Trust and cybersecurity in retail

This is part two of an earlier article on the topic of trust in retail.

Brand and trust are inextricably linked; reputation that has taken years to build can evaporate in a moment. Now more than ever enters the importance of digital security and secure solutions in e-commerce platforms, in-store cards, Digital IDs, trust ratings, influencers and in-store.

We examine how leaders can build effective business cases for investment in cybersecurity and risk governance in end-to-end retail user experiences, emerging technology and corresponding supply chains.

Today's landscape

In today’s retail landscape, cybersecurity is no longer a back office technical concern, it is a direct driver of consumer trust, competitive differentiation, and business resilience. As retailers expand across omnichannel environments and embrace data-driven business models, the sector faces an unprecedented surge in cyber threats. The likely types of loss and impact that can result from a cyberattack include: 

• regulatory fines;
• brand damage;
• wasted management time;
• disputes with partners and/or suppliers (whose confidential or proprietary information may have been compromised);
• claims and DSARs received by individuals affected whether employees or customers;
• ransomware payment requests;
• sanctions and regulatory risk;
• costs of reconstituting data, remedial and forensic costs; and
• an increase in premiums and legal fees.

At the same time, customers have become increasingly sensitive to how their personal information is handled. The result is a commercial environment where trust and cybersecurity are inseparable and where retailers that fail to invest in robust protections risk losing far more than data.

Recent analysis shows that 83% of global consumers prioritise personal data protection, placing data security at the heart of brand loyalty and purchasing decisions. In a privacy driven marketplace, cybersecurity has become a critical differentiator, particularly as customers shop seamlessly across digital and physical channels. With 74% of US consumers browsing and 73% purchasing across both environments, retailers must protect sensitive information at every touchpoint from ecommerce platforms to mobile apps and in store systems.

Yet while customer expectations climb, the attack surface is expanding even faster. Over the past decade, retail’s rapid adoption of cloud services, IoT devices, and complex supply chain ecosystems (as well as emerging technologies) has significantly outpaced its security maturity. This has created what industry analysts describe as a ‘cybersecurity readiness paradox’, where organisations believe they are secure but lack holistic protection strategies. According to recent industry reports, only 2% of global organisations have fully implemented comprehensive cybersecurity across key risk areas with retailers showing notable confidence gaps between executive leaders and cybersecurity teams. 

What happens if retailers don't invest in cybersecurity?

The consequences of under-investment are severe. Cyber incidents targeting retail continue to rise, fuelled by ransomware, phishing schemes, supply chain attacks and AI powered intrusions. In Q2 2025 alone, the retail sector experienced 837 cyber incidents and 419 confirmed data breaches, driven primarily by ransomware and social engineering. High profile breaches have not only disrupted operations but also triggered reputational harm, regulatory penalties, and loss of customer trust, the most damaging consequence of all. 

As digital transformation accelerates, retailers also grapple with increasingly sophisticated attack methods. AI is being weaponised to craft highly convincing phishing messages, automate credential theft, and bypass legacy detection systems. Retailers must recognise that these threats extend beyond traditional IT boundaries: they endanger loyalty programmes, mobile shopping, payment systems, and even customer service chatbots. This makes cybersecurity a business wide responsibility, not just an IT function. 

How cybersecurity operations build customer trust

To bridge the widening trust gap, retailers must embed cybersecurity into the fabric of their operations (and, in so doing, consider zero-trust approaches to online exchanges and transactions). This includes strengthening cloud and endpoint security, adopting zero trust architectures, improving third party risk management, and enhancing governance over AI systems. However, technology alone is not enough.

Trust is built through transparency, communicating clearly with customers about how their data is used, stored, and protected; and with internal teams about emerging risks and shared responsibility. Retailers need to be forward thinking when it comes to cybersecurity as ultimately, they risk losing design or creative investment which may not have yet materialised or dropped (which could include details of commercial payments to high profile talent and settlements).

Ultimately, trust is now the most valuable currency in retail, and cybersecurity is the foundation upon which that trust is built. Retailers that treat security as a strategic enabler not a compliance checkbox will be better positioned to win customer confidence, drive loyalty, and outperform in an increasingly competitive and threat laden market. We have also seen the kind of result that can incur from sub-optimal implementation of AI tools (evident from the creation of GenAI images from Grok).

Practical takeaways 

Leaders in retail along with those in cybersecurity risk governance and compliance teams must work seamlessly with brand and communications teams to: 

• Think carefully before allowing emerging technologies, including AI, to access valuable customer databases, supplier information, staff records and confidential information.

• Have a commercial data strategy and effective data governance that reflects policies in practice (minimise data retention both saves the planet and reduces your information exposure).

• Ensure that cross-practice and discipline teams assess new products, services, apps and emerging technologies (whether in-store, online or deployed in employee engagement or staff monitoring).

• Integrate data privacy impact and AI (or emerging technology) risk assessments in procurement processes and prior to implementation and ongoing updates or upgrades. 

• Devise and employ a ROI or return on investment tool to grade the outputs and products from cybersecurity programmes to measure ROI on spend and demonstrate value to the C-Suite and brand teams. 

• Continuously monitor risk and advise risk and compliance teams of ongoing risk and, where appropriate, have confidence in delaying or suspending adoption of a new tool or cost efficiency model (where the risk outweighs the resulting brand value or there is negligible benefit or advantage).

• Explain how AI systems make decisions, because black-box automation erodes trust.

• Ensure there is a human in the loop and create or enhance those teams who determine whether a particular technology or process fits with brand values (and ethical trading).

• Ensure that they do not underestimate the power of in-store staff and physical brand (and enabling preferences for shopping in all relevant age and shopper types and demographics).

• Design for algorithmic transparency – explaining logic, risks, and any security processes or rules behind automated tools to protect and assist customers and users.

• Rigorously test before roll-out any new production tools for online commerce and implement period PEN (or penetration) testing or systems – try to break stuff!

• Put in place incident response teams and pre-brief crisis comms and forensic teams to respond rapidly to cyber incidents (this may include putting together a contact sheet, which comprises external specialist cybersecurity legal counsel, forensics, crisis comms, HR and IT/Ops teams – which is available offline should systems go-down).

• Practice war games and diarise periodic dress-rehearsals and training for managing incidents.