and adjustment of the strategy & vision, governance, and assessment of new features of the Power Platform are not conducted.
Transparent internal communication that provides guidance and information on guardrails and assists Citizen Developers is missing.
The need for proactive governance is usually known but is only partially implemented and followed.

Based on our experience, organizations are mostly aware of proactive governance requirements. Along with IT, Security, and Risk departments, they usually have restricted access according to best practices before rolling out the platform. One common mistake is that the IT department continues to be put in control of app requests and creation.

Low-code platforms, therefore, require a clear commitment and investment from the whole organization, ensuring that the topics described above are not only implemented “once” and therefore half-heartedly, but also continue to be developed further. This is the only way to keep leveraging the full value of the use cases over time.

Establish a Center of Excellence

To improve business agility, and productivity in a governed, secure, auditable, and manageable way, while being compliant with regulatory requirements as well as reducing costs, and empowering makers, organizations should establish a Center of Excellence (CoE). A CoE helps organizations focus and align their resources and expertise regarding a specific capability to accomplish and sustain performance and value. CoE is designed to drive innovation and improvement, and as a central function it can break down geographic and organizational silos.

In our view, a Center of Excellence encompasses the below key areas in the context of Power Platform.

Vision & Strategy
Administration & Governance
Business Value & Onboarding
Nurture, Change & Adoption
Automation

We advise businesses to start with a set of workshops to identify the current state and maturity level of the Power Platform within their organization. Post assessment – set the target level and define how to go further on the CoE journey, in a phased approach to realize the value sooner. Our consulting approach covers all the key areas and aims to increase the maturity level of each of them separately.

Administration & Governance is one of the key areas in the Power Platform journey. Depending on the size of your organization, consider installing the Power Platform Center of Excellence Starter Kit (Starter Kit) instead of starting from scratch. The Starter Kit should not be misunderstood by CoE. The Power Platform Center of Excellence Starter Kit is a collection of the below set of components, tools, and templatized best practices designed with the Administration & Governance area in mind.

Core components – Catalog tenant resources, DLP Strategy & Visibility, Change app ownership
Compliance components – Sample App audit process, Archive unused apps, Act based on certain connector usage
Nurture components – Onboard new makers, provide training and share best practices, and encourage adoption

The Power Platform Center of Excellence starter kit acts as a foundation element and kick-starts the Power Platform admin & governance journey. There are a few caveats to be mindful of:

It needs to be separately installed and maintained.
The kit itself is not supported by Microsoft.
Multi-tenant setups need to be planned thoroughly with the starter kit.
It is a generic template that might not match every organization’s requirements.

Therefore, it is recommended that once the starter kit is installed and configured within your environment you should consider extending and personalizing it to fit your organization’s requirements as defined by CoE.

Conclusion

With each passing day, the boundaries between business and IT are blurring at an accelerated rate. Business users, in many cases without formal programming experience, but with the help of low-code/no-code platforms, are building applications with increasing frequency. This growth can have an impact on organizations – both positive and negative. In the absence of proper governance, this can lead to a large number of unmonitored applications operating across an organization, potentially compromising data, security, risk, and compliance. Solid governance serves as a firm foundation to enable a safe and secure backbone for the digital journey, and to drive innovation and improvement.

This article was originally published by Swatantra Kumar at https://www.compact.nl/articles/governance-of-power-platform-as-enabler-not-as-gatekeeper/

Low-code: empower the capability to accelerate

Swatantra Kumar — Sat, 27 Dec 2025 12:41:17 +0000

In today’s fast-changing environment customers are better informed, better connected and more demanding than ever before. Digitization is no longer a choice, it is indispensable. Irrespective of the size and industry you are in, your organization needs to continuously transform to survive in the evolving and demanding business environments.
Traditional application development falls short and cannot keep up with the demands from the business. Low-code platforms proved over the last years to provide a solution to deal with both business and IT challenges. Low-code software development can therefore be a serious accelerator, driving the digital transformation of your organization!
This article looks at the potential and the reality of low-code development platforms and how low-code can drive digital transformation within organizations. It illustrates how to start your low-code journey, what it entails and how to make low-code software development a success for your organization.

Introduction

Today’s businesses aspire more and more technology-based innovation. This leads to growing demands for software development to perform in fast-changing environments and live up to customer expectations. At the same time, the complexity of systems and the IT landscape, long lead times for changes and limited developer capacity interfere to meet these increasing demands.

Low-code development platforms employ visual, declarative techniques that make it possible to develop software model-based, rather than the traditional writing of software code. Research shows that this does not only speed up software development and shorten time to market but also frees up time for experienced developers and it makes software development more responsive and accessible for the business.

In this article, we will look at the potential and the reality of low-code development platforms and how low-code can drive digital transformation within organizations. We will show you how to start your low-code journey, what it entails and finally, we will provide guidelines on how to make low-code software development a success.

Business application development challenges

The recently published CIO survey by KPMG and Harvey Nash [KPMG19] clearly shows that both digital leaders and established businesses have as a priority to develop innovative new products and services, deliver consistent and stable IT performance to business, improve business processes, increase operational efficiencies and enhance the customer experience. However, the challenges are numerous, as summarized in Figure 1.

Both business and IT feel the pressure mostly driven by the ongoing digital transformation. It’s fundamentally changing the way the business operates and delivers value to customers.

The business needs to develop innovative new products and services, to improve their business processes and to enhance customer experience to attract customers with technology as the enabler.
IT needs to deliver the business transformation resulting in growing backlogs while maintaining a stable (legacy) IT landscape within a tight labor market.
Specifically, for software developers it is a challenge to keep up with the pace of changes in the software development world; the rise of modern software development platforms, new frameworks, integration possibilities, modules, etc. are almost impossible to keep up with. On top of that, organizations demand developers who understand the business process and work in an ‘agile’ way.

Introduction to low-code

Low-code platforms proved over the last years to provide a solution to deal with the high business demands for technology-based innovation and the challenges of IT and developers. Low-code software development can be an accelerator to drive the digital transformation of your business!

Low-code development platforms employ visual, declarative techniques that make it possible to develop software model-based; development mainly happens with visual graphical user interfaces, which means that programming involves more configuration with models rather than traditional writing of software code.

Visual modelling promotes a better understanding of requirements, cleaner designs, and more maintainable systems. Models help us organize, visualize, understand, and create complex things. In general, this means that, compared to traditional programming, a higher productivity rate can be achieved.

That’s exactly the promise of low-code platforms such as OutSystems, Mendix, and Betty Blocks; acceleration of the digital transformation by enabling rapid application development of business applications with a minimum of development, as well as minimal upfront investment in setup, training, and deployment. They are offered as a platform as a service (PaaS) and are intended for developing and delivering enterprise web and mobile applications, which run in the cloud, on-premise or hybrid environments. By offering full application lifecycle management, from design to deployment and maintenance, low-code platforms empower organizations to focus on customer experience and innovation, rather than on application development and management.

Next, we will dive into the promises and caveats of low-code and how it can accelerate your digital transformation in more detail.

Low-code can be a catalyst to your Digital Transformation

Today’s customers are better informed, better connected and more demanding than ever before. The only survival essential for businesses are to transform rapidly and sustainably. Organizations are aware of the increasing importance of the Digital Transformation. It is the whole process of transforming your business and organizational activities, processes, people and business models to benefit from the mixture of digital technologies.

According to the KPMG research, making digital transformation a success begins with a fully integrated front, middle and back office, creating a ‘Connected Enterprise’, which is fully focused on the customer. Organizations that are getting connected by making significant investments across several connected enterprise capabilities are better able to understand what customers need and value, and they achieve it by delivering the intended experience in a profitable way.

There is not one tool, technology, or solution which can shape all these capabilities. Rather we need multiple tools or a platform which is interoperable, flexible and easy to integrate. This is exactly the reason why implementing and applying low-code development to business strategies has become more and more appealing to organizations.

What does low-code promise?

Low-code platforms promise to be of help in a variety of ways. Let’s look what low-code promises, why it is so appealing and how it can help to overcome the challenges that are holding back the Digital Transformation.

Increases productivity and shortens time to market

Low-code is a Rapid Application Development (RAD) technology. RAD tools are enabling organizations to create reusable software components that represent business services in a rapid way. There are many languages, libraries, and frameworks available now to the development community. These can speed up the development, but still requires the team to design the prototype, data modelling, code the app, do the version control, perform DevOps activities, release management, application monitoring, etc. Low-code platforms make use of a visual modelling development approach to application development, resulting in fast development. Low-code platform also comes with a complete pre-built deployment process with no downtime and no interruption to business operations. The promise of low-code solutions is that it offers everything from design, development, testing, integration and deployment of apps within a single solution.

Aligns business and IT so business leaders can solve digital challenges

Business-managed IT, a phenomenon where technology is managed by business units themselves, isn’t going away. In 2019, 64% of organizations allow business-managed IT investments. Business-managed IT requires a new relationship between business and IT, and those that get it right are much more likely to be significantly better than competitors because of the seamless connection between business requirements and technical execution. Low-code development platforms will enable business and IT to truly converge, enhances mutual understandings, and boosts agile way of working.

Bridges workforce skill gap

With the increasing demand for digital, organizations face challenges fulfilling the growing demands for developers; in 2019, 67% of IT leaders accept the fact that skill gaps are a major challenge for their businesses. More and more organizations are opening doors for the ‘citizen developer’. Gartner defines a citizen developer as a non-professional developer who builds simple business applications used by other people under limited or no IT governance. Low-code, but even more no-code, can empower anyone to be a developer, which bridges the gap of skills. Citizen developers are the new frontiers of software development, while being part of the mainstream workforce.

Seamless integration

Low-code platforms promise easy integration with new technologies, cloud services and back-end systems. While organizations are investing in new and emerging technologies, such as Artificial Intelligence (AI), Robotic Process Automation (RPA) and Big Data, they must deal with an existing (legacy) IT landscape. Low-code tools provide interoperability and easy to integrate systems with built-in connectors and libraries. This can help overcome the integration challenges that organizations are facing.

Easier application maintenance

The traditional application maintenance sums up to 80% of the total-cost-of-ownership (TCO) of a software application across its lifecycle. Low-code helps reduce the maintenance cost by various means. In a recent report “State of Application Development”, low-code users stated that more of their application development effort was devoted to innovation instead of maintenance, outperforming those not using low-code by at least 5% (regarding the total IT hours spend). Research company Metri supports the statement that the productivity of software development rises with low-code, however, they correctly add the comment that the license costs can also rise.

Reliable and secure

Applications running on a modern low-code platform inherit the underlying reliability and security features of the platform. It promotes a transparent model to all the stakeholders and better control.

Low-code caveats

Low-code is a hot technology trend and according to research from Forrester, Gartner and KPMG, the low-code market is expected to grow exponentially. With any hot trend, there is always a risk for a hype. While low-code can be a great RAD technology, it is still software development with comparable challenges. Let’s look at few of them.

Need for low-code experience and development competences

Low-code enables easy application building through a drag-and-drop interface, which makes it easier and more accessible for citizen developers. While for small and stand-alone applications this could work, large business applications are way more complex; it is wishful thinking that citizen developers can develop such applications independently. The knowledge and competences of experienced developers are still a necessity for building high-quality integrated applications. For sure, an IT-savvy citizen developer can be of added value under the supervision of an experienced developer. A Centre of Excellence can support the successful application of citizen developers.

An effective UX, functional design and scalable architecture are essential

Like traditional software development, more extensive and complex low-code applications also need an effective approach and governance. Defining software requirements takes a comparable amount of time compared to traditional development. You still need a UX designer for a functional design, and attention to technical aspects such as a coherent logic and architecture. These are essential for a qualitative and scalable application, of which the costs can be managed in the long term.

Proper attention to orchestration

Development with multiple developers as part of an agile team within one application needs to be orchestrated. Splitting in modules, management of dependencies and management of the multi-disciplinary agile team needs to get proper attention.

Software quality and maintenance are still crucial

Even in a low-code environment, maintaining high quality, sustainable software is key in the era of digitization. Low-code platforms promote a better understanding of requirements, cleaner designs, and more maintainable and sustainable software. Care for software quality and security, (portfolio) management, life cycle management and maintenance processes, and managing quality and costs in the long term are also applicable to low-code applications.

Let’s start the low-code journey and how to make it work

In a nutshell, low-code development platforms address both the growing demands from the perspective of business as well as classic IT capacity related problems. But where do you start? What are the questions organizations should ask themselves to find out whether low-code platforms are suitable for them? What steps should be taken to successfully make use of these platforms and reap the benefits?

The low-code journey provides an overview on how such a journey could look like and what should be considered.

Discover: start experimenting and discover what low-code could mean for you
Key in introducing low-code platforms within an organization is showing its capabilities and strengths right away. The power of low-code is that functional Proof of Concepts (PoCs) can be built in the same amount of time as non-functional prototypes (e.g. mock-ups). This makes experimenting with low-code accessible for every organization to discover what it means and the value it may deliver. It is recommended to start experimenting on a small scale without spending too much effort on administrative processes and formalization.
Vision: engage and define your low-code vision
During the discovering phase, you will notice that the first movers within the company will get excited and the buzz will spread throughout the organization. The company will initiate actions to extend previously built PoCs and start piloting. At this stage, it is time for the IT, innovation, technology or development unit to start structuring initiatives and developing a low-code vision.

A bi-model IT framework allows low-code initiatives to be aligned with (the cadence of) traditional software development initiatives and their related maintenance or operational projects. While developing your low-code vision, it is important to take a broad view and include topics such as your (digital) business strategy, sector developments and other (emerging) technologies. The experience shows that low-code platforms are perfectly suitable as a strategic platform to realize your digital transformation. To get to a decisive vision, it is recommended to keep a pragmatic approach and create a compelling low-code story which will realize awareness and traction across (board, business and IT) stakeholders. It is recommended that, if possible, you already select your low-code platform of choice and already start thinking about implications which will require attention in the next phase.

Sketch and mobilize: develop the low-code value options and prepare for implementation
After experimenting with low-code and developing your low code vision it is time to translate your vision into a more formalized plan and start piloting. This can be done either in certain business units or organization-wide. The extent to which low-code platforms are being used varies. From implementation initiatives of one single application built internally or externally to the full embedment of a low-code platform in which your organization can build and deploy apps continuously. In the end, you will have to establish a business case for change. This stage will teach you what the value options are and what the impact on your operating model will be. On-boarding low-code may require enhancements to your operating model for you to be set for success, such as technical requirements, the (agile) way of working and existing IT landscape.
Launch and realize: organize and execute business integration and system implementation based on low-code platforms
Making use of low-code platforms – either for a single application or as an entire development platform – makes software development, -integration, -debugging and -security validation significantly easier. However, you will still have to organize and manage your initiatives like a traditional software implementation. This can be either in project mode or embedded in an Agile development or DevOps team within your organization. In general, more extensive and complex low-code implementations need an effective approach and governance. Care for software quality and security, life cycle management and maintenance processes are crucial to be in control and manage quality and costs in the long term. Expertise in gathering requirements, design thinking, process optimization up to the actual software building, -testing, -deploying and –quality assurance need to be preserved.
Scale and improve: practice low-code at scale and continuously improve
Achieving your first successful results will make you and your organization eager to create more value and scale low-code. Scaling will increase your capabilities to continuously change and adapt in today’s fast changing world. Combining industry- and business process knowledge with innovative- and technical capabilities will help you determine the best way forward and establish your roadmap for upscaling. While determining your roadmap, bear in mind the wide range of possibilities low-code has to offer – from building (innovative) customer engagement applications to operational efficiency applications and even (partially) replacing (legacy) core systems.

Leading low-code platforms such as OutSystems and Mendix facilitate integrations with ERP systems (e.g. SAP), existing databases, API’s and other technologies. Finally, when your organization is leveraging the low-code platforms, it is highly recommended to establish a Centre of Excellence (CoE). Your CoE will ensure coordination, alignment, consistency and continuous improvement when practising low-code at scale.

Conclusion

In today’s fast changing environment, customers are better informed, better connected and more demanding than ever before. Digitization is no longer a choice, it is indispensable. Irrespective of the size and industry you are in, your organization needs to continuously transform to survive in the evolving and demanding business environments.

However, traditional application development falls short and cannot keep up with the demands from the business. Low-code platforms proved over the last years to provide a solution to deal with both business and IT challenges. Low-code software development can therefore be a serious accelerator, driving the digital transformation of an organization! Accomplishing the use of a low-code platform should be a strategic business decision, not a decision to just build another app.

Low-code development is a hot technology trend at the moment and with any hot trend, there’s always a risk for a ‘hype’. While the promises can certainly be real, they can be achieved or even be surpassed when certain conditions are met. For example, the increase in productivity and delivery speed can be strengthened when the organization is familiar with the concepts of agile, DevOps and design thinking. On the other hand, it should be clear that low-code comes with comparable challenges to traditional software development; proper attention to application-architecture design, technical debt, software quality, security measures and maintenance are essential to manage the costs of low-code environments in the long run.

An effective approach or ‘low-code journey’ can help to take the required measures to reach the agreed upon ambition level and to make low-code part of your organization’s DNA!

This article was originally published at https://www.compact.nl/articles/low-code-empower-the-capability-to-accelerate/

From Project Manager to AI-Orchestrator: Leading in a world where decisions are made by machine

Swatantra Kumar — Sat, 27 Dec 2025 11:22:06 +0000

Introduction: The Defining Moment for the Project Management Profession

Project management has reached its most defining inflection point in modern history. For decades, project managers were the decision-makers; the ones who planned, monitored, and steered projects toward success. The discipline that once thrived on structured frameworks, linear predictability and human oversight is now encountering an unprecedented force: autonomous intelligence capable of analyzing, deciding, optimizing and executing at scales beyond human capacity.

Artificial Intelligence (AI) no longer merely supports delivery; it increasingly directs it. Risk is predicted by algorithms. Schedules self-correct in real time. Resources dynamically reallocate without intervention. In such an environment, the fundamental question confronting the Project Management professionals is no longer technical; it is existential: What becomes of leadership when decisions are made by machines?

The answer does not lie in resistance, but in elevation. The future does not eliminate the Project Manager; it transforms them into something far more powerful: the AI-Orchestrator. This transformation is not a surrender of control; it is a strategic elevation of influence. It’s about gaining leverage. It’s about leading in a world where human creativity and machine intelligence converge to deliver outcomes faster, smarter, and more ethically than ever before.

The Rise of the AI-Orchestrator

AI is already reshaping project management. By 2030, these capabilities will mature into autonomous decision engines. It will handle heavy lifting: planning schedules, negotiating trade-offs, and even recommending strategic pivots based on market signals. The human role? To orchestrate this intelligence, an AI-Orchestrator, ensuring alignment with organizational goals and ethical standards. The AI-Orchestrator operates not merely within the project ecosystem, but across the strategic fabric of the organization, aligning intelligent execution with enterprise ambition, risk posture, and long-term value creation.

Their role is to:

Define the strategic intent that guides machine logic
Govern the ethical boundaries of autonomous decision-making
Align algorithmic outcomes with organizational purpose
Integrate human creativity with machine precision

In this model, leadership shifts from managing tasks to orchestrating outcomes. The Project Management professional evolves from execution supervisor to value steward.

AI becomes the execution engine. The Project Leader becomes the strategic conscience.

When Machines Decide, Who Remains Accountable?

A machine can optimize. It cannot be accountable.

This reality introduces a critical leadership paradox. As algorithms assume decision velocity, responsibility remains irrevocably human. Stakeholders will not hold algorithms accountable; they will hold leaders accountable.

The AI-Orchestrator therefore assumes new pillars of responsibility:

Curator of Intelligence: Selecting and integrating AI tools that complement business strategy.
Decision Governance: Defining thresholds where human override is mandatory.
Ethical Stewardship: Ensuring AI acts within moral, legal, and societal boundaries.
Human Advocate: Preserving empathy, creativity, and judgment, the qualities machines cannot replicate.
Strategic Navigator: Using machine insights to steer projects toward long-term value creation.

At KPMG, our Trusted AI framework provides the ethical and operational foundation for responsible AI adoption. As AI-Orchestrators, project leaders are empowered to embed principles such as integrity, fairness, transparency, reliability, and accountability into every stage of the project lifecycle, ensuring that AI-driven decisions are not only effective but also trustworthy and aligned with organizational values.

Technology executes; Leadership gives direction; Purpose gives meaning. This is leadership redefined - not by control, but by collaboration with digital co-workers; a Human-AI Collaboration.

Redefining Success: From Delivery Metrics to Strategic Impact

The future Project Managers will not be measured solely by time, scope, and cost. These metrics become operational hygiene - managed predominantly by AI. Success will instead be defined by strategic value realization, organizational transformation impact, sustainability and long-term resilience, trust and transparency in AI-enabled decision ecosystems.

The AI-Orchestrator manages not just what is built, but why it is built and whether it truly advances enterprise intent.

Consider the emerging operational reality: An AI system detects a 20% probability of delay in a global rollout and autonomously reallocates resources across regions. Another AI agent negotiates vendor timelines based on predictive supply chain data. Meanwhile, the AI-Orchestrator focuses on stakeholder engagement, cultural alignment, and strategic innovation.

The result? Projects delivered at unprecedented speed and precision, without sacrificing human values. This is Human-AI Collaboration in Action, as a value maximizer.

Strategic Competencies for the Future-Ready Leader

To remain relevant and to thrive in this algorithmic driven digital future, a project leader must master:

AI Governance & Ethical Intelligence: Understanding algorithms and impact, AI governance and digital ethics.
Narrative Leadership & Data Storytelling: Translating machine insights into compelling narratives for stakeholders.
Predictive Strategic Foresight: Anticipating disruptions and leveraging AI for competitive advantage.
Strategic Decision Architecture: Cultivate proficiency in machine-driven decision-making, workflow optimization, and automation processes.
Enterprise Change Orchestration: Driving cultural adoption of human-AI collaboration. AI-Orchestrators will be the architects of transformation, shaping organizations that are agile, intelligent, and future-ready.

The Bottom Line: Commanding the Future, Not Reacting to It

The next generation of project leadership will not be defined by the efficient management of tasks, but by the courageous leadership of orchestrating intelligence. Project Managers are no longer merely custodians of process; they are becoming orchestrators of intelligence, guardians of purpose, and champions of ethical execution. As decisions shift from humans to machines, the role of the project manager becomes more strategic, more human, and more impactful than ever before. The AI-Orchestrator doesn’t just deliver projects, does not compete with algorithms; they command the strategic narrative that directs them, they design the future.

This article was written by Swatantra Kumar and originally published by PMI at https://pmi-nl.nl/blog/from-project-manager-to-ai-orchestrator-leading-in-a-world-where-decisions-are-made-by-machine-23236

Why not let APM do all the heavy lifting: Beyond the basics of Monitoring

Swatantra Kumar — Sat, 07 Jan 2023 19:41:28 +0000

Continuously monitoring Application Performance Management is necessary because business demands proactivity, transparency and timely action

In a short period, the complexity of technology increased exponentially. The number of frameworks that appear “overnight”, together with new architectural patterns and distributed teams, can pose several challenges. Keeping such a complex landscape in check requires constant monitoring.

Choosing the right monitoring solution, not only for the project but also for the team dynamics, will help to identify the possible areas of improvement. Furthermore, embedding a monitoring solution within the development cycle of a product will help to reduce the number of problems that can appear in each step, and might also help shorten the amount of time generally needed in identifying the area of service disruption.

INTRODUCTION

Organizations today operate in highly dynamic and complex environments. Businesses need to adapt faster than ever, and customer experience is central. In the world of Twitter, Facebook, Google and 24/7 real time information streams, responding efficiently and effectively to disruptions has become highly important and application stability is key for a profitable business. Application disruptions, however, can happen easily, when, for instance, a sudden increase in the number of website visitors overloads the servers, causing unexpected behavior and application failures. Understanding the behavior and performance of complex applications in order to resolve such a disruption before it has impacted any users may be the differentiator between becoming successful or being forgotten.

KPMG performed its twentieth annual CIO survey in 2018 [KPMG18]. According to its findings, delivery of stable IT solutions is one of the top 3 Operational Priorities and a top priority for Digital Leaders. Having an APM solution implemented in an IT landscape is a good starting point for developing stable applications.

Application Performance Monitoring, or APM, is the monitoring and management of the availability and performance of software applications. It is the dashboard for performance problems and the answer to the following questions:

How can the organization have real-time holistic visibility of the application stack and Infrastructure map?
Is there deep code-level visibility into the business-critical web and mobile app?
Is the organization aware of future service disruption and can acts before business transactions break down?
Is it transparent whether the users experience suboptimal application performance in a certain time, region, module or business flow?
Is it clear for IT managers where to get started in order to tackle poor application performance?
Does the organization understand the inefficiency of a system and is it uncertain from where to start the improvement process? Which process is more critical and which performance remediation provides the highest RoI (Return on Investment)?

The amount of data, coming out of various business systems today is enormous, and sifting through the noise in order to find the actual problem can be a daunting task even for the most experienced IT managers. It would be near to impossible to find the cause of a service disruption within the mountains of logging output generated by all systems. A precise and efficient tool can be easily used to narrow the scope of a problem. An APM tool can help turn the noise into structured information since the language it speaks is data. This “language” enables people, even those without a technical background, to also understand what is happening when a disruption occurs (e.g. when a web page takes too long to load, by using APM it can be clearly seen in the reporting graph how much longer the page took to load than normal). For web applications, Page Load Time (PLT) and performance are all about speed. In fact, PLT is the most discussed performance metric of the 21st century when it comes to the digital landscape, and according to [Camb09], about half of web users expect a site to load in two seconds or less. PLT is an important part of any user experience and with APM it is easy to pinpoint which action or transaction is expensive and where to start looking. Figure 1 clearly describes and makes it easier to understand why PLT is such an important performance metric. By going above the accepted threshold of two seconds, companies like Google and Amazon felt a considerable decrease in revenues for what might be thought as an insignificant increase in response time.

WHAT IS APM AND WHO IS APPLYING IT?

Both Application Performance Management and Application Performance Monitoring are often abbreviated to APM. Application Performance Management is the more proactive component, while monitoring is more reactive when it comes to application performance. Despite the way it is being looked at, APM is essentially a tool that helps optimize and monitor the performance of any organization’s applications.

Monitoring an application requires data. Depending on the complexity of a solution, there are multiple areas from where data needs to be collected and aggregated in order to evaluate the “health” of a system. Monitoring solutions that are on the market have wide coverage and each suite offers plenty of monitoring options. Most APM vendors offer similar features in their solutions, as the market problems are mostly the same and the way data is collected and analyzed hasn’t changed much in the past few years. Figure 2 depicts the common points all APM vendors are covering, demonstrating the entire end-to-end flow of transactions, including the underlying technical components and hardware.

Companies in almost every sector are already using APM: from Samsung, Allianz, BMW, NTT, and Siemens, who are part of Fortune 100 companies, to CNN and Ryanair. Leading companies from various industries like Media, Financial, Government, Healthcare, Insurance Retail, Telecommunications, and Technology are using it extensively and are asking for more capabilities to measure and act upon. APM vendors are also improving their tools with features like Artificial Intelligence for IT Operations (AIOps), End User Monitoring (EUM), Infrastructure Visibility, Business Performance Monitoring, AI powered user experience insight and Cloud Monitoring.

eBay: “With more than a hundred million active users globally, our customers expect efficient delivery of services. Therefore, our infrastructure performance – which executes critical transactions like product listing, product selection, order booking, payments, and shipping – is key to the success of our business… APM provides unrivalled visibility into performance issues within our network and beyond, as well as automates the rest of the job. This gives us faster root cause analysis and allows us to resolve performance issues before they impact our customers.” – Rajshekhar Desai, Group Manager – Quality, eBay Managed Marketplaces [Desa17].

CNN: “We partnered with APM vendor to build a mobile experience that helps users digest the numbers in a compelling and entirely personal way.” – Matthew Drooker, VP of App Development and Technology, CNN [Droo16].

CNN partnered with an APM vendor in order to develop the CNN Politics application, which provides an immersive multimedia experience that tracks data from polls, voting and fundraising. With exclusive stories and visualizations, personalized alerts and notifications, users have the power of data analysis at their fingertips.

Nasdaq: “It really stood very well within a DevOps model, in this day and age where there is a lot of complexity within a given application architecture. The flow map that came out of the box just really sold the product…” – Eric Poon, Director of Operations Analytics, Nasdaq [Poon18].

“It’s a tool that offers seamless traceability and a view that bridge both the APM and the business product usage effectively.” – Heather Abbott, Senior Vice President of Corporate Solutions Technology [Poon18].

Ryanair: “APM (…) has made us all better and faster at doing our jobs. Without APM, it would be impossible to troubleshoot this environment.” – Declan Costello, Infrastructure and Operations Manager, Ryanair [Cost17].

WHAT PROBLEMS DOES APM SOLVE?

According to [Will18], by 2021, enterprises will monitor 20% of all business applications with APM suites because digitized business processes will increase considerably, compared to 2017, when only 5% of the business applications were monitored using APM suites. These numbers alone should make any organization evaluate where they stand now. Any custom application comes with complexity. With more pressure on digitization, a globally distributed customer base and demand of high availability makes the platform, infrastructure and application more complex. Global trends and patterns show complexity and will keep increasing in coming years. So, let’s look at how APM can help with various problems.

DIGITAL TRANSFORMATION

According to [ISCO16], Digital Transformation (DT) is the process of transforming business and organizational activities, processes, and models to take full advantage from the mixture of digital technologies and the accelerated impact they have across society. As businesses are getting more and more digitalized, organizations need to have more control over their IT landscape and having APM will help in better visualizing that landscape and all the data that flows through it. In order to do that, organizations need to first translate business goals into application requirements. Then they should make sure that those are properly implemented. This can be done via metrics. For example, if a business goal is “an application must be 100% available”, monitoring uptime for the application will be a must. It also helps to understand the customer behavior and demand. The McKinsey [Olan13] analysis puts seamless customer experience, digital fulfillment, automation of activities and customer insights as key aspects for DT to play. APM does this work for organizations by putting facts on the table.

CUSTOMER SERVICE

Every company depends on operation-critical software to run their business and because of this dependency, even a slight outage can lead to unhappy customers. When an unsatisfied customer contacts the Customer Services (CS) team to report a problem, even with basic APM dashboards, the CS can investigate the problem themselves and after narrowing it down, they can contact the relevant team for a solution (e.g. server node was unreachable in some region for some time, the message queue was full or busy executing queued events etc.). They no longer need to disturb the IT Department every time something is reported ([Wats17]). Enabling the right teams to act will save time and money for the organization.

HARDWARE OPTIMIZATION

When it comes to an application and its performance, organizations usually think about the software, but the hardware on which the application runs also matters. Applications can and will consume important hardware resources like CPU, RAM, I/O and storage due to problems that they inherit from the language they are written in and from their architecture. Due to this fact, hardware monitoring is usually the first thing that should be set up. This way the usage of various hardware resources can be observed and, if needed, scaling operations based on user needs can be performed.

ALERT ME!

Having an APM solution in place makes an organization pro-active. The solution does not need to be used only when users contact the CS with a problem; and checking the graphs from time to time to make sure everything is alright is not a must either. One of the beauties of APM is called alerting or notifying. People from the IT Department can create rules in the APM tool that will raise alerts each time the application’s performance dips in specific areas. These alerts can be set with different degrees of importance and the responsible team can receive them in different ways. For example, if an important part of the application went down, a critical alert will be raised and the development team can receive it via their phones, as a message. Less important alerts can just be sent via email and can be taken care of the next day. There are several options available and organizations can choose the one that best fits their product and needs. With this alert system, a proactive response is provided, instead of the typical reactive one.

SLOW IS THE NEW DOWN

Why is an application slow? Applications have evolved from stand-alone to client-server to 3-tier architecture to distributed one; a lot has changed in the IT landscape. With many microservices, APIs (Application Programming Interface), Enterprise Service Buses, Service-Oriented Architecture, message brokers and even cloud-based elastic applications, a slowdown is not easy to identify. Performance management is a challenge given the complexity of today’s hybrid development platforms, cloud-native infrastructure, virtualized and containerized servers, and dynamic and ephemeral application architectures. With the heterogeneous nature of the IT landscape and the numerous interdependencies between elements, it is difficult to identify the cause of why an application is performing poorly. One of the toughest problems that application owners, developers, and IT managers face is the question: “Why is this application slow?”. APM helps to locate the bottlenecks in this distributed application environment.

BENEFITS OF APM

The benefits of APM can be summarized using four categories: improving business continuity; improving user experience and increasing customer satisfaction; enhancing insight and improving productivity for development and IT Ops; and decreasing reliance on experts through better monitoring. By grouping concerns like operational costs reduction, finding and addressing performance bottlenecks, deep-code visibility and transaction profiling into concern bounded categories, like the ones below, it is easier to understand problematic areas and how APM can add value to each one of them. Business Continuity and Better User Experience and greater Customer Satisfaction categories go together well and they address the business as well as the human side, while Enhanced Visibility and High Productivity, together with Decreased Reliance on experts with better Monitoring categories tackle the technical side of a business: a 50%-to-50% balance.

According to [DZON17], 43% of application performance issues are due to an issue in the application codebase. Transaction profiling generally provides the capability for developers to deep dive into the code flow and get method-level processing time breakdown. Many application issues occur due to slow network connectivity, virtualization bottlenecks, memory leaks, distributed environments, etc. APM helps in understanding a complex microservice environment, identifying slow requests moving through the system and diagnosing the root cause of latency in slow customer experience.

APM is more than a way of tracing problems; organizations now have the power to make certain predictions regarding their application, making some of them be one step ahead of the competition, and who knows, maybe even a game changer at some point.

CURRENT STATE OF APM

In the past two years, APM solutions have come a long way. According to the Gartner Magic Quadrant from 2016 (Figure 4), there were only three leaders, but also a visionary, compared to the Magic Quadrant from 2018. Some niche players also moved to being challengers, while a challenger moved to the leaders’ square and the niche players increased considerably. These changes give an idea of how much the APM solutions market has matured in such a short time. The evolution of the big players can be seen in Figure 4 and 5.

[Capp18] categorized these APM suites in their Magic Quadrant of 2018 as follows:

The magic quadrants recognize very few market leaders in the APM segment. Let see who they are and why they are leaders in APM solutions.

As can be in Figure 6, the 2018 APM leaders offer similar functionalities. Their subtle differences, however, make each one of them stand out from the Leaders group and from the other categories in the Magic Quadrant.

For a business with software applications, these applications must always be running optimally with the highest priority. APM is monitoring and managing the performance of the code, application dependencies, transaction times, and overall user experience. Things like AIOps and Distributed tracing are the solutions needed for the new architectures (e.g. services and microservices), so it can be observed that the leaders are considering the technology evolution and they try to keep up with it by anticipating what the market needs.

Figure 7 [GART19] shows that although Dynatrace initially appears to deliver more to their customers than New Relic or AppDynamics, the numbers are showing that they come in second, the winner being New Relic. By taking a closer look at the Product Capabilities areas, the differences between vendors are not that great, but the number of users that reviewed the products can easily reveal the favorite vendor.

By taking a good look at which industries the reviewers originated from, an organization can come closer to choosing the right vendor for their business.

LOOKING FORWARD

Monitoring solution development has improved drastically over the last ten years: from the APM concept as we know it today ([Drag14]), to the age of the cloud, which is lightweight, deploys quickly, and needs zero configuration to get started. It is easy to be impressed by these technological advancements.

The APM tools of tomorrow are far away from only monitoring production applications, they will be an integral part of the software delivery lifecycle. Identifying problems early and enabling continuous optimization across various development and testing phases and environments is a must in such a fast-paced world.

AI is becoming the new norm of monitoring which leads to the development of advanced AI-powered features in APM tools. For instance, causal analysis, which is a pattern detection and machine learning capability. Features such as differential analysis, which uses analytics and machine learning for automatically detecting anomalies and problems ahead of time is quite possible. Another hot topic in the area of APM is assisted triage ([Sidd18]). This is an intelligent engine that uses the graphical topology model, analytics, machine learning and expert heuristics to help users determine and verify the exact root cause of an issue by constructing a personalized path for each individual. These are no longer Sci-Fi stories. The future is on its way and it looks stunning.

REFERENCES

[Camb09] M.A. Cambridge et al., Akamai Reveals 2 Seconds As The New Threshold Of Acceptability For ECommerce Web Page Response Times, Akamai.com, https://www.akamai.com/us/en/about/news/press/2009-press/akamai-reveals-2-seconds-as-the-new-threshold-of-acceptability-for-ecommerce-web-page-response-times.jsp, 14/09/2009.

[Capp18] W. Cappelli, Magic Quadrant for Application Performance Monitoring Suites, Dynatrace.com, https://www.dynatrace.com/gartner-magic-quadrant-application-performance-monitoring-suites, 03/2018.

[Cost17] D. Costello, Ryanair’s Ops Team Relies on New Relic to Deliver Passengers and Performance, NewRelic.com, https://newrelic.com/case-studies/ryanair, 08/2017.

[Desa17] R. Desai, eBay Leverages Compuware APM To Optimise Applications, FirstPost.com, https://www.firstpost.com/biztech/ebay-leverages-compuware-apm-to-optimise-applications-1891241.html, 02/2017.

[Drag14] L. Dragich, Monitoring Magic and the Future of APM, APM digest, https://www.apmdigest.com/monitoring-magic-and-the-future-of-apm, 14/08/2014.

[Droo16] M. Drooker, CNN Politics: Democracy Powered by Data, CA Technologies, https://www.ca.com/us/collateral/case-studies/cnn-politics-democracy-powered-by-data.html, 05/2016.

[DZON17] DZone, Performance & Monitoring, LinkedIn SlideShare, https://www.slideshare.net/tuoitrecomvn/dzone-performancemonitoring2016mastercodevn, 04/2017.

[Eato12] K. Eaton, How One Second Could Cost Amazon $1.6 Billion In Sales, https://www.fastcompany.com/1825005/how-one-second-could-cost-amazon-16-billion-sales, 15/03/2012.

[GART19] Gartner Inc., Application Performance Monitoring Suites > Compare Vendors, Gartner.com, https://www.gartner.com/reviews/market/apm/compare/dynatrace-vs-newrelic-vs-appdynamics-vs-ca-technologies, 2019.

[GOOG19] Google, The core foundations of a delightful web experience, Google Developers, https://developers.google.com/web/fundamentals/, 09/05/2019.

[ISCO16]i-SCOOP, Digital transformation: online guide to digital business transformation, i-SCOOP.eu, https://www.i-scoop.eu/digital-transformation/, 2016.

[KPMG18]Harvey Nash & KPMG, CIO Survey 2018: The Transformational CIO, https://assets.kpmg/content/dam/kpmg/nl/pdf/2018/advisory/cio-survey-2018.pdf, 2018.

[Maln13] R. Malnati, For Google, 400ms of increased page load time, results in 0,44% lost search sessions, Citrix.com, https://www.citrix.com/products/citrix-intelligent-traffic-management/, 02/2013.

[Olan13] T. Olanrewaju et al., Finding your digital sweet spot, McKinsey Digital, https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/finding-your-digital-sweet-spot, 11/2013.

[Pate11] N. Patel, How Loading Time Affects Your Bottom Line, NeilPatel.com, https://neilpatel.com/blog/loading-time/, 04/2011.

[Poon18] E. Poon et al., Challenges: Slow, Cumbersome Log Analytics, Home-Built Tools, AppDynamics.com, https://www.appdynamics.com/case-study/nasdaq/, 04/2018.

[Sidd18] A. Siddiqui, A New Approach to Application Performance Management — Delivering a Future-Proofed Modern Solution, CA Technologies, https://medium.com/@CATechnologies/a-new-approach-to-application-performance-management-delivering-a-future-proofed-modern-solution-960c25a6dddd, 22/05/2018.

[Wats17] M. Watson, Why APM is Valuable to Every Part of Your Business, APM digest, https://www.apmdigest.com/why-apm-is-valuable-to-every-part-of-your-business, 28/02/2017.

Low-Code: A high level overview

Swatantra Kumar — Wed, 25 May 2022 22:22:50 +0000

"Technology has never been more important to organizations” –
Harvey Nash / KPMG CIO Survey 2018

“Low-Code Platforms enable rapid delivery of business applications with a minimum of hand-coding and minimal upfront investment in setup, training, and deployment.” - Forrester

Do your legacy systems hamper your digitalization efforts?
Does it feel like your competitors are gaining edge on innovation?
Would you like to be able to deliver fully customer-centric solutions and do this faster than the competition?
Does it take long to implement new technologies in your organization?
Do you have a shortage of skilled software developers?

If you answered 'Yes' to these questions, maybe low-code platforms are for you. Read this overview and find out how low code can help address those challenges.

Most companies have put investments in technology-based innovation high on their strategic agenda. The current complexity of IT systems, a high effort required to process changes as well as the increasing cost of maintenance of IT systems and a lack of IT personnel impede innovation through software. The current wave of digital transformation faces them with quite some challenges. End users – either clients or employees – expect a seamless and connected user experience and businesses require faster delivery cycles to stay ahead of the game. Over the past decade though, the tooling for software development has evolved at a rapid pace providing an answer to the abovementioned needs. So called 'low-code platforms' have entered the market and have gained increased popularity since then.

What are 'low-code platforms'?

Low code was a term coined in 2014 by Forrester Research and it has quickly gained traction in the past few years. The low-code platforms, however, first emerged in the early 2010s as a response to the ever increasing pace of business application development and the evolution of programming languages.

Low-code platforms make use of a visual development approach to application development. With the use of low-code platforms software can be (re)built using model-based development, meaning that developers or even business analysts can create web and mobile applications, using modeldriven logic through a graphic user interface and making use of pre-built application components.
In general this means that, compared to traditional programming, a higher productivity rate can be achieved.

In this way low-code platforms enable rapid delivery of business applications with a minimum of development, as well as minimal upfront investment in setup, training and deployment. They are
offered as platform as a service (PaaS) and are intended for developing and delivering enterprise web and mobile applications, which run in the cloud, on-premises or in hybrid environments.

Solving the legacy problem

Research commissioned by Hitachi Consulting found that nine out of ten IT-decision makers think legacy systems curb their ability to grow and utilize the full potential digital technologies can offer.
Within the respondents, large companies were more likely to claim to be held back by legacy systems, with 44% saying it affects all or most projects, compared with 28% for medium-sized firms. The challenges for organizations, however, are not only to update legacy systems in order to harness the full benefit of digitalization, but also to go through their own digital transformation in order to stay relevant in an ever faster changing environment.
Whereas low-code platforms were formerly mainly used for mobile apps, workflow applications and niche software, they are now widely used for the renewal of business-critical legacy applications and software for core processes. This allows low code to form an integral part of an organization-wide digital transformation.

Digital transformation with low-code

In 2016, Forrester determined that using low-code platforms can produce applications six to twenty times faster, therefore enabling digital transformation even for small enterprises and for companies that did not start as 'IT shops'. Low-code platforms accelerate digital transformation by enabling rapid application development (some platforms, such as OutSystems, offer full-stack visual modeling capability and one-click deployments, which further accelerates development and eliminates the need for highly-skilled software developers). By offering full application lifecycle management, from design to deployment and maintenance, low-code platforms empower organizations to focus on customer experience and innovation, rather than application development and management.

The leaders in high-productivity platforms

According to the Gartner magic quadrant for Enterprise hpaPaaS, four low-code platforms are in the Leaders section – Salesforce, ServiceNow, Mendix and OutSystems.

OutSystems offers a comprehensive visual modeling capability, including business processes, integration workflows, UIs, business logic, data models, web services and APIs. These enable high-productivity development and a faster time to market for relatively advanced applications. The platform also includes many other services, such as project management and analytics. The Forrester Wave™ (2017) also places OutSystems in the Leaders quadrant for low-code platforms.

Breaking the deadlock for low-code - Part-4 The way to successful usage of low-code software

Swatantra Kumar — Mon, 18 Apr 2022 12:48:03 +0000

Looking at the industry trends, it is fair to say the demand for Low-Code is growing faster than ever however, Developing the low-code ecosystem is crucial for a successful adaption. There are many indicators that the demand for low-code developers outnumbers the talent in the local market. With the increasing number of clients in the Dutch market, only a few developers per company are available. This equation is not effective and time and again leads to low-quality applications.

So, what is the way forward?

Use low-code if you use it in a strategic way. It is okay to do a small pilot but do not get stuck in the middle with only a few apps in your kitty. This may end up being expensive and ineffective. To break even at the operating level and get the most return on investment, clients have to adopt the platform strategically and with a clear vision. KPMG recommends the ( [Kuma19]) 5-step low-code journey Discover – Vision – Sketch & Mobilize – Launch & Realize – Scale & Improve to reap the benefits. Get yourself partnered with a registered and strong low-code partner. The partners come with a broad array of experiences, industry expertise and exclusive access to the resources helping you achieve business results.
Do not allow the business to buy too much other candy in the software candy store. Fragmented use of the platform is detrimental. Many efficiencies can be reached by embedding the low-code platform in the overall platform architecture. Use the platform to a maximum in order to keep the overall application landscape maintainable. Otherwise, low-code will die in your software factory as just another toolkit.
Establish cross-functional agile teams and use a smart co-sourcing model with a few experienced registered partners to staff the agile development teams. The cross-functional teams are self-sufficient and should understand the existing application landscape and have experienced business analysts. Co-sourcing will help accelerate the internal staff’s abilty to use the platform. Scale the team and the low-code digital factory with internal staff as the low-code application landscape grows.
To scale up the low-code factory, it is advised to create a competence center (also known as a “Digital Factory”. The digital factory is a whole new way of working, with new integrated solutions, increased agility and cross-functional teams. The Digital Factory acts as a counter for the business where they get support in implementing digital use cases. Eventually, the factory will have implemented many small and medium use cases and will have the experience to speed-up any following use case. Establish the control framework in the digital factory to ensure the quality measures of software development are guarded. This will ensure the output of the factory is predictable.
Equip the team with the standard processes and promote best practices within your low-code digital factory. It lays the foundation and gives the right direction to the team. Pay attention to the architecture to avoid the spaghetti situation. If the team is working under well-defined architecture, the technical debt will be kept under control. To remain relevant and flexible, introduce modularity in the architecture.
On the other hand, low-code providers and vendors should invest more in promoting opportunities for acquiring the skills. Bring the right partner, developer advocate to grow in the market. Make a sustainable ecosystem which attracts and encourages talent, give them a future-proof career. Give them reasons to be enthusiastic, so that the platform providers can fill the talent gap. Help the developer community to thrive so that they remain active and relevant.

In conclusion
Disruption is a fact of today’s fast changing business environment and no organization is immune in that respect. Organizations need to be able to respond to disruption. Low-code comes to the rescue and can be a serious accelerator. Low-code products are mature and capable of fulfilling the need, provided it is done in the right way.

Doing it right means doing it consistently and strategically. For example by establishing a Digital Factory that uses the platform to its maximum to support businesses to a fast implementation of digital needs. These can be small innovative apps, apps to generate operational effectiveness and customer facing apps. The factory can also be a step-up to replace legacy systems. The digital factory is ideally sourced with internal staff that understand the business and existing application landscape and have a long-term view on the digital goals. Often the digital factory is supported by experienced partners in a co-sourcing model. We do observe the risk of a shortage of skilled developers and a shortage of large solution partners. To gain trust and build a strong foundation for the low-code ecosystem, a herd of solid IT service and consulting firms with the dedicated low-code practice must be present in the market. Skilled low-code champions along with a strong community should also be available in the market. Low-code platform providers have to work towards building a sustainable ecosystem, as they are the essential building block.
We spoke to organizations who went for the low-code journey. The ones who were involved non-stop in that process, the ones with a vision and the ones armed with a right registered low-code partner to back the strategy and fill the skill gap, had the least problems and were the most positive. An experienced low-code partner enables your organization to speed up the time-to-market and thereby gain a competitive advantage with its strategy and broad experience on the platform. We can help you with your low-code journey. We recognize ourselves very much in the story of Do it right or don’t do it at all.

[Kuma19] Kumar, S., Brouwer, A. & Tiemens, S. (2019, October 3). Low-Code: Empower the capability to accelerate. Compact 2019/3. Retrieved from: https://www.compact.nl/en/articles/low-code-empower-the-capability-to-accelerate/

Breaking the deadlock for low-code - Part-3 Developing the low-code ecosystem is crucial for a successful adaption

Swatantra Kumar — Wed, 13 Apr 2022 08:27:39 +0000

We have discussed in Leverage on low-code platforms and key advantages about the key advantages of using Low-Code and how business can leverage from it. Undoubtedly, the low-code platforms OutSystems and Mendix are powerhouses with a bundle of great features, but still, a lot of work lies ahead for continued success. It is recognized that both the leading platform providers have commercial targets and focus on market penetration and new clients and less on continued and successful implementation. But to create a sustainable ecosystem with many skilled developers, a wide and large market penetration is necessary.

This, therefore, contains a substantial risk (many new clients but limited use of the platform at each client) for the low-code ecosystem. Despite the powerful easy-to-use low-code platforms and numerous success stories, many companies are struggling to successfully realize the implementation and high-scale adoption in their application landscape.

The providers should also focus on increasing the use and adoption of the platform with their clients. The true value of the platform is not being retrieved if only a handful of applications are being realized. New clients are often left with a license and a partner for implementation. They either need to train their staff or rely on hiring new staff on the market. Skilled developers are scarce due to relatively young technology and shortage in the IT labor market. An alternative is to extend the development team with the entrepreneurial boutique firms for the execution. The largest of such boutique firms in the Netherlands employs around a hundred developers. Today, as the pressure is continuously building to increase the digital footprint on every line of business, you need a large pool of developers or professional consultants. Admittedly, OutSystems says “Low-code is still quite a young software category… and there is a lack of expert partners” ([Warr18a]).

Since the platform provider’s strategic focus is on tapping and increasing the market share in the competitive and attractive low-code market, there is a less priority on the advisory and architectural support. The consistent quality of the small and mid-sized applications is often lower than the quality of CMMI5 level development of large traditional vendors (e.g. TCS, Infosys, Cognizant, Capgemini).

There are examples in the Dutch market where clients are dissatisfied with the low-code platform. This is in most cases not caused by the platform but by a poorly designed software architecture. The root cause can often be found in the lack of skilled software architects, uncontrolled citizen development and in some cases insufficient quality control measures. KPMG discusses ([Koed20]) the quality risk of citizen development and advocates the quality-centered low-code development approach. One can argue that the platform provider should have been part of the quality control system. Have they perhaps focused on new business too much?

The growing demand for low-code in the Netherlands is paired with the claim of not having enough certified developers (certification assures the knowledge and demonstrated experience). We crunched the numbers in August 2020 to find the figures, and they are supporting the claim. An overview of OutSystems community shows a total of 24,104 certifications awarded across the globe. This number includes all types and levels of certifications and not the certified personnel, which means that the figure includes multiple certifications attained by a single developer. OutSystems has multiple guided learning paths that train you to become a web developer, mobile developer, or a support engineer (now retired). Examining OutSystems’ community members’ directory led to nearly 800 public profiles from the Netherlands with at least one minimum level of certification. At the same time, Mendix claims to have 13,503 certifications globally, and its community members directory led to nearly 920 public profiles from the Netherlands in possession of a minimum level of certification. In either case, the numbers of certified developers do not meet the demand of the growing consumer base. However, a growth has been observed in the number of certified professionals, likely as an effect of free certifications in the Covid19 period and/or access to a wide range of free online courses and workshops.

Next: The way to successful usage of low-code software

[Warr18a] Warren, N. (2018, October 3). Low-Code Myths, Fears, and Realities: Vendor Lock-in. OutSystems. Retrieved from: https://www.outsystems.com/blog/posts/vendor-lock-in/

[Koed20] Koedijk, J. & Stam, D. (2020, June 5). Citizen development flourishes due to COVID-19 crisis, but can your organization maintain its output? KPMG. Retrieved from: https://home.kpmg/nl/nl/home/social/2020/06/citizen-development-flourishes-due-to-covid-19-crisis-but-can-your-organization-maintain-its-output.html

Breaking the deadlock for low-code - Part-2 Leverage on low-code platforms and key advantages

Swatantra Kumar — Sat, 09 Apr 2022 11:24:00 +0000

We read about the rise of the Low-Code platforms in the earlier post in this series. The race to add richness to low-code applications, aggressive vendor investments targeted at some of the most pressing needs, and ability to quickly respond to the challenges of modern enterprise applications are making the low-code platforms attractive. Low-code is often used in the niches of a company. On a high abstraction level, the use cases can be boiled down to four best fitted categories (Figure 5) where low-code gets the job done.

Innovation. Innovative apps are making solutions/processes extremely exciting with impressive productivity, generating business value, using emerging technologies and driving innovation. These could be smart and connected apps merging the physical and digital world using the Internet of Things (IoT), Artificial Intelligence (AI) and Machine Learning (ML). Applications under this category generally start with an idea and evolve with a high rate of change while relying on multiple integration points with external data feeds, web services, IoT data, geodata etc.
Customer engagement. This group of applications focus on business and customer experience. The general goal is to improve customer experience, keep them engaged and improve the satisfaction score. The customer could be another business entity or end users. Think about B2B (Business-to-Business) portals, B2B apps, B2C (Business-to-Consumer) portals, B2C apps; these are one of the largest pools of applications where low-code presence can be seen. These applications often connect to core digital systems and have multi-channel connectivity.
Operational efficiency. Not all of the applications need to be bulletproof or come with a slew of features; oftentimes basic applications aim to improve the organization-specific business processes, or operations are sufficient to enable the team to become more productive and deliver more value. These are principally B2E (Business-to-Employee) apps, workflow or case management applications, compliance and quality management applications and departmental apps. Such applications are often combined with B2B apps. This is also a large group of applications where low-code is widely used. Being organization specific in nature, they are generally integrated with Systems of record, ERP solutions, CRM solutions, Salesforce, SAP, Microsoft Dynamics, Oracle, NetSuite etc.
Legacy modernization. In many organizations, legacy applications serve critical roles in driving business operations. There is a clear need to modernize outdated systems. Often, when retiring the legacy is a not an immediate solution, a low-code solution could be positioned to co-exist to get the most out of the legacy before pulling the plug. The primary focus could be on replacing the legacy or building new skins on top of it while maintaining the system itself. This category could be one of the biggest markets for low-code to penetrate. At enterprises, these applications mostly interact with (but not limited to) Lotus notes, 3GL/4GL apps, Access, SharePoint, Excel, Core record keeping systems and core system extensions.

The key advantages of the low-code platforms
Never before, in the history of software development, has the complexity of technology been this huge. Developers are expected to cover a vast array of areas: (multi-)cloud, hybrid infrastructure, security, performance, scalability, cross-platform, multi-device responsiveness, offline availability, distributed caching, databases, extensions, APIs, AI, ML, DevOps. The complexity has increased exponentially and, so has the application development time. In this complex environment, the low-code platforms are developing themselves into a solid foundation for digitization, with many advantages:

Rapid development enables faster time-to-market. With low-code platforms, businesses can translate ideas into working prototypes in days rather than weeks or months. It gives the true agility to quickly respond to change, fail fast, iteratively improve faster and reach the market better. Rapid development enables shorter time-to-market with faster application development. As a result of the rapid development tool, it significantly shortens the development time compared to traditional development, which can be better utilized for innovations.
Ease of use. The development of the applications is simplified, using the model and visual-based development. It is primarily a drag-and-drop interface; a little technical knowledge is required to develop a business application. This makes room for business users to understand, engage and be accessible in the development journey of the applications.
Easy integration with external systems. Low-code solutions can reduce the complexity of integration with other systems, making it interoperable. Integrations have always been the most cumbersome and tiring process in any software development. With the help of low-code platforms, developers significantly reduce time and effort using its out-of-the-box REST APIs, SOAP web services, webhooks, SAP, OData and external databases connectivity.
In control. Since the infrastructure and codes were generated by the low-code platform, the underlying platform takes care of many important security aspects. It integrates with a wide array of identity providers and implements RBAC (role-based access controls). Once a low-code platform is connected and audited in the organization’s software perimeter, new uses cases can be built fast in a controlled environment.
Scalability. The low-code platforms provide the ability to scale on demand. The applications can benefit from auto-scaling, auto-provisioning, auto-healing out of the box to meet the enterprise needs for users, volumes of data, app functionality. However, the suitability in larger projects and for crucial enterprise applications are yet to be witnessed at large scale.
Privacy. Low-code platforms apply necessary procedures to safeguard the confidentiality of the data stored by the applications.
In-built monitoring and logging. Applications developed using low-code benefit from the platforms’ easy-to-use in-built monitoring solution. There is a wide range of monitoring available e.g. performance, network, server, usages activity, technical debt monitoring. Applications also leverage from the out-of-box logging analytics which helps in troubleshooting errors, web service and API invocations, access logs.
Maintainability. Few platforms provide the service which measures key aspects of app maintainability against a set of ISO/IEC 25010 parameters i.e. modularity, reusability, analyzability, modifiability, testability, and highlights any potential issues that should be addressed. As mentioned, it also provides the technical debt monitor, which helps perform code and runtime performance analysis before recommending solutions to help improve the system’s maintainability.
Mobile-first, offline-first. Low-code supports mobile app development with offline and native capabilities. The platform provides control over (offline) data storage, data synchronization and offline architecture.
Cost-effective. Due to the fact that the basic applications can be built with relatively less skilled staff and that the development cycle of these applications is shortened, more applications can be realized in the same amount of time with less cost. The applications are maintainable and significantly reduce the total cost of ownership (TCO). Hence gives great business value.

Next: Breaking the deadlock for low-code - Part-3 Developing the low-code ecosystem is crucial for a successful adaption

Breaking the deadlock for low-code - Part-1 The rise of low-code platforms

Swatantra Kumar — Thu, 07 Apr 2022 08:56:26 +0000

You need a vision, a strategy and the right solution partner to drive the low-code journey. Don't get stuck in the middle. Do it right or don't do it at all!

Low-code platforms are potentially a saving grace for organizations caught in between critical software legacy and the urge for innovation. This can be a serious accelerator, driving digital transformation. However, a shortage of rightly skilled developers and large solution partners stands in the way of success on a bigger scale. Therefore, the development of an ecosystem is key for low-code on the Dutch market.

Low-code and no-code software development platforms are hot technology, but definitely not a new phenomenon. The pioneers of the modern low-code platforms like OutSystems and Mendix are innovating the capabilities since the early 2000s. The rise in low-code functionalities, capabilities, ability to scale and increasing need for digital transformation using Shadow IT and Citizen Developers led to its adoption as replacement of the enterprise platforms. With gaining popularity of the low-code technologies, big players like Microsoft launched PowerApps in 2016. In June 2020, Amazon also joined the race with its own no-code code development tool Honeycode that aims to build mobile and web applications without writing any code.

Shadow IT refers to the information technology (IT) services (developed or managed by the business units), outside the knowledge or ownership of IT.
Citizen developers are the business users who make use of IT sanctioned platforms to create new business applications.

Typical for low-code development platforms is the use of visual, declarative techniques that make it possible to develop model-based software. This development mainly happens with visual graphical user interfaces, which means that programming involves more configuration with models rather than the traditional writing of software code ([Kuma19]). This helps a wider range of people contribute to software development and enables a tighter collaboration between IT and business to rapidly co-develop the software, or transform the business processes. Such a collaboration capacitates to stay focused on the goal of frequently achieving customer value, and quickly responding to changes, which improves agility.

Leading analyst firm Gartner writes in its enterprise low-code application platforms report ([Gart19]) of August 2019 that by 2024 “low-code application development will be responsible for more than 65% of application development activity”. It acknowledges Mendix, OutSystems, Microsoft, Salesforce and Appian as leaders in the low-code application platforms segment in its latest Magic quadrant.

Forrester Research, another independent market research company, evaluated the 13 leading low-code vendors in the market for its Q1 2019 report and named five as leaders, see Figure 3. The report made it clear that the AD&D (Application Development & Delivery) category vendors offer new value to organizations by removing critical limitations on the speed of app development and delivery. The leaders named in this category were Microsoft, Salesforce, OutSystems, Mendix, Kony ([OutS20]).

Clearly, in both the Gartner and Forrester reports, Microsoft, Salesforce, OutSystems and Mendix are positioned as leaders. The maturity of the low-code platforms, with all the additional benefits of integration and extensibility, scalability and performance, security and governance, results in broad adoption.

Next: Breaking the deadlock for low-code - Part-2 Leverage on low-code platforms and key advantages

[Gart19] Gartner (2019, August 8). Magic Quadrant for Enterprise Low-Code Application Platforms.

[OutS20] OutSystems (2020, January 31). The Forrester Wave™: Low-Code Development Platforms For AD&D Pros, Q1 2019. Retrieved from: https://www.outsystems.com/1/low-code-development-platforms-wave/