Shadow IT: Deciding Between “Know” and “No”

OK, it isn’t that we don’t know that most organizations have one (or possibly many) “shadow IT” teams developing applications. Realistically, most IT development teams are split between developing new applications and supporting existing applications. Spare time is a luxury. 

Unfortunately, this translates into failing to meet the application development needs of business teams. Yet, because they still must meet business or legislative goals, some teams use internal talent to create the applications. Some indicate it is only for a short-term requirement, yet those applications seem to stay around for a long time.

Telling the business teams to stop — in essence, telling them “no” — feels like the necessary path. After all, while they may succeed in creating an application, it is unlikely that the business developers followed any sort of Software Development Life Cycle (SDLC), and they’re equally unlikely to have adopted any type of security best practices. Those reasons and others make one feel as if the proper approach to “dealing” with shadow IT is to just say “no,” perhaps emphatically!

However, the availability of AI has changed the scenario in at least a few ways. For instance, AI assistants have the potential to reduce:

1. the coding timeline for IT teams
2. the testing timeline for Quality Assurance teams
3. the documentation effort of IT teams

All of the above are expected to give development teams greater ability to address the traditional backlog of applications for business units. But we need to consider two factors:

1. IT teams will continue to be challenged to meet all the business teams’ needs.
2. The AI assistants, with guidelines in place, could just as easily be used by the business teams to create applications.

OK, the last statement may generate a ton of discussion but consider the scenario: Business teams really do not want to create security concerns nor do they want an application that is difficult to expand or upgrade (not all are like that). The teams just want to address their business goals, and potentially waiting for IT staff availability may be impractical. 

So, if the IT staff recognizes that AI assistants could help business teams as well as development staff, then addressing shadow IT could switch from “no,” where it is not allowed, to “know,” where it is acknowledged, potentially encouraged, and guidelines are provided. The guidelines likely include an approved set of AI assistants, testing requirements, security and infrastructure assessment approaches, and post-production support, among other items. Acknowledging, or “knowing,” that shadow IT teams exist should encourage more agencywide collaboration and potentially reduce stress.

Your organization still needs to determine the approach that works for it. Just consider that a “no” could change to “know” with respect to shadow IT.

Dan Kempton is the Sr. IT Advisor at North Carolina Department of Information Technology. An accomplished IT executive with over 35 years of experience, Dan has worked nearly equally in the private sector, including startups and mid-to-large scale companies, and the public sector. His Bachelor’s and Master’s degrees in Computer Science fuel his curiosity about adopting and incorporating technology to reach business goals. His experience spans various technical areas including system architecture and applications. He has served on multiple technology advisory boards, ANSI committees, and he is currently an Adjunct Professor at the Industrial & Systems Engineering school at NC State University. He reports directly to the CIO for North Carolina, providing technical insight and guidance on how emerging technologies could address the state’s challenges.

Image by Pete Linforth from Pixabay