Shadow information security practices in organizations: The role of information security transparency, overload, and psychological empowerment
Year: 2025
Type: article
Study design: Observational Study
Abstract: Employees are both the first line of defense in organizations and a significant source of vulnerability. Behavioral research in information security (InfoSec) has predominantly studied the compliance of employees with organizational directives. Less understood are ‘shadow security practices’ – a related category of behavior where employees adopt InfoSec workarounds, albeit to still comply with organizational security needs. We develop a model of the antecedents of employees’ intentions to engage in shadow security practices and empirically test our model through a sample of 433 office workers. Results of our structural equation modeling analysis reveal that both InfoSec overload and psychological empowerment increase intentions to adopt shadow security measures, whereas perceived transparency of organizational InfoSec (through InfoSec communication) reduces this intention. Furthermore, we find that these constructs are interrelated and that InfoSec overload can be increased by both psychological empowerment and InfoSec transparency . Our study develops the theoretical understanding of the important yet under-researched concept of shadow security and presents practical recommendations to effectively manage organizational InfoSec through these factors.
Source: Computers & Security
Authors: Duy Dang-Pham, Nik Thompson, Atif Ahmad, Sean Maynard
Institutions: RMIT Vietnam, Curtin University, The University of Melbourne
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
Estimated APC paid: $3,100
OpenAlex ID: W4410530229