Replacing Excel:the Cambrian explosion of software

A typical pattern in small businesses looks like this. The price list lives in Excel. Holiday planning lives in Excel. Frank (fictitious name) built the quoting tool with the macros, years ago, on a long Friday. And then there is that one file nobody is allowed to touch, because nobody knows anymore what happens if you do.

Spreadsheets are probably the most widely used programming language in the world, with hundreds of millions of users, and various studies find errors in around 95 percent of them (Source: arXiv, 2026). Formulas are code. Macros are code. Just without tests, without version control and without a second person looking at them.

When does Excel turn into a database?

The moment it tips: Excel is used as a database. The file stops calculating and starts managing. Customers, orders, stock. From then on, people depend on a spreadsheet they never built.

A case from autumn 2020 shows how little this has to do with care. Public Health England merged test results in an old Excel file format that holds only about 65,000 rows. Nearly 16,000 Covid cases went unreported for days (Source: BBC, 2020). Not incompetence: a well-run organisation, a routine file format and a limit that kicks in without warning (Source: FinTask, 2026). The sheet was full, and nothing told anyone.

Excel was never the problem. Nobody said: what you are doing is building software.

In the first week of February 2026, over a trillion dollars of market value was wiped off software stocks in seven days (Source: Forrester, 2026). The trigger was the pace of AI agents and the bet that businesses will build their tools themselves, or have them built, instead of paying licences per seat. That is an expectation on the stock market, not a measured replacement. At the same time, software revenue in Germany is growing by 10.2 percent to 58.3 billion euros in 2026 (Source: Bitkom, 2026).

The market is marking down off-the-shelf tools. There is more software overall. The value moves away from the vendor and towards what the business itself knows: its processes, its data, its special cases.

Standard tools were compromises. The special price for regulars lived in a comment field because the software had no field for it. When the tool fits your shop, your knowledge of the shop becomes the most valuable thing you have.

The flip side is called shadow software

The spreadsheet nobody knew about was shadow IT. So is the app a colleague knocked together over the weekend. According to Bitkom, just under a quarter of companies, 23 percent, have rules for using AI, and four in ten assume private AI tools are in use anyway (Source: Bitkom, 2025). In an EY survey from March 2026, 45 percent of technology executives reported a confirmed or suspected data leak through unapproved AI tools (Source: EY via Adaptive Security, 2026).

A ban tends to push these apps deeper into the shadows. The question Excel never had to ask: who can actually get to the data?

Stage 1: internal first, your own data first

Your first app of your own replaces a spreadsheet that only your team uses and that holds no customer data. If you are not sure which one: take the file that no longer calculates but manages. Holiday rota, price list, order overview. It runs behind a login, with access only for accounts you know. Here the blast radius of a mistake stays almost as small as with the spreadsheet, and you learn to build without carrying responsibility for other people’s data.

Three things get better than in Excel right away. Every change is traceable, because the application is versioned. There is one truth instead of seven files. And there is a backup you have actually restored at least once.

Stage 2: set the data boundary deliberately

Before every new feature there is one question: whose data is this? Yours, your staff’s or your customers’? As soon as customer data comes in, you need three things. Row-level access control, meaning a rule for who may see which row. No secret keys in the code that ends up in the browser. And a deletion policy. The first two are exactly what was missing in the scans.

According to the Stack Overflow Developer Survey 2025, 84 percent of developers use AI tools, but only 33 percent trust the output, and 46 percent actively distrust it (Source: Stack Overflow via Coderfile, 2026). In August 2026, Symbiotic Security measured that AI-assisted repositories carry 42.3 vulnerabilities on average, human-written ones 9.6. That is more than four times as many (Source: Symbiotic Security via VibeEval, 2026).

The pros do not have less trust than you. They have a checklist.

Stage 3: before the first stranger

Before your app gets a public address, the question changes from “does it run?” to “does it hold?”. Who gets the call when it goes down at night? What happens when someone sends 10,000 requests a minute? Where is it written down which data you store and why? The nine questions your tool should answer before the first stranger uses it are in “Production-ready software”. You can work through them in an afternoon.

This is also the point where you decide whether you carry it alone or bring someone in. For the building, you need nobody. For the responsibility, you might.

Building it yourself is the right call. It gets risky when the app gets a public address and nobody asked whose data sits inside. Small businesses have an edge here: nobody says no. The order is the no you give yourself.