{"id":"https://openalex.org/W7225256711","doi":"https://doi.org/10.62915/2472-2707.1334","title":"From Shadow IT to Shadow AI: A Scoping Review of How Embedded AI and Employee Use Increase Cybersecurity and Data Privacy Risk","display_name":"From Shadow IT to Shadow AI: A Scoping Review of How Embedded AI and Employee Use Increase Cybersecurity and Data Privacy Risk","publication_year":2026,"publication_date":"2026-11-03","ids":{"openalex":"https://openalex.org/W7225256711","doi":"https://doi.org/10.62915/2472-2707.1334"},"language":"en","primary_location":{"id":"doi:10.62915/2472-2707.1334","doi":"https://doi.org/10.62915/2472-2707.1334","is_oa":true,"landing_page_url":"https://doi.org/10.62915/2472-2707.1334","pdf_url":null,"source":{"id":"https://openalex.org/S4387287378","display_name":"Journal of Cybersecurity Education Research and Practice","issn_l":"2472-2707","issn":["2472-2707"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity Education, Research and Practice","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.62915/2472-2707.1334","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5160648523","display_name":"Jenny Ahn","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jenny Ahn","raw_affiliation_strings":["University of Arizona"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arizona","institution_ids":["https://openalex.org/I138006243"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160645481","display_name":"Bogdan Pavlyuchenkov","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bogdan Pavlyuchenkov","raw_affiliation_strings":["University of Arizona"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arizona","institution_ids":["https://openalex.org/I138006243"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160690087","display_name":"Lasette Smith","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Lasette Smith","raw_affiliation_strings":["University of Arizona"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arizona","institution_ids":["https://openalex.org/I138006243"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067747840","display_name":"Paul Wagner","orcid":"https://orcid.org/0000-0001-5914-0479","observed_orcids":["https://orcid.org/0000-0001-5914-0479","https://orcid.org/0000-0001-7081-4411"]},"institutions":[{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Paul Wagner","raw_affiliation_strings":["University of Arizona"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arizona","institution_ids":["https://openalex.org/I138006243"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093388190","display_name":"Robert J Honomichl","orcid":"https://orcid.org/0009-0001-0968-2277","observed_orcids":["https://orcid.org/0009-0001-0968-2277"]},"institutions":[{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Robert J Honomichl","raw_affiliation_strings":["University of Arizona"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arizona","institution_ids":["https://openalex.org/I138006243"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093388189","display_name":"Ryan Straight","orcid":"https://orcid.org/0000-0002-6251-5662","observed_orcids":["https://orcid.org/0000-0002-6251-5662"]},"institutions":[{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ryan Straight","raw_affiliation_strings":["University of Arizona"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arizona","institution_ids":["https://openalex.org/I138006243"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5160609734","display_name":"Shengjie Xu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shengjie Xu","raw_affiliation_strings":["University of Arizona"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arizona","institution_ids":["https://openalex.org/I138006243"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I138006243"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"2026","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9824000000953674,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9824000000953674,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.0038999998942017555,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11572","display_name":"Information Technology Governance and Strategy","score":0.00279999990016222,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/shadow-ai","display_name":"shadow AI","score":0.9340000152587891},{"id":"https://openalex.org/keywords/shadow-it","display_name":"shadow IT","score":0.9620000123977661},{"id":"https://openalex.org/keywords/cybersecurity-risks","display_name":"cybersecurity risks","score":0.902999997138977},{"id":"https://openalex.org/keywords/data-privacy-risks","display_name":"data privacy risks","score":0.9950000047683716},{"id":"https://openalex.org/keywords/data-leakage","display_name":"data leakage","score":0.7310000061988831},{"id":"https://openalex.org/keywords/prompt-injection","display_name":"prompt injection","score":0.9940000176429749},{"id":"https://openalex.org/keywords/credential-compromise","display_name":"credential compromise","score":0.7850000262260437},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.7319999933242798},{"id":"https://openalex.org/keywords/ai-governance","display_name":"AI governance","score":0.8040000200271606},{"id":"https://openalex.org/keywords/data-loss-prevention","display_name":"data loss prevention","score":0.6890000104904175},{"id":"https://openalex.org/keywords/identity-and-access-management","display_name":"identity and access management","score":0.9900000095367432}],"concepts":[{"id":"https://openalex.org/C117797892","wikidata":"https://www.wikidata.org/wiki/Q286363","display_name":"Shadow (psychology)","level":2,"score":0.6870999932289124},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6287000179290771},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6132000088691711},{"id":"https://openalex.org/C39389867","wikidata":"https://www.wikidata.org/wiki/Q380767","display_name":"Corporate governance","level":2,"score":0.5753999948501587},{"id":"https://openalex.org/C196879817","wikidata":"https://www.wikidata.org/wiki/Q872685","display_name":"Data governance","level":4,"score":0.5568000078201294},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.4832000136375427},{"id":"https://openalex.org/C123403432","wikidata":"https://www.wikidata.org/wiki/Q654068","display_name":"Visibility","level":2,"score":0.4300000071525574},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.39719998836517334},{"id":"https://openalex.org/C506469952","wikidata":"https://www.wikidata.org/wiki/Q181467","display_name":"Homeland security","level":3,"score":0.3553999960422516},{"id":"https://openalex.org/C2777810591","wikidata":"https://www.wikidata.org/wiki/Q16861606","display_name":"Credential","level":2,"score":0.35260000824928284},{"id":"https://openalex.org/C2909164965","wikidata":"https://www.wikidata.org/wiki/Q6014597","display_name":"Incident report","level":2,"score":0.34470000863075256},{"id":"https://openalex.org/C2780952636","wikidata":"https://www.wikidata.org/wiki/Q13479512","display_name":"Incident management","level":2,"score":0.328900009393692},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.3183000087738037},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.30239999294281006},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.30160000920295715},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.28299999237060547},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2768000066280365},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.2711000144481659},{"id":"https://openalex.org/C58642233","wikidata":"https://www.wikidata.org/wiki/Q8269924","display_name":"Taxonomy (biology)","level":2,"score":0.26420000195503235},{"id":"https://openalex.org/C1668388","wikidata":"https://www.wikidata.org/wiki/Q1149776","display_name":"Data management","level":2,"score":0.25589999556541443},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.2549999952316284},{"id":"https://openalex.org/C4924752","wikidata":"https://www.wikidata.org/wiki/Q184148","display_name":"Plug-in","level":2,"score":0.25459998846054077},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2535000145435333},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.2533999979496002}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.62915/2472-2707.1334","doi":"https://doi.org/10.62915/2472-2707.1334","is_oa":true,"landing_page_url":"https://doi.org/10.62915/2472-2707.1334","pdf_url":null,"source":{"id":"https://openalex.org/S4387287378","display_name":"Journal of Cybersecurity Education Research and Practice","issn_l":"2472-2707","issn":["2472-2707"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity Education, Research and Practice","raw_type":"journal-article"},{"id":"pmh:oai:digitalcommons.kennesaw.edu:jcerp-1334","doi":null,"is_oa":true,"landing_page_url":"https://digitalcommons.kennesaw.edu/jcerp/vol2026/iss1/44","pdf_url":"https://digitalcommons.kennesaw.edu/context/jcerp/article/1334/viewcontent/auto_convert.pdf","source":{"id":"https://openalex.org/S4377196456","display_name":"DigitalCommons - Kennesaw State University (Kennesaw State University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I172980758","host_organization_name":"Kennesaw State University","host_organization_lineage":["https://openalex.org/I172980758"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cybersecurity Education, Research and Practice","raw_type":"text"}],"best_oa_location":{"id":"doi:10.62915/2472-2707.1334","doi":"https://doi.org/10.62915/2472-2707.1334","is_oa":true,"landing_page_url":"https://doi.org/10.62915/2472-2707.1334","pdf_url":null,"source":{"id":"https://openalex.org/S4387287378","display_name":"Journal of Cybersecurity Education Research and Practice","issn_l":"2472-2707","issn":["2472-2707"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity Education, Research and Practice","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, justice, and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7297000288963318}],"study_designs":[{"display_name":"Systematic Review","id":"https://openalex.org/study-designs/systematic-review"}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225256711.pdf","grobid_xml":"https://content.openalex.org/works/W7225256711.grobid-xml"},"referenced_works_count":35,"referenced_works":["https://openalex.org/W2004207896","https://openalex.org/W2031909074","https://openalex.org/W2075950485","https://openalex.org/W2084154288","https://openalex.org/W2170899042","https://openalex.org/W2548470887","https://openalex.org/W2790212925","https://openalex.org/W2807135994","https://openalex.org/W2891378911","https://openalex.org/W2901669506","https://openalex.org/W2978143577","https://openalex.org/W3188384090","https://openalex.org/W3195577433","https://openalex.org/W3200759624","https://openalex.org/W4304690373","https://openalex.org/W4327555247","https://openalex.org/W4386982515","https://openalex.org/W4388720055","https://openalex.org/W4388886073","https://openalex.org/W4389201019","https://openalex.org/W4405107520","https://openalex.org/W4405152863","https://openalex.org/W4406063062","https://openalex.org/W4406119201","https://openalex.org/W4408689647","https://openalex.org/W4409647119","https://openalex.org/W4409904866","https://openalex.org/W4411610361","https://openalex.org/W4412651727","https://openalex.org/W4413282861","https://openalex.org/W4414458750","https://openalex.org/W4415257052","https://openalex.org/W4416188253","https://openalex.org/W4416522837","https://openalex.org/W7124680555"],"related_works":["https://openalex.org/W4411610361","https://openalex.org/W7153802829","https://openalex.org/W7150001652","https://openalex.org/W7172211860","https://openalex.org/W7166656888","https://openalex.org/W6967919880","https://openalex.org/W7212111346","https://openalex.org/W7166358583","https://openalex.org/W7209145739","https://openalex.org/W7071279266"],"abstract_inverted_index":{"The":[0,135,219],"rapid":[1],"integration":[2],"of":[3,23,153,162,167,216],"artificial":[4],"intelligence":[5],"into":[6,98],"enterprise":[7],"software":[8],"has":[9],"introduced":[10],"a":[11,78,138,222],"critical":[12,139],"governance":[13,193,227],"challenge:":[14],"Shadow":[15,36,46],"AI,":[16],"the":[17,50,150,213],"unmanaged":[18],"and":[19,26,44,52,63,86,100,105,121,132,158,185,201,205,233],"often":[20],"invisible":[21],"adoption":[22],"AI":[24,47,102,127,144,234],"tools":[25],"features":[27],"by":[28,143],"employees":[29],"outside":[30],"formal":[31],"IT":[32],"oversight.":[33],"Unlike":[34],"traditional":[35],"IT,":[37],"which":[38],"centers":[39],"on":[40],"unauthorized":[41],"data":[42,59,106,175,196],"storage":[43],"infrastructure,":[45],"operates":[48],"at":[49],"knowledge":[51],"decision-making":[53],"layer,":[54],"introducing":[55],"probabilistic":[56],"risks":[57,123],"including":[58,195],"leakage,":[60,176],"agentic":[61,181],"misalignment,":[62],"indirect":[64],"prompt":[65,177],"injection":[66],"that":[67,191],"existing":[68,192],"security":[69,163],"frameworks":[70],"are":[71,113,209],"ill-equipped":[72],"to":[73,89,129,224],"address.":[74],"This":[75],"paper":[76,220],"presents":[77],"Systematic":[79],"Literature":[80],"Review":[81],"(SLR)":[82],"synthesizing":[83],"38":[84],"peer-reviewed":[85],"industry":[87],"sources":[88],"investigate":[90],"three":[91],"research":[92],"questions:":[93],"how":[94],"organizational":[95],"visibility":[96,140],"gaps":[97],"embedded":[99,146],"employee-used":[101],"increase":[103],"cybersecurity":[104,110],"privacy":[107],"risk;":[108],"what":[109,122],"incident":[111,170],"types":[112,171],"most":[114],"commonly":[115],"associated":[116],"with":[117,126,212],"ungoverned":[118],"AI-enabled":[119],"applications;":[120],"employee":[124],"interactions":[125],"pose":[128],"sensitive,":[130],"proprietary,":[131],"regulated":[133],"data.":[134],"analysis":[136],"identifies":[137],"deficit":[141],"created":[142],"capabilities":[145],"within":[147],"vendor-managed":[148],"platforms,":[149],"semantic":[151],"opacity":[152],"large":[154],"language":[155],"model":[156],"interactions,":[157],"employees'":[159],"utilitarian":[160],"bypass":[161],"policies.":[164],"A":[165],"taxonomy":[166],"six":[168],"AI-specific":[169],"is":[172],"presented,":[173],"encompassing":[174],"injection,":[178],"credential":[179],"compromise,":[180],"misuse,":[182],"phishing":[183],"augmentation,":[184],"insecure":[186],"plugin":[187],"exploitation.":[188],"Findings":[189],"demonstrate":[190],"mechanisms,":[194],"loss":[197],"prevention":[198],"systems,":[199],"identity":[200],"access":[202],"management":[203],"frameworks,":[204],"static":[206],"risk":[207],"assessments,":[208],"structurally":[210],"misaligned":[211],"dynamic":[214],"nature":[215],"generative":[217],"AI.":[218],"recommends":[221],"transition":[223],"dynamic,":[225],"risk-based":[226],"integrating":[228],"continuous":[229],"monitoring,":[230],"cross-functional":[231],"oversight,":[232],"TRiSM":[235],"frameworks.":[236]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-11-05T00:00:00"}