Cybersecurity essentials for retailers – from data to identity

From connected devices at the point of sale to complex supply chains and ever-growing data volumes – retailers face an increasingly dynamic cybersecurity landscape. At EuroCIS 2025, three experts at the Cybersecurity Hub shared their insights and tips on how the industry can protect itself. Their advice makes clear that cybersecurity has to be a strategic priority for every retailer.

The retail industry is undergoing rapid digital transformation, with new technologies, automation and connectivity shaping everyday processes and customer experiences. But this progress also expands the attack surface for cybercriminals.

“When you walk around EuroCIS, you see digital gadgets and touchpoints at the point of sale, smart devices, and IoT everywhere. Each connected device brings potential vulnerabilities – and these need to be protected,” observes Markus Limbach from KPMG. He stresses how urgent it has become for retailers to secure IoT networks, digitized processes, and online services against cyberattacks.

Limbach also points out that another growing challenge for retailers is protecting sensitive information as it moves through complex supply chains. Collaboration with suppliers, logistics providers, and customers means constant data exchange, and with it, rising risks.

The effective use of data is a critical issue for retailers, as Moritz Liederbach from ServiceNow, can only agree. Many organizations still operate in silos, he says, where departments rely on separate tools and datasets, making it difficult to gain a unified view or act strategically. “Retailers often work with massive amounts of data across vendors, partners, and customers, but departments collect different data. To truly leverage it, they need to bring everything together into one database,” explains Liederbach. Only then can retailers identify critical infrastructure, set priorities, and develop effective protection strategies.

While technology is advancing, the human factor remains one of the biggest risks in retail cybersecurity. Managing access rights across thousands of employees and external associates is a complex task. “Securing and protecting identity is crucial. If I take over your identity, I don't have to hack or go to great lengths to gain access to the system – it’s the easiest way to cause damage,” emphasizes Roland Knöchel from Saviynt. He highlights that retail companies, with their diverse and fluctuating workforce, must adopt strong identity access management and governance systems. “Let’s say, you’re working with store staff, office employees, and external partners, all with specific roles and access rights that are shifting constantly. Managing this agility securely is essential.”

Artificial intelligence is transforming the cybersecurity landscape – on both sides of the defense line. “Companies can use AI to defend themselves, but attackers also use AI to enhance their capabilities,” warns Markus Limbach. This dynamic has turned cybersecurity into an ongoing race between attack and defense.

For retailers, governance over their AI tools is essential. “Organizations need control and governance over their AI posture. If you manage this properly, AI becomes a great opportunity to strengthen cybersecurity,” he adds.