Shadow IT 2.0: Is Brazil's Citizen Development a Boon or a Breach Waiting to Happen?

Is your company's IT department still the sole gatekeeper of software innovation, or are employees quietly building their own solutions without formal oversight? A new study out of Brazil suggests the latter is increasingly the norm, hinting at a profound shift in how innovation happens within enterprises. Far from being a niche trend, the rise of the 'citizen developer,' often powered by accessible AI tools, is democratizing creation but also sparking urgent questions about control and risk.

The "Panorama Vibe Coding Brasil" survey, conducted by Skyone in partnership with Grupo TNS and released in October 2026, reveals a striking development: half of all professionals in Brazilian companies have already created automations, applications, dashboards, or integrations without formal IT projects. This phenomenon, which the study dubs "Shadow IT 2.0," goes beyond simply using unsanctioned software; it involves employees actively building digital solutions, often leveraging AI through what's termed "vibe coding"—using natural language to instruct AI to write code. A staggering 85.2% of these initiatives occur with no formal IT involvement, with 51.1% developed individually and 34.1% by departmental teams, as reported by IT Forum.

This isn't just about tech-savvy individuals; the trend spans all levels, from C-level executives (62.7% in tech C-levels and 50.5% in business/operations C-levels) to analysts and managers. The solutions range from process automations (52%) and internal applications (47.6%) to AI agents (33%) and chatbots (14.4%), demonstrating a broad spectrum of in-house problem-solving capabilities. While this bottom-up innovation promises unprecedented agility, it also creates significant governance blind spots that companies can no longer afford to ignore.

The Dual-Edged Sword of Citizen Development

The most compelling argument for embracing this decentralized development is the raw speed of innovation it enables. When business units can rapidly prototype and deploy tools to solve immediate operational challenges, they bypass lengthy IT queues and complex project lifecycles. This agility is particularly crucial in today's fast-paced digital economy, where timely solutions can mean the difference between seizing an opportunity and falling behind. The ease of access to AI, which lowers the barrier to entry for development, means that experimentation is no longer the exclusive domain of coders, as emphasized by Felipe Wasserman, Director of Marketing and Growth at Skyone, in Portal ERP. This empowers employees to become active participants in digital transformation, fostering a culture of proactivity and problem-solving.

However, this surge in unofficial development also carries substantial, often unseen, risks. The study found that 42.9% of companies lack clear guidelines on using corporate data in AI tools, and a mere 26.3% have formalized rules. This fragmented approach to AI adoption means that sensitive corporate data could be inadvertently exposed or misused through individually created applications, potentially compromising security and compliance. As Wasserman points out, "The risk isn't in people experimenting. It's in the company not knowing what's already been created, who's using it, what data is circulating there, and who is responsible for the solution if something goes wrong. Shadow IT 2.0 requires a change in posture; less delayed reaction and more visibility, criteria, and monitoring from the start."

Beyond the Tech Department: A Widespread Phenomenon

This phenomenon isn't confined to a specific demographic within companies. While traditionally, we might expect developers to be at the forefront of such initiatives, the "Panorama Vibe Coding Brasil" survey reveals that citizen development is pervasive. From C-levels in technology (62.7%) and business/operations (50.5%) to analysts, specialists, managers, and even software engineers themselves, at least half of the professionals in these groups have already created solutions outside formal IT projects. This broad engagement underscores the inherent demand for agile solutions across all business functions.

Interestingly, the practice is more intense in large organizations, with 58.9% of respondents in companies with over a thousand employees creating their own solutions, compared to 40% in smaller firms (up to 50 employees). While the study doesn't pinpoint the causes, one could infer that larger organizations might have more rigid IT processes or a greater diversity of highly specific departmental needs that central IT struggles to address quickly. This makes self-service solutions particularly appealing.

Yet, the primary barrier for those who want to create their own solutions remains a lack of technical knowledge (cited by 52.6%). Concerns about security and governance, while present, are cited by a smaller 17.8% of professionals. This disparity highlights a crucial blind spot: the perceived ease of creation often overshadows the complex implications of data handling and system integration, suggesting a need for greater awareness and education.

From Prohibition to Partnership: The Path Forward

The findings from Brazil's "Panorama Vibe Coding" study make it clear: the debate is no longer about if employees will use AI to build solutions, but how companies will manage this inevitable wave of innovation. Prohibiting the practice is not only unrealistic but also squanders a valuable source of agility and problem-solving. Instead, the focus must shift towards enabling secure and sustainable citizen development.

Skyone proposes a six-step framework for managing this new era of Shadow IT. This includes understanding what is already being created, defining clear limits for data usage and security, empowering and training professionals, offering secure environments for experimentation (like sandboxes), fostering closer collaboration between business units and IT, and establishing criteria for when a prototype should evolve into a formal corporate solution. This approach transforms IT's role from a gatekeeper to a strategic enabler.

As Wasserman aptly states, "The opportunity for companies is to transform this experimental energy into sustainable innovation; to create environments where people can test and develop solutions, but with clear limits for data, security, and governance. In this scenario, the role of IT also evolves; from an area that only receives demands to a layer that helps the business transform experiments into secure and scalable solutions." This shift isn't just about managing risk; it's about harnessing a powerful, decentralized engine of innovation for long-term strategic advantage.