Shadow IT 2.0: Creating AI solutions outside of IT exposes weaknesses in companies' data governance

Panorama Vibe Coding Brasil indicates that scattered data, legacy systems, and sending information to external servers are the main bottlenecks

The popularization of generative artificial intelligence allows professionals from different areas to create automations, applications, dashboards, and integrations within companies. However, much of this movement occurs outside of formal technology processes and without clear rules about what corporate data can circulate within these tools. This is what the Panorama Vibe Coding Brasil, a study by Skyone, a Brazilian cloud, data, AI, and cybersecurity company, in partnership with the TNS Group, shows. The results were presented on Tuesday, October 6th, at an event at Skyone's headquarters in São Paulo.

Of the 1,971 participants, 50% stated that they themselves or their companies have already developed such a solution without a formal IT project. This trend is recent: 43% of the sample say this occurred in the last six months. Among those who have already created something, 85.2% did so without formal involvement from the technology area. Of this total, 51.1% developed the solution alone and 34.1% with their own team. Only 14.8% had occasional support from IT.

The study calls the phenomenon "Shadow IT 2.0," an extension of the traditional concept of Shadow IT, linked to the contracting of software without knowledge of the technology area. With vibe coding, the practice of creating systems from instructions in natural language for an AI tool, what escapes the control of IT now also includes applications built by the employees themselves.

The presentation of the results was given by Julia Travaioli, Marcela Lahoz, and Gabriella Busse, from Skyone's commercial and partnerships area. Travaioli recalled that "vibe coding" was chosen as the word of the year 2025 by the Collins dictionary. According to her, the research treats the term as a behavior, not as a specific technology: the professional describes the problem, the AI ​​writes most of the code, and the user tests and adjusts the result. In Julia's assessment, the model breaks with the traditional script, in which a demand becomes a request and gets stuck in the technical area's queue. What previously took weeks can now be transformed into a prototype in an afternoon.

According to the data presented, the global vibe coding market is expected to reach approximately US$7 billion in 2026 and US$15 billion in 2031, representing a projected growth of 17% per year.

Marcela Lahoz highlighted that, for almost half of the respondents, AI is already the main tool for searching for information at work, ahead of traditional search engines. According to her, those who have already created a solution on their own are twice as likely to directly consult a large-scale language model (LLM).

Marcela also challenged the idea that this profile is concentrated among young people in the technology field. The rate of those who have already created solutions outside of IT reaches 62.7% among C-level technology executives, 57% among analysts and specialists, 55.1% among managers and coordinators, 51.8% among developers, and 50.5% among C-level business executives. The practice is also more frequent in large organizations: 58.9% of professionals in companies with more than a thousand employees have already created something on their own, compared to 40% in companies with up to 50 employees. According to Marcela, this makes large companies more susceptible to harboring solutions that have not been validated by IT. The study does not point to the causes of this difference.

Among those who have already developed solutions, 52% created process automations, 47.6% internal applications or systems, 33% AI agents or assistants, 18.7% system integrations, and 14.4% chatbots. The question allowed for multiple answers.

Research shows that rules for corporate use of AI data are still poorly defined. 42.9% of respondents say their companies have no guidelines on what data can be used in these tools. Another 26.3% report clear and formalized rules, 18.6% say guidelines exist but are poorly communicated, and 12.2% did not know how to answer.

Adoption is also fragmented. For 26.8%, each person uses the tools on their own, without official guidance. Another 24.2% say that each area chooses its own solutions, without standardization, and 18.8% work in companies that encourage AI, but without defined guidelines. Only 25.1% report formal encouragement accompanied by clear rules.

The largest of the three identified adoption profiles, called "creation with fragmented guidance," accounts for 42.7% of the sample. In this group, 59.2% have already created some solution, 60.9% indicate a lack of data guidelines, and 86.4% of the creations occurred without formal IT involvement.

According to Gabriella Busse, who led the final part of the presentation, agility is real, but the speed makes it difficult to know who else in the company knows the solution and what information is being entered into the AI ​​tools. She questioned what happens to these applications and the data involved when the professional who created them leaves the company. For Gabriella, this scenario makes information governance and security more complex and more expensive. She related this movement to IT response time: respondents report deadlines ranging from less than a day to more than two weeks for a request to be fulfilled.

Felipe Wasserman, Marketing and Growth Director at Skyone, believes that AI has lowered the barrier to entry for developing solutions, allowing applications to emerge and scale before needing to go through company controls. According to him, when a tool starts accessing corporate data, serving multiple people, or supporting a significant process, the lack of visibility becomes a governance problem. For the executive, the risk lies not in experimentation, but in the lack of knowledge about what has already been created, who uses it, what data circulates, and who is responsible for any failures.

In the debate that followed the presentation, Rennan Sanchez, CTO of Skyone, stated that data organization and governance are currently the main challenges in converting AI experimentation into business results. In his assessment, the creation of solutions by business areas is a positive first step, as it brings development closer to those who understand the problems. The next step, however, involves security, governance, and connection to primary sources of transactional data, and it is there, according to the executive, that the problems begin.

According to Sanchez, the raw material for AI applied to business is private and transactional data that is organized and structured. Without it, applications tend to be restricted to uses such as research and discovery. He cited food retail as an example of data silos: point-of-sale (POS) information goes to the warehouse management system (WMS), passes through other checking tools, and then reaches the ERP. Each system concentrates high-value data, but this data is usually scattered and poorly integrated.

In the CTO's view, the AI ​​journey begins by providing access to this data, migrating to the cloud to gain scalability and security. Then comes the centralization of different sources and, only then, the connection of agents and other applications. He pointed to legacy systems as one of the main barriers to AI scalability, as older transactional software often has poor connectivity, low API exposure, and large databases.

Sanchez also mentioned the concept of an "AI factory," used by the market to describe the chain that goes from the chip and energy to the generative models, agents, and frameworks that reach the end user.

When questioned about the risk of data leaks, the CTO stated that professionals have been sending reports, profit and loss statements, billing data, and customer lists to AI tools. According to him, when edge models are used directly, the data leaves the company. In addition to processing, files such as spreadsheets, PDFs, and images are stored on external servers and, according to each provider's terms of use, may be used for training.

As alternatives, Sanchez cited clear rules about what can and cannot be included in AI tools, the adoption of guardrails, and, preferably, the storage of these files on private and dedicated servers. For larger companies or those subject to compliance requirements, he pointed to private inference, with open-source models running on their own infrastructure, as a way to keep processing and files under control.

The executive said that CIOs, IT managers, and data professionals have been pressured about these issues, but have not yet found solutions. He stated that he was surprised by the incidence of creation outside of IT in large companies.

According to Sanchez, leaders face a dilemma between blocking the use of AI, which reduces productivity and innovation, and allowing adoption and establishing controls afterward. He compared the current situation to the evolution of cybersecurity in companies that start with poorly protected networks and only begin to address the problem as they grow. More regulated markets, due to protection and certification requirements, have less room to expand its use.

Regarding return on investment, the CTO stated that many companies are still in the experimentation phase. He compared the cost of inference to that of electricity, which is difficult to directly correlate with the value generated. Instead of buying individual licenses, a significant portion of which, according to him, remains idle, he cited the creation of credit pools that allow tracking who uses the tools and how.

Skyone proposes a six-step framework: mapping what has already been created; defining data and security boundaries; empowering professionals; offering controlled experimentation environments, such as sandboxes that do not involve production data; bridging the gap between business and IT; and establishing criteria for a prototype to be treated as a corporate solution.

For Wasserman, the question is no longer whether people will use AI to build solutions, because that's already happening. According to him, the opportunity lies in transforming this experimentation into sustainable innovation, with clear boundaries for data, security, and governance. The role of IT also changes: from an area that receives demands to a layer that helps the business transform experiments into secure and scalable solutions.

Hernane Ferreira, CEO of The News, stated that the number of participants was surprising for a niche topic and attributed the interest to the popularity of the term "vibe coding," which is still poorly understood by the public. According to him, the production of primary data tends to gain relevance for media outlets.

The survey was conducted by The News, commissioned by Skyone, between September 10 and 25, 2026, online and anonymously, with subscribers of the publication. 1,971 complete responses and 1,539 partial responses were recorded. Because this is a survey with its own audience, the results do not necessarily represent all Brazilian professionals. The questions about what was created and how had a base of 986 respondents.

Written by Skyone