The deployment gap: what happens to the software your people build with AI

Three acts, every time

Every technology that employees adopted ahead of IT has run the same three acts.

Act one. A new capability arrives and adoption outruns everyone's plan for it.

Act two. The sprawl. Too much of the new thing, everywhere, with no owner and no controls.

Act three. A control layer forms, and only once it exists does the capability pay off at full scale, because that is when organizations can say yes without flinching.

Spreadsheets turned every analyst into a database administrator, and twenty years later Sarbanes-Oxley forced controls onto the spreadsheets that were, by then, running the books. SaaS arrived on department credit cards, and IT called it shadow IT for a decade, until single sign-on and vendor review made it governable. Only then did SaaS become the default way to buy software. Cloud went the same way: engineers spun up instances freely until platform teams and FinOps turned the sprawl into an operating model.

AI-built software is deep into act two. What follows is the shape of that act, and what act three has to look like.

Everyone builds now

The adoption numbers are the least surprising part of this. Stack Overflow's 2025 survey found 84% of developers use or plan to use AI tools, and half of professional developers use them daily. GitHub Copilot passed 20 million all-time users in mid-2025 and sits inside 90% of the Fortune 100.

The growth that matters is outside engineering. OpenAI reported Codex passed 5 million weekly users in 2026, and about one in five is not a developer. Syntax was the last barrier, and it is gone.

So the finance manager who lived in spreadsheets builds the reconciliation tool herself. The support lead builds a triage app over a weekend. Both would describe it the same way: getting the thing done.

Every company just acquired a workforce of builders without hiring anyone. Act one took about two years.

Most of it dies

A demo hides an enormous amount. To run in production, for real users on real data, an app has to answer questions the AI assistant never raised. Where does it run, and what happens when it falls over? How does it authenticate to Salesforce, and with whose credentials? Who can use it? Who maintains it? Where are the logs? What does it cost per month, and whose budget does that hit?

For a professional engineering team with a platform team behind it, answering all of that takes weeks. RSM US puts it at four to twelve weeks of work to make an AI-built app production-ready, for a prototype that took two days to build. The analyst has a laptop. For her, weeks of infrastructure work reads as never.

Nobody owns this stretch of the road. The builder cannot do the work. IT never commissioned the app and usually does not know it exists. So the app dies quietly, one of thousands, each one value the company already paid to create.

The aggregate numbers bear this out. S&P Global found 42% of companies abandoned most of their AI initiatives in 2025, up from 17% a year earlier. Put the stages end to end and the estimate lands below one in twenty.

Spending runs the other direction. Token consumption climbs every quarter, and boards read the usage charts as progress. A token is a cost. The value arrives when software ships and runs. A company can double its token bill and deliver nothing.

The portfolio you can't see

Then there are the apps that ship. Determined builders find a way, and the way rarely runs through IT. What accumulates is a portfolio: real software, touching real systems, on no inventory anywhere.

The Cloud Security Alliance surveyed enterprises in 2026 and found 82% had discovered unknown AI agents running in their environments. The detail that matters: 68% of those organizations had rated their own visibility as strong.

The security record is what you would expect from software written fast, by non-engineers, with no review. Wired has reported, in findings Gartner cites, that thousands of vibe-coded apps have exposed corporate credentials and personal data on the open web, many with no authentication at all. Gartner puts a number on where this goes: by 2027, at least 30% of application security exposures will come from vibe-coding practices.

Every step here was rational. The builder needed the app to reach Salesforce and had no legitimate place to put a credential, so the credential went into the code. The exposure is the sum of a thousand rational decisions.

The bill arrives later

Two costs land after the fact.

The first is maintenance. Gartner predicts 60% of vibe-coded applications will be retired by 2028 for failing to deliver predictable business value, and that by 2028, 30% of software engineering teams will experience material capacity strain from maintaining them. Read those together and they describe one object: an orphan. An app whose author changed roles or left, with no documentation and no owner, now sitting on an engineering team's desk because it turned out to matter.

The second is the audit. The EU AI Act has been phasing in since 2024, with standalone high-risk systems facing enforcement from December 2, 2027 under the Digital Omnibus, and Article 99 sets penalties up to €15 million or 3% of worldwide turnover. Details vary by risk class. The posture is uniform: produce an inventory. What AI systems are running? Who owns each one? What data do they touch? Where is the logging?

A company with a thriving invisible portfolio stops at the first question, and every question after it depends on the first.

Governance turns out to pay for itself. Gartner projects that by 2028, governance technologies will cut regulatory compliance costs by 20%, freeing roughly 10% more investment for strategic growth. Governing by construction, where every app arrives with an owner, an audit trail, scoped access, and a spend cap, costs a fraction of reconstructing all of it after the regulator's letter arrives.

That is act two: value that never ships, software nobody can see, and a bill that arrives with someone else's name on it.

The governed runtime

Act three has always been a control layer. For AI-built software, that layer is a runtime: somewhere the app goes when the builder is done, that runs it and governs it in the same motion.

Its requirements fall out of act two. Deployment has to be one step from whatever assistant the builder already uses, because a builder who hits friction returns to the workaround. The platform has to run the app on managed infrastructure, because the builder has no ops team and never will. Credentials have to live in the platform rather than the code, so there is nothing to leak and nothing to hunt down later. And every app needs an owner of record and a registry entry, with spend metered per app, because that inventory is what visibility, budgets, and the auditor's first question all depend on.

One design test sits above the rest: the governed road has to be easier than the workaround. Governance by mandate gets routed around. At citizen-developer scale it holds when builders choose it, and builders choose whatever ships their app fastest. The real test is whether the analyst takes it on any given afternoon.

The analysts have started mapping the category. Gartner's Market Guide for Enterprise Vibe Coding Platforms (April 2026) finds the code-generation step commoditized across platforms, with differentiation centering on governance controls, deployment pipelines, and back-end integrations. For software engineering leaders, Gartner reports, governance, security, and exit strategy outweigh generation speed as selection criteria.

That's why we built Tray Helix: a governed runtime that takes an app from a vibe-coded project to a governed, live app, and gives IT one view of everything that ships. Expect more entrants. Act three always draws a crowd once act two gets big enough, and this is the biggest act two yet.

Close

The thousand developers are already inside your company. They have been building for two years, and most of what they built is either dead on a laptop or alive somewhere you cannot see.

We built Tray Helix because someone has to run act three. An inventory. A named owner on every app. Credentials no one can leak. And one command that takes the analyst from her laptop to a governed production app, on her own, without asking anyone's permission.