Retail Cyber Security Faces Crisis of Fragmented Authority

Retail technology environments have evolved into complex, integrated networks, yet the decision-making processes governing them remain stuck in the past. According to Donnafay MacDonald, research director at Info-Tech Research Group, the primary failure occurs when no single leader has the authority to enforce security protocols across disparate stores, platforms, and third-party vendors. This structural fragmentation allows risks to propagate through identity compromises and lateral movement faster than traditional escalation processes can react.

To bridge these gaps, Info-Tech has released a new blueprint designed to consolidate security ownership. The framework advocates for an operating model built on five core domains: visibility, control boundaries, decision ownership, risk prioritization, and response coordination. By moving away from reactive, ad hoc decision-making, retailers can better distinguish between critical payment system vulnerabilities and minor technical inconveniences, ensuring resources are directed toward threats that pose the greatest risk to operational continuity and customer trust.