The term Shadow IT used to refer to software infrastructure that a company relies on, without the explicit knowledge of the company’s IT department. It can be a massive Excel spreadsheet, it can be some VB script or a SaaS subscription that no one is aware of.

Shadow IT is, by definition, unmanaged. That means that you can move forward a lot more quickly, because you aren’t constrained by the slow company processes. The problem with that is that those processes include things like security, compliance, etc.

A typical example is needing to do a survey. Google Forms does that, no? Let’s just use that rather than try to figure out what the actual survey tool in the company is. I’m sure that you can recall at least a few such stories, where all the replies were available to anyone with a browser.

With AI, it is getting more interesting. Instead of having to wait for IT, non-technical users can build complex systems that bring real value to the company. They are also completely horrendous in terms of meeting the requirements of most organizations.

I just watched a non-techie present an amazing report, showing detailed analysis and visualization that allowed us to really understand what is going on. The “report” is an interactive web application running at localhost on port 3000. That is a Node.js app that Claude built. It pulls data from four different sources, aggregates it all, slices & dices the data and presumably kicks the CISO’s puppy along the way.

Amazing results, but it can only run on their laptop. And looking at the report from last week requires that we find the relevant screen shot, etc…

The problem is that this is useful, and the kind of result that would take a team of two devs three months to deliver. It isn’t worth 6 man-months of development effort, but if it takes a few hours, then it brings a lot of real value.

Now the problem is that this is actually useful, but as it currently stands, it isn’t something that can be taken off that laptop. Making that into a real app still takes multiple man-months to do it properly, securely, and maintainably.

That is going to be a serious concern going forward, I think. Shadow IT and those sorts of one-off apps are going to be much more common. The problem is how they fit into the overall organizational structure.

It is easy to be frustrated by the onerous requirements that most organizations have for building software, especially when you realize how easy it is to just ask the model to generate that for you. The problem is that they are not the same. Just considering a single aspect like backups, for example (and the associated compliance for it), can take more time than it took for the model to generate the entire application.

I don’t have a good answer for this problem, but I can see that it would be a major problem going forward.