This piece is written by Rob Gates, Duco's Chief Architect and Innovation Officer, in his own words. It reflects his personal thinking, not an official Duco position.
We've all stumbled across it. The access database that somehow ended up in the critical path of a regulatory report. The pricing model in a spreadsheet nobody has permissions on. The scheduled task running on an ancient PC that nobody dares turn off.
IT finds out eventually, usually when it breaks. The fix costs money. People learn the lesson. Someone writes a governance framework.
And then it happens again. The frameworks deal with the symptom: which unsanctioned tools people are using. They don't deal with the cause, which is much simpler. People find the fastest path to solving their problem. If the official route is too slow, they take an unofficial one. That's not really a technology problem. It's just people.
Derek's spreadsheet was "shadow IT". But calling it that makes it sound like the problem was Derek. Or the spreadsheet. Nope: Derek had an operational need, the official systems couldn't meet it fast enough, and he built something himself. Entirely rational. The spreadsheet just happened to be the most powerful tool he had at the time.
What's changed isn't the instinct, it's the capability
Arm that same instinct with modern agentic coding tools and the output isn't a macro any more. It's a "proper system". Microservices. Written in rust. It has a README, a test suite, and, according to Claude, it's "100% production ready".
An analyst can now build in an afternoon what would have been a two-month IT project, and critical processes end up running on software nobody in architecture has reviewed and nobody can maintain once the builder moves on. Derek's macro at least looked like what it was. Its successors look like real systems, because they are. Just ungoverned ones.
The blast radius is bigger now
Derek's macro affected one process on one desk. A system built in an afternoon can touch multiple data sets, make matching decisions, and resolve exceptions, at a speed and scale a spreadsheet could never manage. When it goes wrong, the unwind isn't a weekend job.
Make the governed path the fast one
The answer is the one it's always been: give people a governed path that's faster than the ungoverned one, and they'll take it. Not because they care about governance (most don't, and that's fine), but because it's faster.
The catch is that it's a moving target, getting faster every time the models improve. A governed platform that was quick enough six months ago might not be today. Nobody knows where this lands. Anyone claiming otherwise is guessing. So keep the governance constant, let everything else flex, and pick partners who are honest about not knowing the destination either.
The question worth asking yourself is simple: is your governed platform still the fastest route to solving a problem, or has someone on your team already found a quicker way around it?
The instinct that created shadow IT hasn't gone anywhere. It's just picked up considerably sharper tools.