Low-code platforms are sold on what they are supposed to do to a team: business staff build their own tools, and IT stops being the queue everyone waits in. The published evidence for that promise is thinner than the marketing implies. The three biggest named deployments in circulation, at Pacific Gas and Electric, HEINEKEN and Rabobank, are all described in documents published by the platform vendors themselves. The strongest independent material runs the other way, toward governance costs documented in a peer-reviewed study and 38 million records left readable on Power Apps portals.
Who Published the PG&E and HEINEKEN Figures
Microsoft’s own customer story for Pacific Gas and Electric is the most detailed low-code deployment account currently in public circulation. Microsoft states that the California utility enabled more than 4,300 Power Platform makers and built over 2,000 Power Apps applications across four years, alongside 4,200 Power Automate cloud flows and 315 deployed business solutions.
The people quoted in that story are PG&E staff named by Microsoft: Thomas Bilbo, a principal and product owner, executive sponsor Mark Seveska, principal product owner Eric Soria, and Alla Gogerman, who leads intelligent process automation. The HEINEKEN account, published 19 December 2025, follows the same pattern. Both are vendor documents about the vendor’s own product, written with the customer’s cooperation. Neither has been audited by anyone outside the parties involved, and neither is a random sample of anything; success stories are selected because they succeeded.
- Microsoft states PG&E saves 527,000 hours annually and $75 million a year.
- Microsoft states PG&E’s internal chatbot, Peggy, fulfils 25 to 40 percent of helpdesk demand and saves $1.1 million annually, and that an automated SAP account-unlock flow saves 840 hours a year across 4,200 calls.
- Microsoft’s HEINEKEN case study states more than 7,500 makers, over 10,000 applications built, more than 42,000 Power Automate flows, and over 8,000 environments governed by a five-person product team.
- Microsoft claims 3.1 million hours of increased productivity for HEINEKEN, and roughly 300 hours a year saved by a single Amstel Brewery customer agent.
- HEINEKEN staff quoted by Microsoft include Jakub Jakubowski, Giada Binelli, Tom Winter and Sabine van Woerden.
A Customer Story With No Customer Voice
The Rabobank example deserves closer reading than it usually gets. A Mendix press release dated 9 January 2020 says the Dutch bank built RaboDirect, an online-only banking portal for Belgian and German customers, on the Mendix platform, and claims a 50 percent reduction in IT costs together with weekly release cycles.
The release carries two quotations. One is from Bram Voogel, a customer success director at Mendix. The other is from Hans de Visser, then a vice president of product management at Mendix. No Rabobank employee is quoted anywhere in it. A halving of IT costs is a serious claim about how an engineering organisation works, and the only voices attached to it work for the company selling the tool. When an article about team dynamics reaches for that statistic, it is repeating a supplier’s description of a customer, not the customer’s description of itself.
Thirty Interviews on What Citizen Development Costs to Govern
The peer-reviewed literature is smaller and much less cheerful. Viljoen, Radic, Hein, Nguyen and Krcmar published “Governing Citizen Development to Address Low-Code Platform Challenges” in MIS Quarterly Executive in 2024, drawing on 30 interviews with citizen developers and low-code platform experts.
Their abstract states plainly that entrusting software development to novices risks substandard software quality, shadow IT and technical debt. Their conclusion is that governance of citizen development diverges from conventional software-development governance and depends on technical experts plus platform-specific controls.
That finding cuts directly at the team-dynamics pitch. Professional engineers are not removed from the picture; their work moves from writing the application to reviewing, constraining and cleaning up after applications written by people who do not think about permissions, data retention or upgrade paths. Whether that is a net gain depends on how much review capacity an organisation actually has, which is exactly the variable no vendor case study reports.
Thirty-Eight Million Records, Readable Without a Password
On 23 August 2021 the security firm UpGuard published research finding 38 million records exposed across hundreds of Microsoft Power Apps portals, reachable through more than 1,000 anonymously accessible OData lists. This is the closest thing the low-code field has to a documented, named, independently investigated failure.
The technical cause was a default. When OData APIs were enabled on a Power Apps portal, table permissions were disabled unless someone turned them on, leaving records readable at the portal’s data endpoint. Microsoft initially classified the behaviour as by design rather than as a vulnerability, then changed the default and shipped a Portal Checker tool. The Register covered it on the same day under the headline noting Redmond’s advice was to read the manual, and Dark Reading reported it independently as well.
- J.B. Hunt: 1.16 million records, 253,288 of them including Social Security numbers
- Indiana Department of Health: 1.09 million COVID-19 contact-tracing records
- Denton County, Texas: 1.29 million vaccination appointment records
- American Airlines: 869,290 records
- New York City Schools: 704,175 records, and the New York City MTA: 194,824
- Maryland Department of Health: 388,512 records; Ford: 104,578 employee records
- Microsoft’s own internal portals, including Global Payroll Services
When the Licence Price Moves After the Apps Are Built
Gartner’s November 2025 forecast analysis projects the low-code market at $58.2 billion by 2029, growing at a compound annual rate of 14.1 percent, according to the public abstract of a report that is otherwise paywalled. Growth of that order tends to be read as validation. It can equally be read as a description of how much money will be locked into platforms owned by a small number of suppliers.
What that looks like in practice was documented in January 2026 by licensing analyst Jukka Niiranen at The Licensing Guide, working from Microsoft’s own updated licensing documentation. The Power Apps per-app plan was withdrawn for new purchases. The pay-as-you-go alternative works out at roughly $10 per app per month for consistent use, against the $5 the retired plan charged. That is a doubling of the running cost of an application a customer has already built, decided by the platform owner. Niiranen notes that no firm date has been published for when existing per-app licences stop being renewable.
One number this article deliberately does not print is a low-code project failure rate. Figures of that kind circulate widely, but the pages carrying them are content-marketing posts from tools vendors recycling unattributed percentages, with no primary source underneath. An article correcting invented case studies has no business substituting an invented statistic.
Sources: Microsoft Customer Stories · Microsoft Customer Stories · Mendix · MIS Quarterly Executive · UpGuard · The Licensing Guide
