Why can't staff install their own software?

Because installing software requires administrator rights, and an account with those rights can change anything on the machine, including turning off the protections. Restricting administrative privileges is one of the Essential Eight controls precisely because it is the difference between one compromised laptop and a compromised business.

The mechanics are worth understanding, because the restriction can feel arbitrary from the outside. Malware runs with whatever power the logged-in user has. A standard user account is limited: something malicious can make a mess of that person's own files, which is bad, and it cannot install itself deeply, disable security tooling or reach across the network with authority, which is the difference between an incident and a catastrophe. Take away standing administrator rights and you have not stopped the attack, you have contained its blast radius.

There is a second reason, less dramatic and more constant: software installed by individuals is software nobody is managing. It does not get patched on your cadence, it may not be licensed properly, it sits outside your application control approvals, and nobody knows it holds client data until the person who installed it leaves. A fleet where everyone installs their own tools is a fleet nobody can accurately describe, and you cannot secure what you cannot list.

None of which means people should have to wait a week for a browser plugin. The arrangement that works is standard accounts by default, a small number of separate elevated accounts for the roles that genuinely need them, and a request process fast enough that nobody resents it, minutes for something already approved. Slow approvals are what break this: people work around them, and the workarounds are personal laptops and personal accounts, which is a worse outcome than the one you were avoiding. If your business still has administrator rights on every login, that is a quick and unusually cheap fix: 1800 456 567.