devopsy.kinsta.cloud

Tag: Low-Code/No-Code

  • Why Startups are Betting Big on Low-Code/No-Code

    Why Startups are Betting Big on Low-Code/No-Code

    It is exhaustive — from infrastructure to app delivery, from data to applications — to modernize your practices, processes and providers to ensure you have the underlying foundation to take advantage of whatever comes next.

    Two or three years ago, apps created through low-code/no-code platforms were not usually as detailed under the surface as software developed from scratch, yet they sufficed for certain purposes. There was even a clear distinction between software developers and everyone else out of necessity because software development was incredibly difficult to master.

    But now, as we head towards more advanced AI, the SaaS-based low-code/no-code (LCNC) platforms empower businesses to create software exponentially faster and cheaper than a code-based approach.

    The future, therefore, of startups in this changing business landscape becomes even more competitive, taking into account the increasing importance of customer-centric UI modeling, data product development and cutting-edge technologies like machine learning and deep learning.

    High-Value Acceleration

    Applications built through traditional software development can take months or even years to launch. If you create a code-based solution, it’s also easy to blame others and there’s a lack of understanding if it’s not well-documented. “Low-code no-code functionalities can change this dynamic,” says Dr. Ingo Mierswa, an industry-veteran computer scientist and founder of Altair RapidMiner. “The visual workflow describes what it’s doing, so people can understand it, buy into it and take ownership of the results.”

    Visual workflows can be understood and created by more people. “They make it easier to maintain and explain why anything, such as a model’s decision or a bug, has happened because the workflows are documenting themselves,” Mierswa articulates. “It would be hard to create such an explanation if you had to sift through 100,000 lines of code, especially if the code had been changed 17 times in the past two weeks.”

    You need to iterate, you will make mistakes, and you don’t want to waste time with coding non-critical things. “My big advice for all starters is to always think about what’s critical for your product. What’s your IP? What do you need to own and customize? And if coding is not that important for your product, I think going low-code/no-code is always the better way,” Mierswa shares. “It’s more important for startups because you have less resources, less time, more competitive pressure and markets are moving very quickly.”

    Everyone is a Citizen Developer

    In the early 1960s and 1970s, there was a clear distinction between software developers and everyone else out of necessity. Software development was incredibly difficult and time-consuming to learn and master. But now with the onset of low-code/no-code solutions, everyone from custodial teams to C-level executives can create and customize applications that make their jobs more efficient.

    Because no-code/low-code platforms are built on the fundamental premise. “People closer to the problem are better equipped to find simpler and effective solutions,” says Kissflow CEO Suresh Sambandam. “It’s a team sport, and accountability, the most important benefit of LCNC solutions, accelerates development and empowers even more people to collaborate the right way.”A big advantage,” Sambandam says, “is that CIOs of large enterprises can solve the IT talent shortage plaguing the industry today by leveraging expert business users who are ‘citizen developers.’ Many companies can’t avoid struggling to recruit and retain tech talent in a highly competitive market, but low-code/no-code solutions exceedingly help bridge that talent gap by freeing up the bandwidth of existing resources.”

    At the highest level, you always need people who understand the business problems that need to be solved. LCNC functionalities also empower adjacent team members — designers, product managers, data scientists and others — to take part in the different stages of development as the product takes shape.

    Reducing Technical Debt to Overcome Friction

    In an enterprise scenario, most of the core systems like ERP, CRM, SCM in the front end, as well as in the back end, are bought from standard vendors. There is NO differentiation, as all the top enterprises buy from the same vendor. On the other hand, the bulk of differentiation comes from middle-office processes that are unique to an enterprise. Sambandam points out, “Often these are business processes that require heavy domain knowledge that frequently change to adapt to the evolving business conditions and hence business users are better equipped to build these workflow automations.” He highlights that conventional software development models don’t do justice to the agility required by business users and are too complex for them to use. While business users have the domain knowledge, the system would also require integration touch points with other enterprise systems. These integrations often require deeper technical expertise.

    It is essential to create a cultural change within your organization, where it is not just about having the right tools, but also about investing in your employees and skilling them up, commented DevRev Head of Engineering Ahmed Bashir.
    It still is hard work, and there will be friction. “Overcoming friction requires creating a tighter loop across departments and managers, closing the gap between developers and customers,” he underscores. “And LCNC platforms are designed to act as a system of action, surfacing real-time information that connects work with developers, customers and product.”

    This is exactly where platforms like Kissflow, Blaze and Bubble, which support both no-code and low-code use cases come in and let business users handle the domain portion of the application (90%) and IT teams configure the integration points (10%). This greatly reduces friction between IT and business users, especially when it comes to solutions for long-tail internal workflows.

    Long-tail applications include things like approval management, creative requests, incident management, customer onboarding and IT helpdesk. “We looked at the space and decided to tackle this,” Sambandam shares.

    Long-tail apps and processes are often viewed by IT as a drain on time/resources they don’t have, yet it’s a lack of internal workflow processes automation that gum up digital transformation. “We found as we scaled the company that when you empower business users to quickly build and augment workflows that directly impact their day-to-day by giving them the tools to do so without advanced technical knowledge, they are motivated to make it happen,” he affirmed.

    Security is a Business Enabler

    The main objective of security is to protect organizations and people. Organizations prepare for potential security threats by implementing policies and ensuring they have the tools to mitigate and quickly respond to outside threats.

    However many low-code/no-code adopters do not have security expertise on their team so they rely on the LCNC platform to offer security features readily available for the apps they build. Because creating applications with custom code can lead to a variety of security issues. And such applications are difficult to secure, with the majority of tested applications containing one or more session management vulnerabilities, and others with input validation errors.

    Getting a firm handle on security means considering what to do. That sounds simple enough, but it’s surprising how many startups make blunders because of poor planning and shoddy strategies. “We’ve been looking at a trend. Companies want enterprise-level security like audit logs, SSO and other data security requirements for their apps,” commented Nanxi Liu, Co-CEO of Blaze. “Seeing this strong trend, we worked to design our platform with enterprise security and scalability in mind, since most early-stage companies do not have security expertise on their team and rely on platforms to offer advanced security features for the applications they build.”

    Make, however, no mistake — there is no best security but the best practices. “That’s part of why,” Liu says, “compliance-driven businesses like financial services and healthcare companies that require the highest level of security to build their customer portals, consider enterprise-grade no-code and low-code platforms that provide the required level of security.”

    With low-code/no-code platforms, your applications are secure with industry-standard protocols, data protection practices, and features to block unauthorized access.

    To underscore: LCNC allows non-technical people to build complex apps without needing to be familiar with traditional software logic. You don’t need computational thinking because visual components in low-code/no-code platforms automatically have the logic built-in. “And now with the mind-bending AI breakthroughs,” Liu remarks, “users can tell AI in natural language the workflow or feature they need and see it instantly created.”

  • Low-Code/No-Code Application Development – Putting Users in Control

    Low-Code/No-Code Application Development – Putting Users in Control

    Not long ago, it wasn’t uncommon for a new application deployment to take a year or more. Today, that timeframe is measured in weeks. What has changed?

    For many enterprises, traditional, full-code waterfall application development, with its focus on a sequential define-develop-test-deploy-maintain approach, has given way to low-code/no-code development, a faster, more accessible method for developing and modifying applications using intuitive tools without extensive coding. Low-code and no-code development systems fulfill ever-increasing demands for fast application delivery and highly customized automation workflows.

    In addition to putting control back in the hands of users who know their needs best, low-code and no-code systems are also credited with improving developer productivity by enabling professional developers to streamline aspects of the development process.

    According to Gartner, the no-code/low-code platform market is forecast to grow almost 20% in 2023 to $10 billion and reach $12.3 billion in 2024. This growth is not surprising when you consider the following:

    • Tech Talent Shortage. The market for low-code/no-code platforms is driven in large part by a global shortage of skilled software developers, a situation that is expected to continue throughout this decade. Low-code/no-code platforms enable companies to quickly get development projects off the ground without the need for professional developers.
    • Focus on Cost. As companies become ever more mindful of their tech spend, low-code/no-code solutions can offer an accelerated, less expensive alternative to custom software development, which involves professional developers, longer development cycles and more comprehensive support programs.
    • Need to Reduce IT Backlogs. Low-code/no-code is also having a significant impact by reducing application enhancement backlogs in IT departments and application requests from end users that haven’t yet been addressed. In many companies, this backlog is years long. With no-code/low-code, users can actually create and/or modify applications themselves rather than waiting in a queue for their needs to be addressed.
    • Agile Development. Many companies today follow the Agile methodology of software development, where teams work together in incremental cycles to continuously improve. Key drivers of Agile development are flexibility and speed. Low-code/no-code application development can empower those teams with a faster approach to continuous software development based upon pre-defined elements and templates and drag-and-drop interfaces.
    • Growth in Cloud-Native Applications. Growth in low-code/no-code is driven in part by the increased adoption of cloud-native technologies as organizations rapidly embrace the benefits and availability of the cloud. The advantages of cloud-native software development include increased agility, lower hosting costs, faster time to market and improvements to user experience.

    Understand the Landscape and the Limitations

    While low-code/no-code development is on the rise, helping companies roll out almost-ready-made solutions quickly, cost-effectively and with less risk, it is essential to understand that it can come with sacrifices to scalability, flexibility and integration with existing tools.

    Solutions won’t always have a customized front end, they may not have industry-first capabilities, and they’re often viewed as software commodities. Yet, maybe it isn’t always about the technology that drives the outcome but the user experience it delivers.

    One of the hallmarks of a successful organization is striking the right cost/benefit balance. For today’s organizations, faced with labor shortages, tight profit margins and a need for speed, knowing when heavy-lifting custom software development is required and when low-code/no-code offers a better, more cost-effective approach can mean the difference between success and failure.

  • Low-Code/No-Code Testing: Prioritizing AI-Enhanced Test Automation

    Low-Code/No-Code Testing: Prioritizing AI-Enhanced Test Automation

    As organizations strive for faster application delivery and uncompromising software quality, traditional approaches to test automation fall short. With the emergence of low-code/no-code powered by Agile methodology and AI-enhanced tools, a new era of efficient and effective QA automation services has dawned. The expectations of the modern digital landscape require test automation services to undergo a profound transformation.

    Low-code/no-code QA automation services represent a paradigm shift in the software world. Its simplicity, agility and AI-driven capabilities enable organizations to embrace a more efficient and effective approach to testing.

    What Low-Code/No-Code Brings to the Test Automation Landscape

    ● Hassle-free test automation: Low-code/no-code platforms empower testers to automate regression and functional testing with remarkable ease, reducing the reliance on complex scripting and coding. This simplicity accelerates the testing process, enabling quicker iterations and faster time-to-market.
    ● Agile alignment and unparalleled speed: Low-code/no-code test automation seamlessly integrates with Agile methodology and ensures that testing keeps pace with rapid development cycles. This alignment enables organizations to deliver high-quality software within shorter timeframes, gaining a significant competitive edge.
    ● AI-enhanced QA automation tools: By harnessing the power of artificial intelligence, low-code/no-code test automation tools can intelligently analyze vast amounts of test data, identify patterns and make informed decisions. This enhances test coverage, improves efficiency and minimizes false positives, resulting in more reliable and accurate test results.
    ● Cost savings and optimal resource utilization: By significantly reducing the need for extensive scripting and coding expertise, low-code/no-code quality assurance testing reduces maintenance costs and frees up valuable resources. Organizations can allocate their testing budgets more effectively, achieving higher ROI on their quality assurance investments.
    ● Uncompromising Software Quality: Through comprehensive and automated testing, low-code/no-code test automation ensures robust software quality. By minimizing the risk of human errors and identifying defects early in the development life cycle, organizations can deliver superior products that consistently meet or exceed customer expectations. This focus on quality helps build trust, enhance brand reputation and drive customer loyalty.

    Why You Should Prioritize Low-Code/No-Code Test Automation Services

    DevOps teams that recognize the potential of low-code/no-code QA automation services and their ability to drive innovation will be well-positioned to lead their organizations to success.

    Here’s what AI-enhanced low-code/no-code test automation specifically brings to the table for DevOps:

    ● Agility for competitive advantage: Agile methodology combined with low-code/no-code QA automation allows organizations to respond quickly to market changes, customer feedback and emerging opportunities. DevOps teams can ensure that they embrace agility, enabling them to outperform competitors and capture new markets swiftly.
    ● Unleashing the power of AI: AI-enhanced quality assurance testing platforms leverage the capabilities of artificial intelligence to drive intelligent testing. DevOps teams can harness the power of AI to enhance test coverage, identify complex patterns and make data-driven decisions that optimize testing processes and ensure high-quality software.
    ● Resource optimization and cost efficiency: By adopting low-code/no-code test automation practices, teams can optimize resource allocation and testing budgets. The reduced reliance on specialized coding skills allows organizations to leverage the full potential of their testing teams, saving costs and achieving more efficient testing outcomes.
    ● Meeting the demands of software quality: In today’s competitive market, software quality is non-negotiable. DevOps teams must prioritize Agile methodology and AI-enhanced test automation to ensure that their organizations consistently deliver high-quality software that meets or exceeds customer expectations. This commitment to quality helps build trust, enhance brand reputation and drive customer loyalty.

  • Tricentis Acquires Waldo to Further Advance Mobile Testing

    Tricentis Acquires Waldo to Further Advance Mobile Testing

    Tricentis has acquired Waldo as part of an effort to expand the scope of the automated testing capabilities it provides for mobile applications.

    Waldo adds a software-as-a-service (SaaS) platform that provides IT teams with a no-code tool for generating mobile application tests. Waldo uses a virtual environment to simulate iOS and Android devices in a way that eliminates the need for physical devices to conduct tests. Instead, DevOps teams record their applications and then use the no-code tools to generate tests directly from within a browser.

    Tricentis CTO Mav Turner said Tricentis opted to acquire Waldo because it makes it simpler for IT teams to generate tests that can be integrated across a DevOps workflow.

    There currently is a lot of debate over how far application testing should be shifted left toward developers. In theory, the more developers test applications themselves the fewer issues there should be once an application is deployed in a production environment. However, there is still going to be a need for dedicated testing teams to conduct tests across multiple stages of the application development process to ensure quality, noted Turner.

    The difference is more of those tests can include edge use cases that previously there would not have been enough time to conduct, he added.

    Earlier this year, Tricentis added the ability to test native iOS and Android applications to its Testim software-as-a-service (SaaS) platform as part of an effort to extend the reach of that platform to applications that run natively on a mobile device.

    Testing mobile applications is more critical than ever because the cost of failure—in terms of impact on the business—is now much higher as more organizations depend on software to drive business processes. The challenge is that many of these app developers don’t have a software engineering mindset, so they need testing platforms that automatically create and run tests on their behalf in a way that can be customized for specific use cases.

    Over time, the quality of applications should steadily improve as many of the low-level mistakes that developers make are eliminated. That should improve everything from application security to the user experience as applications are continuously updated.

    In addition, organizations that embed testing within DevOps workflows are steadily reducing the number of issues that need to be addressed before applications are deployed.

    Hopefully, as more artificial intelligence (AI) is applied to the testing process, the number of reasons tests are not run as frequently as they should be will steadily decline. Today, it is still too difficult for many developers to author tests, so they don’t conduct as many as they should. Of course, many of them also simply run out of time when writing the code that drives the application takes longer than anticipated.

    One way or another, developers will run out of excuses for not running tests as accountability for code quality increases.

  • How to Avoid Risk When Using Multiple Low-Code Platforms

    How to Avoid Risk When Using Multiple Low-Code Platforms

    Organizations are still increasing their use of low-code/no-code (LCNC). But this adoption isn’t always consolidated around one tool—frequently, multiple low-code/no-code platforms are used under the same roof. In fact, Gartner predicts that by 2024, 75% of large enterprises will be using at least four low-code development tools for both IT application development and citizen development initiatives.

    Utilizing multiple low-code/no-code platforms simultaneously introduces some security concerns. This is partially due to a lack of standard policies to govern different platforms in the same way. Low-code platforms are often incompatible with traditional IT security processes, like vulnerability scanning, manual code reviews and runtime security monitoring. Organizations going all-in on citizen development need safe ways to use low-code/no-code platforms. So, how can they safely enable this innovation without hindering productivity?

    I recently met with Michael Bargury, CTO and co-founder, Zenity, about securing LCNC systems. Bargury, who oversees the OWASP Low-Code Top Ten list, has significant insight into both the benefits and drawbacks of low-code/no-code platforms. Below, we’ll review the potential risks of using multiple low-code platforms and consider ways to mitigate these concerns.

    Why Companies Have Multiple Low-Code Platforms

    Interest in low-code has been rising, and low-code/no-code adoption continues to accelerate across enterprises. According to Bargury, large enterprises often don’t get a choice in the matter—low-code tools are arising organically, and it’s challenging to keep a lid on their proliferation.

    One way this occurs is that low-code becomes embedded into the SaaS platforms everyone already uses. Software platforms integral to business operations, like Salesforce, Microsoft Office and ServiceNow, have arguably mutated into low-code platforms, making them more like cloud providers than SaaS vendors, said Bargury.

    The other way low-code platforms emerge is through bottom-up transitions, says Bargury. This could be a specific knowledge worker working in a subset of the business to automate a domain-specific operation or integrate various tools. Then, there are the platforms, like OutSystems, Mendix or Mulesoft that specifically target professional developers.

    Organizations going all-in on citizen development may build a center of excellence and focus efforts on a single platform. And low-code platforms targeting developers will sometimes encourage more consolidation. Yet, “different platforms solve different use cases better,” explained Bargury. As a result, you will usually have a few converging in the same enterprises.

    Potential Security Concerns of Multiple Low-Code Platforms

    The emergence of low-code is similar to the bring your own device (BYOD) movement. IT and security leaders fought to avoid it at one point, but nowadays, everyone does it. So, what are the security implications if low-code becomes similarly ubiquitous? Well, no matter how it’s generated, low-code-bred programs are still applications susceptible to the same logical problems. And unfortunately, compared to your typical traditional code development life cycle, low-code development is fraught with discrepancies, says Bargury.

    Immature CI/CD Pipelines

    Some platforms do not offer the kind of mature CI/CD process one would expect from a software development platform. For example, there may be no way to create tests or separate your environments. Since there’s no coherent and consistent way to push code from development into production, you lack a way to apply secure development across platforms. “You don’t have a way to ensure every piece of software is up to your standards,” said Bargury.

    Opaque Underyling Codebases

    In traditional software development, you apply your own security reviews to ensure applications don’t contain risks. This includes shift-left scanning, security gates, manual reviews to catch mistakes early on and runtime scanning to catch unknown vulnerabilities in production. But there aren’t always parallels in low-code development. Low-code solutions typically have their own way of doing things with fewer standards, and they avoid exposing the underlying code and Git, said Bargury.

    Lack of Visibility

    As such, with low-code obfuscation, you lose a degree of visibility into how an application runs. Logs may be insufficient or wholly inaccessible. It’s also tricky—or at times impossible—to set up runtime monitoring, let alone scan various platforms. This means that low-code users can’t leverage powerful observability tools to identify errors and remediate security holes.

    Lack of Unified Policies

    Finally, establishing common authorization and permissions across multiple low-code development platforms is another hurdle. Since low-code vendors have their proprietary building blocks, you’re unable to leverage something like OPA or Kyverno to create and unify policies. Lacking shared policies across tools makes it challenging to verify that best practices have been implemented, says Bargury.

    How to Secure Multi-LCNC

    Low-code can grant much creative potential. But, knowing the above risks, what should IT be doing to reduce risks around low-code—especially when using multiple platforms? Well, Bargury shared several steps to help cybersecurity leaders start safely addressing the emergence of increasingly low-code capabilities.

    1. Take low-code development under the application security umbrella. First, low-code must be brought under the security umbrella, if it isn’t already. “It should be part of their mandate,” said Bargury. Shift the responsibility to professionals well-trained in resolving threats.
    2. Understand your surface area. As a basic security tenant, you can’t secure what you don’t know. Thus, Bargury recommends increasing your visibility into each low-code platform by collecting logs when possible and centralizing your analysis.
    3. Create automated guardrails. Next, it’s critical to identify your risks and set guardrails for your low-code users—especially when citizen development is involved. The OWASP framework provides a good overview of common risks and mitigation advice across robotic process automation (RPA), integration and low-code. In general, it’s important to design permissions with the rule of least privilege in mind. This can help reduce the chance of vulnerabilities like LCNC-SEC-03: Data Leakage and Unexpected Consequences and LCNC-SEC-01: Account Impersonation.
    4. Address gaps within the development life cycle (SDLC). Lastly, low-code platforms often provide the building blocks to secure applications, but it’s still up to you to ensure they are safely used. Cybersecurity teams should continually audit the low-code SDLC to ensure holes don’t persist.

    You’re Responsible for Securing Low-Code Development

    Low-code development platforms aren’t 100% safe from harm. It’s not out of the question for hackers to abuse low-code platforms and turn them against their owners. For example, Microsoft’s Detection and Response Team (DART) reported how a hacker group used entry to a low-code tool to remain hidden within an organization for six months, using credential stuffing to access an administrative account. By creating automations, they were able to use internal discovery tools and exfiltrate secrets and data that could have been used for privilege escalation.

    As you can see, there are legitimate concerns for low-code, especially at scale. However, security responsibility is not always that transparent. To date, there isn’t an equivalent of a shared cloud responsibility model in the realm of low-code development. As such, at the end of the day, you need to take the reins to own the applications that you build and ensure everything is secure.