\n
![](\"https:\/\/images.ctfassets.net\/jdtwqhzvc2n1\/BVrNZeCyXWkzq7Ur7p0h4\/608b28b05bcc56c89cc7c917df4d2595\/AdobeStock_951756901.jpeg?w=300&q=30\")
<\/p>\n
\n<\/p>\n
Presented by Retool <\/i><\/p>\n
\n
The logic used to be: buying software is cheaper, faster, and safer for most use cases. Building was reserved for companies with large engineering teams, deep pockets, and problems so specific that no vendor could address them. But now, the cost to code a piece of software has dropped to zero. <\/p>\n
Anyone can build their own software now, but enterprise and governance models have yet to catch up. Retool\u2019s 2026 Build vs. Buy Shift Report, based on a survey of 817 builders, traces exactly how this shift is playing out.<\/p>\n
Two years ago, a custom internal tool might have taken an engineering team weeks or months and cost six figures. Today, an operations lead with the right platform can have a working prototype in a day or two. This structural shift is driven by AI-assisted development and the maturation of enterprise app-building platforms.<\/p>\n
Meanwhile, SaaS pricing hasn\u2019t adjusted, still charging per-seat for generic software that requires customization and integration costs on top. When the cost of building drops by an order of magnitude but the cost of buying stays flat, the math changes for every company, not just the ones with large engineering teams.<\/p>\n
The data reflects this. Retool\u2019s report found that 35% of teams have already replaced at least one SaaS tool with a custom build, and 78% plan to build more custom tooling in 2026.<\/p>\n
The shift isn\u2019t happening uniformly. The top SaaS tools respondents have replaced or considered replacing include workflow automations (35%) and internal admin tools (33%), followed by BI tools (29%) and CRMs (25%).<\/p>\n
A purchased workflow automation tool has to serve thousands of customers, so it optimizes for the average case \u2014 and the average case is nobody\u2019s actual<\/i> case. Every company\u2019s internal workflows are different. They reflect org structure, compliance requirements, data systems, and business logic unique to that organization. <\/p>\n
Internal admin tools carry the same problem: they\u2019re inherently company-specific. These categories were always the most awkward fit for off-the-shelf software, and there\u2019s now an affordable, accessible alternative (MIT\u2019s State of AI in Business reported $2-10 million in savings annually for customer service and document processing tasks).<\/p>\n
The replacement pattern tends to be additive rather than wholesale (nobody is just ripping out Salesforce). They\u2019re replacing the specific pieces that never quite fit: an approval flow that required three workarounds, the dashboard that couldn\u2019t connect to their actual data \u2026 but those narrow replacements add up. Once a team builds one tool that works better than what they bought, the default question shifts from \u201cWhat should we buy?\u201d to \u201cCan we build this?\u201d<\/p>\n
The clearest evidence that procurement processes haven\u2019t kept up with building capability is the scale of shadow IT now occurring inside enterprises. Retool\u2019s report found that 60% of builders have created tools, workflows, or automations outside of IT oversight in the past year \u2014 and 25% report doing so frequently.<\/p>\n
Even experienced, high-judgment people choose speed over process. Two-thirds of total survey respondents (64%) are senior managers and above. Existing procurement cycles weren\u2019t designed for a world where building software takes days rather than months. When people love to quote the 95% generative AI pilot failure rate they\u2019re not accounting for the robust grassroots adoption happening under executives\u2019 noses.<\/p>\n
Shadow IT at this scale is a demand signal. The people closest to the problems are telling organizations that the existing process can\u2019t can't keep up \u2014 31% of those going around IT do so simply because they can build faster than IT can provision tools. So, suppression isn\u2019t a productive response. The challenge is that the tools being built in the shadows are also the ones most likely to stall before they become useful.<\/p>\n
A vibe-coded prototype running on sample data is impressive. A production tool connected to your actual Salesforce instance, with role-based access and a security review, is useful<\/i>. The report found that 51% of builders have shipped production software currently in use by their teams, and among those, about half report saving six or more hours per week. <\/p>\n
When building happens in an ungoverned environment, organizations get neither outcome reliably. Someone connects an AI-powered tool to production data with no audit trail, no access controls, and no owner. Multiply that by dozens of builders across an organization, and you have an expanding security surface that IT doesn\u2019t even know exists.[1]<\/sup> <\/p>\n The teams whose homebuilt solutions reach production tend to have three things the others don\u2019t: connectivity to real data sources, a security and permissions model they trust, and a review process for what gets deployed. Channeling builder energy into governed environments, where speed and security aren\u2019t in conflict, is how organizations avoid shadow IT becoming a liability.<\/p>\n The build vs. buy shift is already underway. The more important question now is who controls the environment where that building happens.<\/p>\n Ungoverned building invites security risks and<\/i> makes the ROI case difficult to close. You can\u2019t measure time saved by tools IT doesn\u2019t know exist, or are only run in one individual\u2019s workflow. You can\u2019t enforce access controls on a prototype that someone connected to production data last Tuesday. And those aren\u2019t hypothetical risks: in Deloitte\u2019s 2026 State of AI in the Enterprise survey of 3,200+ leaders, data privacy and security ranked as the top AI concern at 73%, with governance capabilities close behind at 46%. The 35% of organizations with no AI productivity metrics are missing more than just a dashboard. They\u2019re missing the accountability infrastructure that justifies building over buying in the first place.<\/p>\n The organizations that treat governed environments as a prerequisite for building at scale will be the ones that can actually prove it\u2019s working. The ones that don\u2019t will find out when something breaks.<\/p>\n For a closer look at the data, including how enterprises are approaching AI-assisted building, read the full <\/i>2026 Build vs. Buy Shift Report<\/i>.<\/i><\/p>\n [1]<\/sup><\/i> The cost of which can be steep: <\/i>IBM\u2019s 2025 Cost of Data Breach Report<\/i> found that AI-associated cases cost organizations more than $650,000 per breach.<\/i><\/p>\n David Hsu is CEO at Retool.<\/i><\/p>\n Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they\u2019re always clearly marked. For more information, contact <\/i>sales@venturebeat.com<\/u><\/i>.<\/i><\/p>\nGovernance will define the next era of SaaS<\/h2>\n
\n
\n