Vibe Coding: How companies can reduce the risks of shadow IT

More and more departments are developing their own applications using generative AI – often without clear guidelines on data, quality and operations. This so-called ‘vibe coding’ describes a new approach to software development: applications are no longer created through manual programming, but by formulating requirements in natural language and having them translated directly into code by AI. This gives rise to a new form of shadow IT that spreads more quickly and is harder to control. Why are more and more applications being developed outside the IT department?

When demand is high and established IT processes take too long, solutions are often created directly within the business unit.

In the past, these were Excel models, macros or small databases. Many of these solutions gradually became business-critical – often without proper access controls, without monitoring and without a clear operational model.

Today, essentially the same thing is happening – only much faster. With generative AI, applications, scripts or automated workflows can be created with minimal input. The barrier to entry is significantly lower, whilst the speed of development increases.

The result: more and more business-driven solutions are emerging in parallel – but without sufficient transparency and without clear guidelines for stable and secure operation.

Compared to traditional individual data processing (IDP), additional risks arise that spread more quickly and are harder to control – risks that many companies still underestimate today.

A key issue is the handling of data: prompts often contain contextual information, data fragments or business logic. Without clear rules, this can quickly lead to the unauthorised disclosure of sensitive information.

Added to this is the issue of code quality. AI can generate code, but it is no substitute for thorough testing. If generated content is adopted without verification, security vulnerabilities or structures that are difficult to trace arise.

Furthermore, the technical landscape is becoming more fragmented, with inconsistent data models and data quality issues on the rise, as are data interfaces and data flows. This increases complexity whilst reducing the overview of the solutions.

Another critical issue is operations: many solutions start as prototypes but are quickly put into production. Without testing, monitoring and clear responsibilities, an operational risk arises that often goes unnoticed in day-to-day operations and only becomes apparent when problems arise.

In many organisations, the picture is much the same: prototypes are regarded as temporary, even though they are used on a permanent basis.

In-house solutions are deemed secure without systematically checking for existing (mis)configurations.

Furthermore, the use of AI is equated with higher quality, even though it is primarily the speed of development that increases initially. These assumptions exacerbate existing risks and delay necessary countermeasures.