Digital Transformation and the Rise of Shadow IT: Implicationsfor Organisational Complexity and Cyber Governance
DOI:
https://doi.org/10.65820/ejems-2vol2-issue2-2026Keywords:
Digital transformation, Shadow IT, Shadow AI, Cyber governance, Organisational complexityAbstract
Purpose: This study examines how digital transformation contributes to the emergence of Shadow IT and Shadow AI, synthesising evidence on the factors driving unauthorised technology adoption, its implications for organisational complexity and cyber governance, and the governance strategies proposed to address these challenges.
Methodology: A systematic literature review was conducted in accordance with the PRISMA guidelines, synthesising evidence from 25 peer-reviewed studies across diverse organisational and industrial contexts. The evidence was synthesised through thematic analysis to identify recurring patterns relating to the conceptualisation of Shadow IT, adoption drivers, organisational consequences, cyber governance risks, and organisational responses. The findings were interpreted using the Technology–Organisation–Environment (TOE) framework and Diffusion of Innovation (DOI) theory.
Results: The review found that digital transformation, combined with restrictive governance processes, unmet operational needs, and the widespread availability of cloud computing and generative AI, encourages the adoption of unauthorised technologies. Shadow IT increases organisational complexity by creating fragmented technology infrastructures, data silos, duplicated information, and reduced accountability. These conditions weaken cyber governance through reduced visibility, data security vulnerabilities, compliance risks, and challenges associated with autonomous AI systems.
Novelty and Contribution: The study develops an integrated conceptual framework that explains how digital transformation drives Shadow IT adoption, links unauthorised technology use to organisational complexity and cyber governance risks, and identifies governance mechanisms that balance innovation, security, and compliance
Social and Practical Implications: The findings support the development of governance practices that improve collaboration between business units and IT departments while strengthening cybersecurity, regulatory compliance, and responsible use of digital and AI technologies in contemporary organisations.
References
Abed, S. S. (2024). Literature Review of Theory-Based Empirical Research Examining Consumers’ Adoption of IoT. In
S. K. Sharma, Y. K. Dwivedi, B. Metri, B. Lal, & A. Elbanna (Eds.), Transfer, Diffusion and Adoption of Next-Generation Digital Technologies (pp. 3–14). Springer Nature Switzerland. https://doi.org/10.1007/978-3-031-50204-0_1
Ahmad, A., Desouza, K. C., Maynard, S. B., Naseer, H., & Baskerville, R. L. (2020). How integration of cyber security management and incident response enables organisational learning. Journal of the Association for Information Science and Technology, 71(8), 939–953. https://doi.org/10.1002/asi.24311
Akinson, A. O., Obasanya, A., Raimi, B. O., & Oshoba, A. O. (2025). Does Economic Literacy Matter for Firm Performance and Competitive Advantage: A Systematic Review. Elicit Journal of Economics and Management Studies, 1(1), 1-16. https://doi.org/10.65820/ejems-1vol1-issue1-2025
Alfian, A. A., Ayuningtias, F. T., & Tajuddin, M. H. bin. (2026). Artificial Intelligence, Digital Communication, and Legal Transformation: Toward Adaptive Cyber Governance in Indonesia. Kanuun: Journal of Sharia, Law, and Digital Society, 59–74. https://doi.org/10.66277/kanuun.v1i1.20
Castellano, N., Felden, C., & Pinsker, R. (2022). Shadow IT Behavior of Financial Executives in Germany and Italy as an Antecedent to Internal Data Security Breaches. Hawaii International Conference on System Sciences. https://doi.org/10.24251/HICSS.2022.765
Chateau-Dégat, F., & Mayrhofer, U. (2026). Managing Shadow IT in Cross-Border Acquisitions: A Case Study of a German Multinational. Management International Review, 66(2), 387–407. https://doi.org/10.1007/s11575-025-00611-6
Devasthali, S., & Gupta, G. (2024). Embracing Change from Shadow IT to Collaborative IT Models. In S. K. Sharma, Y.
K. Dwivedi, B. Metri, B. Lal, & A. Elbanna (Eds.), Transfer, Diffusion and Adoption of Next-Generation Digital Technologies (Vol. 699, pp. 365–378). Springer Nature Switzerland. https://doi.org/10.1007/978-3-031-50204-0_31
Digalwar, A. K., Singh, S. R., Pandey, R., & Sharma, A. (2024). Industry 4.0 Implementation: Evidence from Indian Industries. In S. K. Sharma, Y. K. Dwivedi, B. Metri, B. Lal, & A. Elbanna (Eds.), Transfer, Diffusion and Adoption of Next-Generation Digital Technologies (pp. 23–34). Springer Nature Switzerland. https://doi.org/10.1007/978-3-031-50204-0_3
Falcão, D., & Roseira, C. (2022). Mapping the socially responsible consumption gap research: Review and future research agenda. International Journal of Consumer Studies, 46(5), 1718-1760. https://doi.org/10.1111/ijcs.12803
Fatorachian, H., & Ramesh, S. (2025). Leveraging digital transformation platforms to strengthen market position in India’s textile industry. Cogent Business & Management, 12(1), 2527220.
https://doi.org/10.1080/23311975.2025.2527220
Furstenau, D., Rothe, H., & Sandner, M. (2017). Shadow Systems, Risk, and Shifting Power Relations in Organizations. Communications of the Association for Information Systems, 41(1). https://doi.org/10.17705/1CAIS.04103
Fürstenau, D., Rothe, H., & Sandner, M. (2021). Leaving the Shadow: A Configurational Approach to Explain Post-identification Outcomes of Shadow IT Systems. Business & Information Systems Engineering, 63(2), 97–111. https://doi.org/10.1007/s12599-020-00635-2
Haag, S., & Eckhardt, A. (2024). Dealing Effectively with Shadow IT by Managing Both Cybersecurity and User Needs. MIS Quarterly Executive, 23(4). https://aisel.aisnet.org/misqe/vol23/iss4/5
Kasmo, A. B. P., Mor, S., Nugroho, L., Rohadi, M., & Purnama, A. (2025). Integrating Corporate Strategy with Digital Transformation, Cybersecurity, and Sustainability. Jurnal Lemhannas RI, 13(1), 52–68. https://doi.org/10.55960/jlri.v13i1.1062
Klotz, S., Kopper, A., Westner, M., & Strahringer, S. (2019). Causing factors, outcomes, and governance of Shadow IT and business-managed IT: A systematic literature review. International Journal of Information Systems and Project Management, 7(1), 15–43.
Kopper, A., Westner, M., & Strahringer, S. (2020). From Shadow IT to Business-managed IT: A qualitative comparative analysis to determine configurations for successful management of IT by business entities. Information Systems and E-Business Management, 18(2), 209–257. https://doi.org/10.1007/s10257-020-00472-6
Küçükoğlu, U., & Kabakuş, A. K. (2025). Revisiting the Technology–Organization–Environment Framework: Disruptive Technologies as Catalysts of Digital Transformation in the Turkish Banking Sector. Sustainability, 17(23), 10787. https://doi.org/10.3390/su172310787
Lebona, R., Mphunyane, M. Z. M., Mochekele, M., & Thamae, L. (2025). Redesigning Learning Spaces in Higher Institutions for the Post-Pandemic Era: A Systematic Review. Elicit Journal of Education Studies, 1(1), 44-59. https://doi.org/10.65820/ejes-4vol1-issue1-2025
Liang, Q., Crowston, K., & Gou, J. (2026). How to Come Up with AI Use Case Ideas? —An Ideation Technique Development Based on Analysis of Shadow IT Usage. Information Systems Frontiers. https://doi.org/10.1007/s10796-025-10676-1
Malik, G. (2025). CYBERSECURITY GOVERNANCE AND RISK MANAGEMENT FOR DIGITAL TRANSFORMATION.
International Journal of Applied Mathematics, 38(10s), 2532–2561. https://doi.org/10.12732/ijam.v38i10s.1139
Mandal, K., & Bag, S. (2024). Bridging Realities: Understanding the Factors Influencing Visitor Satisfaction and Authentic Experiences in Virtual Tourism. In S. K. Sharma, Y. K. Dwivedi, B. Metri, B. Lal, & A. Elbanna (Eds.), Transfer, Diffusion and Adoption of Next-Generation Digital Technologies (Vol. 699, pp. 161–177). Springer Nature Switzerland. https://doi.org/10.1007/978-3-031-50204-0_14
N’Dri, A. B., & Su, Z. (2024). Successful configurations of technology–organization–environment factors in digital transformation: Evidence from exporting small and medium-sized enterprises in the manufacturing industry. Information & Management, 61(7), 104030. https://doi.org/10.1016/j.im.2024.104030
Ogedengbe, F. A., Abdul Talib, Y. Y., & Rusly, F. H. (2024). Influence of structural factors on employee cloud shadow IT usage during COVID-19 lockdown: A strain theory perspective. Cognition, Technology & Work, 26(1), 63–81. https://doi.org/10.1007/s10111-023-00748-0
Orthi, S. M., Chakraborty, P., Siam, M. A., Shan-A-Alahi, A., Zaiem, A. A., Hasan, S. N., Kaur, J., Mahmud, F., & Goffer,
M. A. (2023). AI-Driven Cyber Threat Intelligence as a Management Information System: Integrating Cybersecurity Governance and IT Project Management for Organisational Resilience. The Eastasouth Journal of Information System and Computer Science, 1(02), 194–213. https://doi.org/10.58812/esiscs.v1i02.873
Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., ... & Moher. (2021). The PRISMA 2020 statement: an updated guideline for reporting systematic reviews. BMJ, 72. https://doi.org/10.1136/bmj.n71
Panxhi, M., Thanasi-Boçe, M., & Hoxha, J. (2025). Digital transformation, entrepreneurial competence, and future job prospects in engineering education. Cogent Education, 12(1), 2526429.
https://doi.org/10.1080/2331186X.2025.2526429
Rakovic, L., Duc, T. A., & Vukovic, V. (2020). Shadow IT and ERP: Multiple Case Studies in German and Serbian Companies. Journal of East European Management Studies, 25(4), 730–752.
Saeed, S., Altamimi, S. A., Alkayyal, N. A., Alshehri, E., & Alabbad, D. A. (2023). Digital Transformation and Cybersecurity Challenges for Business Resilience: Issues and Recommendations. Sensors, 23(15), 6666.
https://doi.org/10.3390/s23156666
Scalabrin Bianchi, I., Vaquina, A., Pereira, R., Dinis Sousa, R., & Dávila, G. A. (2022). A Benefit Dependency Network for Shadow Information Technology Adoption, Based on Practitioners’ Viewpoints. Informatics, 9(4), 95.
https://doi.org/10.3390/informatics9040095
Sebastian, G. (2026). Digital shadow AI risk theory (DART): A framework for managing data disclosure and privacy risks of AI tools at work. Technological Forecasting and Social Change, 229, 124697.
https://doi.org/10.1016/j.techfore.2026.124697
Shunmugasundaram, M., Gangadharan, S., Dave, R., Kala, S., & Michael, O. P. (2026). Shadow AI as the new Shadow IT: Governance blind spots in autonomous enterprise systems. EDPACS, 1–20. https://doi.org/10.1080/07366981.2026.2679653
Silic, M., Silic, D., & Kind-Trüller, K. (2025). From Shadow IT to Shadow AI–Threats, Risks and Opportunities for Organizations. Strategic Change, jsc.2682. https://doi.org/10.1002/jsc.2682
Sillic, M. (2019). Critical impact of organisational and individual inertia in explaining non-compliant security behavior in the Shadow IT context. Computers & Security, 80, 108–119. https://doi.org/10.1016/j.cose.2018.09.012
Thuan, L. T., Tam, N. T., Trang, N. T. N., Trang, L. T. T., Huyen, K. N., & Huong, N. T. (2025). Digital transformation and sustainable business growth: Evidence from SMEs in Vietnam’s Mekong Delta. International Journal of Advanced and Applied Sciences, 12(6), 223–233. https://doi.org/10.21833/ijaas.2025.06.022
Waters-Lynch, J., Allen, D. W. E., Potts, J., & Berg, C. (2025). Shadow user innovation: Governing covert generative-AI use for dynamic-capability renewal. Innovation, 1–17. https://doi.org/10.1080/14479338.2025.2519546
Xu, K. (2025). Promotion path of digital transformation in China’s manufacturing industry based on the technology-organisation-environment framework. Journal of Business Economics and Management, 26(5), 1090–1111. https://doi.org/10.3846/jbem.2025.24959
Zhao, Y., Meng, Q., & Li, Z. (2025). Performance Enhancement Pathways for Electric Vehicle Manufacturing Companies Driven by Digital Transformation—A Configuration Analysis Based on the TOE Framework. Systems, 13(8), 680. https://doi.org/10.3390/systems13080680
Zheng, Y., Dou, X., & Wang, X. (2026). What drives the digital transformation of farmers’ cooperatives? An empirical analysis based on the TOE framework. Agricultural and Food Economics, 14(1), 3. https://doi.org/10.1186/s40100-026-00453-2
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Zakaria Alrababah (Author)
This work is licensed under a Creative Commons Attribution 4.0 International License.
This article is licensed under a Creative Commons Attribution 4.0 International License.
