EVERYTHING
According to Nationalcioreview, a powerful new landscape is emerging where employees across various departments are becoming software builders. This movement goes beyond the concept of traditional shadow IT; it represents a fundamental change in how business problems are solved within large organizations. The speed at which internal teams can now ship solutions—often in days rather than quarters—is driven by the adoption of AI coding assistants and low-code platforms.
The Two Camps of Internal Builders
Internal builders generally fall into two distinct categories, each requiring a tailored approach from the technology organization. The first group comprises engineering teams who are integrating advanced tools like Kilo, Cursor, and Claude Code into their standard workflow. These professionals benefit from faster shipping cycles and cleaner code through AI assistance. The second, equally critical group consists of business builders—non-IT employees in finance, operations, or supply chain. These power users utilize sanctioned AI tools and low-code platforms to automate processes previously requiring IT tickets.
Defining the Sanctioned Path
The most effective strategy for managing this internal development surge is not prohibition, but clear enablement. Organizations must move away from banning everything or allowing everything without oversight. Instead, they should establish a published list of sanctioned tools that have undergone security review and documented data handling rules. For engineering teams, this means approved AI coding assistants tied to Single Sign-On (SSO) with enterprise-grade data handling that excludes proprietary code from training sets. For business builders, it requires curated low-code platforms that respect existing identity and access frameworks.
Tiering Guardrails by Risk Profile
Not all internally built tools pose the same level of risk. A marketing dashboard pulling from a sanctioned warehouse carries less inherent danger than a finance workflow touching the general ledger. To manage this complexity, experts suggest implementing a tiered governance framework:
- Tier 1 – Personal Productivity: Individual workflows focused on summarization or internal analysis. This requires minimal review and light governance, allowing maximum freedom for individuals to build.
- Tier 2 – Team Workflows: Tools shared across departments that integrate with sanctioned data sources but do not interact with regulated or customer-facing information. These require registration in a central catalog and a basic security review.
- Tier 3 – Business-Critical: Any application touching customer data, financial systems, regulated workflows, or external processes. This tier demands a full IT review, formal change management procedures, and continuous monitoring.
The ultimate goal of this structured approach is to make the sanctioned path the easiest path for employees. When approved tools are faster and simpler to access than unauthorized alternatives, shadow IT naturally shrinks. By shifting from gatekeeping to enabling through thoughtful governance, CIOs can harness the immense power of internal innovation while mitigating systemic risk.