September 11, 2026
The increasing use of AI in cyberattacks and how it’s changing the economics of attack vs. defence means that the retail sector is facing an increased number – and speed – of attacks. How can retailers update their cybersecurity to meet these new challenges?
Emma Payne, Senior Advisor at Equal Experts, sits down with Chris Rutter, Global Head of Secure Delivery, to talk about why the old security playbooks are struggling, where your real risks are hiding, and how engineering teams can harness AI right now to beat attackers at their own game.
Emma: What has changed in the retail threat landscape over the past 18 months, since the high-profile cyber attacks of 2025?
Chris: I think there were two key takeaways from those attacks. First, ransomware is still a huge problem which can cause a huge impact for businesses, and second, most highly damaging cyber attacks still take advantage of fundamental security control failures rather than new and sophisticated attack vectors.
On top of that, we’ve seen the game changer of cyber attacks using AI assistance. Attackers are now attacking faster and at a larger scale than has been seen before. The evidence from AI model providers shows that the techniques used by AI-assisted attackers haven’t changed; they’re just easier and cheaper to carry out.
Target acquisition used to involve a lot of legwork, but AI tools now make scanning public endpoints and organisational networks trivial, as well as building credible dossiers on individuals and believable spear-phishing attacks.
Supply chain attacks that were always an infrequent headache have increased in frequency, sophistication and ability to evade defences, and once an adversary gains an initial foothold, AI can help attackers to accelerate the progression from intrusion to elevation to minutes rather than days.
The bad news is that with AI a lot of the constraints that limited attacker activity and effectiveness have been removed, so it’s now cheaper and easier than ever to mount attacks. The good news is that the attacks themselves haven’t changed, and if defenders double down on the fundamentals and use AI to improve their ability to respond more quickly, the balance can be restored.
Emma: That velocity presents an immense operational challenge. When you look at retail architectures, where should CISOs and business leaders actually focus when identifying their weak spots?
Chris: The uncomfortable truth is that a lot of the most dangerous vulnerabilities and control failures in an organisation are already known and are gathering dust in a risk register. We see this often when talking with organisations in the aftermath of a major cyber attack – it’s almost never an esoteric bleeding-edge exploit; it’s something they already knew about that was sitting on an internal risk register.
What I’d say to business leaders is to look again at your risk registers, but instead of looking at each risk in isolation, look at them in the context of the biggest threats to your organisation. To gain a realistic view on your exposure to real-world threats, feed the following into a risk review session:
In practice that means business leaders should be considering and acknowledging the weak spots already known about internally. They need to understand the actual techniques that adversaries are actively using in this sector today. And they need to know what their worst-case scenario is – what are the crown jewels that, if attacked, would cause you the most damage?
Emma: Turning to defence: if attackers are employing AI to perform and progress attacks much more quickly and effectively, how do boards and security teams stay ahead?
Chris: When an adversary can progress from an initial foot-in-the-door to a full system compromise in minutes, relying on a cyber incident response process that requires e-mails and conference calls no longer cuts it. Retailers need effective, rapid and tested countermeasures so they can defend their most critical areas at machine, not human, speed.
We often run AI-assisted Chaos Days, where your own engineering teams use LLMs to interrogate and probe systems under real-world conditions. This helps to identify how and what AI-assisted attackers would target. By analysing the digital footprints left by this sort of attack, defenders can configure their monitoring systems to flag real attacks immediately and take automatic defensive measures.
I think the key message overall is that the threat landscape is evolving as AI makes attacks easier and more frequent, but defenders who focus on getting the basics right, strengthening their most critical controls, and using AI to boost their defences can stay ahead in the cat-and-mouse game that is cyber security.
Emma Payne is a digital transformation and technology executive with over 25 years of experience across retail and the private sector. She has held senior leadership roles including Global Director of Technology and Product at John Lewis & Partners and Pret A Manger, reporting into the Executive Board. She has deep expertise and a proven track record in digital transformation, technology strategy, customer experience and AI adoption.
As a long-standing customer of Equal Experts, Emma joined the advisory team in 2023. She now works with senior leaders and high-performing teams on strategic planning, complex transformations and building lasting partnerships that deliver measurable business value.
Connect with Emma on LinkedIn.
A specialist in security, platforms and modernisation, Chris is our Global Head of Secure Delivery and has spent over a decade helping teams in finance, retail and government build delivery-focused, scalable and secure software systems. Having worked in product delivery, security and advisory roles, Chris specialises in building large-scale technical capabilities and introducing DevSecOps practices to help teams deliver securely at scale.
All business models have their pros and cons. But, when you consider the type of problems we help our clients to solve at Equal Experts, it’s worth thinking about the level of experience and the best consultancy approach to solve them.
If you’d like to find out more about working with us – get in touch. We’d love to hear from you.
