Most IT leaders we speak to feel like they’ve got a pretty good handle on their environment.
Retailers continue to invest heavily in digital transformation, but recent security incidents are a reminder that technology alone does not reduce risk. Security tools work only when the policies, processes, and controls around them are regularly reviewed and enforced.
Strong cybersecurity starts with regular security control assessments and a disciplined review of security policies, processes, and user behaviour.
Why Are Retailers Reassessing Their Cybersecurity Controls?
Over the past few months, many Canadian and U.S. retailers have dealt with some form of cyber intrusion. While not all incidents qualified as full-on breaches, each one compromised some aspect of customer data or business operations, requiring a public response.
These incidents follow a broader pattern across retail. In recent years we've seen high-profile attacks against retailers such as Marks & Spencer, Co-op, London Drugs, and many others, with remediation costs reaching hundreds of millions of dollars. The common thread is that attackers are increasingly exploiting identity, access, third-party connections, and policy gaps rather than simply targeting infrastructure.
In many cases, the retailer already has the systems and security tools needed to stop the attack. What is missing is the rigour required to enforce the policies and controls that could prevent it.
Why Is Compliance Alone Not Enough?
Too often, retailers treat security as a compliance exercise. Policies are written, approved, published, and then left untouched until the next audit. Meanwhile, the business evolves. New applications are deployed, external vendors are added, employees change roles, and attack techniques become more sophisticated. A security control assessment should be a regular exercise because it can help answer critical questions:
-
-
Are privileged access controls still appropriate?
-
Is multi-factor authentication consistently enforced?
-
Are third-party vendors governed and monitored effectively?
-
Do employees understand current phishing and social engineering threats?
-
Are incident response procedures tested and current?
-
Are security controls operating as designed, or only documented as such?
-
The reality is that many breaches are not caused by a sophisticated technical failure. They occur because a policy outlived the process it was governing, a control drifted over time, or a trusted third party became the weakest link.
To avoid falling into the complacency trap, retailers should establish a regular cadence for security control assessments, policy reviews, third-party risk evaluations, and employee awareness training. The objective is not perfection, but continuous evolution. This helps ensure controls remain aligned with how the business actually operates.
A stronger practice is to bring a fresh perspective to the security controls and policies already in place. As a Technology Ally, Compugen questions existing policies, challenges assumptions, and identifies risks that may otherwise be overlooked.
In retail cybersecurity, yesterday's assumptions are often tomorrow's vulnerabilities. Regular reassessment is no longer optional. It is a fundamental part of retail risk management.
As your Technology Ally, Compugen can assess whether your security controls are working as intended and identify practical opportunities to strengthen your defences. Connect with our cybersecurity experts to gain a clearer view of your current risk, prioritize the gaps that matter most, and build a practical path forward.
.png)