# Low-Code, Vibe Code, and Shadow IT on Dope > Low-code platforms were governed but slow. AI tools made building free and ungoverned. The result is shadow IT on dope, and the fix is not banning the tools, it's a third era where the platform is the context, not the app builder. 2026-08-17 · Tim Cadenbach · https://www.tcdev.de/blog/shadow-it-on-dope/ --- A couple of weeks ago I sat in a call with the ops lead of a mid-sized company, maybe 400 people, and at some point he shared his screen to show me something unrelated. In his bookmarks bar I counted five internal tools. Vacation planning, a vendor tracker, two dashboards, something with inventory. He'd built all five himself with AI tools, in evenings, and he was visibly proud. I asked whether IT knew about them. He laughed. Not a no. A laugh. Every one of those tools had customer or employee data in it. None of them had ever seen a security review, a backup policy, or a second pair of eyes. And here's the part that stuck with me: he wasn't doing anything wrong by his own lights. The official way to get a tool built would have taken two quarters and a budget line. His way took a Tuesday. That bookmarks bar is where a twenty-year story arrives, and I think you can only understand the mess by looking at the whole arc. There are three eras, and we're standing in the ugly middle one. ## Era one: governed, powerful, and slow The first attempt at letting non-programmers build software was the low-code platform wave. Mendix, OutSystems, Appian, Power Platform, the Salesforce and ServiceNow app layers. Gartner was predicting by 2021 that [70 percent of new applications would use low-code or no-code technologies by 2025](https://www.gartner.com/en/newsroom/press-releases/2021-11-10-gartner-says-the-majority-of-technology-products-and-services-will-be-built-by-professionals-outside-of-it-by-2024), and the industry mostly rolled its eyes. I rolled mine too, and I want to own that, because I got the important part wrong. I looked at low-code and saw the drag-and-drop editors, the certification industrial complex, the consultants, the demos that fell apart on contact with a real requirement. What I didn't value at the time was everything underneath: one permission model, one data layer, audit trails, deployment you could actually control. The building experience was mediocre. The governance was genuinely good. Era one's real failure wasn't capability. It was that building stayed builder-centric. You still needed the trained specialist, the central IT queue, the project. Every app was its own little project with its own little silo, and the backlog never got shorter. ## Era two: creation went free, and feral Then the price of building software fell to roughly zero. Karpathy named the mode, Collins made ["vibe coding" its word of the year for 2025](https://kingy.ai/news/the-state-of-vibe-coding-2026/), and the tools turned it into an industry: Lovable went from nothing to [8 million users and 200 million dollars in ARR inside twelve months](https://axis-intelligence.com/vibe-coding-statistics/), with Bolt, v0, Replit, Cursor and Claude all feeding the same wave. Prompt in, application out. Anyone can build. I think this is genuinely wonderful, and I mean that without irony. The ops lead with his five tools is more productive than his official IT process ever made him. The gatekeeping era one never solved just evaporated. But notice what else evaporated. Everything underneath. ## The bill: shadow IT on dope We used to worry about shadow IT when it meant an unsanctioned Dropbox account and a heroic Excel file. That was shadow IT on filter coffee. What we have now is shadow IT on dope: full applications with databases, auth flows, and customer data, spun up in an afternoon by people who have never heard of an OWASP list, running on infrastructure nobody in the company controls or even knows exists. The numbers on this are not subtle. IBM's breach report found shadow AI was a factor in [20 percent of breaches, adding an average of 670,000 dollars in cost, with 97 percent of affected organizations lacking any AI access controls](https://www.kiteworks.com/cybersecurity-risk-management/ibm-2026-breach-report-ai-governance/). A year later, breached organizations reporting shadow AI involvement had [more than doubled, from 20 to 43 percent](https://shattered.io/shadow-ai-breaches-670k/). Gartner says [69 percent of organizations already have confirmed or suspected unsanctioned AI in use](https://app.stationx.net/articles/shadow-ai-statistics). And the code itself: Veracode found [45 percent of AI-generated code contains OWASP Top 10 vulnerabilities](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-generated-code-security-vibe-coding-202/), and researchers who scanned Lovable-built apps found [critical row-level security holes in about one in ten of them](https://axis-intelligence.com/vibe-coding-statistics/). The standard corporate reflex is to ban the tools, and it's exactly as effective as banning Dropbox was in 2012, which is to say it moves the usage to personal accounts and makes it invisible. (Ask me how I know. Actually don't ask the companies I know, they'd have to check their firewall logs first.) Here's my opinion, plainly, with stakes: the vibe coding wave cannot be rolled back, and any IT leader whose strategy is prohibition is choosing to have the ops lead's bookmarks bar anyway, just without ever seeing it. The choice isn't between governed and ungoverned building anymore. The choice is between ungoverned building you can see and ungoverned building you can't. ## Era three: the runtime shift Which brings me to the part I find actually interesting, because the resolution of this arc is already visible if you squint. Era one had governance without creation speed. Era two has creation speed without governance. The third era is the obvious synthesis, and the interesting bit is where the platform value moves: away from the builder experience, down into the runtime. Creation speed becomes table stakes, everyone has AI generation now. What becomes the platform is the context the generated apps run in: - One shared data layer, so the vacation app and the vendor tracker stop being data islands - One permission model underneath every app, not bolted onto each one - Governance and audit as properties of the runtime, not chores per project - Capabilities that compose, instead of fourteen little silos In that world the ops lead keeps his Tuesday-evening superpower. He describes what he needs, gets working software, and it lands governed by default, on company data, inside company permissions, visible to IT without a discovery project. The era one people had the right floor and the wrong door. The era two people have the right door and no floor. You can already watch the market bend this way. The internal-tools platforms, Retool, Superblocks, Appsmith, Power Platform, have all been racing to bolt AI generation into their governed runtimes over the past year or two. They started from the floor and are building the door. The vibe coding tools will inevitably try the reverse. Full disclosure, because regular readers will smell it anyway: [the thing I'm building](https://www.tcdev.de/blog/everyone-says-saas-is-dead/) lives squarely in this third era, so I'm not a neutral observer here. I'd just note that I didn't invent the arc to fit my product. The arc is what convinced me to build. If you want to know where your own company sits on it, there's a one-question test. Ask your most resourceful non-IT person what they've built lately, and watch whether they answer or laugh. The laugh is the roadmap.