It is 1993. I am working for one of the world’s largest professional services firms, and the way we share information between our office and our clients is by carrying hard drives back and forth on the tube.

Not metaphorically. Literally. External SCSI hard drives – with a whopping 20Mb (!) of storage capacity, the size of a shoe box, in padded bags, on the London Underground, back and forth between our office and client sites. When you were at the client, you were invisible to the firm. When you were in the firm, you were invisible to the client. The sneakernet - the affectionate term for physically moving data from one place to another on your feet - was the state of the art.

Then Wi-Fi emerged. And suddenly there was a technology that could transform the way we worked - connecting our people to our systems wherever they were, eliminating the hard drives, giving teams back the seamless connection they needed to do their jobs properly. It was obvious. It was exciting. It was exactly what the business needed - so we banned it.

Not out of stupidity - out of reasonable caution. The security protocols were immature. The technology was new and not well understood. The risk to client data was real and the firm’s reputation was everything. It was, by the standards of the time, the right call.  

Except it wasn’t the end of the story.

One of our audit partners - managing a global account, with tens of his team working remotely and carrying hard drives in their briefcases - decided he’d had enough. He slipped out at lunch, walked to a computer shop, and came back with a wireless router and eight PCMCIA cards. He plugged the router into the client’s network and handed out the cards to his team. That afternoon, for the first time, his people were connected - to each other, to the firm, to the work - without carrying anything heavier than a laptop.

He didn’t do it recklessly. He did it because the official answer was “computer says no” and the problem didn’t go away just because the answer was no. The desire path existed whether we acknowledged it or not. He just decided to walk it.

We learned something important from that moment. Not that IT governance doesn’t matter - it does, enormously. But that when people find their own solutions to problems the organisation hasn’t solved, they are not being difficult. They are being human. They are showing you something, the question is whether you’re willing to look.

The Dutch have a name for the paths worn into grass by people who find their own route from A to B. They call them elephant paths. Architects call them desire paths. The formal path is beautifully designed, structurally sound, and completely ignored. The elephant path is scruffy and unofficial but always the shortest route from point a to point b and most importantly, it tells you everything about what people actually need.

I spent years as an enterprise architect designing the formal path. I was good at it. The angles were clean, the materials were right, the whole thing was architecturally pure. And I spent a long time not noticing that the people I was designing for had already found their own way through the grass.

Outside-in thinking starts from a different place. Not: what is the best system we can build? But: what are our people actually trying to achieve, and what would genuinely help them get there? Not process first but outcome first, not inside-out but outside-in.

This is not a minor adjustment to how IT thinks about its role. It is a fundamental reorientation. And it is more urgent now than it has ever been - because Shadow AI is the Wi-Fi moment all over again.

Every week, people across your organisation are opening AI tools you didn’t sanction, running prompts you can’t see, getting answers you can’t govern, and solving problems you didn’t know they had. Not because they’re reckless. Because the official path isn’t working and they want to do better for their customers, their teams and themselves. The elephant path is being worn into the grass right now, in real time, in every organisation I work with.

The IT leaders who will define the next decade are not the ones who ban the router. They are the ones who ask: what does this tell us about what our people need? And then: how do we build that for them - or better still, with them - before they build it themselves?

Not blocking the elephant path. Not following it after the fact. Anticipating it. Making the desire path the design.

That is the shift from inside-out to outside-in. And it is available to every IT leader in every organisation right now - if they’re willing to ask the right question first.