Adobe Marketo Engage

The 2026 agentic push is substantial and specific: named agent skills for program validation, lead import, data normalisation and analytics, a conversational interface for issuing commands, and MCP connectivity. It runs on a platform that has been the enterprise B2B automation standard for two decades. On the removal test the AI comes off and smart campaigns, lead scoring, forms, landing pages, journey orchestration and CRM sync all continue unchanged. The company's own framing supports this reading, describing the agents as augmenting the core rather than replacing it.

The posture is stated and it is guardrailed assistance rather than autonomous action: agents assist with audience selection, content creation and program optimisation while people retain strategy and approvals, and the operational agents work on internal housekeeping such as validation and normalisation rather than outbound sending. Enablement is administratively gated, requiring the account to accept core generative AI terms and supplemental terms and then grant user level access. The gap is containment: nothing published states what a misfiring agent can reach or what stops a run once it starts.

Better than the category norm on two counts. The assistant's product knowledge answers are grounded in official Adobe documentation and return citations, which makes the output checkable rather than merely fluent. And a published data information sheet covers data scope, governance controls and personally identifiable information handling for the AI features, with the underlying model layer reported as Azure OpenAI. The gap is downstream: nothing addresses whether marketing content generated by the platform is identified as AI generated, and predictive scoring logic remains unexplained.

Real outcome evidence with named customers and figures, published at volume: an Australian IT services customer reporting a sales accepted to won ratio rising from under 2 percent to 8.3 percent alongside 200 to 400 sales accepted leads a month, a data protection vendor running more than 1,800 campaigns a year, a financial services firm reporting 41.5 percent of customers on digital communications. Named references extend to Nokia, BNY Mellon, Lumen and Trane.

What is missing is the measurement basis: no stated period, population or metric definition accompanies the figures, and no attribution method separates platform effect from everything else the customer changed at the same time.

Compliance is enforced in the platform and stated as a condition of use. Adobe requires that customers send marketing communications only to people who have opted in, unsubscribed records are automatically blocked from marketing sends, and ISP feedback loops auto unsubscribe complainants with an internal email compliance function taking up the complaint. One click list unsubscribe has been applied to all marketing messages since January 2024. Documentation names GDPR, CAN SPAM and CASL and states the two day window for honouring an opt out. Operational email correctly bypasses the unsubscribe block, which is disclosed rather than hidden.

A full privacy program a buyer can actually inspect: a product level data protection white paper published ungated on the trust centre, sub processor use disclosed and scoped to the specific features that rely on it such as predictive content, and in product privacy controls for CCPA and GDPR consent handling. The gap is the familiar processor boundary. Lawful basis for the records a customer loads is the customer's to establish, and the platform's own opt in requirement is a contractual condition rather than a technical control.

No prospect database is sold and no third party contact data is bundled: the records are the customer's own, acquired through the customer's forms, lists and CRM. The sourcing standard the platform imposes on those records is published and unusually direct, requiring opt in and prohibiting unsolicited sending. Provenance of enrichment through sub processors on specific add on features is disclosed in the data protection white paper. Short of the top band because no legal footing or indemnification position accompanies the requirement.

Low exposure. Sending runs on the platform's own infrastructure with published outbound IP ranges, and third party systems are reached through official interfaces: native Salesforce and Microsoft Dynamics sync, a documented REST API, a partner integration ecosystem, and MCP connectivity for outside agents. No automation of a platform that prohibits it was located. As elsewhere, no conformance position of its own is stated, so the grade rests on architecture rather than a documented commitment.

The cross client boundary is answered in writing and the answer is contractual rather than promotional. Customer data is not used to train or fine tune the underlying models, generated outputs stay inside the customer's own environment under the existing residency, governance and retention controls, and the AI features are governed by core generative AI terms plus supplemental terms the account must accept before enablement.

A published data information sheet sets out data scope, governance controls and personally identifiable information handling. This is the strongest answer to the training question in the index so far, and it stands in direct contrast to peers in the same category that leave it unaddressed.

Sender side mechanics are handled well and are graded on the compliance axis: real sender identity, enforced opt in, one click unsubscribe. What is absent is the newer question. Nothing published states whether email content generated by the platform's AI carries any indication of its origin, and no Article 50 position is stated for the conversational and agentic surfaces introduced through 2026. For an enterprise platform sending regulated marketing at volume into the European Union, that silence is now a posture.

Among the deepest documented integration surfaces in go to market software. Native bidirectional sync with Salesforce and Microsoft Dynamics at object level including lead, contact, account and campaign, a public REST API with extensive published reference documentation, a partner integration ecosystem, published outbound IP ranges for allowlisting, and callable smart campaigns that let outside systems trigger platform logic as events. MCP connectivity announced in 2026 makes the instance addressable by external agents, which is early for an enterprise platform of this size.

Multi tenant cloud with genuine regional choice, which is more than most of this index offers. Instances are reported across the United States, United Kingdom, Netherlands and Australia with a Canadian data centre in development, and AI generated output is stated to remain subject to the customer's existing residency controls.

Short of the top band because the region set is documented through trust profiles and account provisioning rather than a plainly published residency page, and nothing public establishes what is dedicated versus shared at the instance level.

A live trust centre with a product level compliance list that names this product explicitly rather than covering it by implication, plus an ungated product specific data protection and security white paper that describes data flows, sub processor use and encryption in transit and at rest.

Certifications are enumerated across the recognised set including SOC 2, ISO 27001 and business continuity certification, with single sign on through SAML, multi factor authentication and audit capability documented. An outsider can read all of it without a sales conversation or a non disclosure agreement.

The most disclosed vendor in this index on every other dimension publishes no price at all. Four editions exist by name, add on modules each carry a separate annual fee, and the agent capabilities are sold on a usage based AI credit model, and not one number appears anywhere public. The pricing page routes to a sales contact form.

There is no free tier, no published rate card and no stated unit of pricing, so a buyer cannot form even an order of magnitude estimate without entering a sales process. In a category where competitors publish tiers, silence at this scale is a choice.

A real export path exists and is documented: the public REST API supports programmatic extraction of person, activity and program data, which is how customers migrating off the platform actually leave, and the integration surface means most records also live in a connected CRM. The gap is the terms.

No published statement covers post termination data rights, deletion timelines, what happens to campaign and activity history at the end of a subscription, or renewal notice mechanics, all of which sit inside enterprise agreements a prospect cannot read before signing.

Sending discipline is documented as an operating practice with named mechanisms at every stage. Every account starts on a shared pool; a dedicated IP is a paid option the vendor recommends only above roughly 100,000 emails a month with consistent cadence, and deliverability consultants provide a customised warmup ramp because cold IPs get throttled. A trusted IP shared pool is available by application to senders who meet strict practices.

Reputation monitoring is built in through a deliverability tool with sender reputation reporting, bounce categorisation available as campaign triggers, and ISP feedback loops that auto unsubscribe complainants. Guidance names the 0.3 percent complaint threshold and covers SPF, DKIM and DMARC.

The claim is enterprise and mid market B2B with complex buying groups, and the evidence matches it precisely: named customers spanning telecommunications, financial services, industrial manufacturing, IT services and healthcare, across North America, Europe and Australia, with regional case study libraries maintained per market. Edition structure maps to database size, making the intended segment legible from the packaging itself. Independent install base tracking puts active customers in the low thousands, consistent with the enterprise positioning rather than a volume SMB business.