Key question New
AI-processed · Author-approved
How can organizations effectively balance cybersecurity risks with employee needs when managing unauthorized technology?
Loads Spotify's player; Spotify may set cookies. This device remembers your choice.
Key findings
- Four distinct organizational archetypes for managing Shadow IT were identified, each resulting in different levels of unauthorized technology use (from very little to very frequent).
- Shadow IT users are categorized into two types: tech-savvy 'Goal-Oriented Actors' (GOAs) who carefully manage risks, and less aware 'Followers' who pose a greater threat.
- Effective management of Shadow IT is possible by aligning cybersecurity policies with user needs through transparent communication and responsive IT support.
- The study offers 10 practical recommendations, including accepting the existence of Shadow IT, creating dedicated user experience teams, and managing different user types differently to harness benefits while minimizing risks.
What it means for you
CIO / IT Executive
Establish a dedicated user experience team within IT to evaluate employee needs and streamline the formal approval process for new digital technologies.
IT Manager
Differentiate support strategies by identifying tech-savvy risk-managers versus less aware followers, providing targeted security guidance to the higher-risk group.
Business Strategist
Conduct an inventory of unauthorized digital technologies currently used across departments to integrate their core functionalities into official enterprise strategy.
Researcher
Investigate how the four organizational archetypes for managing Shadow IT impact long-term enterprise innovation versus security incidents.
Policymaker
Draft regulatory frameworks that mandate clear organizational communication explaining the exact reasons behind cybersecurity rules and why their compliance is enforced.
Summary
This study analyzes how companies can manage the use of unauthorized technology, known as Shadow IT. Through interviews with 44 employees across 34 companies, the research identifies four common approaches organizations take and provides 10 recommendations for IT leaders to effectively balance security risks with the needs of their employees.
Problem
Employees often use unapproved apps and services (Shadow IT) to be more productive, but this creates significant cybersecurity risks like data leaks and malware infections. Companies struggle to eliminate this practice without hindering employee efficiency. The challenge lies in finding a balance between enforcing security policies and meeting the needs of users.
Transcript
Expert: Thank you, Anna. This study investigates how organizations can manage unauthorized technology, commonly called Shadow IT, by balancing security risks against employee productivity requirements.
Host: Let us start with the core problem. Why do employees turn to unauthorized software and devices in the first place?
Expert: Employees primarily turn to Shadow IT when official systems fail to support their daily workflows efficiently. When corporate tools are cumbersome or lack necessary functionality, workers look for workarounds to meet deadlines. They adopt unapproved cloud services, communication apps, or file-sharing platforms. This individual efficiency, however, creates organizational vulnerabilities, including data leakage, regulatory non-compliance, and entry points for malware.
Host: IT departments often respond by tightening controls. How did the authors study the effectiveness of these responses?
Expert: The authors conducted an empirical study based on qualitative interviews with 44 professionals across 34 companies in various sectors. The sample included both IT security managers and business end users, allowing the researchers to compare administrative intentions with actual workplace behavior.
Host: What did the findings reveal about the users themselves?
Expert: The study distinguishes between two primary user profiles. The first group consists of "Goal-Oriented Actors." These individuals are technically competent and driven by specific task requirements. They actively assess tool suitability and often take steps to minimize exposure, such as anonymizing data. The second group consists of "Followers." These employees adopt unapproved tools simply because peers use them, without understanding the underlying technical or security risks. Consequently, Followers generate higher unintended security exposures.
Host: How do organizations typically handle these behaviors?
Expert: The study outlines four organizational archetypes based on two dimensions: the rigidity of cybersecurity policy enforcement and the responsiveness of IT to user needs. When IT departments rely solely on restrictive bans without providing viable alternatives, Shadow IT does not disappear; it simply becomes hidden. Conversely, organizations that pair structured oversight with active support achieve lower overall operational risk and higher policy compliance.
Host: What are the main practical takeaways for business leaders and IT managers?
Expert: The authors provide ten specific recommendations. The primary takeaway is that leadership should accept that Shadow IT occurs naturally when digital demands outpace central IT delivery. Rather than enforcing absolute prohibition, companies benefit from establishing dedicated user experience functions within IT to identify where corporate tools fall short.
Host: How should management address the two different user groups we discussed?
Expert: Governance must be segmented. Organizations can engage Goal-Oriented Actors constructively, using them as pilot testers for emerging software within controlled sandbox environments. For Followers, the focus shifts to targeted awareness training and providing readily accessible, officially sanctioned alternatives that require minimal technical configuration.
Host: What changes are needed in the procurement and approval process?
Expert: Approval procedures need to be streamlined. Lengthy evaluation cycles directly motivate employees to deploy unvetted solutions. Establishing transparent, fast-track evaluation criteria for low-risk applications significantly reduces the incentive to bypass IT governance.
Host: In summary, addressing Shadow IT requires treating it as a signal of unmet operational needs rather than purely as a disciplinary issue. By aligning security controls with real user workflows, organizations can mitigate cybersecurity exposures while keeping their workforce productive. Alex, thank you for breaking down this study.
Expert: It was my pleasure, Anna.
Host: And to our listeners, thank you for tuning in to A.I.S. Insights — powered by Living Knowledge. Join us next time as we examine the practical applications of business and technology research.
Shadow IT, Cybersecurity, IT Governance, User Needs, Risk Management, Organizational Culture, IT Policy