Retail cyber security: Increase your protection without damaging customer experience

In 2025, a wave of sophisticated cyber-attacks hit the retail industry. In the space of a few chaotic weeks, ecommerce platforms were knocked offline, supply chains faltered, and retailers were forced to confront the uncomfortable truth that the systems underpinning modern commerce were far more vulnerable than many had assumed.

For some businesses, the damage was immediate and severe. Transactions stopped, operations ground to a halt, and teams scrambled to understand how attackers had managed to infiltrate their systems so effectively. For others, the attacks were a warning of what could happen.

That sense of vulnerability has not fully disappeared and many retailers still speak of a lingering anxiety. But with the benefit of distance, it’s worth asking an important question. Has anything actually changed, and if so what?

Have retailers strengthened their defences in the wake of last year’s crisis? Have consumers become more wary about where they share their data? Or, are retailers simply burying their heads in the sand and crossing their fingers that it won’t happen again?

That realisation has accelerated the adoption of newer security frameworks, particularly zero-trust architectures. Unlike traditional security models, which assume users and devices inside a network are trustworthy, zero-trust treats every interaction as potentially risky and requires continuous verification.

Candice notes that research suggests around 63 per cent of organisations globally now have partial or full zero-trust implementation, reflecting how quickly attitudes have shifted since the attacks. But the biggest lesson is not simply about adopting new technologies. In many cases, the attacks exposed how fragmented retail security infrastructure had become.

At the same time, retailers face another delicate balancing act of protecting their businesses, without damaging the all-important customer experience. In ecommerce, even small amounts of friction can have a measurable impact on sales. Additional verification steps, overly aggressive fraud filters, or poorly implemented security checks can quickly push customers to abandon their baskets.

This is where security strategy often goes wrong, says Candice. “Security should be seen as a growth lever, not something that throttles your business,” she says. In practice, that means designing systems that can detect and stop malicious activity without obstructing legitimate customers.

“Over-zealous fraud prevention isn’t good security,” she adds. “It’s just lost revenue.”

This requires increasingly sophisticated risk modelling, often powered by artificial intelligence and behavioural analysis, which can evaluate signals such as device identity, purchasing patterns, and transaction context in real time.

But while technology has advanced rapidly over the past year, one of the industry’s most significant vulnerabilities remains organisational rather than technical.

Emerging technologies such as AI, machine learning, and automation are rapidly reshaping the cyber threat landscape. But many senior decision-makers still lack a deep understanding of how these technologies operate or the risks they introduce.

A survey by digital engineering consultancy firm Akkodis suggests that executive confidence in AI strategies is unstable, and actually fell from 69 per cent in 2024 to just 58 per cent in 2025.  

Meanwhile, the threat landscape itself shows no signs of slowing down.

‘Security is never finished’

Candice points to the rapid emergence of new technologies such as agentic AI as one example of how quickly the environment is changing. “Agentic AI is coming down the road like a juggernaut,” she says. The next generation of attacks won't be conducted by individuals. They'll be conducted by autonomous systems capable of identifying weaknesses, adapting tactics and executing fraud at a scale that humans simply cannot match

While these technologies offer enormous potential for businesses, they also create new opportunities for cyber criminals, who are increasingly using automation and AI to scale their attacks. For retailers, this means the idea of achieving “complete security” is unrealistic. “Security is never finished,” Pressinger says.

Instead, the focus must shift towards resilience, and building systems capable of adapting to new threats and recovering quickly when incidents occur. This involves a combination of adaptive risk models, identity-first security frameworks, and continuous scenario planning designed to anticipate how attack methods might evolve. 

But perhaps most importantly, it requires a shift in mindset. “Future-ready retail isn’t about stopping every failure,” Candice explains. “It’s about making failure non-catastrophic.”

In other words, the goal is not to eliminate cyber risk entirely (an impossible task), but to ensure that when incidents do occur, they don’t bring an entire organisation to its knees.

Protecting customer relationships and systems

That philosophy has become increasingly important as retailers recognise the long-term consequences of cyber incidents extend far beyond operational disruption. Trust, after all, is one of the most valuable currencies in modern retail. “When something goes wrong, consumers remember,” Candice says. “Customers won’t come back if their data is compromised and the issue isn’t handled well.” 

For retailers, that means cyber security isn’t just a matter of protecting systems, but also protecting vital relationships with customers. And while the retail industry has undoubtedly strengthened its defences, the reality is that cyber threats continue to evolve at a relentless pace.

Retailers may be more aware of the risks they face. Their systems may be more resilient than they were before the attacks that hit headlines around the world. But the sense that the industry is operating in an increasingly hostile digital environment hasn’t disappeared. If anything, it has become the new normal. Cyber security is an ongoing battle that could well shape the future of retail.

However, whilst caution and active protection is a must, the positive news is that with the right protection, it’s possible for any business to effectively prevent attacks. In fact, the UK Government's Cyber Essentials scheme says that organisations that introduce cyber security controls make 92% fewer cyber insurance claims.

Now, the onus is on you to ensure that you’re protected not just for today, but for the future. Retailers that continue to view cybersecurity as a compliance exercise will always be reacting to yesterday's attack. The organisations that win will treat security as a strategic capability, a driver of customer trust, and a core part of how they compete. In an AI-powered threat landscape, resilience is no longer a defensive advantage. It's a commercial one.