Central IT versus Shadow IT

Shadow IT has always been a double-edged issue for IT managers: on the one hand, the initiative of the departments helps to implement requirements quickly and, at the same time, to conserve central resources. On the other hand, however, this often results in a proliferation of IT departments that are difficult to oversee, let alone control. Investment and data security, interoperability, data protection and licensing issues – all these are important aspects that a CIO cannot ignore. So it’s no wonder that a tangible conflict of interest often develops here.

The crux is that both views are valid. Without Shadow IT, all wheels would stand still in some places, and without centrally defined and tightly enforced regulations, it would constantly be stuck at one corner or the other. It seems that a kind of peaceful coexistence has developed in the meantime. As long as the decentralised IT systems developed on one’s own responsibility do not require access to central company-critical data, and as long as Central and Shadow IT remain separate, this also works.

Trend: Shadow IT will be further expanded

The call for constantly progressing digital transformation in the specialist areas inevitably leads to a massive expansion of Shadow IT, because

• it is simply impossible to centrally record and implement thousands of digitisation ideas in a timely manner,
• the IT specialists of the central IT department lack the respective specialist know-how,
• the procedure is too rigid and too slow for our dynamic times.

Since the departments think their ideas much more dynamically than one was accustomed to in the IT world, even the classical methods of requirements analysis reach their limits. It doesn’t matter if waterfall or scrum, it doesn’t work, because the drivers among the business users usually don’t even know in advance exactly what they need and what it should look like. They do not only want and have to be involved in writing a backlog, but also directly in the actual development process.

As a result, you’d rather help yourself. With modern tools and approaches, IT experts, the so-called Citizen Developers, can now easily build their own software support, or they can collaborate with competent external service providers. The wave of digitisation is giving the whole thing a decisive boost. Shadow IT is not being reduced; on the contrary, it is being massively expanded.

Many companies have recognised this trend towards decentralisation of IT and have tried to adapt to it by delegating at least trained IT specialists to the specialist departments. This is the right step, but either they don’t get there mentally, or over time they become Citizen Developers themselves, decoupled from Central IT. This is not yet the one and only solution to the problem.

The platforms for citizen developer

This development towards more and more Shadow IT is being helped by the fact that a new type of software development tool is now being established that is optimally tailored to IT-experienced employees in the specialist departments: to software developers who are not trained computer scientists and to specialist users who can program sufficiently well for their own needs.

Since the increasingly complex mainstream IT architectures have become far too difficult and unwieldy for this target group, tools are needed with which one can assemble normal business applications more easily, faster and best without any manual programming – perhaps not quite as professionally as the CIO would like to see it, but on a scale faster and more flexible. Such tools are called low-code platforms because you can get by with little handwritten and comparatively simply structured program code, which anyone with limited computer science knowledge from school or university can read and perhaps also change. In the meantime, there are tools that even want to make this avoidable by doing completely without programming as a no code platform.

Software development with low-code technologies brings with it an increase in productivity and a degree of flexibility never seen before. Most low-code platforms promise an increase in development speed by a factor of 10, with much more flexibility and agility at the same time and in some cases also with significantly higher code quality. With their new tools, the Citizen Developers are literally outgrowing the IT professionals and only need them to exchange data with the central system.

Since the developers in the specialist departments constantly produce new program versions, they naturally want to be able to switch these versions into production themselves, and indeed most low-code products offer powerful integrated deployment features. With cloud-based low-code platforms, they simply do this themselves, and for on-premise installations, developers expect their central IT department to establish the appropriate mechanisms, in other words, they prefer to take care of everything themselves.

Even within Central IT, development and operation are growing ever closer together. DevOps structures and similar forms of interlocking are increasingly being created within IT, and the departmental developers also want exactly the same: departmental DevOps.

Is it beneficial for the departments to develop software?

Yes, it is. To the extent that companies are increasingly digitised and automated, less and less manual work is required, even in highly qualified departments. On the other hand, more and more expertise is demanded from the experts in the specialist areas in order to control, monitor, further optimise and expand digital transformation. In the long run, this will one day turn more or less all employees in the departments into IT people – not necessarily into programmers, but into employees whose main task is to keep the automated company running and improve it further and further.

We don’t yet know the tools they will use to do this. It is almost certain that they will be predominantly AI-supported systems in combination with configuration tools of all kinds. Today’s low-code platforms are at the very beginning of this development. They still have hardly any AI functions, and it is still not very easy to operate them. But they are becoming better and more efficient, and thus more widely usable.

The gap between the logical levels on which Citizen Developers and classic software developers work will become larger and larger. The toolsets of these two target groups will become more and more distant from each other, and the way in which the technical experts configure their digitized systems will become less and less like programming in the future. But software development in the broadest sense remains. That is why this is the way of the future.

Challenge and opportunity for Central IT

Of course, this development is leading to a dramatic increase in what is rightly and wrongly referred to today as Shadow IT. IT departments need to learn how to deal with this and not see these changes as a threat or security risk, but as an opportunity for better and more powerful IT support for the enterprise.

The opportunity lies, among other things, in the fact that most low-code tools are based on today’s standards for secure IT systems, with perfectly normal central databases and web or app base technologies, authentication and authorisation procedures. Not only the data, but also the programs return to the control and responsibility of the IT professionals. This has nothing to do with the first PC-based Shadow IT wave in the 1990s.

Microservice architectures are another way of integrating IT systems from specialist departments. They are used to professionally couple specialist modules developed decentrally and with partly different tools. There are also IT strategists who are of the opinion that the introduction of a comprehensive microservice architecture would be a means of consolidating the heterogeneous tool world and thus leaving out Shadow IT. But it is intended for exactly the opposite: to be able to allow decentralised IT with a certain variety of tools, without cutting back on security and other general IT topics.

Actually, all the prerequisites are fulfilled for allowing Specialist and Central IT to grow together again: The CIO and his people are responsible for the IT infrastructure, including the overarching microservice architectures and all marginal aspects of IT deployment, interoperability and all overarching aspects, while the content comes from the specialist departments, driven and spurred on by the objectives of the CDO. Only the software development itself is partly outsourced to the departments, partly with and partly without own deployment responsibility. Central IT should not slow down this change, but force it. Otherwise, a new type of uncontrolled growth will emerge. After all, there are already more than one hundred different low-code platforms on the market today, and the trend is rising. It will not be possible to bring everything into line, but if the Central IT department does not block this process, but actively pushes it forward itself, then there is the opportunity to limit the variety of tools to a manageable number of different tools. The professionals from the IT departments should not smile at the in-house developments of the departments, but on the contrary, encourage them to do so, and support their Citizen Developers in the best possible way, and thus bring light into the darkness of Shadow IT.

Central IT support for shadow IT

In most specialist areas, the modern Citizen Developer culture has yet to be developed. In many cases, professionals lack the time and experience to develop on their own, and IT-experts in the departments are still scarce or overloaded. Therefore, it will be necessary in the foreseeable future to be supported by external or internally requested IT specialists.

The new possibility that IT projects can be implemented directly in and under the direction of the specialist department, virtually before one’s very eyes, is already being used without restriction by almost all specialist departments. The right tools are available for this, and it could really get going now. But the capacity for doing this is often still lacking. The Central IT department can and should see this as an opportunity to support this with borrowed professional software developers, who then have to use the tools of the specialist departments, i.e. low-code platforms, as a development environment. These can be our own employees or external low-code specialists commissioned on the basis of framework agreements. In any case, the CIO has the chance to ensure sufficient IT competence of the third party developers involved, at least much better than if the specialist departments themselves commission the corresponding services.

In addition, it would be highly desirable if the IT department were to see it as its task to train the future Citizen Developers, i.e. today’s power users, and motivate them to develop themselves. As long as the CIO keeps control of what is being trained and who is motivated to do what, it is well possible to provide sufficient bright light in the shadow IT in the long run.

Notes:

Further information on the subject of low-code can be found at https://www.scopeland.com/home.

Karsten Noack has published more articles in the t2informatik Blog, including

What does t2informatik actually do? One click and you'll know.