Investigating the influence of emotions on Shadow IT usage behaviours
Keywords:
Shadow IT, coping, problem-focused, emotion-focused, Security, BehaviourAbstract
Shadow IT (SIT) usage can be characterized as follows: (1) employees’ voluntary adoption of unapproved IT tools for the purpose of working more efficiently, and (2) employees’ infringement on corporate security policies even when they act without malicious intent. We used the coping model of user adaptation to conduct a survey of 480 SIT users to investigate the ways in which employees cope with SIT usage. Our findings indicate that in the context of SIT usage, employees feel satisfied regardless of their level of control over their SIT usage and that a greater level of perceived control allows employees to maximise their performance at work, increasing satisfaction. We also show that perceived threat fosters the implementation of security measures via problem-focused coping (PFC) behaviours and mi[1]tigates emotion-focused coping (EFC) behaviours. As SIT usage can be perceived both as beneficial and threatening, we contribute to behavioural information systems (IS) research by showing that even when employees covertly use unapproved IT resources and infringe on corporate IT policies, they nevertheless engage in risk mitigation to preserve the increased efficiency they gain from using SIT.
References
Afzal, M., Panagiotopoulos, P. (2024). Coping with digital transformation in frontline public services: A study of user adaptation in policing. Government Information Quarterly, 41(4), 101977, https://doi.org/10.1016/j.giq.2024.101977.
Allen, D., Burton, F.G., Smith, S.D., & Wood, D.A. (2019). Shadow IT Use, Outcome Effects, and Subjective Performance Evaluation. Journal of Strategic Innovation and Sustainability, 14(3), 29–42. https://doi.org/10.33423/jsis.v14i3.2104.
Anandarajan, M., Paravastu, N., Arinze, B., & D'Ovidio, R. (2012). Online identity theft: A longitudinal study of individual threat-response and coping behaviors. Journal of Information System Security, 8(2), 43-49.
Baillette, P., Barlette, Y., & Leclercq-Vandelannoitte, A. (2018). Bring your own device in organizations: Extending the reversed IT adoption logic to security paradoxes for CEOs and end users. International Journal of Information Management, 43, 76–84.
Baillette, P., & Barlette, Y. (2020). Coping Strategies and Paradoxes Related to BYOD Information Security Threats in France. Journal of Global Information Management, 28(2), 1–28. https://doi.org/10.4018/jgim.2020040101
Baillette, P., Barlette, Y., & Berthevas, J.-F. (2022). Benefits and Risks of Shadow IT in Health Care: A Narrative Review of the Literature. Systèmes d’Information et Management, 27(2), 59-96.
Bala, H., & Venkatesh, V. (2016). Adaptation to Information Technology: A Holistic Nomological Network from Implementation to Job Outcomes. Management Science, 62(1), 156–179.
Barlette Y. (2012). Implication et Action Des Dirigeants : Quelles Pistes Pour Améliorer la Sécurité de l’Information en PME ?. Systèmes d’Information et Management, 17(3), 115–149.
Barlette, Y., Jaouen, A., & Baillette, P. (2021). Bring Your Own Device (BYOD) as Reversed IT Adoption: Insights into Managers’ Coping Strategies. International Journal of Information Management, 56, 1–16.
Barlette, Y., Berthevas, J. F., & Sueur, I. (2023). Impacts on Employee Coping Behaviors of Opportunities and Threats Related to the Use of Shadow IT. Systèmes d’Information et Management, 28(4), 71-107.
Bartelheimer, C., Wolf, V., & Beverungen, D. (2023). Workarounds as generative mechanisms for bottom-up process innovation—Insights from a multiple case study. Information Systems Journal, 33(5), 1085–1150.
Beaudry, A., & Pinsonneault, A. (2005). Understanding user responses to information technology: A coping model of user adaptation. MIS Quarterly, 29(3), 493–524.
Becker, J.-M., Cheah, J.-H., Gholamzade, R., Ringle, C. M., & Sarstedt, M. (2023). PLS-SEM’s most wanted guidance. International Journal of Contemporary Hospital Management, 35(1), 321-346, https://doi.org/10.1108/IJCHM-04-2022-0474.
Becker, J.-M., Klein, K., & Wetzels, M. (2012). Hierarchical Latent Variable Models in PLS-SEM: Guidelines for Using Reflective-Formative Type Models. Long Range Planning, 45, 359–394.
Bhattacherjee, A. (2001). Understanding information systems continuance: an expectation-confirmation model. MIS Quarterly, 25(3), 351–370.
Bhattacherjee, A., Davis, C.J., Connolly, A.J., & Hikmet, N. (2018). User response to mandatory IT use: A coping theory perspective. European Journal of Information Systems, 27(4), 395–414.
Carver, C.S., Scheier, M.F., & Weintraub, J.K. (1989). Assessing coping strategies: A theoretically based approach. Journal of personal Social Psychology, 56, 267–283.
Chen, Z., Zhang, R., Xu, T., Yang, Y., Wang, J., & Feng, T. (2020). Emotional attitudes towards procrastination in people: A large-scale sentiment-focused crawling analysis. Computers in Human Behavior, 110, 106391.
Chenoweth, T., Gattiker, T., & Corral, K. (2019). Adaptive and Maladaptive Coping with an It Threat. Information Systems Management, 36(1), 24–39.
Chin, W.W., Thatcher, J.B., Wright, R.T., & Steel, D.J. (2013). Controlling for Common Method Variance in PLS Analysis: The Measured Latent Marker Variable Approach. https://doi.org/10.1007/978-1-4614-8283-3_16.
Chowdhury, N. H., Adam, M. T. P., & Teubner, T. (2023). Rushed to crack – On the perceived effectiveness of cybersecurity measures for secure behaviour under time pressure. Behavior & Information Technology, 42(10), 1568-1589.
Compeau, D.R., Higgins, C.A., & Huff, S. (1999). Social Cognitive Theory and Individual Reactions to Computing Technology: A Longitudinal Study. MIS Quarterly, 23(2), 145–158.
Cook, R.D. (1977). Detection of Influential Observation in Linear Regression. Technometrics, 19(1), 15–18, https://doi.org/10.2307/1268249.
Crossler, R.E., Bélanger, F., & Ormond, D. (2019). The quest for complete security: An empirical analysis of users’ multi-layered protection from security threats. Information Systems Frontiers, 21, 343–357.
Dagorn, N., & Poussing, N. (2012). Engagement et Pratiques des Organisations en Matière de Gouvernance de la Sécurité de l’Information. Systèmes d’Information et Management, 17(3), 113–143.
Davison, R. M., Wong, L.H.M., Ou, C.X.J., & Alter, S. (2021). The coordination of workarounds: Insights from responses to misfits between local realities and a mandated global enterprise system. Information & Management, 58 (8) 103530.
Dinev, T., & Hu, Q. (2007). The Centrality of Awareness in the Formation of User Behavioral Intention toward Protective Information Technologies. Journal of the Association for Information Systems, 8(7), 386–408.
Du, H., Lehmann, C.M., & Willson, V.L. (2022). Would You Give Me Your Password?. Journal of Information Systems, 36(2), 17–52.
Elie-Dit-Cosaque, C.M., & Straub, D.W. (2011). Opening the black box of system usage: User adaptation to disruptive IT. Journal of Information Systems 20(5), 589–607.
Floyd, D.L., Prentice-Dunn, S., & Rogers, R.W. (2000). A Meta-Analysis of Research on Protection Motivation Theory. Journal of Applied Social Psychology, 30, 407-429.
Folkman, S. (1992). Making the case for coping. In B. N. Carpenter (Ed.), Personal coping: Theory, research, and application (p. 31-46). Westport, CT: Praeger.
Folkman, S., Lazarus, R.S., Gruen, R.J., & DeLongis, A. (1986). Appraisal, coping, health status, and psychological symptoms. Journal of personal Social Psychology, 50(3), 571–579.
Fürstenau, D., Rothe, H., & Sandner, M. (2021). Leaving the Shadow: A Configurational Approach to Explain Post-identification Outcomes of Shadow IT Systems. Business Information Systems Engineering, 63(2), 97–111.
Gartner. (2023). Gartner Unveils Top Eight Cybersecurity Predictions for 2023-2024. https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024, accessed 10/31/2025.
Guo, K.H., Yuan, Y., Archer, N.P., & Connelly, C.E. (2011). Understanding Nonmalicious Security Violations in the Workplace: A Composite Behavior Model. Journal of Management Information Systems, 28(2), 203–236.
Györy, A., Cleven, A., Uebernickel, F., & Brenner, W. (2012). Exploring the shadows: IT governance approaches to user-driven innovation. 20th European Conference on Information Systems (ECIS), Barcelona, Spain.
Haag, S., Eckhardt, A., & Bozoyan, C. (2015). Are shadow system users the better IS users? Insights of a lab experiment. 36th International Conference on Information Systems (ICIS). Fort Worth, USA.
Haag, S., & Eckhart, A. (2017). Shadow-It. Business Information Systems Engineering, 59(6), 469–473.
Haag, S., & Eckhardt, A. (2024). Dealing Effectively with Shadow IT by Managing Both Cybersecurity and User Needs. MIS Quarterly Executive, 23(4), 399-412.
Haag, S., Eckhart, A., & Schwartz, A. (2019). The Acceptance of Justifications among Shadow IT Users and Nonusers – An Empirical Analysis. Information & Management, 56(5), 731–741.
Haag, S., Siponen, M., & Liu, F. (2021). Protection Motivation Theory in Information Systems Security Research: A Review of the Past and a Road Map for the Future. Data Base for Advances in Information Systems, 52(2), 25–67.
Hair, J.F., Hult, G.T. M., Ringle, C.M., & Sarstedt, M. (2022). A primer on Partial Least Squares Structural Equation Modeling (PLS-SEM). 3rd ed. Thousand Oaks: Sage.
Hair, J.F., Sarstedt, M., Ringle, C.M., & Gudergan, S.P. (2024). Advanced issues in partial least squares structural equation modeling. 2nd ed. Thousand Oaks: Sage.
Henseler, J., Ringle, C.M., & Sarstedt, M. (2015). A new criterion for assessing discriminant validity in variance-based structural equation modeling. Journal of the Academy of Marketing Science, 43(1), 115–135.
Henseler, J., Ringle, C.M., & Sarstedt, M. (2016). Testing measurement invariance of composites using partial least squares. International Marketing Review 33(3), 405–431.
Ifinedo, P. (2012). Understanding Information Systems Security Policy Compliance: An Integration of the Theory of Planned Behavior and the Protection Motivation Theory. Computers & Security, 31(1), 83–95.
Jumpcloud. (2024). Detours Ahead: How IT Navigates an Evolving World, https://jumpcloud.com/resources/detours-ahead-how-it-navigates-an-evolving-world#success, accessed 10/31/2025.
Junglas, I., Goel, L., Ives, B., & Harris, J. (2019). Innovation at work: The relative advantage of using consumer IT in the workplace. Information Systems Journal, 29, 317–339.
Kopper, A., Westner, M., & Strahringer, S. (2020). From Shadow IT to Business-managed IT: a qualitative comparative analysis to determine configurations for successful management of IT by business entities. Information Systems e-Business Management, 18, 209-257.
Kweon, E., Lee, H., Chai, S., & Yoo, K. (2021). The Utility of Information Security Training and Education on Cybersecurity Incidents: An empirical evidence. Information Systems Frontiers, 23, 361–373.
Larson, R. B. (2019). Controlling social desirability bias. International Journal Marketing Research, 61(5), 534–547.
Laumer, S., Maier, C., & Weitzel, T. (2017). Information quality, user satisfaction, and the manifestation of workarounds: a qualitative and quantitative study of enterprise content management system users. Journal of Information Systems, 26(4), 333–360.
Lazarus, R.S. (1966). Psychological stress and the coping process. New York: McGraw-Hill.
Lazarus, R.S., & Folkman, S. (1984). Stress, appraisal, and coping. New York: Springer Publishing Company.
Lee, N., & Cadogan, J.W. (2013). Problems with formative and higher-order reflective variables. Journal of Business Research, 66, 242–247.
Lee, Y., & Larsen, K.R. (2009). Threat or coping appraisal: Determinants of SMB executives’ decision to adopt anti-malware software. European Journal of Information Systems, 18(2), 177–187.
Li, H., Luo, X., & Chen, Y. (2021). Understanding Information Security Policy Violation from a Situational Action Perspective. Journal of the Association for Information Systems, 22(3), 739-772.
Li, Y., Yazdanmehr, A., Wang, J., & Rao, H.R. (2019a). Responding to identity theft: A victimization perspective. Decision Support Systems, 121, 13-24.
Li, L., He, W., Xu, L., Ash, I., Anwar, M., & Yuan, X. (2019b). Investigating the impact of cybersecurity policy awareness on employees’ cybersecurity behavior. International Journal of Information Management, 45, 13-24.
Liang, H., & Xue, Y. (2009). Avoidance of information technology threats: A theoretical perspective. MIS Quarterly, 33(1), 71–90.
Liang, H., & Xue, Y., Pinsonneault, A., Wu, Y. (2019). What Users Do Besides Problem-focused Coping When Facing IT Security Threats: An Emotion-Focused Coping Perspective. MIS Quarterly, 43(2), 373–394.
Lindell, M.K., & Whitney, D.J. (2001). Accounting for common method variance in cross-sectional research designs. Journal of Applied Psychology, 86(1), 114–121.
Lowry, P.B., D’Arcy, J., Hammer, B., & Moody, G.D. (2016). “Cargo Cult” science in traditional organization and information systems survey research: A case for using nontraditional methods of data collection, including Mechanical Turk and online panels. Journal of Strategic Information Systems, 25(3), 232-240.
Lowry, P. B., Moody, G. D., Parameswaran, S., & Brown, N. J. (2023). Examining the differential effectiveness of fear appeals in information security management using two-stage meta-analysis. Journal of Management Information Systems, 40(4), 1099–1138.
Mady, A., Gupta, S., & Warkentin, M. (2023). The effects of knowledge mechanisms on employees’ information security threat construal. Information Systems Journal, 33(4), 790–841.
Maier, C., Laumer, S., Tarafdar, M., Mattke, J., Reis, L., & Weitzel, T. (2021). Challenge and Hindrance IS Use Stressors and Appraisals: Explaining Contrarian Associations in Post-Acceptance IS Use Behavior. Journal of the Association for Information Systems, 22(6), 1590-1624.
Malaurent, J., & Karanasios, S. (2020). Learning from Workaround Practices: The Challenge of Enterprise System Implementations in Multinational Corporations. Information Systems Journal, 30, 639–663.
McKinley, C.J., & Ruppel, E.K. (2014). Exploring how perceived threat and self-efficacy contribute to college students’ use and perceptions of online mental health resources. Computers in Human Behavior, 34, 101-109.
Menard, P., Bott, G.J., & Crossler, R.E. (2017). User Motivations in Protecting Information Security: Protection Motivation Theory Versus Self-Determination Theory. Journal of Management Information Systems, 34(4), 1203–1230.
Moody, G.D., Siponen, M., & Pahnila, S. (2018). Toward a Unified Model of Information Security Policy Compliance. MIS Quarterly, 42(3), 285–311.
Morquin, D., Ologeanu-Taddei, R., Paré, G., & Wagner, G. (2023). A method for resolving organisation-enterprise system misfits: An action research study in a pluralistic organisation. Information Systems Journal, 33(5), 1–34.
Moser, S., Bruppacher, S.E., & Mosler, H.-J. (2011). How people perceive and will cope with risks from the diffusion of ubiquitous information and communication technologies. Risk Analysis, 31(5), 832–846.
NextDLP. (2024). Understanding and Managing the Risks of Shadow SaaS and GenAI. https://www.nextdlp.com/resources/blog/shadow-saas-genai-survey-results-2024, accessed 08/05/2024.
Orlikowski, W.J. (2000). Using Technology and Constituting Structures: A Practice Lens for Studying Technology in Organisations. Organisation Science, 11(4), 404–428.
Ou, C.X., Zhang, X., Angelopoulos, S., Davison, R.M., & Janse, N. (2022). Security breaches and organization response strategy: Exploring consumers’ threat and coping appraisals. International Journal of Information Management, 65, 102498.
Paas, L.J., & Morren, M. (2018). Please do not answer if you are reading this: respondent attention in online panels. Marketing Letters, 29, 13–21.
Pérès, A., Latour, R., & Bergeron, J. (2003). Attitude des Utilisateurs de Systèmes à l’égard de la Protection des Informations : Un Modèle des Facteurs d’influence. Systèmes d’Information et Management, 8(3), 87–118.
Petter, S., Straub, D., & Rai, A. (2007). Specifying formative constructs in Information Systems Research. MIS Quarterly, 31(4), 623–656.
Podsakoff, P.M., MacKenzie, S.B., Lee, J.-Y., & Podsakoff, N.P. (2003). Common method biases in behavioral research: A critical review of the literature and recommended remedies. Journal of Applied Psychology, 88(5), 879–903.
Podsakoff, P.M., MacKenzie, S.B., & Podsakoff, N.P. (2012). Sources of method bias in social science research and recommendations on how to control it. Annual Review of Psychology, (1), 539–569.
Pratt, M. K. (2023). Shadow IT is increasing and so are the associated security risks. https://www.csoonline.com/article/575457/shadow-it-is-increasing-and-so-are-the-associated-security-risks.html, accessed 10/31/2025.
Rogers, R.W. (1983). Cognitive and physiological processes in fear appeals and attitude change: A revised theory of protection motivation. In J. T. Cacioppo & R. E. Petty (Eds.), Social psychophysiology: A sourcebook (p. 153-176). New York: Guilford Press.
Rowe, F., Wolff, F.-C., & Daniel, C. (2023). Does addictive pleasure at work and building a personal IS on one’s smartphone lead to smartphone dependency?. Journal of Global Information Management, 31(5), 1-25.
Shaw, J.B., & Barrett-Power, E. (1997). A Conceptual Framework for Assessing Organization, Work Group, and Individual Effectiveness During and After Downsizing. Human Relations, 50(2), 109–127.
Siemsen, E., Roth, A., & Oliveira, P. (2010). Common method bias in regression models with linear, quadratic, and interaction effects. Organizational Research Methods, 13(3), 456–476.
Silic, M. (2019). Critical impact of organizational and individual inertia in explaining non-compliant security behavior in the Shadow IT context. Computers & Security, 80, 118–119.
Silic, M., Barlow, J.B., & Back, A. (2017). A new perspective on neutralization and deterrence: predicting shadow IT usage. Information & Management, 54, 1023–1037.
Simmering, M.J., Fuller, C.M., Richardson, H.A., Ocal, Y., & Atinc, G.M. (2015). Marker variable choice, reporting, and interpretation in the detection of common method variance. Organizational Research Methods, 18(3), 473–511.
Siponen, M., Mahmood, M.A., & Pahnila, S. (2014). Employees’ adherence to information security policies: An exploratory field study. Information & Management, 51(2), 217–224.
Soliman, W., & Tuunainen, V. K. (2022). A tale of two frames: Exploring the role of framing in the use discontinuance of volitionally adopted technology. Information Systems Journal, 32(3), 473–519. https://doi.org/10.1111/isj.12355
Spierings, A., Kerr, D., & Houghton, H. (2017). Issues that support the creation of ICT workarounds: towards a theoretical understanding of feral information systems. Information Systems Journal 27, 775–794.
Stein, M.-K., Newell, S., Wagner, E.L., & Galliers, R.D. (2015). Coping with Information Technology: Mixed Emotions, Vacillation, and Nonconforming Use Patterns. MIS Quarterly, 39(2), 367–392.
Straub, D., Limayem, M., & Karahanna-Evaristo, E. (1995). Measuring system usage: Implications for IS theory testing. Management Science, 41(8), 1328–1342.
Tazkarji, M., Van Slyke, C., Hamadeh, G., & Junglas, I. (2024). To Use or Not to Use! Working Around the Information System in the Healthcare Field. Communications of the Association for Information Systems, 55, 279-301. https://doi.org/10.17705/1CAIS.05511
Tejay, G. P. S., & Mohammed, Z. A. (2023). Cultivating security culture for information security success: A mixed-methods study based on anthropological perspective, Information & Management, 60 (3) 103751.
Thomas, K.W., & Velthouse, B.A. (1990). Cognitive elements of empowerment: An “Interpretive” Model of Intrinsic Task Motivation. Academy of Management Review, 15(4), 666–681.
Tobler, N., Colvin, J., & Rawlins, N.W. (2017). Longitudinal analysis and coping model of user adaptation. Journal of Computers Information Systems, 57(2), 97–105.
Tu, Z., Turel, O., Yuan, Y., & Archer, N. (2015). Learning to cope with information security risks regarding mobile device loss or theft: An empirical examination. Information & Management, 52(4), 506–517.
van der Waal, W., van de Weerd, I., Beerepoot, I., Lu, X., Kappen, T., Haitjema, S., & Reijers, H.A. (2025). Putting the SWORD to the Test: Finding Workarounds with Process Mining. Business and Information Systems Engineering, 67, 171–190. https://doi.org/10.1007/s12599-023-00846-3.
van Offenbeek, M.A.G., Vos, J.F.J., van den Hooff, B., & Boonstra, A. (2023). When workarounds aggravate misfits in the use of electronic health record systems. Information Systems Journal, 1–34. https://doi.org/10.1111/isj.12478.
Vance, A., Siponen, M., & Pahnila, S. (2012). Motivating IS security compliance: Insights from Habit and Protection Motivation Theory. Information & Management, 49(3‑4), 190–198.
Walterbusch, M., Fietz, A., & Teuteberg, F. (2017). Missing cloud security awareness: investigating risk exposure in shadow IT. Journal of Enterprise Information Management, 30(4), 644–665.
Wang, J., Li, Y., & Rao, H.R. (2016). Overconfidence in Phishing Email Detection. Journal of the Association for Information Systems, 17(11), 59-783.
Wang, J., Li, Y., & Rao, H.R. (2017). Coping Responses in Phishing Detection: An Investigation of Antecedents and Consequences. Information Systems Research, 28(2), 378–396.
Wong, L.H.M., Hurbean, L., Davison, R.M., Ou, C.X.J., & Muntean, M. (2022).Working around inadequate information systems in the workplace: An empirical study in Romania. International Journal of Information Management, 64, 1–11.
Workman, M., Bommer, W.H., & Straub, D. (2008). Security lapses and the omission of information security measures: A threat control model and empirical test. Computers in Human Behavior, 24(6), 2799–2816.
Xin, T., Siponen, M., & Chen, S. (2022). Understanding the inward emotion-focused coping strategies of individual users in response to mobile malware threats. Behaviour & Information Technology, 41(13), 2835-2859, https://doi.org/10.1080/0144929X.2021.1954242.
Yazdanmehr, A., Wang, J, & Yang, Z. (2020). Peers matter: The moderating role of social influence on information security policy compliance. Information Systems Journal, 30, 791–844.
Yazdanmehr, A., Li, Y., & Wang, J. (2023). Employee responses to information security related stress: Coping and violation intention. Information Systems Journal, 33(3), 598–639.
Yin, Y., Hsu, C., & Zhou, Z. (2023). Employees’ in-role and extra-role information security behaviors from the P-E fit perspective. Computers & Security, 133, 103390.
Zamani, E. D., & Pouloudi, N. (2021). Generative mechanisms of workarounds, discontinuance and reframing: a study of negative disconfirmation with consumerised IT. Information Systems Journal, 31, 384–428.
Published
How to Cite
Issue
Section
License
The author bears the responsibility for checking whether material submitted is subject to copyright or ownership rights (e.g. figures, tables, photographs, illustrations, trade literature and data). The author will need to obtain permission to reproduce any such items, and include these permissions with their final submission.
It is our policy to ask all contributors to transfer for free the copyright in their contribution to the journal owner. There are two broad reasons for this:
- ownership of copyright by the journal owner facilitates international protection against infringement of copyright, libel or plagiarism;
- it also ensures that requests by third parties to reprint or reproduce a contribution, or part of it, in either print or electronic form, are handled efficiently in accordance with our general policy which encourages dissemination of knowledge within the framework of copyright.
In conformity with the French law, the author keeps the 'moral rights' related to the article:
- The 'authorship right': It is the author's right to have his name associated with each publication and exploitation of the article.
- The 'integrity right': It can be claimed by the author if he finds that during an exploitation, his work has been distorted (cutting, reassembly...).
