Who is the IT Department Anyway: An Evaluative Case Study of Shadow IT Mindsets Among Corporate Employees

This study aimed to explore the factors influencing employees to deploy what can be classified as shadow IT in a corporate context. Shadow IT denotes unofficial, unsanctioned forms of IT. We employed a mixed-methods approach, consisting of a survey and follow-up interviews with employees from a large professional services company. The survey yielded 450 responses, uncovering different types of shadow IT within the company. The follow-up interviews with 32 employees aimed to uncover their perceptions of shadow IT, related risks, and their attitudes towards shadow IT usage. The survey and interviews revealed various types of shadow IT and showed a dichotomy of risk-averse and risk-tolerant mindsets. We found that participants employed a combination of these mindsets. Despite being aware of significant risks, gaps exist in acting upon this awareness, leading to an awareness-action gap. Closing this gap can be facilitated through factors that change these mindsets, such as the consequences of previous shadow IT choices, risk discussions, or training.