Every organisation that runs on software faces the same choice sooner or later. It can build with its own people, or buy the software development service from someone else. This is the first in a series of articles on how companies deliver software today. It starts with in-house software development, the option that feels safest because you control it.
The question is what, exactly, you control.
The bottleneck is experience, not headcount
Teams grow by building systems that must meet every norm and recommendation. That covers the whole cycle: from design documentation, through building and testing the software, to fixing defects during maintenance, including security vulnerabilities. Teams therefore have to keep extending their skills, above all in cybersecurity.
Building such a team costs more every year. According to Antal’s 2026 Polish salary report, the highest pay goes to specialists working as AI Solutions Architects, AI Research Scientists and Security Architects[1]. In ISC2’s 2025 survey of more than 16,000 security professionals, 29% said they cannot afford to hire people with the skills they need. 33% said they lack the budget to staff security operations properly[2]. A first-class team is becoming a privilege of clients with an adequate budget.
Today it is no longer enough to build software that works and performs well. Cybersecurity has moved to the front. Data leaks from IT systems show it, especially in defence, public administration and health. In August 2026 the Polish government confirmed a leak of medical data of nearly 19 million people from the MyDr documentation system. A month later data leaked from the Medyc application, and the data protection authority announced an inspection of its maker[3]. Across the EU, public administration was the most frequent target in 2025: 31.8% of the 8,257 incidents analysed by ENISA[4].
Keeping up instead of building
The people you do have are not all building new things. Deloitte’s 2026 Global Technology Leadership Study surveyed 662 senior technology leaders between December 2025 and February 2026. They work at organisations with annual revenue of US$1 billion or more in the Americas, EMEA and Asia-Pacific. The largest single share of their technology budgets, 38%, still goes on maintaining and optimising existing business capabilities. Growth gets 31% and transformation 30%. The maintenance share is down from 48% in 2023, but Deloitte expects it to fall only to 37% by 2028. Meanwhile, total technology spending grows from about 5% of revenue in 2023 to a projected 8% in 2028. The share for developing existing business models and creating new ones is growing too. Yet 41% of the technology leaders say the business sees them as unable to keep up with demand[5].
The next skills gap is already here
While teams keep existing systems running, the next demand arrives. On 14 September, Bitkom reported that, for the first time, most German companies use AI. That is 57% of 603 firms with 20 or more employees. Among the rest, 85% say they lack the technical know-how to implement it. And 66% of companies rate their employees’ AI skills as low. Among AI users, 41% name integration into existing systems as a major cost[6].
At the same time, companies are moving budgets, not adding them. Futurum Group surveyed 1,636 technology decision makers worldwide (10 September). 327 of their organisations are cutting IT headcount. And 58.4% of those are cutting in software and application development[7].
Put together, an in-house software development team has three jobs at once. It must build, keep existing systems running and learn to work with AI. Often it has fewer people than last year.
What in-house software development really owns
The common argument for in-house software development is control. The code is ours, the people are ours, the knowledge stays in the company. Two of these are true. The third holds only if the processes in place keep the knowledge in the company when people leave.
In some organisations, however, the knowledge that matters is not in the repository. The code shows what the system does, but not why. Why does a business rule read this way? Which customer’s case led to an unusual exception? Why did someone skip a test because “everyone knows” it cannot fail? The answers live in a few people’s heads. When one of them leaves, retires or moves to another project, the code stays. In that case, the understanding goes with them.
In-house teams often have less reason than external ones to describe what the code does and why. After all, “we are all here”.
What this means for your in-house software development
Ask four questions before the next budget round.
- Where does your team’s time actually go? Split it into new work, keeping existing systems running, and fixing. Does running take more than a third of the budget, as it still does on average in Deloitte’s study? Then that is capacity you are not using to build.
- What happens if your two most experienced people leave tomorrow? Perhaps the honest answer is “we would struggle for months”. Then the company does not own the knowledge. It is on loan.
- Has your team written down what it knows, in a form someone else could use? Requirements, decisions and the reasons behind them belong with the code. They also need to stay current.
- When did your team last build a system to the full standard? Security by design, documented requirements, a tested recovery plan. If the answer is “never”, the last lifeline is the belief that “nothing has happened in the past dozen or so years, so nothing bad will happen in the years ahead either”.
In-house software development is often the right choice. But control comes from knowledge the team writes down and keeps up to date. It does not, of course, come from whose payroll the developers are on. This matters even more as AI writes a growing share of the code. AI is only as good as the description of what to build. Keeping requirements and decisions with the code is the idea behind Fornax Forge.
Sources
- M. Marszycki, “Pensje polskich specjalistów rosną, ale nierówno. AI i cyberbezpieczeństwo podbijają stawki”, ITwiz, 14 September 2026, on the 15th Antal Salary Report. itwiz.pl
- ISC2, “ISC2 Study Finds Cybersecurity Budget Constraints Remain, But Do Not Worsen, While Skill Needs Grow” (2025 Cybersecurity Workforce Study), 4 December 2025 isc2.org; figures as reported by SecurityInfoWatch, 15 December 2025 securityinfowatch.com
- UODO (Polish data protection authority), “Miliony Polaków poszkodowane. Po nowym wycieku danych medycznych PUODO zapowiada kontrolę”, 25 September 2026. uodo.gov.pl
- ENISA, ENISA Threat Landscape 2026, 22 September 2026. enisa.europa.eu
- Deloitte, “From Operators to Orchestrators: Deloitte’s 2026 Global Technology Leadership Study Reveals a New Mandate for Tech Leaders”, press release, 30 April 2026 deloitte.com; “The dual mandate redefining the future of tech leadership”, Deloitte Insights, 30 April 2026 deloitte.com
- Bitkom, “Erstmals nutzt die Mehrheit der Unternehmen KI”, press release, 14 September 2026. bitkom.org
- Futurum Group, “46.9% of Enterprises Report AI Spend Over Budget in 2H 2026”, press release, 10 September 2026. futurumgroup.com