Ollie Kretovs
Partnerships, EMEA, Retool
Vibe coding offers big benefits, such as increasing staff productivity. Even so, organisations must be aware of its risks — and the importance of security and good governance.
If your organisation has the right guardrails in place, you’ll find there are some major upsides to ‘vibe coding’. The trouble is, without the proper protections, there can be some major downsides, too. It’s that lack of governance and security that is giving leaders pause for thought and preventing wider adoption of this ultra-accessible, AI-enabled software development process.
In truth, the benefits and risks that vibe coding present are not widely recognised — yet — because it’s a relatively new term for a relatively new practice. It was coined by artificial intelligence researcher and computer scientist Andrej Karpathy in early 2025 to describe a way of building software with AI. In a social media post, he said: “There’s a new kind of coding I call ‘vibe coding’, where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.”
A quick and efficient way to democratise software building
In other words, you don’t have to be a coding expert to create applications such as websites, chatbots, dashboards and other software tools anymore. Thanks to the way AI has evolved, pretty much anyone in any organisation can do it these days. You simply tell the technology what you want in plain language — and then sit back and let it do the rest.
It sounds simple (and it is), but the results could optimise the way you work. You might be, say, a health professional who wants to build an application to better track patient data, or a finance team that needs a tool to quickly review customer contracts. Whatever type of operational software you need, vibe coding can swiftly deliver it for you.
“Two forces have converged to bring vibe coding into focus right now,” explains Ollie Kretovs, Partnerships, EMEA at Retool, a secure vibe coding platform which works with global enterprises of every size. “On one side, the latest AI models have become capable enough to generate fully working applications from a singular prompt (ie. one single sentence). On the other, more businesses are being pressured to deliver AI outcomes. In one of our latest reports, 90% of senior managers and security leaders said they were under increased pressure to enable AI-powered app building.”
The productivity and money-saving benefits of vibe coding
This is why, in theory, vibe coding is such an attractive prospect. As it’s easy to do, staff don’t have to wait for over-stretched technical teams to get around to building the applications they need or want. They can simply do it themselves. “It certainly allows coding to happen faster,” agrees Kretovs. “It democratises software building. When we look at our stats, we see that just 36% of our users are developers. The rest are non-developers.”
It’s precisely because those non-developers are now able to make their own software apps that vibe coding becomes a potential money-saver for a business. “Organisations don’t have to hire people on large salaries to do their coding,” he says. “In that sense, vibe coding is definitely more cost-effective.”
However, stresses Kretovs, this doesn’t make technical teams redundant. “We’ve transitioned to the point where writing lines of code is not really central to the programming experience,” he says. “Understanding software concepts such as architecture, testing, security and debugging has become a lot more valuable.”
Done the right way, vibe coding will give everyone the chance
to turn their ideas and experiments into secure live projects
Vibe coding risks have been a barrier to its wider adoption
The positives, then, are plain. However, in practice, the inherent risks of vibe coding are a barrier to its use. One of the biggest concerns is around safety. After all, a vibe-coded prototype might look wonderful and work well, but if it hasn’t been created and tested by a member of the technical team, how can users be sure that it’s properly secure? “The software you build may look and feel impressive,” admits Kretovs. “But that can give people a false sense of security. If your staff are building shadow AI applications and spreading them around the business, they may not be thinking about the technical aspects and governance that make a system safe.”
There are a number of other reasons why vibe-coded prototypes never reach production. For example, an application will need access to company systems and data. But how can an organisation control what data the app can access — and who is allowed to access it? Will the app be able to connect to any data reliably and securely? Will it be running in the cloud? And could it be leaking data outside your four walls? If that happens, it could prove to be a costly experience.
Depending on the case, it may expose your organisation to very large fines, notes Kretovs. If, say, customer data is compromised, it could result in legal action, too. According to Retool, 39% of users say that integration challenges between systems are a barrier to continuing with AI adoption; while 41% have concerns around data privacy, governance and protecting proprietary information.
Finally, when vibe-coded software is built, who will review and test it pre-deployment, and then host, monitor and manage it post-deployment? Who is ultimately responsible for applications that are built by members of staff outside of the software development team? control of the AI tools used for vibe coding. In effect, it allows technical staff to become administrators of these tools and decide who gets access to them — and who doesn’t.
“A centralised platform also gives technical teams an overview of the apps that staff are building along with the data sources they are using,” explains Kretovs. “It’s a way to make sure that no one is accessing systems they shouldn’t be accessing.” Technical teams can then test, monitor and maintain the applications that The solution to all of these challenges is a governed, centralised platform which gives an organisation’s technical team complete visibility and total control of the AI tools used for vibe coding.
Why a centralised platform is key to governance and security
Kretovs believes that the solution to all of these challenges is a governed, centralised platform which gives an organisation’s technical team complete visibility and total have been built and ensure they present no security risk — and they can grant the permissions to access them. It’s a risk mitigation innovation that is the key to unlocking real adoption of AI and AI-driven rewards.
Understanding what comes next in the vibe coding journey
Because of technology like this, Kretovs is optimistic about the future of vibe coding in the workplace. If carried out safely and securely, he believes it’s just too good an opportunity to pass up. “It allows people who have direct knowledge of a problem to build the apps, websites and chatbots needed to solve it,” he says. “It means that projects that were proposed but never built — for many different reasons — are able to come to fruition.”
Teams at Retool have certainly used vibe coding to increase their productivity. But, as you would expect, robust guardrails secure the entire process. “If I vibe code an app,” says Kretovs, “it still has to be tested by other teams before it’s approved as an official business system.”
His advice for any organisation new to vibe coding is simple. Take the same care. And make visibility and good governance central to your vibe coding journey, rather than just trying to add it on as an afterthought. “Done the right way, vibe coding will give everyone the chance to turn their ideas and experiments into secure live projects,” says Kretovs. “It could help transform the way they work.”
