Creative software probably isn’t the first thing that comes to mind when you think about governance risk. Increasingly, though, it’s becoming one of the places where marketing and IT priorities collide.
Part of the reason is the pace marketing teams are now expected to work at. Product cycles have shortened, channels have multiplied and AI has raised expectations again. Once a tool can produce six variations in the time it used to take to produce one, you can bet the next brief asks for six and gets them.
More content across more channels means more applications, more licences and more people who need to be provisioned quickly. If someone needs an application or a licence to do their job, that access must be seamless, because the deadline doesn’t move while the request sits in a queue.
When access doesn’t keep pace with demand, people find ways to keep work moving. Nobody sets out to create a governance problem, but a tool adopted to meet an immediate need can quickly become part of the workflow before IT ever has visibility of it.
While I’m writing this mainly for IT, the point is that neither side can resolve this alone. Marketing needs speed, flexibility and access to the tools that get work out the door, while IT needs visibility, control and security. The organisations I’ve seen manage both successfully are usually the ones that make the approved path easy to use. That’s where Adobe Creative Cloud for enterprise Edition 4 enters the conversation, helping organisations make creative tools easier to govern, provision and manage without adding friction to the people using them.
When the approved toolset lacks a capability, or a licence request is stuck somewhere, the person facing the deadline has to make a call. They can escalate, wait and miss the date, or find something that works and deal with the paperwork later. In my experience, they almost always choose the second option, which is understandable. The first makes them look slow, while the second looks like a bureaucratic timing problem. If marketing assumes it would have been approved anyway, why not keep things moving?
Any purchased software simply becomes a de facto standard that no one questions, and the consequences surface six months later when someone in IT runs an audit. They find creative and AI tooling running across a range of accounts that were never provisioned or reviewed, some still active for people who left the company last year.
What begins as a practical workaround can quickly become difficult to unwind. Once a tool is embedded in workflows and teams rely on it to deliver campaigns, it often remains in place whether it was formally approved or not.
Locking an environment down without giving marketing a workable path to the capability they need doesn’t remove the behaviour. As we’ve learnt over the years, shadow IT finds a way, making the tools harder to see, the accounts more personal and visibility worse.
The reverse is also true, and marketing must take its share of responsibility. When we treat software procurement as an administrative hurdle rather than a genuine risk-management process, we hand IT a problem they can’t anticipate or audit.
While AI has increased expectations for what marketing is expected to produce, it has also made new tools far easier to discover and adopt. Quick sign-ups on the free tier are usually generous enough to get the job done, with nothing needed to install and no procurement conversation required. Whatever barrier once made shadow IT a deliberate act has largely disappeared, and marketing teams are among the most susceptible to this because new creative and content tools launch almost weekly.
Jobs and Skills Australia’s generative AI capacity study1 found that a substantial share of Australian workers have used generative AI at work without their manager’s knowledge, with the studies it draws on placing the figure between 21 and 27 per cent. In practice, when adoption happens this way, responsibility for governance and risk management falls to the individual worker, while the organisation bears the consequences without ever having made a decision.
The answer to all of this is to make the sanctioned path faster than the unsanctioned one, and that’s a provisioning problem before it’s a policy problem.
Single sign-on brings the creative toolset into your existing authentication standards, so access to design software works the same way as access to everything else. Federated identity lets external agencies and contractors work on your assets without anyone sharing credentials, which, in my experience, is one of the most common yet least discussed exposures in marketing. Automatic deprovisioning closes the leavers gap, so access ends when employment does, rather than whenever someone remembers. This matters more in marketing than in most functions because creative work relies heavily on contractors, freelancers and agency staff who cycle in and out of campaigns.
The capability I’d highlight most, though, is the least visible. Creative Cloud for enterprise Edition 4 supports admin roles across system, product, product profile, user group, deployment and support, so day-to-day licence and product administration can sit with the people closest to the work without anyone handing over system-level control. A marketing operations lead can assign a licence on the day it’s needed, while IT retains the environment. That single change removes much of the friction that pushed marketing towards unsanctioned tools in the first place, which means it does more for your governance position than another policy would.
There’s a commercial argument here too, and it’s usually the one that gets the business case approved. Consolidation surfaces duplicate and forgotten subscriptions, replaces individually expensed licences with visible entitlements, and pulls scattered spend into a single negotiated agreement. The visibility is worth as much as the savings, because you can’t govern software you don’t know you’re paying for.
If you take one action from this, make it a conversation with your marketing leadership. Three questions get you most of the picture:
The value of asking is that the answers are far cheaper to hear from your own marketing team than to discover them during an audit or after an incident. In the next blog, I’ll look at the harder half of this problem, which is what marketing generates once everyone is inside the tools, and who bears the risk when AI is doing some of the creating.
With more than 25 years of partnership, Data#3 is Adobe’s largest Australian Platinum Partner and Adobe APAC Partner of the Year. Speak to Data#3 about unlocking the full potential of Adobe Creative Cloud and Document Cloud to securely drive productivity, collaboration, innovation and digital transformation across your organisation.
Information provided within this form will be handled in accordance with our privacy statement.